@agent-cards/sdk 0.20.0 → 0.22.0

package/dist/gmo.js

@@ -0,0 +1,119 @@
+// GMO Payment Gateway, PG Multipayment token v2 (mp-token.js), as the SDK sees it.
+//
+// A GMO merchant page that calls Multipayment.init(shopId) with one argument (teamLab's ticket
+// sites do) sends the card as mp-token.js's getToken: one fetch POST to
+// https://token.mul-pay.jp/payment/CreateToken.json (test host stg.token.mul-pay.jp), as
+// application/json with X-MP-Client-Type: js-legacy, whose body is AES ciphertext of the card with
+// its key wrapped under GMO's shared public key. The agent's page encrypts the placeholder card, so
+// nothing in the paused body can be filled in. The cardholder's device rebuilds the whole envelope
+// with the real card and sends it to GMO itself, and the page receives only GMO's answer: one
+// single-use token, valid 30 minutes and spendable only by the shop's own site (token mode).
+//
+// The registry entry ships dark (capability gmo_shared_pk). This build declares the capability on
+// syncRegistry, and the API serves the entry only to an org Agentcard enabled for GMO, so for every
+// other org nothing here fires: isCardRequest never recognizes a GMO URL and GMO's requests go
+// through untouched, exactly as before.
+//
+// For an org in the dark launch, a POST the registry recognizes on a GMO token host is judged by
+// payment-core's one guard (gmo.generated.ts isGmoSharedPkRequest), the check the API runs at
+// create and the device runs before it rebuilds anything:
+//   - mp-token.js's SHARED_PK getToken for one token pauses for approval;
+//   - anything else on that URL can never be paid by the vault: UNIQUE_PK (a merchant-registered
+//     key nobody can check), GMO Elements (js-iframe), several tokens, a shop id of the other
+//     environment's shape, or any serialization mp-token.js does not write. It is aborted as an
+//     unsupported checkout before any create or prompt.
+// Token v1 (ext/js/token.js) sends the card as a JSONP GET that no vault mode covers. It is aborted
+// the same way, so the placeholder is never tokenized silently.
+import { GMO_PSP, GMO_TOKEN_URLS, isGmoSharedPkRequest, isGmoTokenHost, sanitizeGmoTokenResponse, } from './gmo.generated.js';
+export { GMO_PSP, isGmoTokenHost };
+/** The dark-launch capability a build declares when it pauses only what isGmoSharedPkRequest accepts. */
+export const GMO_CAPABILITY = 'gmo_shared_pk';
+/** The hosts GMO token v1 (ext/js/token.js) sends its JSONP GET to: production, then test. */
+const GMO_TOKEN_V1_HOSTS = ['p01.mul-pay.jp', 'stg.token.mul-pay.jp'];
+const GMO_TOKEN_V1_PATH = '/ext/api/gettoken';
+/**
+ * Fetch interception patterns for GMO token v1's JSONP GET, armed only for an org the API served GMO
+ * to. A CDP pattern matches the URL as written, path case included, while isGmoTokenV1Request
+ * accepts any path case, a trailing dot on the host and any port. So each v1 host is armed whole,
+ * in those four spellings, and the pre-claim gate classifies every paused request with
+ * isGmoTokenV1Request: the v1 GET is aborted, and anything else on the host continues untouched.
+ * Chrome writes the host in lower case, and it blocks a subresource URL that carries credentials.
+ */
+export const GMO_TOKEN_V1_PATTERNS = GMO_TOKEN_V1_HOSTS.flatMap((host) => [`https://${host}/*`, `https://${host}:*`, `https://${host}./*`, `https://${host}.:*`]);
+/**
+ * Whether the vault's current registry recognizes GMO's card request: true only after
+ * syncRegistry() for an org the API serves the dark entry to.
+ */
+export function recognizesGmo(vault) {
+    if (!vault || typeof vault.isCardRequest !== 'function')
+        return false;
+    try {
+        return vault.isCardRequest(GMO_TOKEN_URLS.production, 'POST') || vault.isCardRequest(GMO_TOKEN_URLS.sandbox, 'POST');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * GMO token v1's card request: a GET (or, with no method, a URL a route matcher is asked about)
+ * to /ext/api/getToken on either v1 host, in any case or with a trailing dot, since the servers
+ * behind it need not care.
+ */
+export function isGmoTokenV1Request(rawUrl, method) {
+    if (method !== undefined && method.toUpperCase() !== 'GET')
+        return false;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:')
+        return false;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return GMO_TOKEN_V1_HOSTS.includes(host) && url.pathname.toLowerCase() === GMO_TOKEN_V1_PATH;
+}
+/**
+ * Whether a POST the registry recognized on a GMO token host is anything but mp-token.js's
+ * SHARED_PK getToken for one token: null when the guard accepts it (it pauses for approval), else
+ * the reason it is aborted. A guard that throws refuses.
+ */
+export function gmoRequestRefusal(request) {
+    try {
+        return isGmoSharedPkRequest({ url: request.url, method: request.method.toUpperCase(), headers: request.headers ?? {}, body: request.body })
+            ? null : 'unsupported_gmo_request';
+    }
+    catch {
+        return 'unsupported_gmo_request';
+    }
+}
+/**
+ * The shop a GMO token request names (encryptionParameters.apiKey), as part of that request's
+ * identity. GMO mints a token for that one shop, so a retry that names another shop is a new
+ * question and never takes the first request's approval. Undefined when the URL is not a GMO token
+ * host; null when the body names no shop that can be read.
+ */
+export function gmoRequestShop(url, body) {
+    if (!isGmoTokenHost(url))
+        return undefined;
+    try {
+        const shop = JSON.parse(body)?.encryptionParameters?.apiKey;
+        return typeof shop === 'string' ? shop : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The only answer the page may receive for an approved GMO request: status 200, and GMO's body
+ * reduced to the five fields mp-token.js reads with exactly one 64-hex token
+ * (sanitizeGmoTokenResponse), under a JSON content type. Null for anything else, including
+ * several tokens, which one approval never pays for.
+ */
+export function gmoTokenAnswer(status, body) {
+    if (status !== 200)
+        return null;
+    const sanitized = sanitizeGmoTokenResponse(body);
+    return sanitized ? { status: 200, headers: { 'content-type': 'application/json' }, body: sanitized } : null;
+}

