@agent-cards/sdk 0.23.11 → 0.23.13

package/dist/paddle-vgs.generated.js

@@ -0,0 +1,408 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: f3437a15e11b72b9958179cc9610fdafb411cc5db76be536af62c08360a45575
+// src/paddle-vgs.js
+var PADDLE_VGS_PSP = "paddle_vgs";
+var PADDLE_VGS_CAPABILITY = "paddle_vgs_cards";
+var PADDLE_VGS_OPERATION = "paddle_vgs.card_request";
+var PADDLE_VGS_CONTENT_TYPE = "application/vnd.api+json";
+var PADDLE_VGS_CARDS_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://vault.paddle.com/cards",
+    sandbox: "https://sandbox-vault.paddle.com/cards"
+});
+var PADDLE_VGS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["paddle_vgs_url_refused", "paddle_vgs_headers_refused", "paddle_vgs_body_unsupported"]);
+var BODY_LIMIT = 4096;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["data"]);
+var DATA_KEYS = /* @__PURE__ */ Object.freeze(["type", "attributes"]);
+var ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["pan", "cvc", "exp_month", "exp_year", "cardholder"]);
+var WHERE = /* @__PURE__ */ Object.freeze(["data.attributes.pan", "data.attributes.cvc", "data.attributes.exp_month", "data.attributes.exp_year"]);
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var NAME_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var PAN_LIKE = /(?:[0-9][ _.:-]*){12,}/;
+var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
+var BEARER = /^Bearer [A-Za-z0-9_-]{8,512}\.([A-Za-z0-9_-]{8,4096})\.[A-Za-z0-9_-]{8,1024}$/;
+var BEARER_LIFETIME_SECONDS = 1200;
+var BASE64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function base64UrlText(segment) {
+    let bits = 0;
+    let value = 0;
+    let escaped = "";
+    for (const character of segment) {
+        const sextet = BASE64URL.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            escaped += "%" + (value >> bits & 255).toString(16).padStart(2, "0");
+            value &= (1 << bits) - 1;
+        }
+    }
+    try {
+        return decodeURIComponent(escaped);
+    }
+    catch {
+        return null;
+    }
+}
+function bearerClaims(authorization) {
+    const match = typeof authorization === "string" ? BEARER.exec(authorization) : null;
+    const text = match ? base64UrlText(match[1]) : null;
+    if (text === null)
+        return null;
+    try {
+        const claims = JSON.parse(text);
+        return record(claims) ? claims : null;
+    }
+    catch {
+        return null;
+    }
+}
+function bearerRunning(authorization, nowSeconds = Math.floor(Date.now() / 1e3)) {
+    const claims = bearerClaims(authorization);
+    if (!claims || !Number.isSafeInteger(claims.iat) || !Number.isSafeInteger(claims.exp))
+        return false;
+    return claims.exp > claims.iat && claims.exp - claims.iat <= BEARER_LIFETIME_SECONDS && claims.exp > nowSeconds;
+}
+function paddleVgsEnvironment(url) {
+    if (url === PADDLE_VGS_CARDS_URLS.production)
+        return "production";
+    if (url === PADDLE_VGS_CARDS_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isPaddleVgsCardsUrl(url) {
+    return paddleVgsEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function paddleVgsBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null || !sameKeys(value, ROOT_KEYS) || !record(value.data) || !sameKeys(value.data, DATA_KEYS) || value.data.type !== "cards" || !record(value.data.attributes) || !sameKeys(value.data.attributes, ATTRIBUTE_KEYS)) {
+        return refuse("paddle_vgs_body_unsupported");
+    }
+    const card = value.data.attributes;
+    const holder = card.cardholder;
+    if (typeof card.pan !== "string" || !CARD_NUMBER.test(card.pan) || typeof card.cvc !== "string" || !SECURITY_CODE.test(card.cvc) || !Number.isInteger(card.exp_month) || card.exp_month < 1 || card.exp_month > 12 || !Number.isInteger(card.exp_year) || card.exp_year < 0 || card.exp_year > 99 || !record(holder) || !sameKeys(holder, ["name"]) || typeof holder.name !== "string" || holder.name.length > NAME_LIMIT || CONTROL.test(holder.name) || cardLikeName(holder.name)) {
+        return refuse("paddle_vgs_body_unsupported");
