@agent-cards/sdk 0.23.11 → 0.23.12

package/dist/paddle-vgs.generated.d.ts

@@ -0,0 +1,50 @@
+declare var PADDLE_VGS_PSP: string;
+declare var PADDLE_VGS_CAPABILITY: string;
+declare var PADDLE_VGS_OPERATION: string;
+declare var PADDLE_VGS_CONTENT_TYPE: string;
+declare var PADDLE_VGS_CARDS_URLS: Readonly<{
+    production: "https://vault.paddle.com/cards";
+    sandbox: "https://sandbox-vault.paddle.com/cards";
+}>;
+declare var PADDLE_VGS_REFUSAL_CODES: readonly string[];
+declare function paddleVgsEnvironment(url: any): "production" | "sandbox" | null;
+declare function isPaddleVgsCardsUrl(url: any): boolean;
+declare function paddleVgsBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function paddleVgsRequestRefusal(request: any): any;
+declare function isPreparedPaddleVgsRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare var PADDLE_VGS_MERCHANT_PINS: readonly any[];
+declare function paddleVgsMerchantPin(merchantOrigin: any, pins?: readonly any[]): any;
+declare function paddleVgsMerchantRefusal(environment: any, merchantOrigin: any, authorization: any, pins?: readonly any[]): "unsupported_environment" | "paddle_vgs_merchant_unreviewed" | "paddle_vgs_seller_unreviewed" | null;
+declare function paddleVgsSellerClaimsPinned(pins?: readonly any[]): boolean;
+declare function paddleVgsRefusalMessage(code: any): any;
+declare var PADDLE_VGS_CARD_NETWORKS: readonly string[];
+declare function paddleVgsCardRefusal(body: any, card: any): any;
+declare function paddleVgsStoredCardRefusal(brand: any): "paddle_vgs_card_unsupported" | null;
+declare function paddleVgsTypedCardRefusal(body: any, stored: any): any;
+declare function injectPaddleVgsCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function paddleVgsRefusalCode(text: any): string | null;
+declare function paddleVgsAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };

package/dist/paddle-vgs.generated.js

@@ -0,0 +1,289 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: b33914c3bb882b868a28a7d7abb91d6cca450c0145dca0aa338474400b6f923e
+// src/paddle-vgs.js
+var PADDLE_VGS_PSP = "paddle_vgs";
+var PADDLE_VGS_CAPABILITY = "paddle_vgs_cards";
+var PADDLE_VGS_OPERATION = "paddle_vgs.card_request";
+var PADDLE_VGS_CONTENT_TYPE = "application/vnd.api+json";
+var PADDLE_VGS_CARDS_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://vault.paddle.com/cards",
+    sandbox: "https://sandbox-vault.paddle.com/cards"
+});
+var PADDLE_VGS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["paddle_vgs_url_refused", "paddle_vgs_headers_refused", "paddle_vgs_body_unsupported"]);
+var BODY_LIMIT = 4096;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["data"]);
+var DATA_KEYS = /* @__PURE__ */ Object.freeze(["type", "attributes"]);
+var ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["pan", "cvc", "exp_month", "exp_year", "cardholder"]);
+var WHERE = /* @__PURE__ */ Object.freeze(["data.attributes.pan", "data.attributes.cvc", "data.attributes.exp_month", "data.attributes.exp_year"]);
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var NAME_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var PAN_LIKE = /(?:[0-9][ _.:-]*){12,}/;
+var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
+var BEARER = /^Bearer [A-Za-z0-9_-]{8,512}\.([A-Za-z0-9_-]{8,4096})\.[A-Za-z0-9_-]{8,1024}$/;
+var BEARER_LIFETIME_SECONDS = 1200;
+var BASE64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function base64UrlText(segment) {
+    let bits = 0;
+    let value = 0;
+    let escaped = "";
+    for (const character of segment) {
+        const sextet = BASE64URL.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            escaped += "%" + (value >> bits & 255).toString(16).padStart(2, "0");
+            value &= (1 << bits) - 1;
+        }
+    }
+    try {
+        return decodeURIComponent(escaped);
+    }
+    catch {
+        return null;
+    }
+}
+function bearerClaims(authorization) {
+    const match = typeof authorization === "string" ? BEARER.exec(authorization) : null;
+    const text = match ? base64UrlText(match[1]) : null;
+    if (text === null)
+        return null;
+    try {
+        const claims = JSON.parse(text);