package/dist/hosted-form.d.ts

@@ -2,8 +2,9 @@
  * The hosted_form half of a replay: what the paused navigation is resolved
  * with once the cardholder's device has submitted the processor's own form.
  *
- * On a hosted-form processor (Tranzila) the paused request is a top-level
- * form navigation inside the processor's iframe, not an XHR. The cardholder's
+ * On a hosted-form processor (Tranzila, Authorize.Net DPM and SIM) the paused
+ * request is a form navigation inside a frame, not an XHR: the processor's own
+ * form, or the merchant's form that posts to the processor. The cardholder's
  * device rebuilds that form with the real card and submits it itself, so the
  * processor's answer (approved, declined) is shown on the device and reaches
  * the merchant from the processor. The agent's browser never gets it.

package/dist/hosted-form.js

@@ -2,8 +2,9 @@
  * The hosted_form half of a replay: what the paused navigation is resolved
  * with once the cardholder's device has submitted the processor's own form.
  *
- * On a hosted-form processor (Tranzila) the paused request is a top-level
- * form navigation inside the processor's iframe, not an XHR. The cardholder's
+ * On a hosted-form processor (Tranzila, Authorize.Net DPM and SIM) the paused
+ * request is a form navigation inside a frame, not an XHR: the processor's own
+ * form, or the merchant's form that posts to the processor. The cardholder's
  * device rebuilds that form with the real card and submits it itself, so the
  * processor's answer (approved, declined) is shown on the device and reaches
  * the merchant from the processor. The agent's browser never gets it.

