@agent-cards/checkout 0.19.0 → 0.22.0

package/dist/preflight.js

@@ -1,2 +0,0 @@
-// Read-only discovery is separate from request interception and authorization.
-export * from './preflight.generated.js';

package/dist/preparation.d.ts

@@ -1,38 +0,0 @@
-import { type PreparedCheckout } from './client.js';
-import type { AttachOptions } from './cdp.js';
-import type { CheckoutLifecycle } from './lifecycle.js';
-/** A local, one-use rendezvous. It never starts or retries a merchant request. */
-export declare class PreparationGate {
-    private readonly opts;
-    private readonly lifecycle;
-    private readonly readDocumentUrl;
-    private state;
-    private observedRequest;
-    private documentUrl;
-    private prepared?;
-    private stop;
-    private expiryTimer?;
-    constructor(opts: AttachOptions, lifecycle: CheckoutLifecycle, readDocumentUrl: () => Promise<string>);
-    private prepare;
-    /** Called for every recognized card mutation, before any await or local retry guard. */
-    claim(requestUrl: string, requestBody?: string | null, requestHeaders?: Record<string, string>): PreparedCheckout | undefined;
-    assertDocument(): Promise<void>;
-    private readDocument;
-    isEngaged(): boolean;
-    /**
-     * A card request that only a prepared checkout may pay (an Adyen merchant
-     * profile's, or a Fiserv card capture, pre-claim.ts) arrived with no
-     * preparation and was refused. Like claim() on an unused gate, a later
-     * prepare() is then refused too.
-     */
-    observeUnprepared(): void;
-    retireUnboundClaim(): void;
-    /** A bound native request has its own cancellation/unknown-outcome machinery. */
-    invalidate(reason: string): void;
-    /**
-     * Retire the server handle first, then report the form outcome. Neither
-     * call waits on the other: a stalled report cannot delay the cancel, and a
-     * stalled cancel cannot lose the report.
-     */
-    private cancelThenObserve;
-}

