@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/amadeus-checkout.generated.js

@@ -0,0 +1,549 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: bc8b9a0ad66eb321bec67650079b2d157a84f9f8de4ad79cc9006b937a9a5a58
+// src/amadeus-body.js
+var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var holdsPan = (mopdata) => record(mopdata) && owns(mopdata, "pan") && mopdata.pan !== null && mopdata.pan !== "";
+function amadeusBodyKind(body) {
+    let value;
+    try {
+        value = typeof body === "string" ? JSON.parse(body) : void 0;
+    }
+    catch {
+        return "card";
+    }
+    if (!record(value))
+        return "card";
+    if (value.action === "add") {
+        const entries = Array.isArray(value.data) ? value.data : [value.data];
+        return entries.some((entry) => record(entry) && typeof entry.mopid === "string" && AMADEUS_CARD_MOPID.test(entry.mopid) && holdsPan(entry.mopdata)) ? "card" : "other";
+    }
+    if (value.action === "store")
+        return record(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
+    return "other";
+}
+// src/amadeus-checkout.js
+var AMADEUS_CHECKOUT_PSP = "amadeus_checkout";
+var AMADEUS_CHECKOUT_CAPABILITY = "amadeus_checkout_actions.v1";
+var AMADEUS_CARD_URLS = Object.freeze({
+    production: Object.freeze({
+        sdk: Object.freeze(["https://paypages.payment.amadeus.com/1ASIATP/ARIAPP/pay"]),
+        dcp: Object.freeze(["https://paypages.payment.amadeus.com/1ASIATP/ATPDCP/collect"])
+    }),
+    // pdt, uat, mig and skl. DCP was seen on the production path only, so the test host takes no store.
+    sandbox: Object.freeze({
+        sdk: Object.freeze([
+            "https://paypages.test.payment.amadeus.com/1ASIATP/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPU/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPM/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPK/ARIAPP/pay"
+        ]),
+        dcp: Object.freeze([])
+    })
+});
+var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
+var AMADEUS_MERCHANT_EXPIRY_POLICY = "refuse";
+var AMADEUS_REFUSAL_REASONS = Object.freeze([
+    "unsupported",
+    "card_on_file",
+    "split_tender",
+    "installments",
+    "currency_conversion",
+    "amadeus_3ds",
+    "saved_card",
+    "vendor_mismatch",
+    "header_binding",
+    "merchant_held_expiry",
+    "dcp_field_config_unreviewed"
+]);
+var MESSAGES = Object.freeze({
+    unsupported: "Refusing to pay: unsupported Amadeus card request.",
+    card_on_file: "Refusing to pay: this Amadeus payment would let the merchant keep your card on file, which needs your consent first. Nothing was sent.",
+    split_tender: "Refusing to pay: this Amadeus payment splits the total across more than one payment method. Nothing was sent.",
+    installments: "Refusing to pay: this Amadeus payment asks to pay in installments. Nothing was sent.",
+    currency_conversion: "Refusing to pay: this Amadeus payment converts the total into another currency. Nothing was sent.",
+    amadeus_3ds: "Refusing to pay: this Amadeus payment set up its card check for a different card. Nothing was sent.",
+    saved_card: "Refusing to pay: this Amadeus payment uses a card saved with the merchant, not your Vault card. Nothing was sent.",
+    vendor_mismatch: "Refusing to pay: this Amadeus payment names a card network that is not your card's. Nothing was sent.",
+    header_binding: "Refusing to pay: this Amadeus card form does not belong to the merchant you approved. Nothing was sent.",
+    merchant_held_expiry: "Refusing to pay: this merchant sends your card's expiry date separately, which Agentcard cannot fill yet. Nothing was sent.",
+    dcp_field_config_unreviewed: "Refusing to pay: Agentcard has not reviewed this merchant's Amadeus card form yet. Nothing was sent."
