@agent-cards/checkout 0.19.0 → 0.21.0

package/dist/mercado-checkout.generated.js

@@ -1,198 +0,0 @@
-// @ts-nocheck
-// Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0ea817a75d86052699eeaa7546950e6c046bb0d7a96e4a18dfcd3a0fdd2afc99
-// src/mercado-checkout.js
-var MERCADO_CHECKOUT_ORIGIN = "https://www.mercadopago.com.mx";
-var MERCADO_CONFIGURATION_URL = MERCADO_CHECKOUT_ORIGIN + "/checkout/v1/payment/api/bricks/card-form/tokenization";
-var MERCADO_CHECKOUT_PATTERN = MERCADO_CHECKOUT_ORIGIN + "/checkout/v1/payment/api/*";
-var reject = () => {
-    throw new Error("mercado_checkout_context_invalid");
-};
-var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-var only = (v, keys) => object(v) && Object.keys(v).every((k) => keys.includes(k));
-var exact = (v, keys) => only(v, keys) && keys.every((k) => Object.hasOwn(v, k));
-var text = (v, max = 200) => typeof v === "string" && v.length > 0 && v.length <= max && !/[\u0000-\u001f\u007f]/.test(v);
-var id = (v) => typeof v === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(v);
-var numberId = (v) => typeof v === "string" && /^\d{1,20}$/.test(v);
-var label = (v) => text(v, 120) && /\p{L}/u.test(v) && !/[<>]|\d(?:[ -]*\d){5}|https?:|javascript:|data:/i.test(v);
-var digest = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
-var METHODS = ["visa", "master", "amex"];
-var TYPES = ["credit_card", "debit_card", "prepaid_card"];
-function checkedUrl(raw) {
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        reject();
-    }
-    if (!text(raw, 4096) || url.href !== raw || url.origin !== MERCADO_CHECKOUT_ORIGIN || url.username || url.password || url.hash)
-        reject();
-    return url;
-}
-function mercadoCheckoutDocument(raw) {
-    const url = checkedUrl(raw);
-    const match = /^\/checkout\/v1\/payment\/redirect\/([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\/card-form\/$/.exec(url.pathname);
-    const keys = [...url.searchParams.keys()];
-    if (!match || keys.length !== 3 || new Set(keys).size !== 3 || keys.some((k) => !["preference-id", "router-request-id", "p"].includes(k)) || !id(url.searchParams.get("preference-id")) || !id(url.searchParams.get("router-request-id")) || !text(url.searchParams.get("p"), 2048))
-        reject();
-    return { flowId: match[1], preferenceId: url.searchParams.get("preference-id"), query: url.search.slice(1) };
-}
-function initialization(value) {
-    const keys = [
-        "callerId",
-        "collectorId",
-        "allowThirdPartyCard",
-        "clientId",
-        "flowId",
-        "checkoutId",
-        "scope",
-        "excludedPaymentTypesAndIds",
-        "locale",
-        "siteId",
-        "serviceRoutePrefix",
-        "productId",
-        "marketplace",
-        "platform",
-        "cardDetails"
-    ];
-    if (!exact(value, keys) || !numberId(value.callerId) || !numberId(value.collectorId) || !numberId(value.clientId) || value.allowThirdPartyCard !== true || value.flowId !== "checkout-pro-payment" || value.checkoutId !== "cow" || value.scope !== "prod" || value.locale !== "es-MX" || value.siteId !== "MLM" || value.serviceRoutePrefix !== "/checkout/v1/payment/api" || !id(value.productId) || value.marketplace !== "NONE" || value.platform !== "MP" || !Array.isArray(value.excludedPaymentTypesAndIds) || value.excludedPaymentTypesAndIds.length !== 0 || !exact(value.cardDetails, ["fieldsSetting", "identificationTypes", "additionalSteps"]) || !Array.isArray(value.cardDetails.identificationTypes) || value.cardDetails.identificationTypes.length !== 0 || JSON.stringify(value.cardDetails.additionalSteps) !== '["name"]')
-        reject();
-    const fields = value.cardDetails.fieldsSetting;
-    if (!Array.isArray(fields) || fields.length !== 5 || new Set(fields.map((f) => f?.name)).size !== 5)
-        reject();