package/dist/index.d.ts

@@ -1,9 +1,22 @@
 export { Agentcard, Agentcard as VaultClient, CheckoutModule } from './agentcard.js';
 export type { CheckoutAttachOptions } from './agentcard.js';
-export { CardEncryptedError, UnsupportedModeError, PreparationRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, } from './client.js';
-export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, } from './client.js';
+export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
+export type { GmoUnsupportedReason } from './gmo.js';
+export type { DatatransRefusalReason } from './datatrans.js';
+export type { PelecardRefusalReason } from './pelecard.js';
+export type { PrimerUnsupportedReason, PrimerBlockedReason } from './primer.js';
+export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
+export type { ConvergeRefusalReason } from './elavon-converge.js';
+export type { WspayRefusalReason } from './wspay.js';
+export type { ShijiStsUnsupportedReason } from './shiji-sts.js';
+export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, VerifoneReplay, HostedFormReplay, CardEndpointReplay, DeviceEncryptReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, PlaceholderCard, } from './client.js';
+export type { MicroformField, MicroformSidecar } from './cybersource-flex.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
+export { CardEndpointRefusedError, cardEndpointPatterns } from './card-endpoint.js';
+export { MerchantSessionRefusedError, captureMerchantSession, merchantSessionCapture, merchantSessionReadUrl } from './merchant-session-probe.js';
+export type { MerchantSessionCapture, MerchantSessionCookie, MerchantSessionCdp, MerchantSessionRefusal } from './merchant-session-probe.js';
+export type { CardEndpointRefusal, CardEndpointSession, CardEndpointCookie } from './card-endpoint.js';
 export type { CdpLike, AttachOptions, CorsOutcome } from './cdp.js';
 export type { StripeCheckoutOptions, StripeCheckoutBlockedDetail, StripeCheckoutBlockStage, StripeCheckoutBlockReason } from './stripe-checkout.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
@@ -13,10 +26,13 @@ export type { MerchantProfile, MerchantProfileStatus, MerchantRequestVerdict, Me
 export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
 export type { MerchantAmountCard, MerchantExchange, MerchantRequestSeen, MerchantTotalApproved, MerchantTotalCapture, MerchantTotalScope } from './merchant-total.js';
 export { substituteFiservEnvelope } from './fiserv.js';
+export { classifyVerifoneProfileRequest, substituteVerifoneBody } from './verifone.js';
+export type { VerifoneProfile, VerifoneProfileStatus, VerifoneRequestVerdict, VerifoneSubstitutions } from './verifone.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export type { HostedFormSubmittedPageInput, SyntheticPage } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer, isLoopbackUrl, LOOPBACK_URL_PATTERNS } from './registry.js';
 export type { Recognizer, CheckoutMode, RecognizerOptions } from './registry.js';
+export type { PayrailsSidecar, PayrailsUnsupportedReason } from './payrails.js';
 export type { CheckoutController, CheckoutState, MerchantResult, MerchantPaymentConfirmation, UserAction, LifecycleOptions, PaymentEndpointGuard, PausedCheckout, ResumeResult } from './lifecycle.js';
 export { RequestRegistry, BUILTIN_REQUEST_BUILDERS, stripePaymentIntentConfirm, stripePaymentIntentConfirmRequest, stripeCardTokenRequest, stripePaymentMethodRequest } from './requests.js';
 export type { RequestBuilder, BuildInput, MintedIntent } from './requests.js';
@@ -32,6 +48,6 @@ export type { WebhookEvent, AgentcardEvent, CheckoutAuthorizationEvent, Checkout
 export { readReturnLink } from './voice-pkce.js';
 export type { PkceCrypto } from './voice-pkce.js';
 export { AgentcardError } from './voice-types.js';
-export type { Lang, VoiceAsk, ApprovalPosture, Action, ConnectInput, ConnectResult, Connected, Person, Proposed, Done, ActionState, CreateAuthorizationInput, AuthorizationStatus, Authorization, VoiceResetInput, VoiceChallenge, AuthorizationResult, Verdict, AuthorizationDetail, Exchanged, ExchangeInput, Revoked, TerminalReason, DeliveryChannel, InteractionEvidence, Intent, ApprovalRequestFields, CancelReason, Cancelled, Settlement, SessionState, ReturnLink, VoiceResetOutcome, VaultSessionStep, HostApprovalBundle, AppVoiceKeyDescription, RegisteredAppVoiceKey, RevokedAppVoiceKey, PayingCard, ChoosableCard, } from './voice-types.js';
+export type { Lang, VoiceAsk, ApprovalPosture, Action, ConnectInput, ConnectResult, Connected, Person, Proposed, Done, ActionState, CreateAuthorizationInput, AuthorizationStatus, Authorization, VoiceResetInput, VoiceChallenge, AuthorizationResult, Verdict, AuthorizationDetail, Exchanged, ExchangeInput, Revoked, TerminalReason, DeliveryChannel, InteractionEvidence, Intent, ApprovalRequestFields, CancelReason, Cancelled, Settlement, SessionState, ReturnLink, VoiceResetOutcome, VaultSessionStep, HostApprovalBundle, AppVoiceKeyDescription, HardwareAttestation, RegisteredAppVoiceKey, RevokedAppVoiceKey, PayingCard, ChoosableCard, } from './voice-types.js';
 export { openStream, streamBuffer } from './voice-stream.generated.js';
 export type { Hearing, StreamFormat, StreamHandle, StreamInput, StreamVerdict, ChannelKind } from './voice-stream.generated.js';