+        return record(claims) ? claims : null;
+    }
+    catch {
+        return null;
+    }
+}
+function bearerRunning(authorization, nowSeconds = Math.floor(Date.now() / 1e3)) {
+    const claims = bearerClaims(authorization);
+    if (!claims || !Number.isSafeInteger(claims.iat) || !Number.isSafeInteger(claims.exp))
+        return false;
+    return claims.exp > claims.iat && claims.exp - claims.iat <= BEARER_LIFETIME_SECONDS && claims.exp > nowSeconds;
+}
+function paddleVgsEnvironment(url) {
+    if (url === PADDLE_VGS_CARDS_URLS.production)
+        return "production";
+    if (url === PADDLE_VGS_CARDS_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isPaddleVgsCardsUrl(url) {
+    return paddleVgsEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function paddleVgsBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null || !sameKeys(value, ROOT_KEYS) || !record(value.data) || !sameKeys(value.data, DATA_KEYS) || value.data.type !== "cards" || !record(value.data.attributes) || !sameKeys(value.data.attributes, ATTRIBUTE_KEYS)) {
+        return refuse("paddle_vgs_body_unsupported");
+    }
+    const card = value.data.attributes;
+    const holder = card.cardholder;
+    if (typeof card.pan !== "string" || !CARD_NUMBER.test(card.pan) || typeof card.cvc !== "string" || !SECURITY_CODE.test(card.cvc) || !Number.isInteger(card.exp_month) || card.exp_month < 1 || card.exp_month > 12 || !Number.isInteger(card.exp_year) || card.exp_year < 0 || card.exp_year > 99 || !record(holder) || !sameKeys(holder, ["name"]) || typeof holder.name !== "string" || holder.name.length > NAME_LIMIT || CONTROL.test(holder.name) || cardLikeName(holder.name)) {
+        return refuse("paddle_vgs_body_unsupported");
+    }
+    return CARD;
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function paddleVgsRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "paddle_vgs_url_refused";
+    if (!isPaddleVgsCardsUrl(request.url))
+        return "paddle_vgs_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const authorization = headerValue(headers, "authorization");
+    if (contentType === null || contentType.trim().toLowerCase() !== PADDLE_VGS_CONTENT_TYPE || authorization === null || !bearerRunning(authorization))
+        return "paddle_vgs_headers_refused";
+    const verdict = paddleVgsBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedPaddleVgsRequest(url, method, body, environment, headers) {
+    return (environment === "production" || environment === "sandbox") && paddleVgsEnvironment(url) === environment && paddleVgsRequestRefusal({ url, method, headers, body }) === null;
+}
+var pin = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
+function paddleVgsMerchantPin(merchantOrigin, pins = PADDLE_VGS_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin)) ?? null;
+}
+function paddleVgsMerchantRefusal(environment, merchantOrigin, authorization, pins = PADDLE_VGS_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    const found = paddleVgsMerchantPin(merchantOrigin, pins);
+    if (!found)
+        return "paddle_vgs_merchant_unreviewed";
+    if (found.sellerClaim && authorization !== void 0) {
+        const claims = bearerClaims(authorization);
+        if (!claims || claims[found.sellerClaim.name] !== found.sellerClaim.value)
+            return "paddle_vgs_seller_unreviewed";
+    }
+    return null;
+}
+function paddleVgsSellerClaimsPinned(pins = PADDLE_VGS_MERCHANT_PINS) {
+    return Array.isArray(pins) && pins.length > 0 && pins.every((entry) => !!entry && !!entry.sellerClaim && typeof entry.sellerClaim.name === "string" && entry.sellerClaim.name !== "" && typeof entry.sellerClaim.value === "string" && entry.sellerClaim.value !== "");
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    paddle_vgs_url_refused: "Refusing to pay: this Paddle card request does not go to Paddle's card vault exactly as Paddle's checkout sends it. Nothing was sent.",
+    paddle_vgs_headers_refused: "Refusing to pay: this Paddle card request does not carry the checkout's own headers. Nothing was sent.",
+    paddle_vgs_body_unsupported: "Refusing to pay: this is not the card request of Paddle's checkout. Nothing was sent."