-    for (const field of fields) {
-        if (!only(field, ["name", "type", "title", "placeholder", "length", "validationMessages", "mask", "hintMessage", "validationPattern", "autocomplete", "tooltipMessage"]) || !["card_number", "name", "expiration", "security_code", "identification_types"].includes(field.name) || field.type !== (field.name === "name" ? "text" : "number") || !text(field.title) || field.placeholder !== void 0 && !text(field.placeholder) || ["hintMessage", "validationPattern", "tooltipMessage"].some((k) => field[k] !== void 0 && !text(field[k], 1024)) || field.autocomplete !== void 0 && typeof field.autocomplete !== "boolean" || field.length !== void 0 && (!Number.isInteger(field.length) || field.length < 1 || field.length > 40) || field.mask !== void 0 && (!text(field.mask, 30) || !/^[ $/]+$/.test(field.mask)) || !only(field.validationMessages, ["emptyField", "incompleteField", "invalidField"]) || Object.values(field.validationMessages).some((v) => !text(v)))
-            reject();
-    }
-    if (JSON.stringify(value).length > 12e3)
-        reject();
-    return value;
-}
-function parseMercadoCheckoutContext(value) {
-    if (!exact(value, ["version", "documentUrl", "initializationData"]) || value.version !== 1)
-        reject();
-    mercadoCheckoutDocument(value.documentUrl);
-    initialization(value.initializationData);
-    return JSON.parse(JSON.stringify(value));
-}
-function captureMercadoCheckoutContext(url, method, body, documentUrl) {
-    if (url !== MERCADO_CONFIGURATION_URL || method !== "POST" || typeof body !== "string" || body.length > 16e3)
-        reject();
-    let parsed;
-    try {
-        parsed = JSON.parse(body);
-    }
-    catch {
-        reject();
-    }
-    if (!exact(parsed, ["cardBin", "initializationData"]) || typeof parsed.cardBin !== "string" || !/^\d{8}$/.test(parsed.cardBin))
-        reject();
-    return parseMercadoCheckoutContext({ version: 1, documentUrl, initializationData: parsed.initializationData });
-}
-function isMercadoTokenRequest(url, method) {
-    try {
-        const value = new URL(url), names = [...value.searchParams.keys()];
-        return method === "POST" && value.href === url && value.origin === "https://api.mercadopago.com" && value.pathname === "/v1/card_tokens" && !value.username && !value.password && !value.hash && new Set(names).size === names.length && names.every((n) => ["public_key", "locale", "js_version", "referer"].includes(n)) && id(value.searchParams.get("public_key"));
-    }
-    catch {
-        return false;
-    }
-}
-async function mercadoDigest(value) {
-    const bytes = new TextEncoder().encode(value);
-    return Array.from(new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function canonical(value) {
-    return Array.isArray(value) ? value.map(canonical) : object(value) ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])])) : value;
-}
-async function mercadoContextDigest(context, tokenUrl) {
-    if (!isMercadoTokenRequest(tokenUrl, "POST"))
-        reject();
-    return mercadoDigest(JSON.stringify(canonical({ context: parseMercadoCheckoutContext(context), tokenUrl })));
-}
-function prepareMercadoConfiguration(context, card) {
-    const parsed = parseMercadoCheckoutContext(context);
-    const number = card?.number;
-    if (typeof number !== "string" || !/^\d{12,19}$/.test(number))
-        reject();
-    return { url: MERCADO_CONFIGURATION_URL, body: JSON.stringify({ cardBin: number.slice(0, 8), initializationData: parsed.initializationData }) };
-}
-function parseMercadoConfiguration(value) {
-    const method = value?.paymentMethod, issuers = value?.issuersSettings;
-    if (!object(value) || !exact(method, ["paymentMethodId", "paymentTypeId", "name"]) || !METHODS.includes(method.paymentMethodId) || !TYPES.includes(method.paymentTypeId) || !label(method.name) || !Array.isArray(issuers) || issuers.length !== 1 || !object(issuers[0]) || !label(issuers[0].name))
