@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/eprotect.js

@@ -0,0 +1,222 @@
+// Worldpay eProtect (Vantiv / Litle PayPage): the adapters' side of its card registration.
+//
+// The vendor's browser script (eProtect-api2/3, litle-api2/3, and the Worldpay iframe, which runs
+// them in a Worldpay-origin frame) encrypts the card in the page and sends it as ONE JSONP
+// <script> GET to /eProtect/paypage; the answer is `<callback>({...})`. The rules that judge that
+// request (the query grammar, the pinned keys, the failover and give-up reports, the answer
+// allowlist) live in payment-core and reach this SDK as eprotect.generated.ts. This module holds
+// only what an attachment decides from them:
+//   - which request on eProtect's hosts is the registration to pause for the vault;
+//   - which is the vendor's failover re-send of a registration the page already sent (aborted
+//     quietly: it carries the placeholder's ciphertext and is never a destination);
+//   - which is the vendor's own report that it gave up (/eProtect/ppstats 900 or 901), which ends
+//     the approval running for that registration;
+//   - the script answer the paused registration gets once the cardholder's device registered the
+//     real card: the registration Agentcard stored, wrapped in the callback the paused URL named.
+import { EPROTECT_HOSTS, EPROTECT_PATH, EPROTECT_SECONDARY_HOST, eprotectGiveUp, eprotectJsonp, eprotectMerchantPin, eprotectOutcome, eprotectRequestFacts, eprotectSecondaryAttempt, isEprotectRequest, } from './eprotect.generated.js';
+/** The processor id, as the registry and the API name it. */
+export const EPROTECT_PSP = 'worldpay_eprotect';
+/** The dark-launch capability the API serves the eProtect recognizer behind (payment-core definitions.js). */
+export const EPROTECT_CAPABILITY = 'worldpay_eprotect_jsonp';
+/** What Worldpay answers a registration with on both of its card hosts, and what the paused script gets. */
+export const EPROTECT_SCRIPT_CONTENT_TYPE = 'application/x-javascript;charset=UTF-8';
+const EPROTECT_HOSTNAMES = [EPROTECT_HOSTS.production, EPROTECT_HOSTS.sandbox, EPROTECT_SECONDARY_HOST];
+/**
+ * Why a Worldpay eProtect checkout may not be prepared under `merchant`, or null when it may. On the
+ * production host the API admits only a paypageId payment-core pins for the merchant origin, under
+ * that pin's merchant name, the one the approval shows, and refuses another name
+ * (merchant_profile_mismatch) before any preparation exists. When this build pins the paypageId
+ * too, it refuses another name first, before any network call, as a Fiserv checkout must name its
+ * key pin's merchant. A paypageId this build does not pin is the API's to judge (unsupported_checkout
+ * with no pin); none is pinned on either side yet. The pre-live host takes only the guide's test
+ * cards and needs no pin. `pins` is for tests.
+ */
+export function eprotectCheckoutRefusal(input, pins) {
+    if (input.environment !== 'production')
+        return null;
+    const pin = eprotectMerchantPin(input.paypageId, input.merchantOrigin, pins);
+    return pin && pin.merchant !== input.merchant ? 'merchant_profile_mismatch' : null;
+}
+/** Which eProtect request this is, or null for a URL that is not on one of Worldpay eProtect's hosts. */
+export function classifyEprotectRequest(url, method) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password
+        || !EPROTECT_HOSTNAMES.includes(parsed.hostname))
+        return null;
+    const get = typeof method === 'string' && method.toUpperCase() === 'GET';
+    // Every spelling of the registration path belongs to the registration family: the exact path
+    // carries the card, and any neighbour of it is nothing this SDK completes.