+});
+var FILL_REFUSAL = "Could not fill the card fields for Amadeus. Nothing was sent.";
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns2 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var panLike = (value) => /(?:[0-9][ _.:-]*){12,}/.test(value);
+var plain = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value) && !panLike(value);
+var keysWithin = (value, allowed) => Object.keys(value).every((key) => allowed.includes(key));
+var IDENTIFIER_ID = /^[A-Za-z0-9._~-]{8,64}$/;
+function readAmadeusBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > 65536)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    return record2(value) && JSON.stringify(value) === body ? value : null;
+}
+function amadeusCardUrl(url) {
+    if (typeof url !== "string")
+        return null;
+    for (const environment of ["production", "sandbox"]) {
+        for (const path of ["sdk", "dcp"]) {
+            if (AMADEUS_CARD_URLS[environment][path].includes(url))
+                return { path, environment };
+        }
+    }
+    return null;
+}
+function isAmadeusCardUrl(url, method = "POST") {
+    return method === "POST" && amadeusCardUrl(url) !== null;
+}
+function amadeusEnvironment(url) {
+    return amadeusCardUrl(url)?.environment;
+}
+function amadeusPreparationUrls(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_preparation_environment");
+    return [...AMADEUS_CARD_URLS[environment].sdk, ...AMADEUS_CARD_URLS[environment].dcp];
+}
+var SDK_CONTENT_TYPE = /^text\/plain(?:;\s*charset=utf-8)?$/i;
+var DCP_CONTENT_TYPE = /^application\/json(?:;\s*charset=utf-8)?$/i;
+var SDK_VERSION = /^WEB\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9a-f]{6,40}$/;
+var SDK_FLAVORS = Object.freeze(["Core-Sdk", "Angular-Web-Sdk"]);
+var LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var SDK_HOST = new RegExp(`^${LABEL}(?:\\.${LABEL})+(?::[0-9]{1,5})?$`, "i");
+var SDK_HEADERS = Object.freeze(["amadeus-checkout-sdk-version", "amadeus-checkout-sdk-host", "amadeus-checkout-sdk-flavor"]);
+function foldHeaders(headers) {
+    if (!record2(headers))
+        return null;
+    const folded = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (folded.has(lower) || typeof value !== "string")
+            return null;
+        folded.set(lower, value);
+    }
+    return folded;
+}
+function amadeusOwnHost(host) {
+    const name = host.split(":")[0].toLowerCase();
+    return ["amadeus.com", "amadeus.net", "outpayce.com"].some((domain) => name === domain || name.endsWith(`.${domain}`));
+}
+var HOSTLESS_SDK_VERSION = /^WEB\/3\.0\.0\/[0-9a-f]{6,40}$/;
+function hostBindingRefusal(folded, approvedHost) {
+    const host = folded.get("amadeus-checkout-sdk-host");
+    if (host === void 0) {
+        return approvedHost === void 0 && exact(HOSTLESS_SDK_VERSION, folded.get("amadeus-checkout-sdk-version")) ? null : "header_binding";
+    }
+    if (!exact(SDK_HOST, host) || amadeusOwnHost(host))
+        return "header_binding";
+    if (approvedHost === void 0)
+        return null;
+    return typeof approvedHost === "string" && host.toLowerCase() === approvedHost.toLowerCase() ? null : "header_binding";
+}
+function amadeusSdkHostRefusal(headers, approvedHost) {
+    const folded = foldHeaders(headers);
+    if (!folded || typeof approvedHost !== "string" || approvedHost === "")
+        return "header_binding";
+    return hostBindingRefusal(folded, approvedHost);
+}
+function headersRefusal(path, headers, merchantHost) {
+    const folded = foldHeaders(headers ?? {});
+    if (!folded)
+        return "unsupported";
+    if (path === "dcp") {
+        if (!exact(DCP_CONTENT_TYPE, folded.get("content-type")))
+            return "unsupported";
+        return SDK_HEADERS.some((name) => folded.has(name)) ? "unsupported" : null;
+    }
+    if (!exact(SDK_CONTENT_TYPE, folded.get("content-type")))
+        return "unsupported";