-        reject();
-    const issuerId = String(issuers[0].id);
-    if (!/^\d{1,11}$/.test(issuerId) || typeof issuers[0].id !== "string" && !Number.isSafeInteger(issuers[0].id))
-        reject();
-    const cvc = Array.isArray(value.fieldsSetting) ? value.fieldsSetting.filter((f) => f?.name === "security_code") : [];
-    const amex = method.paymentMethodId === "amex";
-    if (cvc.length !== 1 || cvc[0].type !== "number" || cvc[0].length !== (amex ? 4 : 3) || value.securityCodeSettings?.mode !== "mandatory" || value.securityCodeSettings?.location !== (amex ? "front" : "back"))
-        reject();
-    return {
-        paymentMethodId: method.paymentMethodId,
-        paymentTypeId: method.paymentTypeId,
-        paymentMethodName: method.name,
-        issuerId,
-        issuerName: issuers[0].name
-    };
-}
-function tokenIdentity(body) {
-    let value;
-    try {
-        value = JSON.parse(body);
-    }
-    catch {
-        reject();
-    }
-    if (!object(value) || value.live_mode === false || typeof value.id !== "string" || !/^[A-Za-z0-9_-]{8,256}$/.test(value.id))
-        reject();
-    return value.id;
-}
-async function createMercadoProcessorContext(configuration, context, tokenUrl, tokenBody) {
-    return {
-        version: 1,
-        psp: "mercado_pago",
-        source: "checkout_pro_bin8",
-        contextDigest: await mercadoContextDigest(context, tokenUrl),
-        tokenDigest: await mercadoDigest(tokenIdentity(tokenBody)),
-        ...parseMercadoConfiguration(configuration)
-    };
-}
-async function validateMercadoProcessorContext(value, context, tokenUrl, tokenBody) {
-    if (!exact(value, ["version", "psp", "source", "contextDigest", "tokenDigest", "paymentMethodId", "paymentTypeId", "paymentMethodName", "issuerId", "issuerName"]) || value.version !== 1 || value.psp !== "mercado_pago" || value.source !== "checkout_pro_bin8" || !digest(value.contextDigest) || !digest(value.tokenDigest) || !METHODS.includes(value.paymentMethodId) || !TYPES.includes(value.paymentTypeId) || !label(value.paymentMethodName) || !numberId(value.issuerId) || value.issuerId.length > 11 || !label(value.issuerName) || value.contextDigest !== await mercadoContextDigest(context, tokenUrl) || value.tokenDigest !== await mercadoDigest(tokenIdentity(tokenBody)))
-        reject();
-    return { ...value };
-}
-async function createMercadoAssociationGate({ context, tokenUrl, tokenBody, processorContext }) {
-    const checked = parseMercadoCheckoutContext(context), metadata = await validateMercadoProcessorContext(processorContext, checked, tokenUrl, tokenBody);
-    const document = mercadoCheckoutDocument(checked.documentUrl), token = tokenIdentity(tokenBody);
-    let claimed = false;
-    return { take({ url, method, body, documentUrl }) {
-            if (claimed)
-                reject();
-            const target = checkedUrl(url);
-            if (method !== "PUT" || documentUrl !== checked.documentUrl || target.pathname !== "/checkout/v1/payment/api/flow/" + document.flowId || target.search || typeof body !== "string" || body.length > 64e3)
-                reject();
-            let parsed;
-            try {
-                parsed = JSON.parse(body);
-            }
-            catch {
-                reject();
-            }
-            if (!only(parsed, ["id", "values", "type", "featureFlags", "version", "prev_step", "urlParams"]) || parsed.id !== "next_step" || parsed.type !== "redirect" || parsed.version !== "checkout" || parsed.prev_step !== "card_form" || parsed.urlParams !== document.query || !only(parsed.values, ["payment_method", "card_token", "card_ui_settings", "captchaToken"]) || parsed.values.card_token !== token || !object(parsed.values.card_ui_settings) || !only(parsed.values.payment_method, ["id", "type", "name", "issuer"]) || parsed.values.payment_method.id !== metadata.paymentMethodId || parsed.values.payment_method.type !== metadata.paymentTypeId)