+    }
+    return CARD;
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function paddleVgsRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "paddle_vgs_url_refused";
+    if (!isPaddleVgsCardsUrl(request.url))
+        return "paddle_vgs_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const authorization = headerValue(headers, "authorization");
+    if (contentType === null || contentType.trim().toLowerCase() !== PADDLE_VGS_CONTENT_TYPE || authorization === null || !bearerRunning(authorization))
+        return "paddle_vgs_headers_refused";
+    const verdict = paddleVgsBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedPaddleVgsRequest(url, method, body, environment, headers) {
+    return (environment === "production" || environment === "sandbox") && paddleVgsEnvironment(url) === environment && paddleVgsRequestRefusal({ url, method, headers, body }) === null;
+}
+var pin = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
+function paddleVgsMerchantPin(merchantOrigin, pins = PADDLE_VGS_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin)) ?? null;
+}
+function paddleVgsMerchantRefusal(environment, merchantOrigin, authorization, pins = PADDLE_VGS_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    const found = paddleVgsMerchantPin(merchantOrigin, pins);
+    if (!found)
+        return "paddle_vgs_merchant_unreviewed";
+    if (found.sellerClaim && authorization !== void 0) {
+        const claims = bearerClaims(authorization);
+        if (!claims || claims[found.sellerClaim.name] !== found.sellerClaim.value)
+            return "paddle_vgs_seller_unreviewed";
+    }
+    return null;
+}
+function paddleVgsSellerClaimsPinned(pins = PADDLE_VGS_MERCHANT_PINS) {
+    return Array.isArray(pins) && pins.length > 0 && pins.every((entry) => !!entry && !!entry.sellerClaim && typeof entry.sellerClaim.name === "string" && entry.sellerClaim.name !== "" && typeof entry.sellerClaim.value === "string" && entry.sellerClaim.value !== "");
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    paddle_vgs_url_refused: "Refusing to pay: this Paddle card request does not go to Paddle's card vault exactly as Paddle's checkout sends it. Nothing was sent.",
+    paddle_vgs_headers_refused: "Refusing to pay: this Paddle card request does not carry the checkout's own headers. Nothing was sent.",
+    paddle_vgs_body_unsupported: "Refusing to pay: this is not the card request of Paddle's checkout. Nothing was sent."
+});
+function paddleVgsRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.paddle_vgs_body_unsupported;
+}
+var CARD_MISMATCH_REFUSAL = "Refusing to pay: this Paddle payment names a card expiry or network that is not your card's. Nothing was sent.";
+var PADDLE_VGS_CARD_NETWORKS = /* @__PURE__ */ Object.freeze(["visa", "mastercard", "amex"]);
+function cardNetwork(number) {
+    if (typeof number !== "string" || !CARD_NUMBER.test(number))
+        return null;
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (number[0] === "4")
+        return "visa";
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "mastercard";
+    if (two === 34 || two === 37)
+        return "amex";
+    return null;
+}
+function paddleVgsCardRefusal(body, card) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        return verdict.code;
+    const attributes = JSON.parse(body).data.attributes;
+    const number = card ? String(card.number) : "";
+    const month = card ? Number(card.month) : NaN;
+    const year = card ? Number(card.year) % 100 : NaN;
+    const network = cardNetwork(number);
+    if (attributes.exp_month !== month || attributes.exp_year !== year || network === null || cardNetwork(attributes.pan) !== network) {
+        return "paddle_vgs_card_mismatch";
+    }
+    return null;
+}
+var storedBrand = (brand) => typeof brand === "string" && brand !== "" ? brand.toLowerCase() : null;
+function paddleVgsStoredCardRefusal(brand) {
+    const network = storedBrand(brand);
+    return network === null || PADDLE_VGS_CARD_NETWORKS.includes(network) ? null : "paddle_vgs_card_unsupported";