package/dist/preparation.js

@@ -1,191 +0,0 @@
-import { CheckoutPreparationError } from './client.js';
-import { validAmountInput } from './client.js';
-import { matchesPreparation, validPreparationEnvironment, preparationEndpoint } from './prepared-processor.js';
-/** A local, one-use rendezvous. It never starts or retries a merchant request. */
-export class PreparationGate {
-    opts;
-    lifecycle;
-    readDocumentUrl;
-    state = 'unused';
-    observedRequest = false;
-    documentUrl = '';
-    prepared;
-    stop = new AbortController();
-    expiryTimer;
-    constructor(opts, lifecycle, readDocumentUrl) {
-        this.opts = opts;
-        this.lifecycle = lifecycle;
-        this.readDocumentUrl = readDocumentUrl;
-        lifecycle.setPreparationHandler(options => this.prepare(options));
-        lifecycle.abort.signal.addEventListener('abort', () => this.invalidate('cancelled'), { once: true });
-    }
-    async prepare(options) {
-        if (this.opts.stripeCheckout)
-            throw new CheckoutPreparationError(null, 'unsupported_processor');
-        options = { ...options };
-        if (this.state !== 'unused' || this.observedRequest || this.lifecycle.getState().status !== 'idle' || this.lifecycle.isBlocked()) {
-            // A late opt-in cannot turn the next native retry into ordinary approval.
-            // Preserve any existing authorization's state for reconciliation.
-            if (this.state === 'unused')
-                this.state = 'failed';
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'must_prepare_before_first_request');
-        }
-        // Reserve synchronously, including while origin discovery/OAuth is pending.
-        this.state = 'preparing';
-        this.lifecycle.preparing();
-        const signal = AbortSignal.any([this.stop.signal, this.lifecycle.abort.signal, ...(options?.signal ? [options.signal] : [])]);
-        const onAbort = () => this.invalidate('cancelled');
-        signal.addEventListener('abort', onAbort, { once: true });
-        try {
-            if (!options || !validPreparationEnvironment(options.psp, options.environment))
-                throw new CheckoutPreparationError(null, 'unsupported_processor');
-            // A Fiserv checkout's merchantProfile names a key pin, which prepareCheckout checks: its
-            // capture endpoint is checked below like any processor-hosted checkout's.
-            if (options.merchantProfile !== undefined && options.psp !== 'fiserv') {
-                // An Adyen merchant's own endpoint: a profile this build reviewed, which
-                // this attachment pauses, and one Agentcard turned on for this client.
-                const profile = typeof this.opts.vault.merchantProfile === 'function' && typeof options.merchantProfile === 'string'
-                    ? this.opts.vault.merchantProfile(options.merchantProfile) : null;
-                if (options.psp !== 'adyen')
-                    throw new CheckoutPreparationError(null, 'unsupported_processor');
-                if (!profile)
-                    throw new CheckoutPreparationError(null, 'processor_interception_unavailable');
-                if (profile.status !== 'enabled')
-                    throw new CheckoutPreparationError(null, 'unsupported_checkout');
-            }
-            else {
-                const tokenizer = preparationEndpoint(options.psp, options.environment);
-                if (!this.opts.vault.isCardRequest(tokenizer, 'POST'))
-                    throw new CheckoutPreparationError(null, 'processor_interception_unavailable');
-            }
-            if (!validAmountInput(this.opts.amount) || this.opts.amount === 0 || !/^[a-z]{3}$/i.test(this.opts.currency ?? ''))
-                throw new CheckoutPreparationError(null, 'amount_required');
-            if (signal.aborted)
-                throw new CheckoutPreparationError(null, 'cancelled');
-            this.documentUrl = await this.readDocument();
-            const page = new URL(this.documentUrl);
-            if (!(page.protocol === 'https:' || (page.protocol === 'http:' && page.hostname === 'localhost')) || page.username || page.password)
-                throw new CheckoutPreparationError(null, 'merchant_origin_invalid');
-            const prepared = await this.opts.vault.prepareCheckout({
-                ...options, user: this.opts.user, merchant: this.opts.merchant,
-                amount: this.opts.amount, currency: this.opts.currency, cardId: this.opts.cardId,
-                merchantOrigin: page.origin, checkoutKey: crypto.randomUUID(), timeoutMs: this.opts.timeoutMs, signal,
-                onPreparationCreated: id => this.lifecycle.preparationCreated(id),
-                onApprovalUrl: url => {
-                    if (!signal.aborted) {
-                        this.lifecycle.approvalUrl(url);
-                        try {
-                            Promise.resolve(this.opts.onApprovalUrl?.(url)).catch(() => { });
-                        }
-                        catch { /* observer only */ }
-                    }
-                },
-            });
-            this.prepared = prepared;
-            // A Fiserv preparation also names the key pin the cardholder approves (merchantProfile).
-            if (prepared.psp !== options.psp || prepared.environment !== options.environment
-                || prepared.merchantProfile !== options.merchantProfile)