+    if (!exact(SDK_VERSION, folded.get("amadeus-checkout-sdk-version")))
+        return "header_binding";
+    const flavor = folded.get("amadeus-checkout-sdk-flavor");
+    if (flavor !== void 0 && !SDK_FLAVORS.includes(flavor))
+        return "unsupported";
+    return hostBindingRefusal(folded, merchantHost);
+}
+var SDK_DATA_KEYS = Object.freeze(["mopid", "mopdata", "fingerprint"]);
+var SDK_MOPDATA_KEYS = Object.freeze(["pan", "CVV", "holdername", "expmonth", "expyear", "vendor", "address", "contact"]);
+var SDK_MOPDATA_REFUSALS = Object.freeze({
+    prefill_index: "saved_card",
+    installmentPlansID: "installments",
+    selectedInstallmentPlan: "installments",
+    options: "currency_conversion",
+    tdsSessionId: "amadeus_3ds",
+    tdsDeviceInformation: "amadeus_3ds"
+});
+var VENDOR = /^[a-z0-9_]{2,32}$/;
+var TWO_DIGITS = /^[0-9]{2}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var PHONE = /^\+?[0-9][0-9 ().-]{2,31}$/;
+var ADDRESS_KEY = /^[A-Za-z][A-Za-z0-9_]{0,31}$/;
+function addressSound(value) {
+    if (!record2(value))
+        return false;
+    const entries = Object.entries(value);
+    return entries.length <= 16 && entries.every(([key, text]) => exact(ADDRESS_KEY, key) && plain(text, 128));
+}
+function contactSound(value) {
+    return record2(value) && keysWithin(value, ["phone", "email"]) && (!owns2(value, "phone") || exact(PHONE, value.phone)) && (!owns2(value, "email") || plain(value.email, 254));
+}
+function sdkShapeRefusal(value) {
+    if (!keysWithin(value, ["PPID", "data", "action"]) || !owns2(value, "data") || value.action !== "add" || !exact(IDENTIFIER_ID, value.PPID))
+        return "unsupported";
+    if (Array.isArray(value.data))
+        return "split_tender";
+    const data = value.data;
+    if (!record2(data))
+        return "unsupported";
+    if (owns2(data, "saveMopInformation"))
+        return "card_on_file";
+    if (owns2(data, "partial_amount"))
+        return "split_tender";
+    if (!keysWithin(data, SDK_DATA_KEYS) || !exact(AMADEUS_CARD_MOPID, data.mopid) || !record2(data.mopdata) || owns2(data, "fingerprint") && !(plain(data.fingerprint, 256) && /^[\x20-\x7e]+$/.test(data.fingerprint)))
+        return "unsupported";
+    const mopdata = data.mopdata;
+    for (const key of Object.keys(mopdata)) {
+        if (owns2(SDK_MOPDATA_REFUSALS, key))
+            return SDK_MOPDATA_REFUSALS[key];
+    }
+    if (!keysWithin(mopdata, SDK_MOPDATA_KEYS) || !digits(mopdata.pan, 12, 19) || !digits(mopdata.CVV, 3, 4) || !exact(VENDOR, mopdata.vendor))
+        return "unsupported";
+    const bothEmpty = mopdata.expmonth === "" && mopdata.expyear === "";
+    if (!bothEmpty && !(exact(MONTH, mopdata.expmonth) && exact(TWO_DIGITS, mopdata.expyear)))
+        return "unsupported";
+    if (owns2(mopdata, "holdername") && !plain(mopdata.holdername, 128) || owns2(mopdata, "address") && !addressSound(mopdata.address) || owns2(mopdata, "contact") && !contactSound(mopdata.contact))
+        return "unsupported";
+    return null;
+}
+var AMADEUS_DCP_REVIEWED_KEYS = Object.freeze(["vendor", "pan", "expdate", "owner", "cvv", "address", "city", "zipCode", "country", "state"]);
+var DCP_TEXT_KEYS = Object.freeze(["address", "city", "zipCode", "country", "state"]);
+var DCP_VENDOR = /^[A-Za-z0-9_-]{1,32}$/;
+var EXPDATE = /^(?:0[1-9]|1[0-2])[0-9]{2}$/;
+var NETWORKS = Object.freeze(["visa", "mastercard", "amex"]);
+function isAmadeusDcpConfig(config) {
+    if (!record2(config) || !keysWithin(config, ["keys", "vendors"]) || !Array.isArray(config.keys) || !record2(config.vendors))
+        return false;
+    const keys = config.keys;
+    if (new Set(keys).size !== keys.length || !keys.every((key) => AMADEUS_DCP_REVIEWED_KEYS.includes(key)) || !["pan", "expdate", "vendor"].every((key) => keys.includes(key)))
+        return false;
+    const vendors = Object.entries(config.vendors);