+}
+function paddleVgsTypedCardRefusal(body, stored) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        return verdict.code;
+    const attributes = JSON.parse(body).data.attributes;
+    const card = stored && typeof stored === "object" ? stored : {};
+    if (Number.isInteger(card.expiryMonth) && attributes.exp_month !== card.expiryMonth)
+        return "paddle_vgs_card_mismatch";
+    if (Number.isInteger(card.expiryYear) && attributes.exp_year !== card.expiryYear % 100)
+        return "paddle_vgs_card_mismatch";
+    const brand = storedBrand(card.brand);
+    if (brand !== null && cardNetwork(attributes.pan) !== brand)
+        return "paddle_vgs_card_mismatch";
+    return null;
+}
+function injectPaddleVgsCard(body, card) {
+    const verdict = paddleVgsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(paddleVgsRefusalMessage(verdict.code));
+    const number = card ? String(card.number) : "";
+    const cvc = card ? String(card.cvc) : "";
+    const month = card ? Number(card.month) : NaN;
+    const year = card ? Number(card.year) % 100 : NaN;
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvc) || !Number.isInteger(month) || month < 1 || month > 12 || !Number.isInteger(year) || year < 0) {
+        throw new Error("Could not fill the card fields for Paddle. Nothing was sent.");
+    }
+    if (paddleVgsCardRefusal(body, { number, month, year }) !== null)
+        throw new Error(CARD_MISMATCH_REFUSAL);
+    const value = JSON.parse(body);
+    const attributes = value.data.attributes;
+    attributes.pan = number;
+    attributes.cvc = cvc;
+    attributes.exp_month = month;
+    attributes.exp_year = year;
+    return { body: JSON.stringify(value), where: [...WHERE] };
+}
+var ANSWER_LIMIT = 65536;
+var STORED_CARD_ID = /^[A-Za-z0-9_-]{1,128}$/;
+var REFUSAL_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
+var MAX_CODE_DIGITS = 11;
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var isStoredCardId = (id) => typeof id === "string" && STORED_CARD_ID.test(id) && /[A-Za-z]/.test(id) && !PAN_LIKE.test(id);
+function storedCardId(answer) {
+    const data = answer && answer.data;
+    if (!record(data) || data.type !== "cards")
+        return null;
+    return isStoredCardId(data.id) ? data.id : null;
+}
+var boundedCode = (value) => typeof value === "string" && REFUSAL_CODE.test(value) && (value.match(/[0-9]/g) ?? []).length <= MAX_CODE_DIGITS ? value : null;
+function paddleVgsRefusalCode(text) {
+    const answer = readAnswer(text);
+    if (!answer)
+        return null;
+    const first = Array.isArray(answer.errors) && record(answer.errors[0]) ? answer.errors[0] : null;
+    return boundedCode(first && first.error_code) ?? boundedCode(first && first.code) ?? boundedCode(answer.error_code) ?? boundedCode(answer.code);
+}
+function paddleVgsAnswerOutcome(status, text, card) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "paddle_vgs_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: paddleVgsRefusalCode(text) ?? `http_${status}` };
+    if (status !== 200 && status !== 201)
+        return { outcome: "unknown", reason: "paddle_vgs_unconfirmed" };
+    const id = storedCardId(readAnswer(text));
+    if (id === null)
+        return { outcome: "unknown", reason: "paddle_vgs_unsafe_response" };
+    const number = card ? String(card.number).replace(/[^0-9]/g, "") : "";
+    if (number && id.replace(/[^0-9]/g, "").includes(number))
+        return { outcome: "unknown", reason: "paddle_vgs_unsafe_response" };
+    return { outcome: "approved", body: JSON.stringify({ data: { type: "cards", id } }) };
+}
+var PADDLE_VGS_CARD_ID_WINDOW_MS = 6e4;
+var PAY_URL = /^https:\/\/(sandbox-)?checkout-service\.paddle\.com\/(checkout|transaction-checkout)\/[A-Za-z0-9_-]{1,64}\/pay$/;
+function paddleVgsPayTarget(url) {
+    const match = typeof url === "string" ? PAY_URL.exec(url) : null;
+    return match ? Object.freeze({ environment: match[1] ? "sandbox" : "production", line: match[2] === "checkout" ? "classic" : "billing" }) : null;