-                throw new CheckoutPreparationError(prepared.id, 'checkout_changed');
-            if (signal.aborted || this.state !== 'preparing') {
-                void this.cancelThenObserve(prepared.id, 'cancelled');
-                throw new CheckoutPreparationError(prepared.id, 'cancelled');
-            }
-            await this.assertDocument();
-            if (signal.aborted || this.state !== 'preparing')
-                throw new CheckoutPreparationError(prepared.id, 'cancelled');
-            const remaining = Date.parse(prepared.expiresAt) - Date.now();
-            if (!(remaining > 0))
-                throw new CheckoutPreparationError(prepared.id, 'expired');
-            this.state = 'ready';
-            this.expiryTimer = setTimeout(() => this.invalidate('expired'), remaining);
-            this.expiryTimer.unref?.();
-            this.lifecycle.prepared(prepared);
-            return prepared;
-        }
-        catch (error) {
-            const failure = error instanceof CheckoutPreparationError ? error : new CheckoutPreparationError(this.prepared?.id ?? null, 'preparation_unconfirmed');
-            this.invalidate(failure.reason);
-            throw failure;
-        }
-        // Keep the signal listener after ready: caller cancellation retires the handle too.
-    }
-    /** Called for every recognized card mutation, before any await or local retry guard. */
-    claim(requestUrl, requestBody, requestHeaders) {
-        this.observedRequest = true;
-        if (this.state === 'unused')
-            return undefined;
-        if (this.state !== 'ready' || !this.prepared) {
-            this.invalidate(this.state === 'preparing' ? 'submitted_before_ready' : 'already_used_or_unavailable');
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'already_used_or_unavailable');
-        }
-        const prepared = this.prepared;
-        // A merchant-hosted preparation claims only its profile's reviewed card request.
-        // A Fiserv preparation claims only a capture under the key pin it names.
-        if (Date.parse(prepared.expiresAt) <= Date.now() || !matchesPreparation(prepared, requestUrl, 'POST', requestBody, requestHeaders)) {
-            const reason = Date.parse(prepared.expiresAt) <= Date.now() ? 'expired' : 'checkout_changed';
-            this.invalidate(reason);
-            throw new CheckoutPreparationError(prepared.id, reason);
-        }
-        this.state = 'consumed';
-        clearTimeout(this.expiryTimer);
-        return prepared;
-    }
-    async assertDocument() {
-        if (this.documentUrl && await this.readDocument() !== this.documentUrl)
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_changed');
-    }
-    async readDocument() {
-        const signal = AbortSignal.any([this.stop.signal, this.lifecycle.abort.signal, AbortSignal.timeout(5_000)]);
-        const failure = () => new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_unavailable');
-        if (signal.aborted)
-            throw failure();
-        let aborted;
-        const stopped = new Promise((_, reject) => {
-            aborted = () => reject(failure());
-            signal.addEventListener('abort', aborted, { once: true });
-        });
-        try {
-            return await Promise.race([this.readDocumentUrl(), stopped]);
-        }
-        finally {
-            signal.removeEventListener('abort', aborted);
-        }
-    }
-    isEngaged() { return this.state !== 'unused'; }
-    /**
-     * A card request that only a prepared checkout may pay (an Adyen merchant
-     * profile's, or a Fiserv card capture, pre-claim.ts) arrived with no
-     * preparation and was refused. Like claim() on an unused gate, a later
-     * prepare() is then refused too.
-     */
-    observeUnprepared() { this.observedRequest = true; }
-    retireUnboundClaim() {
-        if (this.state !== 'consumed' || !this.prepared || this.lifecycle.getState().authorizationId)
-            return;
-        void this.cancelThenObserve(this.prepared.id, 'request_not_bound');
-        // No bound ID means the adapter must not leave a spent handle appearing ready.
-        if (this.lifecycle.getState().status === 'ready_to_submit')
-            this.lifecycle.preparationFailed(new CheckoutPreparationError(this.prepared.id, 'request_not_bound'));
-    }
-    /** A bound native request has its own cancellation/unknown-outcome machinery. */
-    invalidate(reason) {
-        if (this.state === 'unused' || this.state === 'consumed' || this.state === 'failed')
-            return;
-        this.state = 'failed';
-        clearTimeout(this.expiryTimer);
-        this.stop.abort();
-        if (this.prepared)
-            void this.cancelThenObserve(this.prepared.id, reason);
-        this.lifecycle.preparationFailed(new CheckoutPreparationError(this.prepared?.id ?? null, reason));
-    }
-    /**
-     * Retire the server handle first, then report the form outcome. Neither
-     * call waits on the other: a stalled report cannot delay the cancel, and a
-     * stalled cancel cannot lose the report.
-     */
-    async cancelThenObserve(id, reason) {
-        const cancellation = this.opts.vault.cancelPreparation(id).catch(() => { });
-        const observation = this.opts.vault.observePreparation?.(id, this.observedRequest ? 'presented_not_filled' : 'not_presented', reason);
-        await Promise.all([cancellation, observation?.catch(() => { })]);
-    }
-}