+});
+function paddleVgsRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.paddle_vgs_body_unsupported;
+}
+var CARD_MISMATCH_REFUSAL = "Refusing to pay: this Paddle payment names a card expiry or network that is not your card's. Nothing was sent.";
+var PADDLE_VGS_CARD_NETWORKS = /* @__PURE__ */ Object.freeze(["visa", "mastercard", "amex"]);
+function cardNetwork(number) {
+    if (typeof number !== "string" || !CARD_NUMBER.test(number))
+        return null;
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (number[0] === "4")
+        return "visa";
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "mastercard";
+    if (two === 34 || two === 37)
+        return "amex";
+    return null;
+}
+function paddleVgsCardRefusal(body, card) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        return verdict.code;
+    const attributes = JSON.parse(body).data.attributes;
+    const number = card ? String(card.number) : "";
+    const month = card ? Number(card.month) : NaN;
+    const year = card ? Number(card.year) % 100 : NaN;
+    const network = cardNetwork(number);
+    if (attributes.exp_month !== month || attributes.exp_year !== year || network === null || cardNetwork(attributes.pan) !== network) {
+        return "paddle_vgs_card_mismatch";
+    }
+    return null;
+}
+var storedBrand = (brand) => typeof brand === "string" && brand !== "" ? brand.toLowerCase() : null;
+function paddleVgsStoredCardRefusal(brand) {
+    const network = storedBrand(brand);
+    return network === null || PADDLE_VGS_CARD_NETWORKS.includes(network) ? null : "paddle_vgs_card_unsupported";
+}
+function paddleVgsTypedCardRefusal(body, stored) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        return verdict.code;
+    const attributes = JSON.parse(body).data.attributes;
+    const card = stored && typeof stored === "object" ? stored : {};
+    if (Number.isInteger(card.expiryMonth) && attributes.exp_month !== card.expiryMonth)
+        return "paddle_vgs_card_mismatch";
+    if (Number.isInteger(card.expiryYear) && attributes.exp_year !== card.expiryYear % 100)
+        return "paddle_vgs_card_mismatch";
+    const brand = storedBrand(card.brand);
+    if (brand !== null && cardNetwork(attributes.pan) !== brand)
+        return "paddle_vgs_card_mismatch";
+    return null;
+}
+function injectPaddleVgsCard(body, card) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(paddleVgsRefusalMessage(verdict.code));
+    const number = card ? String(card.number) : "";
+    const cvc = card ? String(card.cvc) : "";
+    const month = card ? Number(card.month) : NaN;
+    const year = card ? Number(card.year) % 100 : NaN;
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvc) || !Number.isInteger(month) || month < 1 || month > 12 || !Number.isInteger(year) || year < 0) {
+        throw new Error("Could not fill the card fields for Paddle. Nothing was sent.");
+    }
+    if (paddleVgsCardRefusal(body, { number, month, year }) !== null)
+        throw new Error(CARD_MISMATCH_REFUSAL);
+    const value = JSON.parse(body);
+    const attributes = value.data.attributes;
+    attributes.pan = number;
+    attributes.cvc = cvc;
+    attributes.exp_month = month;
+    attributes.exp_year = year;
+    return { body: JSON.stringify(value), where: [...WHERE] };
+}
+var ANSWER_LIMIT = 65536;
+var STORED_CARD_ID = /^[A-Za-z0-9_-]{1,128}$/;
+var REFUSAL_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
+var MAX_CODE_DIGITS = 11;
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function storedCardId(answer) {
+    const data = answer && answer.data;
+    if (!record(data) || data.type !== "cards" || typeof data.id !== "string")
+        return null;
+    const id = data.id;
+    return STORED_CARD_ID.test(id) && /[A-Za-z]/.test(id) && !PAN_LIKE.test(id) ? id : null;
+}
+var boundedCode = (value) => typeof value === "string" && REFUSAL_CODE.test(value) && (value.match(/[0-9]/g) ?? []).length <= MAX_CODE_DIGITS ? value : null;
+function paddleVgsRefusalCode(text) {
+    const answer = readAnswer(text);
+    if (!answer)
+        return null;
+    const first = Array.isArray(answer.errors) && record(answer.errors[0]) ? answer.errors[0] : null;