package/dist/index.js

@@ -1,14 +1,19 @@
 // The one client and its modules. `VaultClient` is the client's older name and
 // stays importable for one release; it constructs the same object.
 export { Agentcard, Agentcard as VaultClient, CheckoutModule } from './agentcard.js';
-export { CardEncryptedError, UnsupportedModeError, PreparationRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, } from './client.js';
+export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
+export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
+export { CardEndpointRefusedError, cardEndpointPatterns } from './card-endpoint.js';
+// The merchant-session probe's capture (the deterministic merchant total, phase 0): no card, no Pay.
+export { MerchantSessionRefusedError, captureMerchantSession, merchantSessionCapture, merchantSessionReadUrl } from './merchant-session-probe.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
 export { classifyDeclaredMerchantRequest, classifyMerchantRequest, substituteMerchantHostedBody } from './merchant-hosted.js';
 // The merchant's own total for a raw CDP runtime that intercepts on its own (merchant-total.ts).
 export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
 export { substituteFiservEnvelope } from './fiserv.js';
+export { classifyVerifoneProfileRequest, substituteVerifoneBody } from './verifone.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer, isLoopbackUrl, LOOPBACK_URL_PATTERNS } from './registry.js';
 // The request builders: `agentcard.checkout.requests`, and the shipped builders as functions.