package/dist/prepared-processor.d.ts

@@ -1,43 +0,0 @@
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv';
-export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
-/**
- * How the approved card reaches the processor: the device's own request (token), or
- * ciphertext the device produces for this browser to send (cse: Adyen's four encrypted
- * fields, or Fiserv's Secure Data Capture envelope under a key Agentcard pinned).
- */
-export type PreparationMode = 'token' | 'cse';
-export declare function preparationMode(psp: string): PreparationMode;
-/**
- * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
- * Adyen can: test and live are separate hosts and key prefixes. Fiserv's are separate
- * hosts too: connect (production) and connect-cert (sandbox).
- */
-export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
-export declare function preparationEndpoint(psp: PreparationProcessor, environment: PreparationEnvironment): string;
-/** Processor identity and environment are part of the device's prior consent. */
-export declare function matchesPreparedRequest(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, method: string, body?: string | null, headers?: Record<string, string>): boolean;
-/**
- * The one request a merchant-hosted preparation pays: the reviewed profile's
- * card request itself (classifyMerchantRequest pauses it), at the profile's exact
- * endpoint, as its method, with a body the profile reviewed. A sibling endpoint, a
- * stored card, a store-the-card body or any other shape never consumes consent.
- */
-export declare function matchesPreparedMerchantRequest(profileId: string, requestUrl: string, method: string, body?: string | null, sandboxDeclaration?: {
-    endpoint: string;
-}): boolean;
-/**
- * matchesPreparedRequest for a preparation, through its merchant profile (at its declared
- * endpoint, when it names one) when it names one. A Fiserv preparation also names the key its
- * cardholder approved a payment under (merchantProfile, a pin id): the capture's own pin,
- * the one its envelope's key is pinned as for its endpoint and merchant, must be that
- * pin, as the API's bind requires. Two pins in one environment (a merchant's old and new
- * keys during a rotation) never spend each other's approval. No other processor names one.
- */
-export declare function matchesPreparation(preparation: {
-    psp: PreparationProcessor;
-    environment: PreparationEnvironment;
-    merchantProfile?: string;
-    sandboxDeclaration?: {
-        endpoint: string;
-    };
-}, requestUrl: string, method: string, body?: string | null, headers?: Record<string, string>): boolean;

