@agent-cards/checkout 0.19.0 → 0.22.0

package/dist/owned-shop.generated.js

@@ -1,108 +0,0 @@
-// @ts-nocheck
-// Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c8cfb844f3de3f156ee741a0167256d2e764ddfb7d243ce813e011761d3b711a
-// src/owned-shop.js
-var OWNED_SHOP_OPERATION = "stripe.owned_shop_token_to_payment_intent.v1";
-var OWNED_SHOP_SKU = "autopilot-pilot-100";
-var OWNED_SHOP_AMOUNT_CENTS = 100;
-var OWNED_SHOP_CURRENCY = "usd";
-var OWNED_SHOP_ORDER_FIELD = "agentcard_shop_order";
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/;
-var INTENT = /^pi_[A-Za-z0-9]{1,200}(?![\s\S])/;
-var refuse = () => {
-    throw new Error("stripe_owned_shop_refused");
-};
-var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var keys = (value, allowed) => record(value) && Object.keys(value).length === allowed.length && Object.keys(value).every((key) => allowed.includes(key));
-function isOwnedShopPaymentIntentId(value) {
-    return typeof value === "string" && INTENT.test(value);
-}
-function order(value) {
-    if (!keys(value, ["order_id", "sku", "amount", "currency"]) || typeof value.order_id !== "string" || !UUID.test(value.order_id) || value.sku !== OWNED_SHOP_SKU || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY)
-        refuse();
-    return {
-        order_id: value.order_id,
-        sku: OWNED_SHOP_SKU,
-        amount: OWNED_SHOP_AMOUNT_CENTS,
-        currency: OWNED_SHOP_CURRENCY
-    };
-}
-function serializeOwnedShopOrder(value) {
-    return JSON.stringify(order(value));
-}
-function hasOwnedShopMarker(request) {
-    if (typeof request?.body !== "string")
-        return false;
-    return request.body.split("&").some((part) => {
-        const raw = part.split("=", 1)[0];
-        const loose = raw.replace(/\+/g, " ").replace(/%([0-9a-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
-        return loose.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD);
-    });
-}
-function form(body) {
-    if (typeof body !== "string" || !body || body.length > 16384 || /[^\x21-\x7e]/.test(body))
-        refuse();
-    const chunks = body.split("&");
-    if (chunks.length > 16)
-        refuse();
-    const entries = /* @__PURE__ */ new Map();
-    const seen = /* @__PURE__ */ new Set();
-    for (const chunk of chunks) {
-        const eq = chunk.indexOf("=");
-        if (eq < 1)
-            refuse();
-        let key, value;
-        try {
-            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
-            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
-        }
-        catch {
-            refuse();
-        }
-        if (seen.has(key.toLowerCase()) || value.length > 2048 || /[\x00-\x1f\x7f]/.test(key + value))
-            refuse();
-        seen.add(key.toLowerCase());
-        entries.set(key, value);
-    }
-    return entries;
-}
-function parseOwnedShopOrder(request) {
-    if (!hasOwnedShopMarker(request))
-        return null;
-    const entries = form(request.body);
-    if (!entries.has(OWNED_SHOP_ORDER_FIELD) || [...entries.keys()].some((key) => key !== OWNED_SHOP_ORDER_FIELD && key.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD)))
-        refuse();
-    const encoded = entries.get(OWNED_SHOP_ORDER_FIELD);
-    let parsed;
-    try {
-        parsed = JSON.parse(encoded);
-    }
-    catch {
-        refuse();
-    }
-    const result = order(parsed);
-    if (serializeOwnedShopOrder(result) !== encoded)
-        refuse();
-    return result;
-}
-function parseOwnedShopReceipt(value, expectedOrder) {
-    let boundOrder;
-    try {
-        boundOrder = order(expectedOrder);
-    }
-    catch {
-        return null;
-    }
-    if (!keys(value, ["object", "order_id", "payment_intent_id", "status", "amount", "currency", "livemode"]) || value.object !== "agentcard_shop_receipt" || value.order_id !== boundOrder.order_id || !isOwnedShopPaymentIntentId(value.payment_intent_id) || value.status !== "succeeded" || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY || value.livemode !== false)
-        return null;
-    return {
-        object: "agentcard_shop_receipt",
-        order_id: boundOrder.order_id,
-        payment_intent_id: value.payment_intent_id,
-        status: "succeeded",
-        amount: OWNED_SHOP_AMOUNT_CENTS,
-        currency: OWNED_SHOP_CURRENCY,
-        livemode: false
-    };
-}
-export { OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY, OWNED_SHOP_OPERATION, OWNED_SHOP_ORDER_FIELD, OWNED_SHOP_SKU, hasOwnedShopMarker, isOwnedShopPaymentIntentId, parseOwnedShopOrder, parseOwnedShopReceipt, serializeOwnedShopOrder };