package/dist/juspay-gate.d.ts

@@ -0,0 +1,82 @@
+export declare const JUSPAY_PSP = "juspay";
+/** The capability the API serves the Juspay recognizer behind (payment-core definitions.js). */
+export declare const JUSPAY_CAPABILITY = "juspay_txns.v1";
+/**
+ * Fetch.enable globs for every host the gate judges. The registry arms api.juspay.in and
+ * sandbox.juspay.in already; api.juspay.io and api-ns1.juspay.in are Juspay's too and in no
+ * recognizer, so without these a card request there would never pause to be refused.
+ */
+export declare const JUSPAY_URL_PATTERNS: readonly string[];
+/** The request a gate judges: the pre-claim context's own shape (body null when the adapter could not read it). */
+export interface JuspayRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string | null;
+}
+/** payment-core classifyJuspayRequest's verdict. `reason` is its fixed vocabulary; nothing the page wrote is echoed. */
+export type JuspayDecision = {
+    decision: 'answer_tokenize';
+    reason: string;
+    host: string;
+    merchantId: string;
+} | {
+    decision: 'pause' | 'continue' | 'abort';
+    reason: string;
+};
+export declare class JuspayCheckoutGate {
+    private readonly vault;
+    /** Each synthetic token this attachment answered a tokenize with, and the host and merchant it answered. */
+    private readonly issued;
+    constructor(vault: {
+        isCardRequest(url: string, method?: string): boolean;
+    } | undefined);
+    /** On while the registry recognizes a Juspay /txns: after a sync that declared juspay_txns.v1, for an org Juspay is on for. */
+    isEnabled(): boolean;
+    /** Whether this URL is on a Juspay host the gate judges: the Playwright route matcher's test. */
+    matches(url: string): boolean;
+    /** The Fetch.enable globs the CDP adapter arms beside the registry's own, while the gate is on. */
+    urlPatterns(): string[];
+    /**
+     * The verdict on a request, or null when it is not on a Juspay host or the gate is off. A POST
+     * whose body the adapter could not read (CDP reported one without its bytes, or Playwright
+     * reported the page's empty form post as no body) is judged as having no body by the classifier,
+     * so it passes only as this checkout's own pay/start redirect: a link an allowlisted answer names,
+     * on a host, and for the v2 link a merchant, that a token in `issued` was answered for. Anything
+     * else is refused for that request alone.
+     */
+    classify(request: JuspayRequest): JuspayDecision | null;
+    /**
+     * Mint the synthetic token a placeholder tokenize is answered with, from 16 bytes of this
+     * runtime's cryptographic randomness, and remember it for the /txns that follows. It names no
+     * card and Juspay never issued it, so it pays nothing anywhere.
+     */
+    issue(host: string, merchantId: string): {
+        token: string;
+        response: {
+            status: number;
+            headers: Record<string, string>;
+            body: string;
+        };
+    };
+    /** A token whose answer never reached the page: no /txns may pause on it. */
+    forget(token: string): void;
+    /**
+     * Whether an approval must end with the request that raised it. Every Juspay /txns names its
+     * own order_id, and a page that clicks Pay again creates a new order, so an approval for one
+     * order never answers another order's request.
+     */
+    bindsApproval(url: string, method: string): boolean;
+}
+/**
+ * The answer an approved Juspay /txns hands the page, or null. Only a 200 in the allowlisted
+ * shape passes (payment-core sanitizeJuspayTxnsResponse against the paused request: the paused
+ * order, a status Juspay approves with, and the bank's pay/start redirect on the paused host with
+ * no card token and no card number anywhere), and it is re-serialized here, so a field the API
+ * stored beyond that shape never reaches the page.
+ */
+export declare function juspayPageAnswer(status: number, body: string, request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+}): string | null;

