@agent-cards/sdk 0.23.13 → 0.23.15

package/dist/wix-payments.generated.js

@@ -0,0 +1,241 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 4e41c8fcd50a59095d1cd3b65d988dc506309c247bfc2de6ec4641210c0846c2
+// src/wix-payments.js
+var WIX_PAYMENTS_PSP = "wix_payments";
+var WIX_PAYMENTS_CAPABILITY = "wix_payments_tokenize";
+var WIX_PAYMENTS_OPERATION = "wix_payments.card_request";
+var WIX_PAYMENTS_HOST = "cashier-pci.wixapps.net";
+var WIX_PAYMENTS_TOKENIZE_URL = "https://cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens";
+var WIX_PAYMENTS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["wix_payments_url_refused", "wix_payments_headers_refused", "wix_payments_body_unsupported"]);
+var BODY_LIMIT = 8192;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["cvv", "creditCard"]);
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["number", "expiration", "additionalInformation", "billingAddress"]);
+var EXPIRATION_KEYS = /* @__PURE__ */ Object.freeze(["month", "year"]);
+var HOLDER_KEYS = /* @__PURE__ */ Object.freeze(["holderName"]);
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var FIRST_YEAR = 2e3;
+var LAST_YEAR = 2099;
+var FIELD_NAME = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+var MAX_FIELDS = 32;
+var MAX_NESTED_FIELDS = 8;
+var TEXT_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var INSTANCE = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
+var JSON_TYPE = /^application\/json(?:\s*;\s*charset=utf-8)?$/i;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isWixPaymentsTokenizeUrl(url) {
+    return url === WIX_PAYMENTS_TOKENIZE_URL;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+var billingText = (value) => value === null || plainText(value);
+function billingFields(value) {
+    if (!record(value))
+        return false;
+    const names = Object.keys(value);
+    if (names.length > MAX_FIELDS)
+        return false;
+    return names.every((name) => {
+        const field = value[name];
+        if (!FIELD_NAME.test(name))
+            return false;
+        if (!record(field))
+            return billingText(field);
+        const nested = Object.keys(field);
+        return nested.length <= MAX_NESTED_FIELDS && nested.every((key) => FIELD_NAME.test(key) && billingText(field[key]));
+    });
+}
+function wixPaymentsBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null || !sameKeys(value, ROOT_KEYS) || !record(value.creditCard) || !sameKeys(value.creditCard, CARD_KEYS)) {
+        return refuse("wix_payments_body_unsupported");
+    }
+    const card = value.creditCard;
+    const expiration = card.expiration;
+    const holder = card.additionalInformation;
+    if (typeof value.cvv !== "string" || !SECURITY_CODE.test(value.cvv) || typeof card.number !== "string" || !CARD_NUMBER.test(card.number) || !record(expiration) || !sameKeys(expiration, EXPIRATION_KEYS) || !Number.isInteger(expiration.month) || expiration.month < 1 || expiration.month > 12 || !Number.isInteger(expiration.year) || expiration.year < FIRST_YEAR || expiration.year > LAST_YEAR || !record(holder) || !sameKeys(holder, HOLDER_KEYS) || !plainText(holder.holderName) || !billingFields(card.billingAddress)) {
+        return refuse("wix_payments_body_unsupported");
+    }
+    return CARD;
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function wixPaymentsRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "wix_payments_url_refused";
+    if (!isWixPaymentsTokenizeUrl(request.url))
+        return "wix_payments_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const authorization = headerValue(headers, "authorization");
+    if (contentType === null || !JSON_TYPE.test(contentType.trim()) || authorization === null || !INSTANCE.test(authorization)) {
+        return "wix_payments_headers_refused";
+    }
+    const verdict = wixPaymentsBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedWixPaymentsRequest(url, method, body, environment, headers) {
+    return environment === "production" && wixPaymentsRequestRefusal({ url, method, headers, body }) === null;
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "parahouse_magazine", merchant: "ParaHouse Magazine", origins: ["https://www.parahousemagazine.com"] }),
+    pin({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
+    pin({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
+]);
+function wixPaymentsMerchantPin(merchantOrigin, pins = WIX_PAYMENTS_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin)) ?? null;
+}
+function wixPaymentsMerchantRefusal(environment, merchantOrigin, pins = WIX_PAYMENTS_MERCHANT_PINS) {
+    if (environment !== "production")
+        return "unsupported_environment";
+    return wixPaymentsMerchantPin(merchantOrigin, pins) ? null : "wix_payments_merchant_unreviewed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    wix_payments_url_refused: "Refusing to pay: this Wix card request does not go to Wix's card tokenizer exactly as Wix's card form sends it. Nothing was sent.",
+    wix_payments_headers_refused: "Refusing to pay: this Wix card request does not carry the checkout's own headers. Nothing was sent.",
+    wix_payments_body_unsupported: "Refusing to pay: this is not the card request of Wix's card form. Nothing was sent."