+    return boundedCode(first && first.error_code) ?? boundedCode(first && first.code) ?? boundedCode(answer.error_code) ?? boundedCode(answer.code);
+}
+function paddleVgsAnswerOutcome(status, text, card) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "paddle_vgs_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: paddleVgsRefusalCode(text) ?? `http_${status}` };
+    if (status !== 200 && status !== 201)
+        return { outcome: "unknown", reason: "paddle_vgs_unconfirmed" };
+    const id = storedCardId(readAnswer(text));
+    if (id === null)
+        return { outcome: "unknown", reason: "paddle_vgs_unsafe_response" };
+    const number = card ? String(card.number).replace(/[^0-9]/g, "") : "";
+    if (number && id.replace(/[^0-9]/g, "").includes(number))
+        return { outcome: "unknown", reason: "paddle_vgs_unsafe_response" };
+    return { outcome: "approved", body: JSON.stringify({ data: { type: "cards", id } }) };
+}
+export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 66c54c571ca1294220b070eaca1ca3888feebcd7f2562b761d74ded25a453c57
+// artifact-sha256: 38065a5bd834d5233979a0528fde4345378914e8e8b1a63e329bff0994572da5
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -404,14 +404,8 @@ function payrailsCardOnFileRefusal(body) {
 }
 var AUTHORIZE_LIMIT = 32768;
 var AUTHORIZE_KEYS = Object.freeze(["amount", "paymentComposition", "returnInfo", "meta"]);
-var COMPOSITION_KEYS = Object.freeze([
-    "paymentMethodCode",
-    "integrationType",
-    "amount",
-    "storeInstrument",
-    "paymentInstrumentData",
-    "enrollInstrumentToNetworkOffers"
-]);
+var COMPOSITION_KEYS = Object.freeze(["paymentMethodCode", "integrationType", "amount", "storeInstrument", "paymentInstrumentData"]);
+var ENROLLMENT_COMPOSITION_KEYS = Object.freeze([...COMPOSITION_KEYS, "enrollInstrumentToNetworkOffers"]);
 var RETURN_KEYS = Object.freeze(["success", "cancel", "error", "pending"]);
 var AMOUNT_VALUE = /^[0-9]{1,15}(?:\.[0-9]{1,12})?$/;
 var CURRENCY = /^[A-Z]{3}$/;
@@ -476,12 +470,14 @@ function readAuthorizeBody(body) {
     const amount = readAmount(parsed.amount);
     const parts = parsed.paymentComposition;
     const part = Array.isArray(parts) && parts.length === 1 && record(parts[0]) ? parts[0] : null;
-    if (!amount || !part || !sameKeys(part, COMPOSITION_KEYS) || part.paymentMethodCode !== "card" || part.integrationType !== "api")
+    const flagged = !!part && owns(part, "enrollInstrumentToNetworkOffers");
+    if (!amount || !part || !sameKeys(part, flagged ? ENROLLMENT_COMPOSITION_KEYS : COMPOSITION_KEYS) || part.paymentMethodCode !== "card" || part.integrationType !== "api")
         return malformed;
     const partAmount = readAmount(part.amount);
     if (!partAmount || partAmount.value !== amount.value || partAmount.currency !== amount.currency)
         return malformed;
-    if (typeof part.storeInstrument !== "boolean" || typeof part.enrollInstrumentToNetworkOffers !== "boolean")
+    const enrollInstrumentToNetworkOffers = flagged ? part.enrollInstrumentToNetworkOffers : false;
+    if (typeof part.storeInstrument !== "boolean" || typeof enrollInstrumentToNetworkOffers !== "boolean")
         return malformed;
     const data = part.paymentInstrumentData;
     const keys = record(data) ? Object.keys(data) : [];
@@ -502,7 +498,7 @@ function readAuthorizeBody(body) {
         value: Object.freeze({
             amount: Object.freeze({ value: amount.value, currency: amount.currency }),
             storeInstrument: part.storeInstrument,
-            enrollInstrumentToNetworkOffers: part.enrollInstrumentToNetworkOffers,
+            enrollInstrumentToNetworkOffers,
             encryptedData: data.encryptedData,
             vaultProviderConfigId: data.vaultProviderConfigId,
             wrappedKeyBytes: jwe.wrappedKey.length

package/dist/prepared-processor.d.ts

@@ -16,8 +16,12 @@
  * CyberSource's reply 30 times, a second apart, from Save (Arrow Electronics), too soon for an
  * approval after Save. Its environments are its two hosts: secureacceptance (production) and
  * testsecureacceptance (sandbox).