-                reject();
-            claimed = true;
-            parsed.values.payment_method = {
-                id: metadata.paymentMethodId,
-                type: metadata.paymentTypeId,
-                name: metadata.paymentMethodName,
-                issuer: { id: Number(metadata.issuerId), name: metadata.issuerName }
-            };
-            return JSON.stringify(parsed);
-        }, get claimed() {
-            return claimed;
-        } };
-}
-export { MERCADO_CHECKOUT_ORIGIN, MERCADO_CHECKOUT_PATTERN, MERCADO_CONFIGURATION_URL, captureMercadoCheckoutContext, createMercadoAssociationGate, createMercadoProcessorContext, isMercadoTokenRequest, mercadoCheckoutDocument, mercadoContextDigest, mercadoDigest, parseMercadoCheckoutContext, parseMercadoConfiguration, prepareMercadoConfiguration, validateMercadoProcessorContext };

package/dist/mercado-checkout.js

@@ -1,108 +0,0 @@
-import { captureMercadoCheckoutContext, createMercadoAssociationGate, isMercadoTokenRequest, MERCADO_CONFIGURATION_URL, MERCADO_CHECKOUT_ORIGIN, parseMercadoCheckoutContext } from './mercado-checkout.generated.js';
-/** Capture only the native Checkout Pro configuration. A late configuration,
- * navigation or repeated token cannot replace the context of an issued token.
- * Final payment requests retain the attachment's existing payment guards.
- */
-export class MercadoCheckoutGate {
-    context = null;
-    started = false;
-    stopped = false;
-    sequence = 0;
-    associatedFlow = null;
-    association = null;
-    matches(url) {
-        try {
-            const parsed = new URL(url);
-            return parsed.origin === MERCADO_CHECKOUT_ORIGIN
-                && (parsed.pathname === new URL(MERCADO_CONFIGURATION_URL).pathname || parsed.pathname.startsWith('/checkout/v1/payment/api/flow/'));
-        }
-        catch {
-            return false;
-        }
-    }
-    requiresDocument(url, method) {
-        try {
-            const parsed = new URL(url);
-            return method.toUpperCase() === 'POST'
-                && parsed.origin === 'https://api.mercadopago.com' && /^\/v1\/card_tokens$/i.test(parsed.pathname);
-        }
-        catch {
-            return false;
-        }
-    }
-    invalidate() {
-        if (!this.context && !this.started && this.sequence === 0)
-            return;
-        this.stopped = true;
-        this.context = null;
-        this.association = null;
-        this.sequence++;
-    }
-    async configuration(url, method, body, readDocument) {
-        if (url !== MERCADO_CONFIGURATION_URL || method !== 'POST')
-            return false;
-        if (this.started || this.stopped)
-            throw new Error('mercado_checkout_configuration_changed');
-        const sequence = ++this.sequence;
-        this.context = null;
-        const documentUrl = await readDocument();
-        // A newer native BIN lookup owns the context; the older harmless lookup
-        // still continues, but cannot erase or invalidate that newer capture.
-        if (sequence !== this.sequence && !this.stopped)
-            return true;
-        const context = captureMercadoCheckoutContext(url, method, body, documentUrl);
-        if (sequence !== this.sequence || this.started || this.stopped)
-            throw new Error('mercado_checkout_configuration_changed');
-        this.context = context;
-        return true;
-    }
-    claimToken(url, method, documentUrl) {
-        if (!this.requiresDocument(url, method))
-            return undefined;
-        // Other Mercado products remain on their existing tokenization path.