+    if (parsed.pathname.toLowerCase().startsWith(EPROTECT_PATH.toLowerCase())) {
+        const facts = get ? eprotectRequestFacts(url) : null;
+        if (facts)
+            return { kind: 'registration', paypageId: facts.paypageId, id: facts.id };
+        const repeat = get ? eprotectSecondaryAttempt(url) : null;
+        if (repeat)
+            return { kind: 'failover', paypageId: repeat.paypageId, id: repeat.id };
+        return { kind: 'unsupported' };
+    }
+    const report = get ? eprotectGiveUp(url) : null;
+    if (report)
+        return { kind: 'give_up', code: report.code, paypageId: report.paypageId, id: report.txnId };
+    return { kind: 'sibling' };
+}
+/** The registration GET exactly as payment-core admits it: its URL alone, with no body. */
+export function isEprotectRegistration(request) {
+    return (request.method ?? 'POST').toUpperCase() === 'GET'
+        && isEprotectRequest({ url: request.url, method: 'GET', body: request.body ?? '' });
+}
+/**
+ * The answer a paused registration script gets, or null when the stored answer is not one to hand
+ * the page: Worldpay's own shape, `<callback>(<registration>)` under its script type, with the
+ * callback the paused URL named. The registration must be one payment-core's judge accepts for that
+ * exact URL (response 870, the page's own id, only allowlisted fields), byte for byte what the API
+ * stored after running the same judge.
+ */
+export function eprotectScriptAnswer(templateUrl, response) {
+    const facts = eprotectRequestFacts(templateUrl);
+    if (!facts || response.status !== 200 || typeof response.body !== 'string')
+        return null;
+    let body;
+    try {
+        body = eprotectJsonp(facts.callback, response.body);
+    }
+    catch {
+        return null;
+    }
+    const verdict = eprotectOutcome(200, body, templateUrl, undefined);
+    if (verdict.outcome !== 'registered' || verdict.sanitizedJson !== response.body)
+        return null;
+    return { status: 200, headers: { 'content-type': EPROTECT_SCRIPT_CONTENT_TYPE }, body };
+}
+const attemptKey = (attempt) => JSON.stringify([attempt.paypageId, attempt.id]);
+/**
+ * How long a paused registration's re-send is still recognized as a known repeat. The vendor
+ * scripts re-send 5 seconds after an unanswered primary and give up at the merchant's own timeout
+ * (10 to 15 seconds at the merchants this SDK covers), so a minute leaves room for a timer a busy
+ * page delays. A re-send that comes later still is aborted all the same, as unsupported (pre-claim).
+ */
+export const EPROTECT_REPEAT_WINDOW_MS = 60_000;
+/** At most this many paused registrations are remembered at once; the oldest is forgotten first. */
+export const EPROTECT_REPEAT_LIMIT = 64;
+/**
+ * One attachment's eProtect state. A failover re-send or a give-up report names a registration by
+ * paypageId and id; each is matched against what this attachment itself paused and answered, never
+ * taken on the page's word. Inert (classify returns null) until the registry serves eProtect, which
+ * a client reaches only by syncing with the capability for an org the API enabled, so a build, an
+ * org or an API that never served it leaves every eProtect request exactly as before.
+ */
+export class EprotectGate {
+    vault;
+    now;
+    /** Paused registrations, oldest first, each with the time its re-send window closes. */
+    seen = new Map();
+    running = null;
+    answered = null;
+    constructor(vault, now = Date.now) {
+        this.vault = vault;
+        this.now = now;
+    }
+    /** What this request is, when the registry serves eProtect and the URL is on its hosts; null leaves it to the other gates. */
+    classify(url, method) {
+        if (typeof this.vault?.recognizesProcessor !== 'function' || !this.vault.recognizesProcessor(EPROTECT_PSP))
+            return null;
+        return classifyEprotectRequest(url, method);
+    }
+    /** Playwright's route predicate sees only the URL: route the registration family and the give-up reports, never the scripts. */
+    matches(url) {
+        const request = this.classify(url, 'GET');
+        return request !== null && request.kind !== 'sibling';
+    }
+    /**
+     * The page sent this registration and this attachment paused it: its re-send is then a known
+     * repeat for EPROTECT_REPEAT_WINDOW_MS. Seeing it again restarts that window. A long-lived
+     * attachment keeps at most EPROTECT_REPEAT_LIMIT of them, so repeated attempts never grow it.