+}
+function paddleVgsPayCarriesStoredCard(body) {
+    if (typeof body !== "string")
+        return true;
+    try {
+        return JSON.stringify(JSON.parse(body)).includes('"vgs_card"');
+    }
+    catch {
+        return true;
+    }
+}
+var FRAME_BRANDS = /* @__PURE__ */ Object.freeze(["visa", "master", "american_express", "discover", "diners_club", "jcb", "maestro", "dankort", "unionpay", "unknown"]);
+var PAY_BRANDS = /* @__PURE__ */ Object.freeze({ visa: "visa", mastercard: "master", amex: "american_express" });
+var FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
+var FIRST_SIX = /^[0-9]{6}$/;
+var LAST_FOUR = /^[0-9]{4}$/;
+var fullYear = (year) => {
+    const value = Number(year);
+    return Number.isInteger(value) && value >= 0 && value <= 99 ? 2e3 + value : value;
+};
+var expiryMonth = (month) => Number.isInteger(month) && month >= 1 && month <= 12;
+var expiryYear = (year) => Number.isInteger(year) && year >= 2e3 && year <= 2099;
+function paddleVgsCardFacts(card) {
+    const number = card ? String(card.number) : "";
+    const network = cardNetwork(number);
+    const month = card ? Number(card.month) : NaN;
+    const year = card ? fullYear(card.year) : NaN;
+    if (network === null || !expiryMonth(month) || !expiryYear(year))
+        throw new Error("Could not read this card's details for Paddle. Nothing was sent.");
+    return Object.freeze({ card_first_six: number.slice(0, 6), card_last_four: number.slice(-4), expiry_month: month, expiry_year: year, card_brand: PAY_BRANDS[network] });
+}
+function paddleVgsCardFactsOf(value) {
+    if (!record(value))
+        return null;
+    const keys = Object.keys(value);
+    if (keys.length !== FACT_KEYS.length || !FACT_KEYS.every((key) => keys.includes(key)))
+        return null;
+    const { card_first_six: firstSix, card_last_four: lastFour, expiry_month: month, expiry_year: year, card_brand: brand } = value;
+    const network = typeof firstSix === "string" && FIRST_SIX.test(firstSix) ? cardNetwork(`${firstSix}000000`) : null;
+    if (network === null || PAY_BRANDS[network] !== brand || typeof lastFour !== "string" || !LAST_FOUR.test(lastFour) || !expiryMonth(month) || !expiryYear(year))
+        return null;
+    return Object.freeze({ card_first_six: firstSix, card_last_four: lastFour, expiry_month: month, expiry_year: year, card_brand: brand });
+}
+function paddleVgsCardFactsAgree(facts, stored) {
+    const read = paddleVgsCardFactsOf(facts);
+    if (!read)
+        return false;
+    const card = record(stored) ? stored : {};
+    const network = Object.keys(PAY_BRANDS).find((name) => PAY_BRANDS[name] === read.card_brand);
+    const brand = storedBrand(card.brand);
+    return !(typeof card.last4 === "string" && LAST_FOUR.test(card.last4) && card.last4 !== read.card_last_four) && (brand === null || brand === network) && !(Number.isInteger(card.expiryMonth) && card.expiryMonth !== read.expiry_month) && !(Number.isInteger(card.expiryYear) && card.expiryYear % 100 !== read.expiry_year % 100);
+}
+var PAY_BODY_LIMIT = 16384;
+var PAY_DATA_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "payment_method_data"]);
+var PAY_CARD_KEYS = /* @__PURE__ */ Object.freeze(["metadata", "three_d_s", "vgs_card"]);
+var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
+var BROWSER_INFO = /^[A-Za-z0-9+/]{1,4096}={0,2}$/;
+var RADAR_TOKEN = /^[\x21-\x7e]{1,512}$/;
+var COUNTRY_CODE = /^[A-Za-z]{2}$/;
+var FRONTEND_HOST = /^https:\/\/[\x21-\x7e]{1,1024}$/;
+var radarKeys = (value) => sameKeys(value, ["token", "country_code"]) || sameKeys(value, ["country_code", "token"]);
+function readPay(body, line) {
+    if (typeof body !== "string" || body === "" || body.length > PAY_BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const data = value.data;
+    if (!sameKeys(value, ["data"]) || !record(data) || !(sameKeys(data, PAY_DATA_KEYS) || sameKeys(data, [...PAY_DATA_KEYS, "checkout"])) || data.payment_method_type !== (line === "classic" ? "CARD" : "card"))
+        return null;