-        if (!documentUrl.startsWith(MERCADO_CHECKOUT_ORIGIN + '/checkout/'))
-            return undefined;
-        if (!isMercadoTokenRequest(url, method) || this.started || this.stopped || !this.context || this.context.documentUrl !== documentUrl)
-            throw new Error('mercado_checkout_configuration_unavailable');
-        this.started = true;
-        return parseMercadoCheckoutContext(this.context);
-    }
-    async arm(replay, tokenUrl) {
-        if (!this.started)
-            return;
-        if (this.stopped || !this.context || replay.mode !== 'token' || replay.status !== 201 || !replay.processorContext)
-            throw new Error('mercado_checkout_metadata_unavailable');
-        const context = this.context;
-        const association = await createMercadoAssociationGate({ context, tokenUrl, tokenBody: replay.body, processorContext: replay.processorContext });
-        if (this.stopped || this.context !== context)
-            throw new Error('mercado_checkout_context_changed');
-        this.association = association;
-    }
-    associationBody(url, method, body, documentUrl) {
-        if (['GET', 'HEAD', 'OPTIONS'].includes(method) || !this.matches(url) || url === MERCADO_CONFIGURATION_URL)
-            return undefined;
-        let parsed;
-        try {
-            parsed = JSON.parse(body);
-        }
-        catch {
-            if (this.started)
-                throw new Error('mercado_checkout_association_invalid');
-            return undefined;
-        }
-        // The observed Pay request keeps the existing payment guards, including
-        // after the native document navigates to review. Every card association
-        // must use the checked shape; changing prev_step cannot bypass correction.
-        const cardAssociation = parsed?.id === 'next_step' || parsed?.prev_step === 'card_form'
-            || (parsed?.values && ('card_token' in parsed.values || 'payment_method' in parsed.values));
-        if (!cardAssociation && parsed?.id === 'pay' && parsed?.prev_step === 'review' && this.associatedFlow === url)
-            return undefined;
-        if (!cardAssociation && !this.started)
-            return undefined;
-        if (!this.started || this.stopped || !this.association)
-            throw new Error('mercado_checkout_association_unavailable');
-        const corrected = this.association.take({ url, method, body, documentUrl });
-        this.associatedFlow = url;
-        return corrected;
-    }
-}

package/dist/merchant-handoff.d.ts

@@ -1,54 +0,0 @@
-import type { CheckoutLifecycle } from './lifecycle.js';
-/** onEvent is ordinary integrator telemetry; the shape matches AttachOptions.onEvent. */
-type HandoffEvent = {
-    type: string;
-    detail?: unknown;
-};
-/**
- * A merchant-hosted card request after hand-off, shared by the CDP and
- * Playwright adapters so both read it the same way.
- *
- * The browser continued the merchant's own request with the Vault's ciphertext in
- * it; the merchant's server now charges the card through Adyen and answers its own
- * page. Nothing Agentcard holds says whether it did. Two things after hand-off are
- * therefore an unknown outcome, never a failure to retry:
- *   - the continued request answers 5xx or fails in the network: the merchant may
- *     have charged the card, and its page may never learn that it did;
- *   - the page sends the card request again before an answer arrived (Dick's
- *     retries on a network error or a 500, ATG on anything not OK): its retry
- *     carries the agent's dummy card, and the approval is spent.
- * Either reports `payment_outcome_unknown` once and holds the checkout until the
- * application reconciles the merchant order. Every card request to the same
- * profile after hand-off is aborted, answered or not: a prepared approval is
- * single use.
- *
- * Which of the two it reports follows the order the page saw them in. A page that
- * retries because the merchant answered 5xx read that answer first, but an
- * adapter can read the retry first (Chrome pauses a request in the browser
- * process, ahead of the renderer's report of the answer), so retried() judges
- * a retry once the adapter has read what the page reported before sending it.
- */
-export declare class MerchantHandoffWatch {
-    private readonly lifecycle;
-    private readonly onEvent?;
-    private handoff;
-    private answered;
-    private reported;
-    constructor(lifecycle: CheckoutLifecycle, onEvent?: ((event: HandoffEvent) => void) | undefined);
-    /** Record a hand-off before its continue is sent, so an answer that races the command is still read. */
-    begin(profile: string, authorizationId: string, url: string): void;
-    /** The continued request's response arrived with this status. */
-    responded(status: number): void;
-    /** The continued request failed before any response arrived. */
-    failed(): void;
-    /**
-     * The page sent a card request to a profile. True when it is the profile a
-     * hand-off already went to: the caller aborts it at once. A retry sent before
-     * any answer reached the page also reports the unknown outcome. When the
-     * adapter must first read more of what the page reported before it sent this
-     * retry, `inPageOrder` keeps `judge`, calls it once it has, and returns true.