+     */
+    saw(attempt) {
+        const now = this.now();
+        this.forgetBefore(now);
+        const key = attemptKey(attempt);
+        this.seen.delete(key);
+        this.seen.set(key, now + EPROTECT_REPEAT_WINDOW_MS);
+        for (const oldest of this.seen.keys()) {
+            if (this.seen.size <= EPROTECT_REPEAT_LIMIT)
+                break;
+            this.seen.delete(oldest);
+        }
+    }
+    /** Drops every registration whose re-send window closed: the map is in window order. */
+    forgetBefore(now) {
+        for (const [key, until] of this.seen) {
+            if (until > now)
+                break;
+            this.seen.delete(key);
+        }
+    }
+    /**
+     * A re-send of a registration this attachment paused, whether its approval is running, answered,
+     * or never started. The vendor script re-sends 5 seconds after an unanswered primary and has no
+     * error path, so a primary the adapters refused before any approval (no ready preparation, another
+     * paypageId, an approval already outstanding) or answered just as that timer fired is re-sent
+     * too. Such a re-send is aborted quietly, like one during the approval, and never replaces that
+     * refusal's own state with `unsupported`. A re-send of a registration this attachment never paused
+     * means the primary went somewhere it does not cover, and pre-claim aborts that one as unsupported.
+     * Both carry the placeholder's ciphertext, and both are aborted. A registration is remembered
+     * only for its re-send window (saw).
+     */
+    repeats(attempt) {
+        this.forgetBefore(this.now());
+        return this.seen.has(attemptKey(attempt));
+    }
+    /**
+     * An approval is running for this paused request, when it is a registration; `stop` ends it as the
+     * page abandoning its request. A new attempt also retires the last answered registration: a
+     * give-up report for it now belongs to a checkout the lifecycle has moved past, and must not end
+     * the attempt that just began (see gaveUp).
+     */
+    begin(url, method, stop) {
+        const request = classifyEprotectRequest(url, method);
+        this.running = request?.kind === 'registration' ? { key: attemptKey(request), stop } : null;
+        this.answered = null;
+    }
+    /**
+     * The approval's answer reached this registration; `lost` reports that the page had already given
+     * up on it. Kept after the attempt ends, since the vendor's report can land just after the answer,
+     * and only until the next attempt begins.
+     */
+    delivered(url, lost) {
+        const request = classifyEprotectRequest(url, 'GET');
+        if (request?.kind === 'registration')
+            this.answered = { key: attemptKey(request), lost };
+    }
+    /** The approval for the paused request ended, answered or not. */
+    end() { this.running = null; }
+    /**
+     * The vendor's give-up report: end the approval still running for that registration (the
+     * adapter cancels the authorization, which the API confirms only before the device registered
+     * the card, and aborts the paused script instead of answering it), or report that the answer
+     * already handed to it came too late. Returns which one, or null when the report names neither,
+     * including a registration answered before the current attempt began.
+     */
+    gaveUp(attempt) {
+        const key = attemptKey(attempt);
+        if (this.running?.key === key) {
+            const { stop } = this.running;
+            this.running = null;
+            stop();
+            return 'running';
+        }
+        if (this.answered?.key === key) {
+            const { lost } = this.answered;
+            this.answered = null;
+            lost();
+            return 'answered';
+        }
+        return null;
+    }
+}

package/dist/hosted-form.d.ts

@@ -2,8 +2,9 @@
  * The hosted_form half of a replay: what the paused navigation is resolved
  * with once the cardholder's device has submitted the processor's own form.
  *
- * On a hosted-form processor (Tranzila) the paused request is a top-level
- * form navigation inside the processor's iframe, not an XHR. The cardholder's
+ * On a hosted-form processor (Tranzila, Authorize.Net DPM and SIM) the paused
+ * request is a form navigation inside a frame, not an XHR: the processor's own
+ * form, or the merchant's form that posts to the processor. The cardholder's
  * device rebuilds that form with the real card and submits it itself, so the
  * processor's answer (approved, declined) is shown on the device and reaches
  * the merchant from the processor. The agent's browser never gets it.

package/dist/hosted-form.js

@@ -2,8 +2,9 @@
  * The hosted_form half of a replay: what the paused navigation is resolved
  * with once the cardholder's device has submitted the processor's own form.
  *
- * On a hosted-form processor (Tranzila) the paused request is a top-level
- * form navigation inside the processor's iframe, not an XHR. The cardholder's
+ * On a hosted-form processor (Tranzila, Authorize.Net DPM and SIM) the paused
+ * request is a form navigation inside a frame, not an XHR: the processor's own
+ * form, or the merchant's form that posts to the processor. The cardholder's
  * device rebuilds that form with the real card and submits it itself, so the
  * processor's answer (approved, declined) is shown on the device and reaches
  * the merchant from the processor. The agent's browser never gets it.