+    return vendors.length > 0 && vendors.every(([network, code]) => NETWORKS.includes(network) && exact(DCP_VENDOR, code));
+}
+function dcpShapeRefusal(value, config) {
+    if (!keysWithin(value, ["DCPID", "action", "data"]) || value.action !== "store" || !exact(IDENTIFIER_ID, value.DCPID) || !record2(value.data) || !keysWithin(value.data, ["mopdata"]) || !record2(value.data.mopdata))
+        return "unsupported";
+    if (!isAmadeusDcpConfig(config))
+        return "dcp_field_config_unreviewed";
+    const mopdata = value.data.mopdata;
+    if (typeof mopdata.pan === "string" && (mopdata.pan.includes("X") || mopdata.pan.startsWith("prefilled-")))
+        return "saved_card";
+    if (!keysWithin(mopdata, config.keys) || !digits(mopdata.pan, 12, 19) || !exact(EXPDATE, mopdata.expdate) || !exact(DCP_VENDOR, mopdata.vendor) || owns2(mopdata, "cvv") && !digits(mopdata.cvv, 3, 4) || owns2(mopdata, "owner") && !plain(mopdata.owner, 128) || DCP_TEXT_KEYS.some((key) => owns2(mopdata, key) && !plain(mopdata[key], 128)))
+        return "unsupported";
+    return null;
+}
+function amadeusVendorFor(number) {
+    if (!digits(number, 12, 19))
+        return null;
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (number[0] === "4")
+        return "visa";
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "mastercard";
+    if (two === 34 || two === 37)
+        return "amex";
+    return null;
+}
+function soundCard(card) {
+    if (!record2(card))
+        return null;
+    const month = Number.isInteger(card.month) || digits(card.month, 1, 2) ? Number(card.month) : NaN;
+    const year = Number.isInteger(card.year) || digits(card.year, 2, 4) ? Number(card.year) : NaN;
+    const vendor = amadeusVendorFor(card.number);
+    if (!vendor || !(month >= 1 && month <= 12) || !(year >= 0 && year <= 99 || year >= 2e3 && year <= 2099) || !digits(card.cvc, vendor === "amex" ? 4 : 3, vendor === "amex" ? 4 : 3))
+        return null;
+    const name = typeof card.name === "string" && card.name.trim() !== "" && plain(card.name, 128) ? card.name : null;
+    return { number: card.number, cvc: card.cvc, vendor, mm: String(month).padStart(2, "0"), yy: String(year % 100).padStart(2, "0"), name };
+}
+function bodyRefusal(path, value, card, options) {
+    if (path === "sdk") {
+        if (!owns2(value, "PPID"))
+            return "unsupported";
+        const shape2 = sdkShapeRefusal(value);
+        if (shape2)
+            return shape2;
+        const mopdata = value.data.mopdata;
+        const policy = options.expiryPolicy ?? AMADEUS_MERCHANT_EXPIRY_POLICY;
+        if (mopdata.expmonth === "" && policy !== "fill")
+            return "merchant_held_expiry";
+        if (card === null)
+            return null;
+        return amadeusVendorFor(card && card.number) === mopdata.vendor ? null : "vendor_mismatch";
+    }
+    if (!owns2(value, "DCPID"))
+        return "unsupported";
+    const shape = dcpShapeRefusal(value, options.dcpConfig);
+    if (shape)
+        return shape;
+    if (card === null)
+        return null;
+    const network = amadeusVendorFor(card && card.number);
+    return network !== null && options.dcpConfig.vendors[network] === value.data.mopdata.vendor ? null : "vendor_mismatch";
+}
+function amadeusRequestRefusal(request, card, options = {}) {
+    if (!record2(request) || request.method !== "POST")
+        return "unsupported";
+    const at = amadeusCardUrl(request.url);
+    const value = readAmadeusBody(request.body);
+    if (!at || !value)
+        return "unsupported";
+    return headersRefusal(at.path, request.headers, options.merchantHost) ?? bodyRefusal(at.path, value, card, options);
+}
+function amadeusRefusalMessage(reason) {
+    return owns2(MESSAGES, reason) ? MESSAGES[reason] : MESSAGES.unsupported;
+}
+function isPreparedAmadeusRequest(url, method, body, environment, headers, options = {}) {
