@agent-cards/checkout 0.19.0 → 0.21.0

package/dist/registry.d.ts

@@ -1,121 +0,0 @@
-/**
- * Which outbound requests carry a raw card, and where the card sits inside them.
- *
- * This is the only merchant-specific knowledge in the system, and it is keyed by
- * PSP rather than by merchant: every Shopify store shares one entry, every Stripe
- * site shares another. The list is served from the Agentcard API at runtime so
- * integrators pick up new processors without shipping a release.
- */
-export type Encoding = 'json' | 'form';
-/**
- * How a paused request gets its card. `token` (the default when absent): the
- * cardholder's device calls the processor and the runtime replays the
- * processor's response. `cse`: the processor encrypts the card in-page
- * (Adyen); the device returns ciphertext and the runtime substitutes it into
- * the paused body and lets the request continue. `hosted_form`: the device
- * submits the processor's own form and the paused request resolves with no
- * processor answer (served only to SDKs that ask for it on sync).
- */
-export type CheckoutMode = 'token' | 'cse' | 'hosted_form';
-export interface Recognizer {
-    /** Stable id, e.g. "shopify" */
-    psp: string;
-    /** Matches the tokenization endpoint. */
-    match: RegExp;
-    /**
-     * Anchored (`^…$`) regex SOURCES for the hostnames this PSP may ever receive
-     * a card on — the server's own allowlist, served next to `match` and carried
-     * through syncRegistry() verbatim.
-     *
-     * Strings, not RegExps, because that is the wire shape and because nothing
-     * here matches with them: they exist so a transport that can only pre-filter
-     * by URL (CDP's `Fetch.enable`, which takes globs) can be armed from the
-     * registry instead of a hardcoded list. Optional so a hand-built registry
-     * (tests, pinning) still type-checks.
-     */
-    hosts?: string[];
-    encoding: Encoding;
-    /**
-     * Request headers that must be replayed verbatim for the merchant to accept
-     * the call (signatures, client tokens). Matched case-insensitively.
-     */
-    passthroughHeaders: RegExp[];
-    /**
-     * Form keys that carry the card number. When present, a request on this
-     * recognizer's endpoints is a card request only if its body carries one of
-     * them: a Stripe confirmation that pays with a method the page already
-     * created (`payment_method=pm_...`) carries none, so there is nothing for
-     * the cardholder to approve. Served by the API and carried through
-     * syncRegistry() verbatim.
-     */
-    cardFields?: string[];
-    /**
-     * With cardFields: the endpoints (regex source over hostname + pathname,
-     * anchored) where a request without a card is routine and never ours, so
-     * it continues untouched; a request without a card anywhere else is refused.
-     */
-    passWithoutCard?: string;
-    /**
-     * True when the card is encrypted inside the page before the request leaves.
-     * A digit swap is useless here; the vault must re-run the PSP's client-side
-     * crypto instead. Refused locally unless the entry also carries
-     * `mode: 'cse'`, which says the vault does exactly that.
-     */
-    clientSideEncrypted?: boolean;
-    /** How the card reaches the processor; absent means 'token'. Carried verbatim by syncRegistry. */
-    mode?: CheckoutMode;
-    /**
-     * Dark launch: a capability name the API attaches to an entry it serves only
-     * to a client that declared it (?capabilities=). Absent on every entry in
-     * BUILTIN_REGISTRY, because a gated entry is left out of the built-in
-     * fallback. Carried verbatim by syncRegistry for a client that does declare
-     * it, so the SDK never has to act on it.
-     */
-    capability?: string;
-    /**
-     * True when this processor cannot be taken over on an ordinary authorization:
-     * the cardholder must have approved a prepare() first. authorize() refuses
-     * such a request locally, before it prompts, when no preparation is active
-     * (PreparationRequiredError), and the API answers 409 preparation_required.
-     * Absent on every BUILTIN_REGISTRY entry today and carried verbatim by
-     * syncRegistry for a build that reaches a processor which sets it.
-     */
-    preparationRequired?: boolean;
-    /**
-     * Anchored regex SOURCES (a subset of `hosts`) marking the vendor's
-     * SANDBOX/TEST hostnames, so the backend and the device can tell a test host
-     * from a live one. Carried verbatim by syncRegistry; the SDK never matches
-     * with them (recognition still uses `hosts`), so it acts on neither this nor
-     * the pin below. Present in BUILTIN_REGISTRY for the host-separated processors.
-     */
-    sandboxHosts?: string[];
-    /**
-     * True when a processor's host environment is enforced: the API refuses a
-     * create whose host environment disagrees with the row's test/live nature, and
-     * the device sends only documented test cards to a sandbox host. Absent on
-     * every entry today; carried verbatim by syncRegistry, and the SDK never acts
-     * on it.