package/dist/index.d.ts

@@ -1,11 +1,22 @@
 export { Agentcard, Agentcard as VaultClient, CheckoutModule } from './agentcard.js';
 export type { CheckoutAttachOptions } from './agentcard.js';
-export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
+export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
 export type { GmoUnsupportedReason } from './gmo.js';
-export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, PlaceholderCard, } from './client.js';
+export type { DatatransRefusalReason } from './datatrans.js';
+export type { PelecardRefusalReason } from './pelecard.js';
+export type { PrimerUnsupportedReason, PrimerBlockedReason } from './primer.js';
+export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
+export type { ConvergeRefusalReason } from './elavon-converge.js';
+export type { WspayRefusalReason } from './wspay.js';
+export type { ShijiStsUnsupportedReason } from './shiji-sts.js';
+export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, VerifoneReplay, HostedFormReplay, CardEndpointReplay, DeviceEncryptReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, PlaceholderCard, } from './client.js';
 export type { MicroformField, MicroformSidecar } from './cybersource-flex.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
+export { CardEndpointRefusedError, cardEndpointPatterns } from './card-endpoint.js';
+export { MerchantSessionRefusedError, captureMerchantSession, merchantSessionCapture, merchantSessionReadUrl } from './merchant-session-probe.js';
+export type { MerchantSessionCapture, MerchantSessionCookie, MerchantSessionCdp, MerchantSessionRefusal } from './merchant-session-probe.js';
+export type { CardEndpointRefusal, CardEndpointSession, CardEndpointCookie } from './card-endpoint.js';
 export type { CdpLike, AttachOptions, CorsOutcome } from './cdp.js';
 export type { StripeCheckoutOptions, StripeCheckoutBlockedDetail, StripeCheckoutBlockStage, StripeCheckoutBlockReason } from './stripe-checkout.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
@@ -15,10 +26,13 @@ export type { MerchantProfile, MerchantProfileStatus, MerchantRequestVerdict, Me
 export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
 export type { MerchantAmountCard, MerchantExchange, MerchantRequestSeen, MerchantTotalApproved, MerchantTotalCapture, MerchantTotalScope } from './merchant-total.js';
 export { substituteFiservEnvelope } from './fiserv.js';
+export { classifyVerifoneProfileRequest, substituteVerifoneBody } from './verifone.js';
+export type { VerifoneProfile, VerifoneProfileStatus, VerifoneRequestVerdict, VerifoneSubstitutions } from './verifone.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export type { HostedFormSubmittedPageInput, SyntheticPage } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer, isLoopbackUrl, LOOPBACK_URL_PATTERNS } from './registry.js';
 export type { Recognizer, CheckoutMode, RecognizerOptions } from './registry.js';
+export type { PayrailsSidecar, PayrailsUnsupportedReason } from './payrails.js';
 export type { CheckoutController, CheckoutState, MerchantResult, MerchantPaymentConfirmation, UserAction, LifecycleOptions, PaymentEndpointGuard, PausedCheckout, ResumeResult } from './lifecycle.js';
 export { RequestRegistry, BUILTIN_REQUEST_BUILDERS, stripePaymentIntentConfirm, stripePaymentIntentConfirmRequest, stripeCardTokenRequest, stripePaymentMethodRequest } from './requests.js';
 export type { RequestBuilder, BuildInput, MintedIntent } from './requests.js';
@@ -34,6 +48,6 @@ export type { WebhookEvent, AgentcardEvent, CheckoutAuthorizationEvent, Checkout
 export { readReturnLink } from './voice-pkce.js';