package/dist/juspay-gate.js

@@ -0,0 +1,126 @@
+// Juspay Express Checkout in the checkout SDK: what one attachment keeps between the requests of
+// the card flow Swiggy web ships. payment-core's juspay.js holds the protocol and its rules
+// (vendored unchanged as juspay.generated.ts); nothing here decides what a body means.
+//
+// Swiggy's page sends the card in two form POSTs from its own document: /card/tokenize with the
+// card, then /txns with the token Juspay returned and the CVV again. A real token needs no
+// merchant secret and pays any order of that merchant for 15 minutes, so the agent's page must
+// never hold one, and the agent's placeholder must never reach Juspay. The SDK therefore answers
+// the placeholder tokenize itself, with a synthetic ctkn_agentcard token minted here and
+// remembered with the host and merchant it was minted for, and pauses only the /txns that carries
+// one of those tokens. The cardholder's device then sends both real requests, and the page
+// receives the allowlisted /txns answer (juspayPageAnswer).
+//
+// Dark launch: the gate is on only while the registry this attachment runs on recognizes a
+// Juspay /txns, which the API serves to a build that declares juspay_txns.v1 on syncRegistry(),
+// and only for an org Agentcard turned Juspay on for. Off, every request to a Juspay host is
+// handled exactly as it was before this module existed.
+import { classifyJuspayRequest, juspaySyntheticToken, juspayTokenizeAnswer, sanitizeJuspayTxnsResponse, JUSPAY_API_HOSTS, JUSPAY_SIBLING_HOSTS, } from './juspay.generated.js';
+export const JUSPAY_PSP = 'juspay';
+/** The capability the API serves the Juspay recognizer behind (payment-core definitions.js). */
+export const JUSPAY_CAPABILITY = 'juspay_txns.v1';
+const HOSTS = [...JUSPAY_API_HOSTS, ...JUSPAY_SIBLING_HOSTS];
+/**
+ * Fetch.enable globs for every host the gate judges. The registry arms api.juspay.in and
+ * sandbox.juspay.in already; api.juspay.io and api-ns1.juspay.in are Juspay's too and in no
+ * recognizer, so without these a card request there would never pause to be refused.
+ */
+export const JUSPAY_URL_PATTERNS = HOSTS.map((host) => `*${host}*`);
+/** The /txns of each environment: the registry recognizing either one is what turns the gate on. */
+const TXNS_URLS = JUSPAY_API_HOSTS.map((host) => `https://${host}/txns`);
+/** Synthetic tokens one attachment remembers; past this, the oldest is forgotten first. */
+const MAX_ISSUED = 64;
+/** A Juspay host, in any letter case and with any trailing dot, which DNS reads as the same host. */
+function juspayHost(url) {
+    try {
+        return HOSTS.includes(new URL(url).hostname.toLowerCase().replace(/\.+$/, ''));
+    }
+    catch {
+        return false;
+    }
+}
+export class JuspayCheckoutGate {
+    vault;
+    /** Each synthetic token this attachment answered a tokenize with, and the host and merchant it answered. */
+    issued = new Map();
+    constructor(vault) {
+        this.vault = vault;
+    }
+    /** On while the registry recognizes a Juspay /txns: after a sync that declared juspay_txns.v1, for an org Juspay is on for. */
+    isEnabled() {
+        try {
+            return TXNS_URLS.some((url) => this.vault?.isCardRequest(url, 'POST') === true);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Whether this URL is on a Juspay host the gate judges: the Playwright route matcher's test. */
+    matches(url) {
+        return juspayHost(url) && this.isEnabled();
+    }
+    /** The Fetch.enable globs the CDP adapter arms beside the registry's own, while the gate is on. */
+    urlPatterns() {
+        return this.isEnabled() ? [...JUSPAY_URL_PATTERNS] : [];
+    }
+    /**
+     * The verdict on a request, or null when it is not on a Juspay host or the gate is off. A POST
+     * whose body the adapter could not read (CDP reported one without its bytes, or Playwright
+     * reported the page's empty form post as no body) is judged as having no body by the classifier,
+     * so it passes only as this checkout's own pay/start redirect: a link an allowlisted answer names,
+     * on a host, and for the v2 link a merchant, that a token in `issued` was answered for. Anything
+     * else is refused for that request alone.
+     */
+    classify(request) {
+        if (!this.matches(request.url))
+            return null;
+        const decision = classifyJuspayRequest(request, this.issued);
+        if (decision && request.body === null && String(request.method).toUpperCase() === 'POST'
+            && !(decision.decision === 'continue' && decision.reason === 'pay_start')) {
+            return { decision: 'abort', reason: 'request_body_unreadable' };
+        }
+        return decision;
+    }
+    /**
+     * Mint the synthetic token a placeholder tokenize is answered with, from 16 bytes of this
+     * runtime's cryptographic randomness, and remember it for the /txns that follows. It names no
+     * card and Juspay never issued it, so it pays nothing anywhere.
+     */
+    issue(host, merchantId) {
+        const token = juspaySyntheticToken(crypto.getRandomValues(new Uint8Array(16)));
+        if (this.issued.size >= MAX_ISSUED)
+            this.issued.delete(this.issued.keys().next().value);
+        this.issued.set(token, { host, merchantId });
+        return { token, response: juspayTokenizeAnswer(token) };
+    }
+    /** A token whose answer never reached the page: no /txns may pause on it. */
+    forget(token) {
+        this.issued.delete(token);
+    }
+    /**
+     * Whether an approval must end with the request that raised it. Every Juspay /txns names its
+     * own order_id, and a page that clicks Pay again creates a new order, so an approval for one
+     * order never answers another order's request.
+     */
+    bindsApproval(url, method) {
+        return String(method).toUpperCase() === 'POST' && this.matches(url);
+    }
+}
+/**
+ * The answer an approved Juspay /txns hands the page, or null. Only a 200 in the allowlisted
+ * shape passes (payment-core sanitizeJuspayTxnsResponse against the paused request: the paused
+ * order, a status Juspay approves with, and the bank's pay/start redirect on the paused host with
+ * no card token and no card number anywhere), and it is re-serialized here, so a field the API
+ * stored beyond that shape never reaches the page.
+ */
+export function juspayPageAnswer(status, body, request) {
+    if (status !== 200)
+        return null;
+    // No token argument: like the API, the SDK never holds the real token the device's tokenize returned.
+    try {
+        return sanitizeJuspayTxnsResponse(body, request, undefined);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/juspay.generated.d.ts