-     */
-    retried(profile: string, inPageOrder?: (judge: () => void) => boolean): boolean;
-    private unknown;
-}
-export {};

package/dist/merchant-handoff.js

@@ -1,100 +0,0 @@
-import { PaymentOutcomeUnknownError } from './client.js';
-/**
- * A merchant-hosted card request after hand-off, shared by the CDP and
- * Playwright adapters so both read it the same way.
- *
- * The browser continued the merchant's own request with the Vault's ciphertext in
- * it; the merchant's server now charges the card through Adyen and answers its own
- * page. Nothing Agentcard holds says whether it did. Two things after hand-off are
- * therefore an unknown outcome, never a failure to retry:
- *   - the continued request answers 5xx or fails in the network: the merchant may
- *     have charged the card, and its page may never learn that it did;
- *   - the page sends the card request again before an answer arrived (Dick's
- *     retries on a network error or a 500, ATG on anything not OK): its retry
- *     carries the agent's dummy card, and the approval is spent.
- * Either reports `payment_outcome_unknown` once and holds the checkout until the
- * application reconciles the merchant order. Every card request to the same
- * profile after hand-off is aborted, answered or not: a prepared approval is
- * single use.
- *
- * Which of the two it reports follows the order the page saw them in. A page that
- * retries because the merchant answered 5xx read that answer first, but an
- * adapter can read the retry first (Chrome pauses a request in the browser
- * process, ahead of the renderer's report of the answer), so retried() judges
- * a retry once the adapter has read what the page reported before sending it.
- */
-export class MerchantHandoffWatch {
-    lifecycle;
-    onEvent;
-    handoff = null;
-    answered = false;
-    reported = false;
-    constructor(lifecycle, onEvent) {
-        this.lifecycle = lifecycle;
-        this.onEvent = onEvent;
-    }
-    /** Record a hand-off before its continue is sent, so an answer that races the command is still read. */
-    begin(profile, authorizationId, url) {
-        this.handoff = { profile, authorizationId, url };
-        this.answered = false;
-        this.reported = false;
-    }
-    /** The continued request's response arrived with this status. */
-    responded(status) {
-        if (!this.handoff || this.answered)
-            return;
-        this.answered = true;
-        if (Number.isInteger(status) && status >= 500)
-            this.unknown('merchant_server_error', { status });
-    }
-    /** The continued request failed before any response arrived. */
-    failed() {
-        if (!this.handoff || this.answered)
-            return;
-        this.answered = true;
-        this.unknown('merchant_request_failed');
-    }
-    /**
-     * The page sent a card request to a profile. True when it is the profile a
-     * hand-off already went to: the caller aborts it at once. A retry sent before
-     * any answer reached the page also reports the unknown outcome. When the
-     * adapter must first read more of what the page reported before it sent this
-     * retry, `inPageOrder` keeps `judge`, calls it once it has, and returns true.
-     */
-    retried(profile, inPageOrder) {
-        const handoff = this.handoff;
-        if (!handoff || handoff.profile !== profile)
-            return false;
-        let judged = false;
-        const judge = () => {
-            if (judged)
-                return;
-            judged = true;
-            if (this.handoff === handoff && !this.answered)
-                this.unknown('merchant_retried_after_handoff');
-            this.onEvent?.({ type: 'blocked', detail: 'merchant_retried_after_handoff' });
-        };
-        let waiting = false;
-        // An order the adapter cannot establish is judged on what it has read.
-        try {
-            waiting = !this.answered && inPageOrder?.(judge) === true;
-        }
-        catch {
-            waiting = false;
-        }
-        if (!waiting)
-            judge();
-        return true;
-    }
-    unknown(reason, extra = {}) {
-        if (!this.handoff || this.reported)
-            return;
-        // A result the application already confirmed with the merchant stands.