package/dist/prepared-processor.js

@@ -1,172 +0,0 @@
-import { paysafePreparationUrl, isPreparedPaysafeRequest } from './paysafe.generated.js';
-import { adyenPreparationUrl, isPreparedAdyenRequest } from './adyen.generated.js';
-import { braintreeEnvironment, isPreparedBraintreeRequest, readTokenizationJson } from './braintree.js';
-import { isPreparedRecurlyRequest } from './recurly.generated.js';
-import { isPreparedSpreedlyRequest, isSpreedlyTokenRequest, SPREEDLY_TOKEN_ENDPOINT } from './spreedly.generated.js';
-import { checkoutComPreparationUrl, isPreparedCheckoutComRequest } from './checkout-com.generated.js';
-import { classifyDeclaredMerchantRequest, classifyMerchantRequest } from './merchant-hosted.js';
-import { fiservCapturePinId, fiservPreparationUrl, isPreparedFiservRequest } from './fiserv.js';
-export function preparationMode(psp) {
-    return psp === 'adyen' || psp === 'fiserv' ? 'cse' : 'token';
-}
-/**
- * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
- * Adyen can: test and live are separate hosts and key prefixes. Fiserv's are separate
- * hosts too: connect (production) and connect-cert (sandbox).
- */
-export function validPreparationEnvironment(psp, environment) {
-    if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
-        return environment === 'shared';
-    return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv'].includes(psp) && ['production', 'sandbox'].includes(environment);
-}
-export function preparationEndpoint(psp, environment) {
-    if (!validPreparationEnvironment(psp, environment))
-        throw new Error('unsupported_preparation_processor');
-    if (psp === 'paysafe')
-        return paysafePreparationUrl(environment);
-    if (psp === 'fiserv')
-        return fiservPreparationUrl(environment);
-    if (psp === 'checkout_com')
-        return checkoutComPreparationUrl(environment);
-    if (psp === 'adyen')
-        return adyenPreparationUrl(environment);
-    if (psp === 'bambora')
-        return 'https://api.bam.shift4api.net/scripts/tokenization/tokens';
-    if (psp === 'mercado_pago')
-        return 'https://api.mercadopago.com/v1/card_tokens';
-    if (psp === 'recurly')
-        return 'https://api.recurly.com/js/v1/token';
-    if (psp === 'spreedly')
-        return SPREEDLY_TOKEN_ENDPOINT;
-    if (psp === 'worldpay')
-        return environment === 'production'
-            ? 'https://access.worldpay.com/sessions/card' : 'https://try.access.worldpay.com/sessions/card';
-    if (psp === 'braintree')
-        return environment === 'production'
-            ? 'https://payments.braintree-api.com/graphql' : 'https://payments.sandbox.braintree-api.com/graphql';
-    return environment === 'production'
-        ? 'https://pci-connect.squareup.com/v2/card-nonce' : 'https://pci-connect.squareupsandbox.com/v2/card-nonce';
-}
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-const keys = (value, allowed) => Object.keys(value).every(key => allowed.includes(key));
-const string = (value, max = 1024) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-const digits = (value, min, max) => typeof value === 'string' && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
-const month = (value) => (typeof value === 'number' && Number.isInteger(value) || digits(value, 1, 2)) && Number(value) >= 1 && Number(value) <= 12;
-const year = (value) => (typeof value === 'number' && Number.isInteger(value) || digits(value, 2, 4)) && (Number(value) >= 0 && Number(value) <= 99 || Number(value) >= 2000 && Number(value) <= 9999);
-/** Native fresh-card shapes only. Saved-card, charge and recurring siblings never consume consent. */
-function freshCardBody(psp, body) {
-    const value = readTokenizationJson(body);
-    if (!value)
-        return false;
-    if (psp === 'worldpay')
-        return keys(value, ['identity', 'cardNumber', 'cardExpiryDate', 'cvc'])
-            && string(value.identity) && digits(value.cardNumber, 12, 19)
-            && record(value.cardExpiryDate) && keys(value.cardExpiryDate, ['month', 'year'])
-            && month(value.cardExpiryDate.month) && year(value.cardExpiryDate.year)
-            && (value.cvc === undefined || digits(value.cvc, 3, 4));
-    if (psp === 'bambora')
-        return keys(value, ['number', 'expiry_month', 'expiry_year', 'cvd'])
-            && digits(value.number, 12, 19) && month(value.expiry_month) && year(value.expiry_year)
-            && (value.cvd === undefined || digits(value.cvd, 3, 4));
-    if (psp !== 'mercado_pago' || !keys(value, ['card_number', 'expiration_month', 'expiration_year', 'security_code', 'cardholder', 'device'])
-        || !digits(value.card_number, 12, 19) || !month(value.expiration_month) || !year(value.expiration_year)
-        || (value.security_code !== undefined && value.security_code !== '' && !digits(value.security_code, 3, 4)) || !record(value.cardholder)
-        || !keys(value.cardholder, ['name', 'identification']))
-        return false;
-    const holder = value.cardholder;
-    if (holder.name !== undefined && holder.name !== '' && !string(holder.name))
-        return false;