+    if (data.checkout !== void 0 && !(record(data.checkout) && sameKeys(data.checkout, ["frontend_host"]) && typeof data.checkout.frontend_host === "string" && FRONTEND_HOST.test(data.checkout.frontend_host)))
+        return null;
+    const method = data.payment_method_data;
+    const card = record(method) && sameKeys(method, ["card"]) ? method.card : null;
+    if (!record(card) || !(sameKeys(card, PAY_CARD_KEYS) || sameKeys(card, [...PAY_CARD_KEYS, "session_tracking"])))
+        return null;
+    const metadata = card.metadata;
+    if (!record(metadata) || !sameKeys(metadata, METADATA_KEYS) || typeof metadata.cardholder_name !== "string" || metadata.cardholder_name.length > NAME_LIMIT || CONTROL.test(metadata.cardholder_name) || cardLikeName(metadata.cardholder_name) || typeof metadata.card_first_six !== "string" || !FIRST_SIX.test(metadata.card_first_six) || typeof metadata.card_last_four !== "string" || !LAST_FOUR.test(metadata.card_last_four) || !expiryMonth(metadata.expiry_month) || !expiryYear(metadata.expiry_year) || !FRAME_BRANDS.includes(metadata.card_brand))
+        return null;
+    const details = card.three_d_s;
+    if (!record(details) || !sameKeys(details, ["browser_info"]) || typeof details.browser_info !== "string" || !BROWSER_INFO.test(details.browser_info))
+        return null;
+    if (!record(card.vgs_card) || !sameKeys(card.vgs_card, ["card_id"]) || !isStoredCardId(card.vgs_card.card_id))
+        return null;
+    if (card.session_tracking !== void 0) {
+        const tracking = card.session_tracking;
+        const radar = record(tracking) && sameKeys(tracking, ["stripe_radar"]) ? tracking.stripe_radar : null;
+        if (!record(radar) || !radarKeys(radar) || typeof radar.token !== "string" || !RADAR_TOKEN.test(radar.token) || typeof radar.country_code !== "string" || !COUNTRY_CODE.test(radar.country_code))
+            return null;
+    }
+    return value;
+}
+function paddleVgsPayVerdict(request, approved) {
+    const facts = record(approved) ? paddleVgsCardFactsOf(approved.facts) : null;
+    if (!facts || !isStoredCardId(approved.cardId) || approved.environment !== "production" && approved.environment !== "sandbox") {
+        return refuse("paddle_vgs_pay_unbound");
+    }
+    const target = record(request) && typeof request.method === "string" && request.method.toUpperCase() === "POST" ? paddleVgsPayTarget(request.url) : null;
+    const value = target ? readPay(request.body, target.line) : null;
+    if (!value)
+        return refuse("paddle_vgs_pay_unsupported");
+    const card = value.data.payment_method_data.card;
+    if (target.environment !== approved.environment || card.vgs_card.card_id !== approved.cardId)
+        return refuse("paddle_vgs_pay_card_mismatch");
+    for (const key of FACT_KEYS)
+        card.metadata[key] = facts[key];
+    return Object.freeze({ verdict: "continue", body: JSON.stringify(value) });
+}
+export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 66c54c571ca1294220b070eaca1ca3888feebcd7f2562b761d74ded25a453c57
+// artifact-sha256: 38065a5bd834d5233979a0528fde4345378914e8e8b1a63e329bff0994572da5
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -404,14 +404,8 @@ function payrailsCardOnFileRefusal(body) {
 }
 var AUTHORIZE_LIMIT = 32768;
 var AUTHORIZE_KEYS = Object.freeze(["amount", "paymentComposition", "returnInfo", "meta"]);
-var COMPOSITION_KEYS = Object.freeze([
-    "paymentMethodCode",
-    "integrationType",
-    "amount",
-    "storeInstrument",
-    "paymentInstrumentData",
-    "enrollInstrumentToNetworkOffers"
-]);
+var COMPOSITION_KEYS = Object.freeze(["paymentMethodCode", "integrationType", "amount", "storeInstrument", "paymentInstrumentData"]);
+var ENROLLMENT_COMPOSITION_KEYS = Object.freeze([...COMPOSITION_KEYS, "enrollInstrumentToNetworkOffers"]);
 var RETURN_KEYS = Object.freeze(["success", "cancel", "error", "pending"]);
 var AMOUNT_VALUE = /^[0-9]{1,15}(?:\.[0-9]{1,12})?$/;
 var CURRENCY = /^[A-Z]{3}$/;
@@ -476,12 +470,14 @@ function readAuthorizeBody(body) {