-        if (this.lifecycle.getState().status === 'completed')
-            return;
-        this.reported = true;
-        const { authorizationId, profile, url } = this.handoff;
-        this.lifecycle.failed(new PaymentOutcomeUnknownError(authorizationId, reason), true);
-        this.onEvent?.({ type: 'payment_outcome_unknown', detail: { authorizationId, reason, profile, url, ...extra } });
-    }
-}

package/dist/merchant-hosted.d.ts

@@ -1,140 +0,0 @@
-/** 'observe': paused, reported and aborted, never paid. 'enabled': a prepared checkout may pay it. */
-export type MerchantProfileStatus = 'observe' | 'enabled';
-/**
- * A test-mode checkout against your own Adyen TEST account: your own server's
- * card endpoint (an exact HTTPS URL), taking a card request shaped like a reviewed
- * profile's, encrypted under your own Adyen TEST client key (test_...). The API
- * accepts one only from a test-mode client of an org Agentcard turned declarations
- * on for, reads the key's public key from Adyen's TEST platform itself, and the
- * Vault encrypts only Adyen's documented test cards under it.
- */
-export interface SandboxMerchantDeclaration {
-    /** The reviewed profile whose card request your endpoint takes (its body rules, holder and fields). */
-    profile: string;
-    /** Your endpoint: HTTPS, written exactly as the browser sends it, no port, credentials or fragment. */
-    endpoint: string;
-    /** Your Adyen TEST client key (test_ followed by 32 letters and digits). */
-    clientKey: string;
-}
-/** A reviewed merchant profile this client arms: its id, the merchant it names, and its effective status. */
-export interface MerchantProfile {
-    readonly id: string;
-    readonly merchant: string;
-    readonly status: MerchantProfileStatus;
-    /** Present when this client armed the profile's shape at its own declared test endpoint (declareSandboxMerchant). */
-    readonly sandboxDeclaration?: Readonly<Pick<SandboxMerchantDeclaration, 'endpoint' | 'clientKey'>>;
-}
-/** A profile's verdict on a paused request; see classifyMerchantRequest. */
-export type MerchantRequestVerdict = {
-    verdict: 'pause';
-} | {
-    verdict: 'abort';
-    reason: string;
-} | {
-    verdict: 'pass';
-};
-/** One step of a JSON path: an object key, or an index into an array. */
-export type JsonPathStep = string | number;
-/** A card fact the API asks to write beside the ciphertext (reserved: no profile declares one yet). */
-export interface MerchantHostedFact {
-    path: JsonPathStep[];
-    value: string;
-}
-/**
- * Where a merchant-hosted approval's ciphertext goes: the profile's holder path
- * (`[]` is the body root), the merchant's names for Adyen's four fields, and the
- * keys at the holder to drop with the swap (adyen-web's `brand`, derived from the
- * agent's dummy digits). payment-core's substituteMerchantHosted refuses anything
- * but exactly the profile's own values.
- */
-export interface MerchantHostedSubstitutions {
-    encoding: 'json';
-    kind: 'merchant_hosted';
-    profile: string;
-    path: JsonPathStep[];
-    fields: Record<string, string>;
-    remove: string[];
-    /** Card facts to write after the swap. No profile declares any yet, and the substitution refuses them. */
-    set?: MerchantHostedFact[];
-}
-/**
- * The profile's verdict on a paused request: pause (its reviewed card request),
- * abort (encrypted card data it cannot finish, with the reason) or pass (no
- * encrypted card data, or not its endpoint or a sibling of it). Reads only;
- * throws for a profile id this build did not review.
- */
-export declare const classifyMerchantRequest: (profileId: string, url: string, method: string, body: string | null | undefined) => MerchantRequestVerdict;
-/** The endpoint origin, the path TEMPLATE and the profile's own query: what an event may name. */
-export declare const merchantProfileTemplatedUrl: (profileId: string, url: string) => string;
-/** SHA-256 of a JSON body's sorted key paths, no value in it; null for a body that is not JSON. */
-export declare const merchantBodyKeyPathSha256: (body: string) => string | null;
-/** 'sandbox' for a profile on Adyen's TEST platform, 'production' for every live environment. */
-export declare const merchantProfileEnvironment: (profileId: string) => 'production' | 'sandbox';
-/** classifyMerchantRequest for a sandbox declaration: the profile's body rules at the declared endpoint instead of the profile's. */
-export declare const classifyDeclaredMerchantRequest: (profileId: string, endpoint: string, url: string, method: string, body: string | null | undefined) => MerchantRequestVerdict;
-/**
- * The profiles this client arms: every profile this build reviewed, once each, in
- * this build's order. A served entry is `{ merchant_profile: <the profile's wire
- * projection> }`, and the first one that names a profile with exactly this build's
- * rules (endpoint, body rules, holder, fields, key: everything but `status`) and a
- * status this build knows decides it: 'enabled' only when both that entry and this
- * build say so. Every other profile stays in 'observe': one the API did not serve (no
- * sync yet, a failed sync, an API that predates profiles) and one the API reviewed
- * again after this build was cut, which this build cannot pay. In 'observe' its card
- * request is still paused and aborted, so the agent's dummy card never reaches a
- * reviewed merchant, whatever the API answered.