+    return (environment === "production" || environment === "sandbox") && amadeusEnvironment(url) === environment && amadeusRequestRefusal({ url, method, body, headers }, null, options) === null;
+}
+var NAME_REFUSAL = "Add a cardholder name to the selected card in your Vault, then try again. Nothing was sent.";
+function injectAmadeusCard(body, card, options = {}) {
+    const value = readAmadeusBody(body);
+    const path = value && owns2(value, "PPID") ? "sdk" : value && owns2(value, "DCPID") ? "dcp" : null;
+    if (path === null)
+        throw new Error(MESSAGES.unsupported);
+    const shape = bodyRefusal(path, value, null, options);
+    if (shape)
+        throw new Error(amadeusRefusalMessage(shape));
+    const sound = soundCard(card);
+    if (!sound)
+        throw new Error(FILL_REFUSAL);
+    const vendor = bodyRefusal(path, value, card, options);
+    if (vendor)
+        throw new Error(amadeusRefusalMessage(vendor));
+    const mopdata = value.data.mopdata;
+    const holder = path === "sdk" ? "holdername" : "owner";
+    if (owns2(mopdata, holder) && !sound.name) {
+        throw new Error(typeof card.name === "string" && card.name.trim() !== "" ? FILL_REFUSAL : NAME_REFUSAL);
+    }
+    const where = [];
+    const write = (key, text) => {
+        mopdata[key] = text;
+        where.push(`data.mopdata.${key}`);
+    };
+    if (path === "sdk") {
+        write("pan", sound.number);
+        write("CVV", sound.cvc);
+        write("expmonth", sound.mm);
+        write("expyear", sound.yy);
+    }
+    else {
+        write("pan", sound.number);
+        if (owns2(mopdata, "cvv"))
+            write("cvv", sound.cvc);
+        write("expdate", `${sound.mm}${sound.yy}`);
+    }
+    if (owns2(mopdata, holder))
+        write(holder, sound.name);
+    return { body: JSON.stringify(value), where };
+}
+var RESPONSE_LIMIT = 32768;
+var DECLINE_LABELS = Object.freeze(["label_error_payment", "label_error_bin", "label_error_bin_vendor", "label_error_bin_type"]);
+var EXPIRED_LABELS = Object.freeze(["session_timeout", "ppid_expired"]);
+var REF_KEYS = Object.freeze(["recloc", "orderId", "mopId", "pri", "approvalcode", "externalId", "paymentMerchantReference", "prr"]);
+var PAYMENT_INFORMATION_KEYS = Object.freeze(["approvalcode", "pri", "externalId", "mopId"]);
+var REF_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,63}$/;
+var FEE = /^[0-9]{1,9}(?:\.[0-9]{1,4})?$/;
+function readAnswer(body) {
+    if (typeof body !== "string" || body === "" || body.length > RESPONSE_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record2(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function refValues(value, keys) {
+    const out = {};
+    for (const key of keys) {
+        if (!owns2(value, key))
+            continue;
+        if (!exact(REF_VALUE, value[key]))
+            return null;
+        out[key] = value[key];
+    }
+    return out;
+}
+function rebuildRefs(refs) {
+    if (!record2(refs))
+        return null;
+    const out = refValues(refs, REF_KEYS);
+    if (!out)
+        return null;
+    if (owns2(refs, "paymentInformation")) {
+        const list = refs.paymentInformation;
+        if (!Array.isArray(list) || list.length > 8 || !list.every(record2))
+            return null;
+        const rebuilt = list.map((entry) => refValues(entry, PAYMENT_INFORMATION_KEYS));
+        if (rebuilt.some((entry) => entry === null))
+            return null;
+        out.paymentInformation = rebuilt;
+    }
+    return out;
+}
+function successUrl(value) {
+    if (typeof value !== "string" || value.length > 2048 || !/^https:\/\/[\x21-\x7e]+$/.test(value) || /["'<>\\]/.test(value))
+        return false;
+    try {
+        return new URL(value).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function unescaped(text) {
+    let out = text;
+    for (let pass = 0; pass < 16; pass += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            return out;
+        out = next;
+    }
+    return null;
+}