 export type { PkceCrypto } from './voice-pkce.js';
 export { AgentcardError } from './voice-types.js';
-export type { Lang, VoiceAsk, ApprovalPosture, Action, ConnectInput, ConnectResult, Connected, Person, Proposed, Done, ActionState, CreateAuthorizationInput, AuthorizationStatus, Authorization, VoiceResetInput, VoiceChallenge, AuthorizationResult, Verdict, AuthorizationDetail, Exchanged, ExchangeInput, Revoked, TerminalReason, DeliveryChannel, InteractionEvidence, Intent, ApprovalRequestFields, CancelReason, Cancelled, Settlement, SessionState, ReturnLink, VoiceResetOutcome, VaultSessionStep, HostApprovalBundle, AppVoiceKeyDescription, RegisteredAppVoiceKey, RevokedAppVoiceKey, PayingCard, ChoosableCard, } from './voice-types.js';
+export type { Lang, VoiceAsk, ApprovalPosture, Action, ConnectInput, ConnectResult, Connected, Person, Proposed, Done, ActionState, CreateAuthorizationInput, AuthorizationStatus, Authorization, VoiceResetInput, VoiceChallenge, AuthorizationResult, Verdict, AuthorizationDetail, Exchanged, ExchangeInput, Revoked, TerminalReason, DeliveryChannel, InteractionEvidence, Intent, ApprovalRequestFields, CancelReason, Cancelled, Settlement, SessionState, ReturnLink, VoiceResetOutcome, VaultSessionStep, HostApprovalBundle, AppVoiceKeyDescription, HardwareAttestation, RegisteredAppVoiceKey, RevokedAppVoiceKey, PayingCard, ChoosableCard, } from './voice-types.js';
 export { openStream, streamBuffer } from './voice-stream.generated.js';
 export type { Hearing, StreamFormat, StreamHandle, StreamInput, StreamVerdict, ChannelKind } from './voice-stream.generated.js';

package/dist/index.js

@@ -1,14 +1,19 @@
 // The one client and its modules. `VaultClient` is the client's older name and
 // stays importable for one release; it constructs the same object.
 export { Agentcard, Agentcard as VaultClient, CheckoutModule } from './agentcard.js';
-export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
+export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
+export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
+export { CardEndpointRefusedError, cardEndpointPatterns } from './card-endpoint.js';
+// The merchant-session probe's capture (the deterministic merchant total, phase 0): no card, no Pay.
+export { MerchantSessionRefusedError, captureMerchantSession, merchantSessionCapture, merchantSessionReadUrl } from './merchant-session-probe.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
 export { classifyDeclaredMerchantRequest, classifyMerchantRequest, substituteMerchantHostedBody } from './merchant-hosted.js';
 // The merchant's own total for a raw CDP runtime that intercepts on its own (merchant-total.ts).
 export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
 export { substituteFiservEnvelope } from './fiserv.js';
+export { classifyVerifoneProfileRequest, substituteVerifoneBody } from './verifone.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer, isLoopbackUrl, LOOPBACK_URL_PATTERNS } from './registry.js';
 // The request builders: `agentcard.checkout.requests`, and the shipped builders as functions.

package/dist/juspay-gate.d.ts

@@ -0,0 +1,82 @@
+export declare const JUSPAY_PSP = "juspay";
+/** The capability the API serves the Juspay recognizer behind (payment-core definitions.js). */
+export declare const JUSPAY_CAPABILITY = "juspay_txns.v1";
+/**
+ * Fetch.enable globs for every host the gate judges. The registry arms api.juspay.in and
+ * sandbox.juspay.in already; api.juspay.io and api-ns1.juspay.in are Juspay's too and in no
+ * recognizer, so without these a card request there would never pause to be refused.