-    if (holder.identification !== undefined && (!record(holder.identification) || !keys(holder.identification, ['type', 'number'])
-        || Object.values(holder.identification).some(v => v !== '' && !string(v))))
-        return false;
-    if (value.device !== undefined && (!record(value.device) || !keys(value.device, ['meli'])
-        || !record(value.device.meli) || !keys(value.device.meli, ['session_id']) || !string(value.device.meli.session_id, 4096)))
-        return false;
-    return true;
-}
-/** Processor identity and environment are part of the device's prior consent. */
-export function matchesPreparedRequest(psp, environment, requestUrl, method, body, headers) {
-    if (method.toUpperCase() !== 'POST' || !validPreparationEnvironment(psp, environment))
-        return false;
-    if (psp === 'paysafe')
-        return isPreparedPaysafeRequest(requestUrl, method, body ?? null, environment, headers);
-    // Fiserv: that environment's card-capture endpoint exactly, the capture rules on the whole
-    // request (missing headers refuse), and an envelope under a key pinned for that environment
-    // and for the merchant the body names (payment-core isPreparedFiservRequest).
-    if (psp === 'fiserv')
-        return isPreparedFiservRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers);
-    if (psp === 'checkout_com')
-        return isPreparedCheckoutComRequest(requestUrl, method, body ?? null, environment, headers);
-    if (psp === 'adyen')
-        return isPreparedAdyenRequest(requestUrl, method, body ?? null, environment);
-    if (psp === 'braintree')
-        return braintreeEnvironment(requestUrl) === environment && isPreparedBraintreeRequest(body ?? null);
-    if (psp === 'spreedly')
-        return isSpreedlyTokenRequest(requestUrl, method) && isPreparedSpreedlyRequest(body ?? null);
-    try {
-        const request = new URL(requestUrl), endpoint = new URL(preparationEndpoint(psp, environment));
-        if (request.username || request.password || request.hash)
-            return false;
-        if (psp === 'recurly')
-            return [endpoint.href, 'https://api.eu.recurly.com/js/v1/token'].includes(requestUrl)
-                && isPreparedRecurlyRequest(body ?? null);
-        if (psp === 'bambora') {
-            if (![endpoint.href, 'https://api.na.bambora.com/scripts/tokenization/tokens'].includes(requestUrl))
-                return false;
-        }
-        else if (psp === 'worldpay') {
-            if (requestUrl !== endpoint.href)
-                return false;
-        }
-        else if (request.origin !== endpoint.origin || request.pathname !== endpoint.pathname)
-            return false;
-        if (psp === 'mercado_pago') {
-            const names = [...request.searchParams.keys()];
-            if (new Set(names).size !== names.length || names.some(name => !['public_key', 'locale', 'js_version', 'referer'].includes(name)))
-                return false;
-        }
-        return psp === 'square' || freshCardBody(psp, body ?? null);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * The one request a merchant-hosted preparation pays: the reviewed profile's
- * card request itself (classifyMerchantRequest pauses it), at the profile's exact
- * endpoint, as its method, with a body the profile reviewed. A sibling endpoint, a
- * stored card, a store-the-card body or any other shape never consumes consent.
- */
-export function matchesPreparedMerchantRequest(profileId, requestUrl, method, body, sandboxDeclaration) {
-    try {
-        const verdict = sandboxDeclaration
-            ? classifyDeclaredMerchantRequest(profileId, sandboxDeclaration.endpoint, requestUrl, method, body ?? '')
-            : classifyMerchantRequest(profileId, requestUrl, method, body ?? '');
-        return verdict.verdict === 'pause';
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * matchesPreparedRequest for a preparation, through its merchant profile (at its declared
- * endpoint, when it names one) when it names one. A Fiserv preparation also names the key its
- * cardholder approved a payment under (merchantProfile, a pin id): the capture's own pin,
- * the one its envelope's key is pinned as for its endpoint and merchant, must be that
- * pin, as the API's bind requires. Two pins in one environment (a merchant's old and new
- * keys during a rotation) never spend each other's approval. No other processor names one.
- */
-export function matchesPreparation(preparation, requestUrl, method, body, headers) {
-    if (preparation.psp === 'fiserv') {
-        if (!matchesPreparedRequest(preparation.psp, preparation.environment, requestUrl, method, body, headers))
-            return false;
-        return typeof preparation.merchantProfile === 'string' && fiservCapturePinId(requestUrl, body ?? null) === preparation.merchantProfile;
-    }
-    if (preparation.merchantProfile !== undefined) {
-        return preparation.psp === 'adyen'
-            && matchesPreparedMerchantRequest(preparation.merchantProfile, requestUrl, method, body, preparation.sandboxDeclaration);
-    }
-    return matchesPreparedRequest(preparation.psp, preparation.environment, requestUrl, method, body, headers);
-}