+});
+function wixPaymentsRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.wix_payments_body_unsupported;
+}
+var WHERE = /* @__PURE__ */ Object.freeze(["cvv", "creditCard.number", "creditCard.expiration.month", "creditCard.expiration.year"]);
+var fullYear = (year) => Number.isInteger(year) && year >= 0 && year <= 99 ? FIRST_YEAR + year : year;
+function frameCard(card) {
+    if (!card)
+        return null;
+    const number = String(card.number);
+    const cvv = String(card.cvc);
+    const month = Number(card.month);
+    const year = fullYear(Number(card.year));
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvv) || !Number.isInteger(month) || month < 1 || month > 12 || !Number.isInteger(year) || year < FIRST_YEAR || year > LAST_YEAR)
+        return null;
+    return { number, cvv, month, year };
+}
+function written(body, values) {
+    const value = JSON.parse(body);
+    value.cvv = values.cvv;
+    value.creditCard.number = values.number;
+    value.creditCard.expiration.month = values.month;
+    value.creditCard.expiration.year = values.year;
+    return JSON.stringify(value);
+}
+function injectWixPaymentsCard(body, card) {
+    const verdict = wixPaymentsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(wixPaymentsRefusalMessage(verdict.code));
+    const values = frameCard(card);
+    if (!values)
+        throw new Error("Could not fill the card fields for Wix. Nothing was sent.");
+    return { body: written(body, values), where: [...WHERE] };
+}
+function isWixPaymentsDeviceRequest(templateBody, deviceBody) {
+    if (wixPaymentsBodyVerdict(templateBody).verdict !== "card" || wixPaymentsBodyVerdict(deviceBody).verdict !== "card")
+        return false;
+    const device = JSON.parse(deviceBody);
+    const values = { cvv: device.cvv, number: device.creditCard.number, month: device.creditCard.expiration.month, year: device.creditCard.expiration.year };
+    return written(templateBody, values) === deviceBody && values.number !== JSON.parse(templateBody).creditCard.number;
+}
+var ANSWER_LIMIT = 65536;
+var TOKEN = /^[A-Za-z0-9_-]{8,128}$/;
+var LONG_DIGIT_RUN = /[0-9]{13,}/;
+var REFUSAL_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
+var MAX_CODE_DIGITS = 11;
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var tokenValue = (value) => typeof value === "string" && TOKEN.test(value) && !LONG_DIGIT_RUN.test(value);
+var boundedCode = (value) => typeof value === "string" && REFUSAL_CODE.test(value) && (value.match(/[0-9]/g) ?? []).length <= MAX_CODE_DIGITS ? value : null;
+function wixPaymentsRefusalCode(text) {
+    const answer = readAnswer(text);
+    const details = answer && record(answer.details) ? answer.details : null;
+    const application = details && record(details.applicationError) ? details.applicationError : null;
+    return application ? boundedCode(application.code) : null;
+}
+function tokenAnswer(answer) {
+    const token = answer && record(answer.token) ? answer.token : null;
+    if (!token || !tokenValue(token.token))
+        return null;
+    const out = { token: token.token };
+    if (token.securityCodeToken !== void 0 && token.securityCodeToken !== null) {
+        if (!tokenValue(token.securityCodeToken))
+            return null;
+        out.securityCodeToken = token.securityCodeToken;
+    }
+    if (token.creditCard !== void 0 && token.creditCard !== null) {
+        if (!record(token.creditCard))
+            return null;
+        const card = {};
+        const expiration = token.creditCard.expiration;
+        if (expiration !== void 0 && expiration !== null) {
+            if (!record(expiration) || !Number.isInteger(expiration.month) || expiration.month < 1 || expiration.month > 12 || !Number.isInteger(expiration.year) || expiration.year < FIRST_YEAR || expiration.year > LAST_YEAR)
+                return null;
+            card.expiration = { month: expiration.month, year: expiration.year };
+        }
+        const holder = token.creditCard.additionalInformation;
+        if (holder !== void 0 && holder !== null) {
+            if (!record(holder) || holder.holderName !== void 0 && !plainText(holder.holderName))
+                return null;
+            if (holder.holderName !== void 0)
+                card.additionalInformation = { holderName: holder.holderName };
+        }
+        out.creditCard = card;
+    }
+    return out;
+}
+function wixPaymentsAnswerOutcome(status, text, card) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "wix_payments_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: wixPaymentsRefusalCode(text) ?? `http_${status}` };
+    if (status !== 200)
+        return { outcome: "unknown", reason: "wix_payments_unconfirmed" };
+    const token = tokenAnswer(readAnswer(text));
+    if (token === null)
+        return { outcome: "unknown", reason: "wix_payments_unsafe_response" };
+    const number = card ? String(card.number).replace(/[^0-9]/g, "") : "";
+    if (number && [token.token, token.securityCodeToken ?? ""].some((value) => value.replace(/[^0-9]/g, "").includes(number))) {
+        return { outcome: "unknown", reason: "wix_payments_unsafe_response" };
+    }
+    const expiration = token.creditCard && token.creditCard.expiration;
+    if (card && expiration && (expiration.month !== Number(card.month) || expiration.year !== fullYear(Number(card.year)))) {
+        return { outcome: "unknown", reason: "wix_payments_token_mismatch" };
+    }
+    return { outcome: "approved", body: JSON.stringify({ token }) };
+}
+export { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_HOST, WIX_PAYMENTS_MERCHANT_PINS, WIX_PAYMENTS_OPERATION, WIX_PAYMENTS_PSP, WIX_PAYMENTS_REFUSAL_CODES, WIX_PAYMENTS_TOKENIZE_URL, injectWixPaymentsCard, isPreparedWixPaymentsRequest, isWixPaymentsDeviceRequest, isWixPaymentsTokenizeUrl, wixPaymentsAnswerOutcome, wixPaymentsBodyVerdict, wixPaymentsMerchantPin, wixPaymentsMerchantRefusal, wixPaymentsRefusalCode, wixPaymentsRefusalMessage, wixPaymentsRequestRefusal };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.13",
+  "version": "0.23.15",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -24,11 +24,14 @@
     "access": "public"
   },
   "scripts": {
-    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
-    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
+    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts), the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones), and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned.",
+    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs redact-url.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs",
+    "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
+    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
+    "verify:pack": "node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs paddle-tokenex.test.mjs lyra.test.mjs redact-url.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node paypal-card-forms-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs && node ebanx-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",