     const amount = readAmount(parsed.amount);
     const parts = parsed.paymentComposition;
     const part = Array.isArray(parts) && parts.length === 1 && record(parts[0]) ? parts[0] : null;
-    if (!amount || !part || !sameKeys(part, COMPOSITION_KEYS) || part.paymentMethodCode !== "card" || part.integrationType !== "api")
+    const flagged = !!part && owns(part, "enrollInstrumentToNetworkOffers");
+    if (!amount || !part || !sameKeys(part, flagged ? ENROLLMENT_COMPOSITION_KEYS : COMPOSITION_KEYS) || part.paymentMethodCode !== "card" || part.integrationType !== "api")
         return malformed;
     const partAmount = readAmount(part.amount);
     if (!partAmount || partAmount.value !== amount.value || partAmount.currency !== amount.currency)
         return malformed;
-    if (typeof part.storeInstrument !== "boolean" || typeof part.enrollInstrumentToNetworkOffers !== "boolean")
+    const enrollInstrumentToNetworkOffers = flagged ? part.enrollInstrumentToNetworkOffers : false;
+    if (typeof part.storeInstrument !== "boolean" || typeof enrollInstrumentToNetworkOffers !== "boolean")
         return malformed;
     const data = part.paymentInstrumentData;
     const keys = record(data) ? Object.keys(data) : [];
@@ -502,7 +498,7 @@ function readAuthorizeBody(body) {
         value: Object.freeze({
             amount: Object.freeze({ value: amount.value, currency: amount.currency }),
             storeInstrument: part.storeInstrument,
-            enrollInstrumentToNetworkOffers: part.enrollInstrumentToNetworkOffers,
+            enrollInstrumentToNetworkOffers,
             encryptedData: data.encryptedData,
             vaultProviderConfigId: data.vaultProviderConfigId,
             wrappedKeyBytes: jwe.wrappedKey.length

package/dist/paysafe.generated.d.ts

@@ -1,12 +1,10 @@
 export type PaysafePreparationEnvironment = 'production' | 'sandbox';
 export declare function paysafePreparationUrl(environment: string): string;
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
+/** The environment of a reviewed build's card URL. Exact strings refuse credentials, queries, fragments and URL normalization. */
 export declare function paysafeEnvironment(url: string): PaysafePreparationEnvironment | undefined;
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
+/** A reviewed Checkout build (BUILDS) starts a 40-second XHR when Pay is pressed. Prior approval may
+ * consume only its new-card request, including native clientInfo and headers, on the card URL that
+ * build sends to in the approved environment. Saved cards, alternate APIs and 3DS-only requests
+ * require separate review. The guard checks original bytes and never changes the request.
  */
 export declare function isPreparedPaysafeRequest(url: string, method: string, body: string | null, environment: string, headers?: Record<string, string>): boolean;

package/dist/paysafe.generated.js

@@ -1,10 +1,34 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 24c7940ae8974c0d24e5a365144c1b07ccc46863ae3094eb92b3c54c8307e837
+// source-sha256: afa00cd57246e51361474c66c5ab4282bd5b39f0297fdf68616e164e19ed1741
 import { readTokenizationJson } from './braintree.js';
+/** The card URL a preparation names: Checkout 1.8.0's. The bind takes the exact URL of the build the request names (BUILDS). */
 const ENDPOINTS = {
     production: 'https://hosted.paysafe.com/checkout/api/v1/tokenize',
     sandbox: 'https://hosted.test.paysafe.com/checkout/api/v1/tokenize',
 };
+/**
+ * The Paysafe Checkout builds whose new-card request a prior approval may consume, each read from
+ * Paysafe's public bundle. A request binds only to the build its own clientInfo.version names, on
+ * that build's URL and headers, so a build Paysafe ships later is refused, and nothing is sent,
+ * until it is read and listed here. The request moved inside 1.x: 1.8.0 to 1.12.0 post to
+ * hosted.paysafe.com with a correlationId header, 1.16.1 to api.paysafe.com with three other
+ * headers, so a version range would hold one build's request to another build's rules.