package/dist/recurly.generated.d.ts

@@ -1 +0,0 @@
-export declare function isPreparedRecurlyRequest(body: string | null): boolean;

package/dist/recurly.generated.js

@@ -1,87 +0,0 @@
-// Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 6a1932841621aca1a7371165e0b54a161c4dd5bb077acc190a0c5399229fa350
-/** Normal Recurly.js 4 new-card POST, before it consumes an approval.
- * Native fields and indexed form serialization: recurly/recurly-js commit
- * 7cd9a2b131bf12d7cebfbc7eea1ba86aa54c60e7, lib/recurly/{token,request,fraud}.js
- * and risk/{risk,three-d-secure/three-d-secure}.js. Worldpay and Cybersource
- * risk sessions depend on the original card; proactive Braintree also produces
- * another token type. All nonempty risk results are refused until collection
- * can use the approved card. This function never rewrites the body.
- */
-const SCALARS = new Set(['number', 'month', 'year', 'cvv', 'type', 'key', 'version', 'deviceId', 'sessionId', 'instanceId',
-    'first_name', 'last_name', 'address1', 'address2', 'company', 'country', 'city', 'state', 'postal_code', 'phone',
-    'vat_number', 'tax_identifier', 'tax_identifier_type', 'fraud_session_id', 'card_network_preference']);
-const BROWSER = new Set(['color_depth', 'java_enabled', 'language', 'referrer_url', 'screen_height', 'screen_width', 'time_zone_offset', 'user_agent']);
-const FRAUD_PROCESSORS = new Set(['kount', 'litle_threat_metrix', 'braintree', 'fraudnet']);
-const contiguous = (values) => [...values.keys()].sort((a, b) => Number(a) - Number(b)).every((value, index) => value === String(index));
-export function isPreparedRecurlyRequest(body) {
-    if (typeof body !== 'string' || !body || body.length > 65536)
-        return false;
-    const chunks = body.split('&');
-    if (chunks.length > 200)
-        return false;
-    const fields = new Map();
-    const fraud = new Map();
-    try {
-        for (const chunk of chunks) {
-            const separator = chunk.indexOf('=');
-            if (separator < 1)
-                return false;
-            const name = decodeURIComponent(chunk.slice(0, separator).replace(/\+/g, ' '));
-            const value = decodeURIComponent(chunk.slice(separator + 1).replace(/\+/g, ' '));
-            if (fields.has(name) || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value))
-                return false;
-            fields.set(name, value);
-            if (SCALARS.has(name))
-                continue;
-            const browser = /^browser\[([a-z_]+)\]$/.exec(name);
-            if (browser && BROWSER.has(browser[1]))
-                continue;
-            const structured = /^fraud\[([0-9]|1[0-9])\]\[(.+)\]$/.exec(name);
-            if (!structured)
-                return false;
-            const [, index, leaf] = structured;
-            if (!['processor', 'session_id'].includes(leaf) && !/^udf\]\[([0-9]|1[0-9])\]\[(label|value)$/.test(leaf))
-                return false;
-            if (!fraud.has(index))
-                fraud.set(index, new Map());
-            fraud.get(index).set(leaf, value);
-        }
-    }
-    catch {
-        return false;
-    }
-    const number = fields.get('number') ?? '', month = fields.get('month') ?? '', year = fields.get('year') ?? '';
-    if (!/^[0-9]{12,19}$/.test(number) || !/^[0-9]{1,2}$/.test(month) || Number(month) < 1 || Number(month) > 12
-        || !/^(?:[0-9]{2}|20[0-9]{2})$/.test(year))
-        return false;
-    if (fields.has('cvv') && fields.get('cvv') !== '' && !/^[0-9]{3,4}$/.test(fields.get('cvv')))
-        return false;
-    if (fields.has('type') && fields.get('type') !== 'credit_card')
-        return false;
-    // A co-badged network choice belongs to the entered card's supported brands.
-    if (fields.get('card_network_preference'))
-        return false;
-    if (fields.has('key') && !fields.get('key')?.trim())
-        return false;
-    if (!contiguous(fraud))
-        return false;
-    for (const item of fraud.values()) {
-        if (!FRAUD_PROCESSORS.has(item.get('processor') ?? '') || !item.get('session_id'))
-            return false;
-        const udf = new Map();
-        for (const key of item.keys()) {
-            const field = /^udf\]\[([0-9]|1[0-9])\]\[(label|value)$/.exec(key);
-            if (!field)
-                continue;
-            if (item.get('processor') !== 'kount')
-                return false;
-            if (!udf.has(field[1]))
-                udf.set(field[1], new Set());
-            udf.get(field[1]).add(field[2]);
-        }
-        if (!contiguous(udf) || [...udf.values()].some(keys => keys.size !== 2))
-            return false;
-    }
-    return true;
-}