package/dist/paysafe.generated.d.ts

@@ -1,12 +0,0 @@
-export type PaysafePreparationEnvironment = 'production' | 'sandbox';
-export declare function paysafePreparationUrl(environment: string): string;
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
-export declare function paysafeEnvironment(url: string): PaysafePreparationEnvironment | undefined;
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
- */
-export declare function isPreparedPaysafeRequest(url: string, method: string, body: string | null, environment: string, headers?: Record<string, string>): boolean;

package/dist/paysafe.generated.js

@@ -1,87 +0,0 @@
-// Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 24c7940ae8974c0d24e5a365144c1b07ccc46863ae3094eb92b3c54c8307e837
-import { readTokenizationJson } from './braintree.js';
-const ENDPOINTS = {
-    production: 'https://hosted.paysafe.com/checkout/api/v1/tokenize',
-    sandbox: 'https://hosted.test.paysafe.com/checkout/api/v1/tokenize',
-};
-const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
-const keys = (value, allowed) => record(value) && Object.keys(value).every(key => allowed.includes(key));
-const exact = (pattern, value) => typeof value === 'string' && pattern.exec(value)?.[0] === value;
-const text = (value, max = 1024) => typeof value === 'string' && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-const uuid = (value) => exact(/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i, value);
-export function paysafePreparationUrl(environment) {
-    if (environment !== 'production' && environment !== 'sandbox')
-        throw new Error('unsupported_preparation_environment');
-    return ENDPOINTS[environment];
-}
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
-export function paysafeEnvironment(url) {
-    return url === ENDPOINTS.production ? 'production' : url === ENDPOINTS.sandbox ? 'sandbox' : undefined;
-}
-const ADDRESS_FIELDS = ['city', 'country', 'zip', 'street', 'street2', 'state'];
-function billing(value) {
-    return keys(value, ADDRESS_FIELDS) && Object.values(value).every(value => text(value))
-        && (!own(value, 'country') || exact(/^[A-Z]{2}$/, value.country));
-}
-function freshCard(value) {
-    if (!keys(value, ['card', 'clientInfo', 'billingAddress']) || !keys(value.card, ['cardNum', 'cardExpiry', 'cvv', 'holderName']))
-        return false;
-    const card = value.card;
-    if (!exact(/^[0-9]{12,19}$/, card.cardNum) || !exact(/^[0-9]{3,4}$/, card.cvv)
-        || !keys(card.cardExpiry, ['month', 'year']) || !exact(/^(?:0[1-9]|1[0-2])$/, card.cardExpiry.month)
-        || !exact(/^20[0-9]{2}$/, card.cardExpiry.year) || own(card, 'holderName') && !text(card.holderName)
-        || own(value, 'billingAddress') && !billing(value.billingAddress))
-        return false;
-    const info = value.clientInfo;
-    return keys(info, ['correlationId', 'invocationId', 'version', 'appName'])
-        && uuid(info.correlationId) && uuid(info.invocationId) && info.version === '1.8.0' && info.appName === 'paysafe.checkout';
-}
-const BROWSER_HEADERS = new Set(['accept', 'accept-language', 'accept-encoding', 'content-length', 'origin', 'referer',
-    'user-agent', 'host', 'connection', 'cache-control', 'pragma', 'priority', 'dnt',
-    'sec-fetch-dest', 'sec-fetch-mode', 'sec-fetch-site', 'sec-fetch-user']);
-function singleUseCredential(value) {
-    if (!exact(/^Basic [A-Za-z0-9+/]+={0,2}$/, value) || value.length > 1024)
-        return false;
-    try {
-        const encoded = value.slice(6), decoded = atob(encoded);
-        // Checkout receives public OT credentials, never merchant API credentials.
-        return btoa(decoded) === encoded && exact(/^OT-[0-9]{1,20}:[!-~]{1,512}$/, decoded);
-    }
-    catch {
-        return false;
-    }
-}
-function nativeHeaders(headers, correlationId) {
-    if (!record(headers))
-        return false;
-    const parsed = new Map();
-    let bytes = 0;
-    for (const [name, value] of Object.entries(headers)) {
-        const lower = name.toLowerCase();
-        if (parsed.size >= 64 || parsed.has(lower) || !exact(/^[A-Za-z0-9-]+$/, name) || !text(value, 8192)
-            || (bytes += name.length + value.length) > 32768)
-            return false;
-        if (!['content-type', 'correlationid', 'x-paysafe-credentials'].includes(lower) && !BROWSER_HEADERS.has(lower)
-            && !exact(/^sec-ch-ua(?:-[a-z0-9-]+)?$/, lower))
-            return false;
-        parsed.set(lower, value);
-    }
-    return exact(/^application\/json(?:;\s*charset=utf-8)?$/i, parsed.get('content-type'))
-        && parsed.get('correlationid') === correlationId && singleUseCredential(parsed.get('x-paysafe-credentials'));
-}
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
- */
-export function isPreparedPaysafeRequest(url, method, body, environment, headers) {
-    if (method !== 'POST' || (environment !== 'production' && environment !== 'sandbox')
-        || paysafeEnvironment(url) !== environment)
-        return false;
-    const value = readTokenizationJson(body);
-    return freshCard(value) && record(value.clientInfo) && nativeHeaders(headers, value.clientInfo.correlationId);
-}