+ *
+ * paddle_vgs: prepared only. Paddle's checkout frame aborts its card request to its VGS card vault 10
+ * seconds after Pay and sends it once more, too soon for an approval after Pay. Its environments are its
+ * two card URLs: vault.paddle.com (production) and sandbox-vault.paddle.com (sandbox).
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -39,8 +43,11 @@ export declare function preparationRequestMethod(psp: string): 'GET' | 'POST';
  * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
  * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
  * clicked again). The cardholder's device answers with a token that pays nothing until the
- * merchant's server charges it. Every other prepared checkout still answers only the request it
- * was bound to.
+ * merchant's server charges it. Paddle VGS too: Paddle's frame aborts its card request to its VGS
+ * card vault 10 seconds after sending it and sends the same body under the same bearer once more, and
+ * the device's answer is the stored card's id, which pays nothing until Paddle's /pay names it. Only
+ * that repeat, byte for byte under the same bearer, is answered (cdp.ts paddleVgsRetryKey).
+ * Every other prepared checkout still answers only the request it was bound to.
  */
 export declare function preparedApprovalAnswersRetry(psp: string): boolean;
 /**
@@ -50,7 +57,8 @@ export declare function preparedApprovalAnswersRetry(psp: string): boolean;
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
- * live, testsecureacceptance is test.
+ * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
+ * sandbox-vault is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**

package/dist/prepared-processor.js

@@ -13,6 +13,7 @@ import { eprotectPreparationUrl, isPreparedEprotectRequest } from './eprotect.ge
 import { amadeusEnvironment, amadeusPreparationUrls, amadeusRequestRefusal, isPreparedAmadeusRequest } from './amadeus-checkout.generated.js';
 import { isPreparedVerifoneRequest } from './verifone.js';
 import { isPreparedSecureAcceptanceRequest, secureAcceptanceEnvironment, secureAcceptancePreparationUrl, secureAcceptanceRequestRefusal, } from './cybersource-secure-acceptance.generated.js';
+import { PADDLE_VGS_CARDS_URLS, isPreparedPaddleVgsRequest } from './paddle-vgs.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -30,11 +31,14 @@ export function preparationRequestMethod(psp) {
  * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
  * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
  * clicked again). The cardholder's device answers with a token that pays nothing until the
- * merchant's server charges it. Every other prepared checkout still answers only the request it
- * was bound to.
+ * merchant's server charges it. Paddle VGS too: Paddle's frame aborts its card request to its VGS
+ * card vault 10 seconds after sending it and sends the same body under the same bearer once more, and
+ * the device's answer is the stored card's id, which pays nothing until Paddle's /pay names it. Only
+ * that repeat, byte for byte under the same bearer, is answered (cdp.ts paddleVgsRetryKey).
+ * Every other prepared checkout still answers only the request it was bound to.
  */
 export function preparedApprovalAnswersRetry(psp) {
-    return psp === 'bambora';
+    return psp === 'bambora' || psp === 'paddle_vgs';
 }
 /**
  * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
@@ -43,13 +47,14 @@ export function preparedApprovalAnswersRetry(psp) {
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
- * live, testsecureacceptance is test.
+ * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
+ * sandbox-vault is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
     return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
-        'cybersource_secure_acceptance'].includes(psp) && ['production', 'sandbox'].includes(environment);
+        'cybersource_secure_acceptance', 'paddle_vgs'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -91,6 +96,9 @@ export function preparationEndpoint(psp, environment) {
     // The token-create URL on the environment's host, as the API names it: the one request the claim binds.
     if (psp === 'cybersource_secure_acceptance')
         return secureAcceptancePreparationUrl(environment);
+    // Paddle VGS: the environment's one card URL, the only URL the claim takes for it.
+    if (psp === 'paddle_vgs')
+        return PADDLE_VGS_CARDS_URLS[environment];
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -236,6 +244,10 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     // Flex gate verified the issuing field iframe's capture context against that JWE's key.
     if (psp === 'cybersource_flex')
         return isPreparedCybersourceFlexRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers);
+    // Paddle VGS: the environment's own card URL and payment-core's whole request rule (the checkout's bearer,
+    // the JSON:API content type and the frame's body), the rule the API and the Vault bind with too.
+    if (psp === 'paddle_vgs')
+        return isPreparedPaddleVgsRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers ?? {});
     if (psp === 'creditguard')
         return matchesPreparedCreditguard(environment, requestUrl, body, headers, binding);
     // A Verifone request is judged only through the profile its preparation names (matchesPreparation).