+ */
+export declare const JUSPAY_URL_PATTERNS: readonly string[];
+/** The request a gate judges: the pre-claim context's own shape (body null when the adapter could not read it). */
+export interface JuspayRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string | null;
+}
+/** payment-core classifyJuspayRequest's verdict. `reason` is its fixed vocabulary; nothing the page wrote is echoed. */
+export type JuspayDecision = {
+    decision: 'answer_tokenize';
+    reason: string;
+    host: string;
+    merchantId: string;
+} | {
+    decision: 'pause' | 'continue' | 'abort';
+    reason: string;
+};
+export declare class JuspayCheckoutGate {
+    private readonly vault;
+    /** Each synthetic token this attachment answered a tokenize with, and the host and merchant it answered. */
+    private readonly issued;
+    constructor(vault: {
+        isCardRequest(url: string, method?: string): boolean;
+    } | undefined);
+    /** On while the registry recognizes a Juspay /txns: after a sync that declared juspay_txns.v1, for an org Juspay is on for. */
+    isEnabled(): boolean;
+    /** Whether this URL is on a Juspay host the gate judges: the Playwright route matcher's test. */
+    matches(url: string): boolean;
+    /** The Fetch.enable globs the CDP adapter arms beside the registry's own, while the gate is on. */
+    urlPatterns(): string[];
+    /**
+     * The verdict on a request, or null when it is not on a Juspay host or the gate is off. A POST
+     * whose body the adapter could not read (CDP reported one without its bytes, or Playwright
+     * reported the page's empty form post as no body) is judged as having no body by the classifier,
+     * so it passes only as this checkout's own pay/start redirect: a link an allowlisted answer names,
+     * on a host, and for the v2 link a merchant, that a token in `issued` was answered for. Anything
+     * else is refused for that request alone.
+     */
+    classify(request: JuspayRequest): JuspayDecision | null;
+    /**
+     * Mint the synthetic token a placeholder tokenize is answered with, from 16 bytes of this
+     * runtime's cryptographic randomness, and remember it for the /txns that follows. It names no
+     * card and Juspay never issued it, so it pays nothing anywhere.
+     */
+    issue(host: string, merchantId: string): {
+        token: string;
+        response: {
+            status: number;
+            headers: Record<string, string>;
+            body: string;
+        };
+    };
+    /** A token whose answer never reached the page: no /txns may pause on it. */
+    forget(token: string): void;
+    /**
+     * Whether an approval must end with the request that raised it. Every Juspay /txns names its
+     * own order_id, and a page that clicks Pay again creates a new order, so an approval for one
+     * order never answers another order's request.
+     */
+    bindsApproval(url: string, method: string): boolean;
+}
+/**
+ * The answer an approved Juspay /txns hands the page, or null. Only a 200 in the allowlisted
+ * shape passes (payment-core sanitizeJuspayTxnsResponse against the paused request: the paused
+ * order, a status Juspay approves with, and the bank's pay/start redirect on the paused host with
+ * no card token and no card number anywhere), and it is re-serialized here, so a field the API
+ * stored beyond that shape never reaches the page.
+ */
+export declare function juspayPageAnswer(status: number, body: string, request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+}): string | null;

package/dist/juspay-gate.js

@@ -0,0 +1,126 @@
+// Juspay Express Checkout in the checkout SDK: what one attachment keeps between the requests of
+// the card flow Swiggy web ships. payment-core's juspay.js holds the protocol and its rules
+// (vendored unchanged as juspay.generated.ts); nothing here decides what a body means.
+//
+// Swiggy's page sends the card in two form POSTs from its own document: /card/tokenize with the
+// card, then /txns with the token Juspay returned and the CVV again. A real token needs no
+// merchant secret and pays any order of that merchant for 15 minutes, so the agent's page must
+// never hold one, and the agent's placeholder must never reach Juspay. The SDK therefore answers
+// the placeholder tokenize itself, with a synthetic ctkn_agentcard token minted here and
+// remembered with the host and merchant it was minted for, and pauses only the /txns that carries
+// one of those tokens. The cardholder's device then sends both real requests, and the page
+// receives the allowlisted /txns answer (juspayPageAnswer).
+//
+// Dark launch: the gate is on only while the registry this attachment runs on recognizes a
+// Juspay /txns, which the API serves to a build that declares juspay_txns.v1 on syncRegistry(),
+// and only for an org Agentcard turned Juspay on for. Off, every request to a Juspay host is
+// handled exactly as it was before this module existed.
+import { classifyJuspayRequest, juspaySyntheticToken, juspayTokenizeAnswer, sanitizeJuspayTxnsResponse, JUSPAY_API_HOSTS, JUSPAY_SIBLING_HOSTS, } from './juspay.generated.js';
+export const JUSPAY_PSP = 'juspay';
+/** The capability the API serves the Juspay recognizer behind (payment-core definitions.js). */
+export const JUSPAY_CAPABILITY = 'juspay_txns.v1';
+const HOSTS = [...JUSPAY_API_HOSTS, ...JUSPAY_SIBLING_HOSTS];
+/**
+ * Fetch.enable globs for every host the gate judges. The registry arms api.juspay.in and
+ * sandbox.juspay.in already; api.juspay.io and api-ns1.juspay.in are Juspay's too and in no
+ * recognizer, so without these a card request there would never pause to be refused.