+ *
+ * 1.8.0: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
+ * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c; LIVE/TEST select hosted[.test].
+ * 1.16.1: the checkout/v1/latest loader (SHA-256 5fac65c4f7a74b45388ad3ce7c02282f05e832226792bebc417cd9ff191be4f0)
+ * names it and frames checkout/v1/latest/index.html. Its main.js (SHA-256
+ * 328c6443da930f3648826248afa3c342cdd07d04e49a78b0878dda187772bf80) posts to environment +
+ * "checkout/api/v1/tokenize", and its vendor.js (SHA-256 7348275bd07256e295f4b83b292c7fe5115dd7ac35d1b1fe3d26eda3c37d2835)
+ * maps LIVE/TEST to api[.test].paysafe.com and sets X-Internal-Correlation-Id, X-Paysafe-Credentials,
+ * X-App-Version (the clientInfo version) and X-TransactionSource (CheckoutV1 for paysafe.checkout).
+ * The TEST host serves the same bytes (read 2026-10-15).
+ */
+const BUILDS = [
+    { version: '1.8.0', endpoints: ENDPOINTS, correlation: 'correlationid', fixed: {} },
+    { version: '1.16.1', correlation: 'x-internal-correlation-id', fixed: { 'x-app-version': '1.16.1', 'x-transactionsource': 'CheckoutV1' },
+        endpoints: { production: 'https://api.paysafe.com/checkout/api/v1/tokenize', sandbox: 'https://api.test.paysafe.com/checkout/api/v1/tokenize' } },
+];
 const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
 const keys = (value, allowed) => record(value) && Object.keys(value).every(key => allowed.includes(key));
 const exact = (pattern, value) => typeof value === 'string' && pattern.exec(value)?.[0] === value;
@@ -16,27 +40,31 @@ export function paysafePreparationUrl(environment) {
         throw new Error('unsupported_preparation_environment');
     return ENDPOINTS[environment];
 }
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
+/** The environment of a reviewed build's card URL. Exact strings refuse credentials, queries, fragments and URL normalization. */
 export function paysafeEnvironment(url) {
-    return url === ENDPOINTS.production ? 'production' : url === ENDPOINTS.sandbox ? 'sandbox' : undefined;
+    const build = BUILDS.find(candidate => url === candidate.endpoints.production || url === candidate.endpoints.sandbox);
+    return !build ? undefined : url === build.endpoints.production ? 'production' : 'sandbox';
 }
 const ADDRESS_FIELDS = ['city', 'country', 'zip', 'street', 'street2', 'state'];
 function billing(value) {
     return keys(value, ADDRESS_FIELDS) && Object.values(value).every(value => text(value))
         && (!own(value, 'country') || exact(/^[A-Z]{2}$/, value.country));
 }
-function freshCard(value) {
+/** The reviewed build whose new-card body this is: never a saved card, a 3-D Secure request or another app's body. */
+function freshCardBuild(value) {
     if (!keys(value, ['card', 'clientInfo', 'billingAddress']) || !keys(value.card, ['cardNum', 'cardExpiry', 'cvv', 'holderName']))
-        return false;
+        return undefined;
     const card = value.card;
     if (!exact(/^[0-9]{12,19}$/, card.cardNum) || !exact(/^[0-9]{3,4}$/, card.cvv)
         || !keys(card.cardExpiry, ['month', 'year']) || !exact(/^(?:0[1-9]|1[0-2])$/, card.cardExpiry.month)
         || !exact(/^20[0-9]{2}$/, card.cardExpiry.year) || own(card, 'holderName') && !text(card.holderName)
         || own(value, 'billingAddress') && !billing(value.billingAddress))
-        return false;
+        return undefined;
     const info = value.clientInfo;
-    return keys(info, ['correlationId', 'invocationId', 'version', 'appName'])
-        && uuid(info.correlationId) && uuid(info.invocationId) && info.version === '1.8.0' && info.appName === 'paysafe.checkout';
+    if (!keys(info, ['correlationId', 'invocationId', 'version', 'appName'])
+        || !uuid(info.correlationId) || !uuid(info.invocationId) || info.appName !== 'paysafe.checkout')
+        return undefined;
+    return BUILDS.find(build => build.version === info.version);
 }
 const BROWSER_HEADERS = new Set(['accept', 'accept-language', 'accept-encoding', 'content-length', 'origin', 'referer',
     'user-agent', 'host', 'connection', 'cache-control', 'pragma', 'priority', 'dnt',