-     */
-    hostEnvironmentPinned?: boolean;
-}
-import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
-export { BUILTIN_REGISTRY };
-export declare function findRecognizer(url: string, registry?: Recognizer[]): Recognizer | null;
-/**
- * True when this processor cannot be taken over on an ordinary authorization:
- * the cardholder must have approved a prepare() first (the `preparationRequired`
- * field above). authorize() applies this before it prompts and refuses with
- * PreparationRequiredError when no preparation is active; the API answers 409
- * preparation_required for the same case. This is the SAME rule payment-core's
- * recognizerRequiresPreparation applies on the server, a strict `=== true`, so a
- * value that rode in over the wire (syncRegistry spreads the served JSON) cannot
- * turn a truthy string into a gate. Absent on every BUILTIN_REGISTRY entry, so
- * this is false for all 24 today.
- */
-export declare function recognizerRequiresPreparation(rec: Pick<Recognizer, 'preparationRequired'>): boolean;
-/**
- * Glob url patterns covering every host in `registry` — what to hand
- * `Fetch.enable` so a card request is ever paused. Deliberately a superset of
- * the recognizers; isCardRequest is the exact check.
- */
-export declare function cardUrlPatterns(registry: Recognizer[]): string[];

package/dist/registry.js

@@ -1,310 +0,0 @@
-/**
- * Which outbound requests carry a raw card, and where the card sits inside them.
- *
- * This is the only merchant-specific knowledge in the system, and it is keyed by
- * PSP rather than by merchant: every Shopify store shares one entry, every Stripe
- * site shares another. The list is served from the Agentcard API at runtime so
- * integrators pick up new processors without shipping a release.
- */
-// Pinned fallback generated from the single shared processor catalog.
-import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
-export { BUILTIN_REGISTRY };
-export function findRecognizer(url, registry = BUILTIN_REGISTRY) {
-    // Match the way the SERVER does, on the PARSED url — never as a substring of
-    // the raw string. `match` is unanchored, so a raw-string test classifies any
-    // URL that merely CONTAINS a tokenizer endpoint as a card request:
-    //   https://evil.com/?next=https://api.stripe.com/v1/tokens
-    // The server refuses that (its hosts[] are anchored against URL.hostname), so
-    // the request could not be intercepted anyway — but the SDK had already paused
-    // it, and a pause it cannot complete becomes an ABORT. That turns an
-    // integrator's unrelated POST into a failed request.
-    //
-    // hosts[] is synced from the API precisely so the client can apply the server's
-    // own allowlist. Use it when present, and fall back to matching `match`
-    // against "hostname + pathname" (not the query) for a registry served by an
-    // older API that predates the field.
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        return null;
-    }
-    if (parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password)
-        return null;
-    const hostPath = `${parsed.hostname.toLowerCase()}${parsed.pathname}`;
-    return (registry.find((r) => {
-        if (r.hosts && r.hosts.length > 0) {
-            const hostAllowed = r.hosts.some((h) => new RegExp(h, 'i').test(parsed.hostname));
-            if (!hostAllowed)
-                return false;
-        }
-        // FULLY ANCHORED, exactly as the server does it. Unanchored, any EXTENSION
-        // of a valid path is admitted on a legitimate processor host
-        // (api.stripe.com/v1/tokens/anything), which the service then refuses —
-        // and a pause the SDK cannot complete becomes an abort.
-        return new RegExp(`^(?:${r.match.source})$`, 'i').test(hostPath);
-    }) ?? null);
-}
-/**
- * True when this processor cannot be taken over on an ordinary authorization:
- * the cardholder must have approved a prepare() first (the `preparationRequired`
- * field above). authorize() applies this before it prompts and refuses with
- * PreparationRequiredError when no preparation is active; the API answers 409
- * preparation_required for the same case. This is the SAME rule payment-core's
- * recognizerRequiresPreparation applies on the server, a strict `=== true`, so a
- * value that rode in over the wire (syncRegistry spreads the served JSON) cannot
- * turn a truthy string into a gate. Absent on every BUILTIN_REGISTRY entry, so
- * this is false for all 24 today.
- */
-export function recognizerRequiresPreparation(rec) {
-    return rec.preparationRequired === true;
-}
-// ---------------------------------------------------------------------------
-// Registry -> CDP url patterns
-//
-// `Fetch.enable` takes GLOB url patterns (`*` = any run of characters, `?` =
-// exactly one, `\` escapes), never regexes, so the registry's anchored host
-// regexes have to be widened into globs before a raw-CDP integrator can arm
-// interception with them.