package/dist/playwright.d.ts

@@ -1,3 +0,0 @@
-export * from './cdp.js';
-export { collectCheckoutSignals, inspectCheckout } from './preflight-playwright.js';
-export type { CheckoutInspectionFrame, CheckoutInspectionPage, CheckoutCollectionOptions, InspectCheckoutOptions, } from './preflight-playwright.js';

package/dist/playwright.js

@@ -1,3 +0,0 @@
-// Preserve the existing Playwright entry point's CDP and payment attachment exports.
-export * from './cdp.js';
-export { collectCheckoutSignals, inspectCheckout } from './preflight-playwright.js';

package/dist/pre-claim.d.ts

@@ -1,123 +0,0 @@
-import { StripeCheckoutGate } from './stripe-checkout.js';
-import { MercadoCheckoutGate } from './mercado-checkout.js';
-import type { CheckoutLifecycle } from './lifecycle.js';
-import { type MerchantProfile } from './merchant-hosted.js';
-import type { MerchantHandoffWatch } from './merchant-handoff.js';
-/** The native Stripe step the gate claimed, or null when none was: exactly what StripeCheckoutGate.claim returns. */
-type StripeStep = ReturnType<StripeCheckoutGate['claim']>;
-/** A synthetic response a gate fulfills locally. The effect applies CORS and encoding. */
-type StubResponse = {
-    status: number;
-    headers: Record<string, string>;
-    body: string;
-};
-/** onEvent is ordinary integrator telemetry; the shape matches AttachOptions.onEvent. */
-type PreClaimEvent = {
-    type: string;
-    detail?: unknown;
-};
-/** How the request was resolved. continue/answer/abort are already performed by the
- * time the decision is returned; only pause hands work back to the adapter. */
-export type PreClaimDecision = {
-    kind: 'continue';
-} | {
-    kind: 'abort';
-} | {
-    kind: 'answer';
-} | {
-    kind: 'pause';
-    stripeStep: StripeStep;
-};
-/** The adapter mechanics a gate performs. Each is awaited where the inline code
- * awaited it; none swallow their own transport failure (a gate adds a .catch
- * only where the inline code did), except abort, which each adapter makes safe
- * the way the inline aborts were (CDP catches the send; Playwright's route.abort
- * resolves). */
-export interface PreClaimEffects {
-    /** Let the request through, optionally replacing its body. */
-    continueRequest(postData?: string): Promise<void>;
-    /** Fulfill the request locally with a synthetic response (CORS applied inside). */
-    answer(response: StubResponse): Promise<void>;
-    /** Fail the request. */
-    abort(): Promise<void>;
-}
-/** Live adapter state and the gates a request is judged against. Accessors are
- * functions because the inline code re-read this state after each await; a
- * snapshot taken before Mercado's document read or Stripe's assertDocument
- * would judge on a stale value. */
-export interface PreClaimContext {
-    /** The adapters expose headers and body as getters, read inside the gate that
-     * needs them: Playwright's postData() can throw, and Mercado reads the body in
-     * its own try, so that failure stops the native checkout instead of rejecting
-     * the route handler with the request neither aborted nor reported. */
-    request: {
-        url: string;
-        method: string;
-        headers: Record<string, string>;
-        body: string | null;
-    };
-    vault: {
-        isCardRequest(url: string, method?: string): boolean;
-        merchantProfileOf?(url: string): MerchantProfile | null;
-    };