+ */
+export const JUSPAY_URL_PATTERNS = HOSTS.map((host) => `*${host}*`);
+/** The /txns of each environment: the registry recognizing either one is what turns the gate on. */
+const TXNS_URLS = JUSPAY_API_HOSTS.map((host) => `https://${host}/txns`);
+/** Synthetic tokens one attachment remembers; past this, the oldest is forgotten first. */
+const MAX_ISSUED = 64;
+/** A Juspay host, in any letter case and with any trailing dot, which DNS reads as the same host. */
+function juspayHost(url) {
+    try {
+        return HOSTS.includes(new URL(url).hostname.toLowerCase().replace(/\.+$/, ''));
+    }
+    catch {
+        return false;
+    }
+}
+export class JuspayCheckoutGate {
+    vault;
+    /** Each synthetic token this attachment answered a tokenize with, and the host and merchant it answered. */
+    issued = new Map();
+    constructor(vault) {
+        this.vault = vault;
+    }
+    /** On while the registry recognizes a Juspay /txns: after a sync that declared juspay_txns.v1, for an org Juspay is on for. */
+    isEnabled() {
+        try {
+            return TXNS_URLS.some((url) => this.vault?.isCardRequest(url, 'POST') === true);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Whether this URL is on a Juspay host the gate judges: the Playwright route matcher's test. */
+    matches(url) {
+        return juspayHost(url) && this.isEnabled();
+    }
+    /** The Fetch.enable globs the CDP adapter arms beside the registry's own, while the gate is on. */
+    urlPatterns() {
+        return this.isEnabled() ? [...JUSPAY_URL_PATTERNS] : [];
+    }
+    /**
+     * The verdict on a request, or null when it is not on a Juspay host or the gate is off. A POST
+     * whose body the adapter could not read (CDP reported one without its bytes, or Playwright
+     * reported the page's empty form post as no body) is judged as having no body by the classifier,
+     * so it passes only as this checkout's own pay/start redirect: a link an allowlisted answer names,
+     * on a host, and for the v2 link a merchant, that a token in `issued` was answered for. Anything
+     * else is refused for that request alone.
+     */
+    classify(request) {
+        if (!this.matches(request.url))
+            return null;
+        const decision = classifyJuspayRequest(request, this.issued);
+        if (decision && request.body === null && String(request.method).toUpperCase() === 'POST'
+            && !(decision.decision === 'continue' && decision.reason === 'pay_start')) {
+            return { decision: 'abort', reason: 'request_body_unreadable' };
+        }
+        return decision;
+    }
+    /**
+     * Mint the synthetic token a placeholder tokenize is answered with, from 16 bytes of this
+     * runtime's cryptographic randomness, and remember it for the /txns that follows. It names no
+     * card and Juspay never issued it, so it pays nothing anywhere.
+     */
+    issue(host, merchantId) {
+        const token = juspaySyntheticToken(crypto.getRandomValues(new Uint8Array(16)));
+        if (this.issued.size >= MAX_ISSUED)
+            this.issued.delete(this.issued.keys().next().value);
+        this.issued.set(token, { host, merchantId });
+        return { token, response: juspayTokenizeAnswer(token) };
+    }
+    /** A token whose answer never reached the page: no /txns may pause on it. */
+    forget(token) {
+        this.issued.delete(token);
+    }
+    /**
+     * Whether an approval must end with the request that raised it. Every Juspay /txns names its
+     * own order_id, and a page that clicks Pay again creates a new order, so an approval for one
+     * order never answers another order's request.
+     */
+    bindsApproval(url, method) {
+        return String(method).toUpperCase() === 'POST' && this.matches(url);
+    }
+}
+/**
+ * The answer an approved Juspay /txns hands the page, or null. Only a 200 in the allowlisted
+ * shape passes (payment-core sanitizeJuspayTxnsResponse against the paused request: the paused
+ * order, a status Juspay approves with, and the bank's pay/start redirect on the paused host with
+ * no card token and no card number anywhere), and it is re-serialized here, so a field the API
+ * stored beyond that shape never reaches the page.