-//
-// These patterns are only a COARSE pre-filter. Every request they pause is
-// re-checked with the real recognizer (VaultClient.isCardRequest) before
-// anything is intercepted, so a pattern that is too BROAD costs one extra
-// continueRequest round-trip, while one that is too NARROW silently drops the
-// card request on the floor and the shopper pays with their own card. Every
-// conversion below therefore WIDENS: anything not expressible as a glob
-// (character classes, groups, quantifiers, lookarounds) becomes `*`.
-// ---------------------------------------------------------------------------
-/**
- * Glob url patterns covering every host in `registry` — what to hand
- * `Fetch.enable` so a card request is ever paused. Deliberately a superset of
- * the recognizers; isCardRequest is the exact check.
- */
-export function cardUrlPatterns(registry) {
-    const out = new Set();
-    for (const rec of registry ?? []) {
-        for (const pattern of recognizerUrlPatterns(rec))
-            out.add(pattern);
-    }
-    return [...out];
-}
-function recognizerUrlPatterns(rec) {
-    const hosts = Array.isArray(rec?.hosts) ? rec.hosts.filter((h) => typeof h === 'string') : [];
-    if (hosts.length > 0) {
-        // Host text ANYWHERE in the URL, not `*://host/*`. Two reasons: a URL with
-        // userinfo (`https://u:p@host/…`) still has `host` as its hostname so the
-        // registry matches it, and isCardRequest tests `match` unanchored against
-        // the raw URL, so a URL merely carrying the host in its query also
-        // "matches" client-side. Anchoring the scheme would arm narrower than
-        // either check.
-        //
-        // Lowercased because CDP matches these globs case-SENSITIVELY against the
-        // canonical url, and a canonical url's authority is always lowercase (the
-        // URL parser folds it before the request is ever issued) — the same
-        // normalization resolveRecognizerForUrl does with url.hostname. Do not
-        // "fix" this by wildcarding the letters: `*???.??????.???*` matches most of
-        // the web and would pause every request on the page.
-        return hosts.flatMap((h) => regexSourceToGlobs(h)).map((g) => wrap(g).toLowerCase());
-    }
-    // No hosts[] — a registry pinned before the field existed, or hand-built.
-    // Fall back to widening `match`, which is the predicate isCardRequest
-    // actually applies. Path case can matter to a glob (CDP matches
-    // case-sensitively) while a hostname is always lowercased by the URL parser,
-    // so arm both spellings rather than guess.
-    return regexSourceToGlobs(rec?.match?.source ?? '')
-        .map(wrap)
-        .flatMap((g) => (g === g.toLowerCase() ? [g] : [g, g.toLowerCase()]));
-}
-/** `a|b` at the top level is two independent hostnames, so it is two globs. */
-function regexSourceToGlobs(source) {
-    return splitTopLevelAlternation(source).map(branchToGlob);
-}
-function splitTopLevelAlternation(source) {
-    const parts = [];
-    let depth = 0;
-    let inClass = false;
-    let start = 0;
-    for (let i = 0; i < source.length; i++) {
-        const c = source[i];
-        if (c === '\\') {
-            i++;
-            continue;
-        }
-        if (inClass) {
-            if (c === ']')
-                inClass = false;
-            continue;
-        }
-        if (c === '[') {
-            inClass = true;
-            continue;
-        }
-        if (c === '(') {
-            depth++;
-            continue;
-        }
-        if (c === ')') {
-            depth = Math.max(0, depth - 1);
-            continue;
-        }
-        if (c === '|' && depth === 0) {
-            parts.push(source.slice(start, i));
-            start = i + 1;
-        }
-    }
-    parts.push(source.slice(start));
-    return parts;
-}
-/**
- * One alternation-free regex source -> one glob. Literal characters survive;
- * every construct that can match more than itself collapses to `*`. An empty
- * result is `*` on purpose: an empty regex matches every hostname, so the glob
- * that mirrors it has to match every URL.
- */
-function branchToGlob(branch) {
-    const atoms = [];
-    let i = 0;
-    while (i < branch.length) {
-        const c = branch[i];
-        let atom;
-        if (c === '^' || c === '$') {
-            i += 1;
-            continue;
-        } // anchors constrain nothing in a glob
-        if (c === '\\') {
-            const next = branch[i + 1] ?? '';
-            i += 2;
-            // \d \w \s \b … are classes/assertions; only escaped punctuation (\., \-)
-            // is a literal character.