+function cardShaped(text) {
+    const open = unescaped(text);
+    return open === null || /(?:[0-9][^A-Za-z0-9]*){12,}/.test(open);
+}
+function rebuildSdkSuccess(value) {
+    const data = value.data;
+    const unexpected = { out: null, reason: "amadeus_unexpected_response" };
+    if (!keysWithin(value, ["status", "action", "data", "messages"]) || value.status !== "OK" || value.action !== "redirect" || !record2(data) || !keysWithin(data, ["type", "refs", "url", "obfees_amount"]) || data.type !== "success_backtomerchant")
+        return unexpected;
+    const out = { status: "OK", action: "redirect", data: { type: "success_backtomerchant" } };
+    const kept = [];
+    if (owns2(data, "refs")) {
+        const refs = rebuildRefs(data.refs);
+        if (!refs)
+            return unexpected;
+        out.data.refs = refs;
+        kept.push(...REF_KEYS.filter((key) => owns2(refs, key)).map((key) => refs[key]));
+        for (const entry of refs.paymentInformation ?? [])
+            kept.push(...Object.values(entry));
+    }
+    if (owns2(data, "url")) {
+        if (!successUrl(data.url))
+            return unexpected;
+        out.data.url = data.url;
+        kept.push(data.url);
+    }
+    if (owns2(data, "obfees_amount")) {
+        const fee = data.obfees_amount;
+        if (!(exact(FEE, fee) || typeof fee === "number" && Number.isFinite(fee) && fee >= 0 && fee < 1e9))
+            return unexpected;
+        out.data.obfees_amount = fee;
+    }
+    return kept.some(cardShaped) ? { out: null, reason: "amadeus_card_shaped_value" } : { out, reason: null };
+}
+function sdkFailureLabel(value) {
+    if (value.status !== "KO" || !Array.isArray(value.messages) || !record2(value.messages[0]))
+        return null;
+    const label = value.messages[0].text;
+    return DECLINE_LABELS.includes(label) || EXPIRED_LABELS.includes(label) ? label : null;
+}
+var cardText = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? String(value) : value;
+function echoesCard(body, value, card) {
+    if (!record2(card))
+        return false;
+    const number = cardText(card.number);
+    if (!digits(number, 12, 19))
+        return false;
+    if (new RegExp(number.split("").join("[ _.:-]?")).test(body))
+        return true;
+    const cvc = cardText(card.cvc);
+    const pending = [value];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const [key, item] of Object.entries(node)) {
+            for (const text of [key, typeof item === "string" || typeof item === "number" ? String(item) : ""]) {
+                const open = unescaped(text);
+                if (open === null || open.replace(/[^0-9]/g, "").includes(number))
+                    return true;
+            }
+            if (typeof item === "string" && key !== "obfees_amount" && digits(cvc, 3, 4) && unescaped(item)?.replace(/[\s_:-]/g, "") === cvc)
+                return true;
+            if (item !== null && typeof item === "object")
+                pending.push(item);
+        }
+    }
+    return false;
+}
+function amadeusResponseOutcome(status, body, { url, card } = {}) {
+    const at = amadeusCardUrl(url);
+    if (!at)
+        return { outcome: "unknown", reason: "amadeus_request_unknown" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: `http_${status}` };
+    if (status !== 200)
+        return { outcome: "unknown", reason: "amadeus_status_unconfirmed" };
+    const value = readAnswer(body);
+    if (!value)
+        return { outcome: "unknown", reason: "amadeus_unreadable" };
+    if (card && echoesCard(body, value, card))
+        return { outcome: "unknown", reason: "amadeus_card_echo" };
+    if (at.path === "dcp")
+        return value.status === "OK" ? { outcome: "approved", feeApplied: false } : { outcome: "unknown", reason: "amadeus_dcp_unconfirmed" };
+    if (value.status === "KO") {
+        const label = sdkFailureLabel(value);
+        if (DECLINE_LABELS.includes(label))