-    guards: {
-        matches(url: string, method?: string): boolean;
-    };
-    mercado: MercadoCheckoutGate;
-    stripe: StripeCheckoutGate;
-    readDocumentUrl: () => Promise<string>;
-    lifecycle: CheckoutLifecycle;
-    /** isEngaged and observeUnprepared are called only for an armed merchant profile's card request or a Fiserv card capture. */
-    preparationGate: {
-        invalidate(reason: string): void;
-        isEngaged(): boolean;
-        observeUnprepared(): void;
-    };
-    effects: PreClaimEffects;
-    onEvent?: (event: PreClaimEvent) => void;
-    failureSummary: (error: unknown) => string;
-    attachmentReady: () => boolean;
-    /** setupStop.signal.aborted: the attachment is tearing down. */
-    interceptionAborted: () => boolean;
-    /** lifecycle.abort.signal.aborted: the checkout was cancelled. */
-    lifecycleAborted: () => boolean;
-    /** A terminal failure has latched. */
-    terminal: () => boolean;
-    /** The merchant document is gone. CDP has no such signal here and returns false. */
-    documentClosed: () => boolean;
-    /** A per-session arm is still in flight (CDP only); Playwright returns false. */
-    stripeAttachmentBusy: () => boolean;
-    /** The paused request itself is gone (Playwright only); CDP returns false. */
-    requestInactive: () => boolean;
-    awaitingApproval: () => boolean;
-    /** Set by the Stripe gate; read by the terminal arbiter and carried into a pause. */
-    stripeStep: StripeStep;
-    /** The merchant-hosted hand-off this attachment made, if any (merchant-handoff.ts). */
-    merchantHandoff?: Pick<MerchantHandoffWatch, 'retried'>;
-}
-/**
- * The URL an event may name for a request. For an armed merchant profile's
- * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
- * profile's own query (merchantProfileTemplatedUrl), so a user id, cart id or
- * email in the merchant's path or query never reaches telemetry. For anything
- * else: origin and path (redactUrl), as before.
- */
-export declare function eventUrl(vault: {
-    merchantProfileOf?(url: string): MerchantProfile | null;
-} | undefined, url: string): string;
-/** A gate returns a decision when it handles the request, undefined to defer to
- * the next gate, or a promise of either when it must do I/O first. */
-export type PreClaimGate = (ctx: PreClaimContext) => PreClaimDecision | undefined | Promise<PreClaimDecision | undefined>;
-export declare const MERCHANT_BODY_UNREADABLE = "the paused request carries no body the SDK could read, so Agentcard cannot tell whether it carries a card";
-export declare const fiservPreClaim: PreClaimGate;
-/** The processor gates, in order. A new family adds one entry here; the terminal
- * arbiter runs after all of them and is not part of this list. A gate appended
- * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
- * pauses each one itself. */
-export declare const PSP_PRE_CLAIM_GATES: readonly PreClaimGate[];
-/** Run each gate in order; the first to return a decision wins. If none does,
- * the terminal arbiter decides between continue, abort (unsupported) and pause.
- * Returns synchronously while every gate defers synchronously (an ordinary card
- * request pauses with no await), and a promise once a gate does I/O. */
-export declare function dispatchPreClaim(ctx: PreClaimContext, gates?: readonly PreClaimGate[]): PreClaimDecision | Promise<PreClaimDecision>;
-export {};