-            atom = /[A-Za-z0-9]/.test(next) ? '*' : globEscape(next);
-        }
-        else if (c === '[') {
-            i = skipCharClass(branch, i);
-            atom = '*';
-        }
-        else if (c === '(') {
-            i = skipGroup(branch, i); // groups, non-capturing groups, lookarounds
-            atom = '*';
-        }
-        else if (c === '.') {
-            i += 1;
-            atom = '*';
-        }
-        else if (c === ')' || c === ']') {
-            i += 1; // unbalanced closer: ignore rather than throw
-            continue;
-        }
-        else if (quantifierEnd(branch, i) !== null) {
-            // A quantifier with nothing in front of it. Widen whatever preceded it.
-            i = quantifierEnd(branch, i);
-            if (atoms.length > 0)
-                atoms[atoms.length - 1] = '*';
-            else
-                atoms.push('*');
-            continue;
-        }
-        else {
-            i += 1;
-            atom = globEscape(c);
-        }
-        // `x?` / `x*` / `x+` / `x{2,3}`: the atom is optional or repeatable, so the
-        // only glob that covers every string it accepts is `*`.
-        const after = quantifierEnd(branch, i);
-        if (after !== null) {
-            i = after;
-            atom = '*';
-        }
-        atoms.push(atom);
-    }
-    return collapse(atoms).join('');
-}
-/** Index just past a quantifier at `i`, or null when there isn't one. */
-function quantifierEnd(source, i) {
-    const c = source[i];
-    let end;
-    if (c === '*' || c === '+' || c === '?') {
-        end = i + 1;
-    }
-    else if (c === '{') {
-        const close = source.indexOf('}', i);
-        if (close === -1 || !/^\{\d+(,\d*)?\}$/.test(source.slice(i, close + 1)))
-            return null;
-        end = close + 1;
-    }
-    else {
-        return null;
-    }
-    if (source[end] === '?')
-        end += 1; // lazy quantifier
-    return end;
-}
-function skipCharClass(source, i) {
-    let j = i + 1;
-    if (source[j] === '^')
-        j++;
-    if (source[j] === ']')
-        j++; // a leading `]` is a literal
-    for (; j < source.length; j++) {
-        if (source[j] === '\\') {
-            j++;
-            continue;
-        }
-        if (source[j] === ']')
-            return j + 1;
-    }
-    return source.length;
-}
-function skipGroup(source, i) {
-    let depth = 0;
-    let inClass = false;
-    for (let j = i; j < source.length; j++) {
-        const c = source[j];
-        if (c === '\\') {
-            j++;
-            continue;
-        }
-        if (inClass) {
-            if (c === ']')
-                inClass = false;
-            continue;
-        }
-        if (c === '[') {
-            inClass = true;
-            continue;
-        }
-        if (c === '(') {
-            depth++;
-            continue;
-        }
-        if (c === ')') {
-            depth--;
-            if (depth === 0)
-                return j + 1;
-        }
-    }
-    return source.length;
-}
-/** `*` and `?` are the glob's own wildcards; `\` is its escape. */
-function globEscape(ch) {
-    return ch === '*' || ch === '?' || ch === '\\' ? `\\${ch}` : ch;
-}
-/** `**` matches exactly what `*` does; keep patterns readable. */
-function collapse(atoms) {
-    const out = [];
-    for (const a of atoms) {
-        if (a === '*' && out[out.length - 1] === '*')
-            continue;
-        out.push(a);
-    }
-    return out;
-}
-/** `…host…` -> `*host*`, without doubling a `*` the conversion already emitted. */
-function wrap(glob) {
-    let body = glob;
-    while (body.startsWith('*'))
-        body = body.slice(1);
-    while (body.length > 0 && body.endsWith('*') && !body.endsWith('\\*'))
-        body = body.slice(0, -1);
-    return body.length > 0 ? `*${body}*` : '*';
-}

package/dist/spreedly.generated.d.ts

@@ -1,10 +0,0 @@
-declare var SPREEDLY_TOKEN_ENDPOINT: string;
-declare function isSpreedlyTokenRequest(url: any, method?: string): boolean;
-declare function isPreparedSpreedlyRequest(body: any): boolean;
-declare function isSpreedlyRequest(request: any): boolean;
-declare function injectSpreedlyCard(body: any, card: any): {
-    body: string;
-    where: string[];
-};
-declare function sanitizeSpreedlyTokenResponse(body: any): string;
-export { SPREEDLY_TOKEN_ENDPOINT, injectSpreedlyCard, isPreparedSpreedlyRequest, isSpreedlyRequest, isSpreedlyTokenRequest, sanitizeSpreedlyTokenResponse };