@@ -53,9 +81,11 @@ function singleUseCredential(value) {
         return false;
     }
 }
-function nativeHeaders(headers, correlationId) {
+/** The build's own headers, each once with its native value, and only headers a browser adds beside them. */
+function nativeHeaders(headers, correlationId, build) {
     if (!record(headers))
         return false;
+    const native = ['content-type', 'x-paysafe-credentials', build.correlation, ...Object.keys(build.fixed)];
     const parsed = new Map();
     let bytes = 0;
     for (const [name, value] of Object.entries(headers)) {
@@ -63,25 +93,27 @@ function nativeHeaders(headers, correlationId) {
         if (parsed.size >= 64 || parsed.has(lower) || !exact(/^[A-Za-z0-9-]+$/, name) || !text(value, 8192)
             || (bytes += name.length + value.length) > 32768)
             return false;
-        if (!['content-type', 'correlationid', 'x-paysafe-credentials'].includes(lower) && !BROWSER_HEADERS.has(lower)
+        if (!native.includes(lower) && !BROWSER_HEADERS.has(lower)
             && !exact(/^sec-ch-ua(?:-[a-z0-9-]+)?$/, lower))
             return false;
         parsed.set(lower, value);
     }
     return exact(/^application\/json(?:;\s*charset=utf-8)?$/i, parsed.get('content-type'))
-        && parsed.get('correlationid') === correlationId && singleUseCredential(parsed.get('x-paysafe-credentials'));
+        && parsed.get(build.correlation) === correlationId && singleUseCredential(parsed.get('x-paysafe-credentials'))
+        && Object.entries(build.fixed).every(([name, value]) => parsed.get(name) === value);
 }
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
+/** A reviewed Checkout build (BUILDS) starts a 40-second XHR when Pay is pressed. Prior approval may
+ * consume only its new-card request, including native clientInfo and headers, on the card URL that
+ * build sends to in the approved environment. Saved cards, alternate APIs and 3DS-only requests
+ * require separate review. The guard checks original bytes and never changes the request.
  */
 export function isPreparedPaysafeRequest(url, method, body, environment, headers) {
     if (method !== 'POST' || (environment !== 'production' && environment !== 'sandbox')
         || paysafeEnvironment(url) !== environment)
         return false;
     const value = readTokenizationJson(body);
-    return freshCard(value) && record(value.clientInfo) && nativeHeaders(headers, value.clientInfo.correlationId);
+    if (!value || !record(value.clientInfo))
+        return false;
+    const build = freshCardBuild(value);
+    return !!build && url === build.endpoints[environment] && nativeHeaders(headers, value.clientInfo.correlationId, build);
 }

package/dist/pre-claim.d.ts

@@ -13,6 +13,7 @@ import { type CardEndpointProfile } from './card-endpoint.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
 import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
+import { type PaddleVgsPayGate } from './paddle-vgs-pay.js';
 /** The native Stripe step the gate claimed, or null when none was: exactly what StripeCheckoutGate.claim returns. */
 type StripeStep = ReturnType<StripeCheckoutGate['claim']>;
 /** A synthetic response a gate fulfills locally. The effect applies CORS and encoding. */
@@ -189,6 +190,12 @@ export interface PreClaimContext {
      * Absent, no MyCheckout card submit is held to a product here.
      */
     worldlineMyCheckout?: WorldlineMyCheckoutProducts;
+    /**
+     * The attachment's binding of Paddle's /pay to the stored card's id it handed a frame (paddle-vgs-pay.ts),
+     * judged by the request's frame (`frame`). Absent, or for an org the API did not serve Paddle VGS to, Paddle's
+     * checkout services are not this gate's.
+     */
+    paddleVgsPay?: PaddleVgsPayGate;
 }
 /**
  * The URL an event may name for a request. For an armed merchant profile's
@@ -211,6 +218,7 @@ export declare const ekashuPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
 export declare const worldlineMyCheckoutPreClaim: PreClaimGate;
+export declare const paddleVgsPayPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or