@@ -0,0 +1,89 @@
+declare var JUSPAY_API_HOSTS: readonly ("api.juspay.in" | "sandbox.juspay.in")[];
+declare var JUSPAY_SIBLING_HOSTS: readonly string[];
+declare var JUSPAY_SYNTHETIC_TOKEN: RegExp;
+declare var JUSPAY_APPROVED_STATUSES: readonly string[];
+declare var JUSPAY_REFUSED_STATUSES: readonly string[];
+declare var JUSPAY_TOKENIZE_NETWORK: string;
+declare function parseJuspayForm(body: any): {
+    key: string;
+    value: string;
+    valueStart: number;
+    valueEnd: number;
+}[] | null;
+declare function juspayEnvironment(url: any): "production" | "sandbox" | undefined;
+declare function isJuspaySyntheticToken(value: any): boolean;
+declare function juspaySyntheticToken(bytes: any): string;
+declare function juspayTokenizeAnswer(token: any): {
+    status: number;
+    headers: {
+        "content-type": string;
+    };
+    body: string;
+};
+declare function juspayTxnsTemplateRefusal(url: any, headers: any, body: any): "card_token" | "format" | "merchant_id" | "card_security_code" | "merchant_mismatch" | "juspay_endpoint" | "content_type" | "unreadable_body" | "unsupported_field" | "missing_field" | "order_id" | "routing_id" | "payment_method_type" | "redirect_after_payment" | "save_to_locker" | "tokenize" | "card_nickname" | null;
+declare function assertJuspayTxnsTemplate(url: any, headers: any, body: any): Readonly<{
+    environment: "production" | "sandbox" | undefined;
+    host: any;
+    txnsUrl: any;
+    tokenizeUrl: any;
+    orderId: string | undefined;
+    merchantId: string | undefined;
+    routingId: string | null;
+    contentType: string;
+}>;
+declare function classifyJuspayRequest(request: any, issued: any): {
+    decision: any;
+    reason: any;
+} | null;
+declare function juspayTokenizeRequest(request: any, card: any): {
+    url: any;
+    method: string;
+    headers: {
+        "x-routing-id"?: any;
+        "content-type": any;
+        "x-merchantid": any;
+    };
+    body: string;
+};
+declare function juspayTxnsRequest(request: any, token: any, cvc: any): {
+    url: any;
+    method: string;
+    headers: {
+        "x-routing-id"?: any;
+        "content-type": any;
+        "x-merchantid": any;
+    };
+    body: any;
+};
+declare function juspayResponseFacts(text: any): {
+    errorCode: string | null;
+    status: string | null;
+};
+declare function readJuspayTokenizeReply(status: any, text: any): {
+    ok: boolean;
+    token: string;
+    code?: undefined;
+} | {
+    ok: boolean;
+    code: string;
+    token?: undefined;
+};
+declare function isJuspayTokenizeRefusal(code: any): boolean;
+declare function sanitizeJuspayTxnsResponse(text: any, template: any, token: any): string;
+declare function juspayTxnsOutcome(status: any, text: any, template: any, token: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { JUSPAY_API_HOSTS, JUSPAY_APPROVED_STATUSES, JUSPAY_REFUSED_STATUSES, JUSPAY_SIBLING_HOSTS, JUSPAY_SYNTHETIC_TOKEN, JUSPAY_TOKENIZE_NETWORK, assertJuspayTxnsTemplate, classifyJuspayRequest, isJuspaySyntheticToken, isJuspayTokenizeRefusal, juspayEnvironment, juspayResponseFacts, juspaySyntheticToken, juspayTokenizeAnswer, juspayTokenizeRequest, juspayTxnsOutcome, juspayTxnsRequest, juspayTxnsTemplateRefusal, parseJuspayForm, readJuspayTokenizeReply, sanitizeJuspayTxnsResponse };