+            return { outcome: "refused", code: label };
+        return { outcome: "unknown", reason: label ? "amadeus_session_expired" : "amadeus_unexpected_response" };
+    }
+    if (owns2(value, "actionToken") || owns2(value, "replies") || value.action !== "redirect" || !record2(value.data) || value.data.type !== "success_backtomerchant")
+        return { outcome: "unknown", reason: "amadeus_action_required" };
+    const rebuilt = rebuildSdkSuccess(value);
+    if (!rebuilt.out)
+        return { outcome: "unknown", reason: rebuilt.reason };
+    return { outcome: "approved", feeApplied: owns2(rebuilt.out.data, "obfees_amount") && Number(rebuilt.out.data.obfees_amount) !== 0 };
+}
+function sanitizeAmadeusResponse(body, url, card) {
+    const at = amadeusCardUrl(url);
+    const value = readAnswer(body);
+    const fail = () => {
+        throw new Error("Invalid Amadeus card response.");
+    };
+    if (!at || !value)
+        return fail();
+    let out;
+    if (at.path === "dcp") {
+        out = value.status === "OK" ? '{"status":"OK"}' : fail();
+    }
+    else if (value.status === "KO") {
+        const label = sdkFailureLabel(value);
+        out = label ? JSON.stringify({ status: "KO", messages: [{ type: "error", text: label }] }) : fail();
+    }
+    else {
+        const rebuilt = rebuildSdkSuccess(value);
+        out = rebuilt.out ? JSON.stringify(rebuilt.out) : fail();
+    }
+    if (card && echoesCard(out, JSON.parse(out), card))
+        return fail();
+    return out;
+}
+function amadeusFacts(body) {
+    const value = readAnswer(body);
+    const label = value ? sdkFailureLabel(value) : null;
+    return { refusalCode: DECLINE_LABELS.includes(label) ? label : null };
+}
+export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };

package/dist/amadeus.d.ts

@@ -0,0 +1,41 @@
+/** How long after the pause a paused Amadeus SDK add may still be sent. */
+export declare const AMADEUS_SEND_WINDOW_MS = 20000;
+/**
+ * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
+ * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
+ * through its abort event, and Amadeus's tunnel listens for load, error and timeout alone, so a
+ * cancelled add would leave the SDK, and Air France's page, waiting for the page's own 40 second
+ * limit. As a network error, the tunnel reports it at once as its own "Error".
+ */
+export declare function failsAsNetworkError(url: string): boolean;
+/** The send window for a request paused under a preparation for `psp`, or null when it has none. */
+export declare function amadeusSendWindowMs(psp: string | undefined, url: string): number | null;
+/** What the window reads from the adapter, re-read when it closes. */
+export interface SendWindowHooks {
+    /** The authorization the paused request raised, once the API created it. */
+    authorizationId(): string | null;
+    /** True once the answer is being handed to the page: the window no longer applies. */
+    delivering(): boolean;
+    /** A plain runtime cancel. Resolves only when the API confirms the card never moved. */
+    cancel?: (authorizationId: string) => Promise<unknown>;
+    /**
+     * Retire the preparation of a create that has not answered (VaultClient.retirePreparation).
+     * Resolves null once the API confirms no request can bind it, or the ID of the authorization
+     * already bound to it; rejects when the API confirms neither.
+     */
+    retirePreparation?: () => Promise<string | null>;
+    onEvent?: (event: {
+        type: string;
+        detail?: unknown;
+    }) => void;
+}
+/** The part of a merchant attempt the window acts on. */
+export interface SendWindowAttempt {
+    readonly signal: AbortSignal;
+    stop(cause: 'amadeus_send_window_closed'): void;
+}
+/**
+ * Arm the window on one paused request. Returns the function that disarms it, which the adapter
+ * calls once the attempt settles, whatever the outcome.