+ */
+export function juspayPageAnswer(status, body, request) {
+    if (status !== 200)
+        return null;
+    // No token argument: like the API, the SDK never holds the real token the device's tokenize returned.
+    try {
+        return sanitizeJuspayTxnsResponse(body, request, undefined);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/juspay.generated.d.ts

@@ -0,0 +1,89 @@
+declare var JUSPAY_API_HOSTS: readonly ("api.juspay.in" | "sandbox.juspay.in")[];
+declare var JUSPAY_SIBLING_HOSTS: readonly string[];
+declare var JUSPAY_SYNTHETIC_TOKEN: RegExp;
+declare var JUSPAY_APPROVED_STATUSES: readonly string[];
+declare var JUSPAY_REFUSED_STATUSES: readonly string[];
+declare var JUSPAY_TOKENIZE_NETWORK: string;
+declare function parseJuspayForm(body: any): {
+    key: string;
+    value: string;
+    valueStart: number;
+    valueEnd: number;
+}[] | null;
+declare function juspayEnvironment(url: any): "production" | "sandbox" | undefined;
+declare function isJuspaySyntheticToken(value: any): boolean;
+declare function juspaySyntheticToken(bytes: any): string;
+declare function juspayTokenizeAnswer(token: any): {
+    status: number;
+    headers: {
+        "content-type": string;
+    };
+    body: string;
+};
+declare function juspayTxnsTemplateRefusal(url: any, headers: any, body: any): "card_token" | "format" | "merchant_id" | "card_security_code" | "merchant_mismatch" | "juspay_endpoint" | "content_type" | "unreadable_body" | "unsupported_field" | "missing_field" | "order_id" | "routing_id" | "payment_method_type" | "redirect_after_payment" | "save_to_locker" | "tokenize" | "card_nickname" | null;
+declare function assertJuspayTxnsTemplate(url: any, headers: any, body: any): Readonly<{
+    environment: "production" | "sandbox" | undefined;
+    host: any;
+    txnsUrl: any;
+    tokenizeUrl: any;
+    orderId: string | undefined;
+    merchantId: string | undefined;
+    routingId: string | null;
+    contentType: string;
+}>;
+declare function classifyJuspayRequest(request: any, issued: any): {
+    decision: any;
+    reason: any;
+} | null;
+declare function juspayTokenizeRequest(request: any, card: any): {
+    url: any;
+    method: string;
+    headers: {
+        "x-routing-id"?: any;
+        "content-type": any;
+        "x-merchantid": any;
+    };
+    body: string;
+};
+declare function juspayTxnsRequest(request: any, token: any, cvc: any): {
+    url: any;
+    method: string;
+    headers: {
+        "x-routing-id"?: any;
+        "content-type": any;
+        "x-merchantid": any;
+    };
+    body: any;
+};
+declare function juspayResponseFacts(text: any): {
+    errorCode: string | null;
+    status: string | null;
+};
+declare function readJuspayTokenizeReply(status: any, text: any): {
+    ok: boolean;
+    token: string;
+    code?: undefined;
+} | {
+    ok: boolean;
+    code: string;
+    token?: undefined;
+};
+declare function isJuspayTokenizeRefusal(code: any): boolean;
+declare function sanitizeJuspayTxnsResponse(text: any, template: any, token: any): string;
+declare function juspayTxnsOutcome(status: any, text: any, template: any, token: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { JUSPAY_API_HOSTS, JUSPAY_APPROVED_STATUSES, JUSPAY_REFUSED_STATUSES, JUSPAY_SIBLING_HOSTS, JUSPAY_SYNTHETIC_TOKEN, JUSPAY_TOKENIZE_NETWORK, assertJuspayTxnsTemplate, classifyJuspayRequest, isJuspaySyntheticToken, isJuspayTokenizeRefusal, juspayEnvironment, juspayResponseFacts, juspaySyntheticToken, juspayTokenizeAnswer, juspayTokenizeRequest, juspayTxnsOutcome, juspayTxnsRequest, juspayTxnsTemplateRefusal, parseJuspayForm, readJuspayTokenizeReply, sanitizeJuspayTxnsResponse };