@agent-cards/sdk 0.20.0

package/examples/preflight/stripe-script.result.json

@@ -0,0 +1,87 @@
+{
+  "snapshot": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-15.1",
+    "signals": [
+      {
+        "rule_id": "stripe-js-v3",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      },
+      {
+        "rule_id": "stripe-js-script",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      }
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    }
+  },
+  "result": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-15.1",
+    "integration": {
+      "id": "kernel_native",
+      "version": "example-native-adapter"
+    },
+    "scenario": "one_time",
+    "scenario_defaulted": false,
+    "psp": "stripe",
+    "flow": null,
+    "mode": "token",
+    "status": "unknown",
+    "support_scope": null,
+    "checkout_flow_status": "unknown",
+    "candidates": [
+      {
+        "psp": "stripe",
+        "relevance": "undetermined",
+        "evidence": [
+          {
+            "rule_id": "stripe-js-v3",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "/v3/*"
+          },
+          {
+            "rule_id": "stripe-js-script",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "^/v3/?$"
+          }
+        ]
+      }
+    ],
+    "reason_codes": [
+      "checkout_flow_unidentified",
+      "integration_processor_undeclared"
+    ],
+    "limitations": [
+      "Processor assets alone do not establish the active card payment flow."
+    ],
+    "missing_evidence": [
+      "active_checkout_flow",
+      "integration_processor_capability"
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    },
+    "scope": "preflight_hint",
+    "merchant_confirmation_required": true
+  }
+}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@agent-cards/sdk",
+  "version": "0.20.0",
+  "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./cdp": "./dist/cdp.js",
+    "./playwright": "./dist/playwright.js",
+    "./preflight": "./dist/preflight.js",
+    "./preflight/catalog.json": "./dist/preflight-catalog.json",
+    "./preflight/schemas.json": "./dist/preflight-schemas.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "examples",
+    "PREFLIGHT.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
+    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
+    "prepublishOnly": "pnpm build",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs autopilot.test.mjs stripe-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node fiserv-browser.test.mjs",
+    "check:payment-core": "node scripts/generate-payment-core.mjs --check",
+    "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
+    "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",
+    "test:preflight:browser": "node preflight-browser.test.mjs",
+    "pack:preview": "node scripts/pack-preflight-preview.mjs",
+    "test:preflight:schemas": "node --test preflight-schemas.test.mjs",
+    "check:kernel-native": "node examples/preflight/kernel-native/qualification.mjs inventory --check"
+  },
+  "keywords": [
+    "payments",
+    "agents",
+    "browser-automation",
+    "pci",
+    "checkout",
+    "voice",
+    "agentcard"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "license": "UNLICENSED"
+}

package/readme.test.mjs

@@ -0,0 +1,53 @@
+// The README's hello world, run as written against the stub. The block is read
+// off README.md, its import is pointed at dist, `returnLink` (the link the
+// app's sheet came back with) is taken from the stub, and the client is aimed
+// at the stub; nothing else changes, so a line that stops running here stops
+// the test.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { test } from 'node:test';
+import { startStub } from './voice-stub.mjs';
+
+const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
+
+/** The first fenced block after the heading, as text. */
+export function readmeBlock(file, heading) {
+  const md = fs.readFileSync(file, 'utf8');
+  const at = md.indexOf(`\n${heading}\n`);
+  assert.ok(at >= 0, `${heading} is in ${file}`);
+  const m = /```[a-z]*\n([\s\S]*?)```/.exec(md.slice(at));
+  assert.ok(m, `a code block follows ${heading}`);
+  return m[1];
+}
+
+test("the hello world runs as written: connect, the sheet's return link, a sandbox purchase, the result", async () => {
+  // The API names the client's mode on the token exchange; the hello world names none itself.
+  const stub = await startStub({ tokenSandbox: true });
+  try {
+    let code = readmeBlock(new URL('./README.md', import.meta.url), '## Hello world');
+    assert.equal(code.trim().split('\n').filter((l) => l.trim()).length, 7, 'seven lines');
+    assert.match(code, /request: 'sandbox'/); assert.match(code, /user_id: person\.user_id/);
+    assert.doesNotMatch(code, /sandbox: true/, 'sandbox and live are decided by the credentials, never named in code');
+    // The import becomes a dynamic one on dist; the client is aimed at the stub; the return link is the stub's.
+    code = code.replace(/^import \{([^}]+)\} from '@agent-cards\/sdk';/m, "const {$1} = await import('./dist/index.js');");
+    code = code.replace('new Agentcard({', 'new Agentcard({ baseUrl: stub.baseUrl, pollIntervalMs: 10,');
+    code = code.replace('completeConnect(returnLink)', 'completeConnect(stub.state.returnLinkFor(link.session_id))');
+    process.env.AGENTCARD_CLIENT_ID = 'cid'; process.env.AGENTCARD_CLIENT_SECRET = 'acs_good';
+    // The person approves while the server waits.
+    const approve = setInterval(() => { for (const row of stub.state.authorizations.values()) { row.status = 'approved'; row.approved_with = 'voice'; } }, 20);
+    try {
+      const run = new AsyncFunction('stub', code + '\nreturn { agentcard, link, person, purchase, card, cards, result };');
+      const out = await run(stub);
+      assert.equal(out.agentcard.sandbox, true, 'the client learned its mode from the token exchange');
+      assert.equal(out.link.grant, 'exchange');
+      assert.equal(out.person.user_id, 'usr_1');
+      assert.equal(out.purchase.status, 'awaiting_approval');
+      assert.match(out.purchase.approval_url, /^http:\/\/vault\.test\/authorize\?id=cauth_/);
+      assert.equal(out.result.status, 'approved'); assert.equal(out.result.approved_with, 'voice');
+      // The card that pays rides the create (decision 213): named, with the recommendation's reason, and the others beside it.
+      assert.equal(out.card.id, 'vc_sapphire'); assert.match(out.card.reason, /3x on shopping/); assert.equal(out.cards.length, 2);
+      const create = stub.state.requests.find((r) => r.path === '/v2/checkout/authorizations').body;
+      assert.equal(create.user, 'usr_1'); assert.match(create.request.url, /pi_sandbox/);
+    } finally { clearInterval(approve); }
+  } finally { await stub.close(); }
+});