+ */
+export declare function armSendWindow(ms: number, attempt: SendWindowAttempt, hooks: SendWindowHooks): () => void;

package/dist/amadeus.js

@@ -0,0 +1,81 @@
+// Two Amadeus Checkout rules both browser adapters share: how a refused card request fails
+// (failsAsNetworkError), and the send window of a prepared SDK add, below.
+//
+// The Checkout Web SDK's tunnel iframe gives its add XHR 30 seconds (xhr.timeout = 30000 in
+// tunnel.50fc56c91f295b5bfef0.js), then reports a timeout and Air France's page gives the payment
+// up. A card the device sends after that point would register with Amadeus on a payment the page no
+// longer waits for, so a paused add must be sent within 20 seconds of the pause or fail unsent. The
+// SDK cannot see the device start sending, and the API can: a plain runtime cancel is confirmed only
+// while the card has not moved, and once it is, the device's send is refused.
+//
+// So when the window closes and no answer is being handed to the page yet, the adapter asks for that
+// cancel. Confirmed: nothing was sent and nothing can be, so the attempt stops, the page's request
+// fails, and the checkout reads failed. Not confirmed: the device may already be sending, so the
+// attempt keeps waiting for its answer, which can still reach the page, and the page's own 30 second
+// deadline still ends it. A create that has not answered yet may already have committed its row and
+// bound the preparation the cardholder approved, and that device may be sending too. So the window
+// first retires the preparation: once the API confirms no request can bind it, nothing can be sent;
+// when a request already holds it, that authorization gets the same cancel and the same rule, and
+// when the API confirms neither, the attempt keeps waiting. The Data Collection Page's store has no
+// client timeout and gets no window.
+import { amadeusCardUrl } from './amadeus-checkout.generated.js';
+/** How long after the pause a paused Amadeus SDK add may still be sent. */
+export const AMADEUS_SEND_WINDOW_MS = 20_000;
+/**
+ * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
+ * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
+ * through its abort event, and Amadeus's tunnel listens for load, error and timeout alone, so a
+ * cancelled add would leave the SDK, and Air France's page, waiting for the page's own 40 second
+ * limit. As a network error, the tunnel reports it at once as its own "Error".
+ */
+export function failsAsNetworkError(url) {
+    return amadeusCardUrl(url) !== null;
+}
+/** The send window for a request paused under a preparation for `psp`, or null when it has none. */
+export function amadeusSendWindowMs(psp, url) {
+    return psp === 'amadeus_checkout' && amadeusCardUrl(url)?.path === 'sdk' ? AMADEUS_SEND_WINDOW_MS : null;
+}
+/**
+ * Arm the window on one paused request. Returns the function that disarms it, which the adapter
+ * calls once the attempt settles, whatever the outcome.
+ */
+export function armSendWindow(ms, attempt, hooks) {
+    let disarmed = false;
+    const settled = () => disarmed || attempt.signal.aborted || hooks.delivering();
+    // Resolves only once the API confirms the card never left the device and never can; see the top
+    // of this file for the create that has not answered.
+    const retire = async () => {
+        let id = hooks.authorizationId();
+        if (id === null) {
+            if (typeof hooks.retirePreparation !== 'function')
+                throw new Error('preparation_retirement_unavailable');
+            id = await hooks.retirePreparation();
+        }
+        if (id === null)
+            return;
+        if (typeof hooks.cancel !== 'function')
+            throw new Error('authorization_cancel_unavailable');
+        await hooks.cancel(id);
+    };
+    const close = async () => {
+        if (settled())
+            return;
+        let confirmed = false;
+        try {
+            await retire();
+            confirmed = true;
+        }
+        catch { /* not confirmed: the card may already be on its way */ }
+        if (settled())
+            return;
+        if (!confirmed) {
+            hooks.onEvent?.({ type: 'blocked', detail: 'amadeus_send_window_unconfirmed' });
+            return;
+        }
+        hooks.onEvent?.({ type: 'blocked', detail: 'amadeus_send_window_closed' });
+        attempt.stop('amadeus_send_window_closed');
+    };
+    const timer = setTimeout(() => { void close(); }, ms);
+    timer.unref?.();
+    return () => { disarmed = true; clearTimeout(timer); };
+}