- */
-export declare function armServedProfiles(entries?: readonly unknown[]): MerchantProfile[];
-/**
- * Arms a sandbox declaration: the reviewed profile's card request at your own
- * endpoint, under your own Adyen TEST key. Throws a TypeError for a profile this
- * build did not review, an endpoint the API would refuse, or a key that is not a
- * test_ key. The endpoint rule is the API's own (payment-core sandboxDeclarationRefusal):
- * an HTTPS URL in the exact form the browser writes it (no port, credentials or
- * fragment), on a public domain name outside Adyen's domains, Agentcard's and every
- * reviewed merchant's domain (declaredEndpointRefusal), and on no host this build's
- * processor registry names. The armed entry names its host as the merchant, and is
- * 'enabled' whatever the reviewed profile's status: it never pays the reviewed
- * merchant, the API refuses it from a live client and from an org it has not turned
- * declarations on for, and the Vault encrypts only Adyen's documented test cards
- * under a test_ key.
- */
-export declare function declareSandboxMerchant(input: SandboxMerchantDeclaration): MerchantProfile;
-/** The armed profile whose endpoint, or a sibling of it (same origin and path shape), a URL is; null for any other URL. */
-export declare function merchantProfileFor(profiles: readonly MerchantProfile[], url: string): MerchantProfile | null;
-/** The Fetch.enable globs that pause every armed profile's endpoint and its siblings, a declared endpoint included. */
-export declare function merchantProfileUrlPatterns(profiles: readonly MerchantProfile[]): string[];
-/** classifyMerchantRequest for an armed profile: at its declared endpoint when it has one. */
-export declare function classifyProfileRequest(profile: MerchantProfile, url: string, method: string, body: string | null | undefined): MerchantRequestVerdict;
-/** merchantProfileTemplatedUrl for an armed profile: a declared endpoint's origin and path, never its query. */
-export declare function profileTemplatedUrl(profile: MerchantProfile, url: string): string;
-/**
- * The Fetch.enable globs for every profile this build reviewed. Every one of them is
- * armed from the start (armServedProfiles), so attachToCdp arms all of them at attach
- * and a syncRegistry() before or after it changes only a profile's status: its card
- * request is paused and judged under CDP exactly as attachToPlaywright's per-request
- * route judges it.
- */
-export declare function reviewedMerchantProfileUrlPatterns(): string[];
-/**
- * The continuation of a merchant-hosted approval: the live paused body with the
- * Vault's ciphertext in place of the dummy fields. The API never sees the body the
- * browser continues, so the live body must first hash to the one the API checked
- * when the authorization was created (`bodySha256`); a page that rewrote its body
- * while the cardholder decided is refused rather than paid. payment-core's
- * substituteMerchantHosted then reads the profile's body rules again on the live
- * body, writes only the profile's four fields, and refuses a profile that is not
- * enabled, unless this client armed the endpoint from its own sandbox declaration
- * (the replay carries `sandboxDeclaration`), where every body rule still applies.
- * Throws SubstitutionError; nothing leaves the browser when it does.
- */
-export declare function substituteMerchantHostedBody(body: string, replay: {
-    substitutions: MerchantHostedSubstitutions;
-    bodySha256: string;
-    sandboxDeclaration?: MerchantProfile['sandboxDeclaration'];
-}): string;
-/** The URL an event names for a merchant-hosted replay's request: its declared endpoint's origin and path, or the profile's template. */
-export declare function replayTemplatedUrl(replay: {
-    profile: string;
-    sandboxDeclaration?: MerchantProfile['sandboxDeclaration'];
-}, url: string): string;