@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/toast.generated.d.ts

@@ -0,0 +1,41 @@
+declare var TOAST_PSP: string;
+declare var TOAST_CAPABILITY: string;
+declare var TOAST_OPERATION: string;
+declare var TOAST_PAYMENT_METHODS_URL: string;
+declare var TOAST_KEY_ID: string;
+declare var TOAST_KEY: Readonly<{
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB";
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e";
+}>;
+declare var TOAST_CIPHERTEXT_BYTES: number;
+declare var TOAST_SUBSTITUTION: Readonly<{
+    at: "card";
+    fields: readonly string[];
+}>;
+declare var TOAST_REFUSAL_CODES: readonly string[];
+declare function isToastPaymentMethodsUrl(url: any): boolean;
+declare function isToastHost(url: any): boolean;
+declare function isToastCiphertext(value: any): boolean;
+declare function readToastBody(body: any): Readonly<{
+    ok: false;
+    code: any;
+}> | Readonly<{
+    ok: false;
+    wallet: true;
+}> | Readonly<{
+    ok: boolean;
+    sessionSecret: any;
+    postalCode: any;
+    cardData: any;
+}>;
+declare function toastBodyVerdict(body: any): Readonly<{
+    verdict: "card";
+}> | Readonly<{
+    verdict: "continue";
+}> | Readonly<{
+    verdict: "refuse";
+    code: any;
+}>;
+declare function toastRequestRefusal(request: any): any;
+declare function toastRefusalMessage(code: any): any;
+export { TOAST_CAPABILITY, TOAST_CIPHERTEXT_BYTES, TOAST_KEY, TOAST_KEY_ID, TOAST_OPERATION, TOAST_PAYMENT_METHODS_URL, TOAST_PSP, TOAST_REFUSAL_CODES, TOAST_SUBSTITUTION, isToastCiphertext, isToastHost, isToastPaymentMethodsUrl, readToastBody, toastBodyVerdict, toastRefusalMessage, toastRequestRefusal };

package/dist/toast.generated.js

@@ -0,0 +1,113 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: d0c3bda9a5b7939a6984156929cbcb7ba7d427fa38c544aad65c4593cf272d05
+// src/toast.js
+var TOAST_PSP = "toast";
+var TOAST_CAPABILITY = "toast_pinned_key";
+var TOAST_OPERATION = "toast.encrypted_card";
+var TOAST_PAYMENT_METHODS_URL = "https://payments.toasttab.com/v1/payment-methods";
+var TOAST_KEY_ID = "RSA-OAEP-SHA1::bacb4887-8314-4c23-98fc-d5ef7bc99e94_oo-legacy-browsers";
+var TOAST_KEY = /* @__PURE__ */ Object.freeze({
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB",
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e"
+});
+var TOAST_CIPHERTEXT_BYTES = 256;
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+var TOAST_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["toast_url_refused", "toast_foreign_key", "toast_keeps_card", "toast_body_malformed"]);
+var BODY_LIMIT = 8192;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["type", "card", "sessionSecret", "usage", "setupFutureUsage", "billingDetails"]);
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["keyId", "cardData"]);
+var WALLETS = /* @__PURE__ */ Object.freeze(["APPLE_PAY", "GOOGLE_PAY"]);
+var SESSION_SECRET = /^[\x21-\x7e]{1,1024}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var failed = (code) => (
+/** @type {ToastBodyReadJs} */
+Object.freeze({ ok: false, code }));
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function isWalletBody(parsed) {
+    const card = parsed.card;
+    const rootOk = sameKeys(parsed, ["type", "card", "sessionSecret"]) || sameKeys(parsed, ["type", "card", "sessionSecret", "billingDetails"]) && record(parsed.billingDetails);
+    return rootOk && WALLETS.includes(parsed.type) && record(card) && sameKeys(card, ["keyId", "cardData", "wallet"]) && card.keyId === null && typeof card.cardData === "string" && record(card.wallet) && sameKeys(card.wallet, ["type"]) && card.wallet.type === parsed.type && typeof parsed.sessionSecret === "string";
+}
+function isToastPaymentMethodsUrl(url) {
+    return url === TOAST_PAYMENT_METHODS_URL;
+}
+function isToastHost(url) {
+    if (typeof url !== "string")
+        return false;
+    try {
+        return new URL(url).hostname.toLowerCase().replace(/\.$/, "") === "payments.toasttab.com";
+    }
+    catch {
+        return false;
+    }
+}
+function isToastCiphertext(value) {
+    return typeof value === "string" && CIPHERTEXT_B64.test(value);
+}
+function readToastBody(body) {
+    const malformed = failed("toast_body_malformed");
+    if (typeof body !== "string" || body.length > BODY_LIMIT)
+        return malformed;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return malformed;
+    }
+    if (!record(parsed) || JSON.stringify(parsed) !== body)
+        return malformed;
+    if (isWalletBody(parsed))
+        return (
+        /** @type {ToastBodyReadJs} */
+        Object.freeze({ ok: false, wallet: true }));
+    const card = parsed.card;
+    if (!sameKeys(parsed, ROOT_KEYS) || parsed.type !== "CARD" || !record(card) || !sameKeys(card, CARD_KEYS))
+        return malformed;
+    if (typeof card.keyId !== "string")
+        return malformed;
+    if (card.keyId !== TOAST_KEY_ID)
+        return failed("toast_foreign_key");
+    if (!isToastCiphertext(card.cardData))
+        return malformed;
+    if (typeof parsed.sessionSecret !== "string" || !SESSION_SECRET.test(parsed.sessionSecret))
+        return malformed;
+    if (parsed.usage !== null || parsed.setupFutureUsage !== null)
+        return failed("toast_keeps_card");
+    const billing = parsed.billingDetails;
+    if (!record(billing) || !sameKeys(billing, ["postalCode"]) || typeof billing.postalCode !== "string" || !POSTAL_CODE.test(billing.postalCode))
+        return malformed;
+    const read = { ok: true, sessionSecret: parsed.sessionSecret, postalCode: billing.postalCode, cardData: card.cardData };
+    return Object.freeze(read);
+}
+function toastBodyVerdict(body) {
+    const read = readToastBody(body);
+    if (read.ok)
+        return CARD;
+    return read.wallet ? CONTINUE : refuse(read.code);
+}
+function toastRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST" || !isToastPaymentMethodsUrl(request.url))
+        return "toast_url_refused";
+    const read = readToastBody(request.body);
+    return read.ok ? null : read.code ?? "toast_body_malformed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    toast_url_refused: "Refusing to pay: this Toast card request does not go to the address Toast's card form sends cards to. Nothing was sent.",
+    toast_foreign_key: "Refusing to pay: this Toast card request is encrypted under a key Agentcard has not reviewed. Nothing was sent.",
+    toast_keeps_card: "Refusing to pay: this Toast checkout asks to keep the card for later payments, and Agentcard pays only a one-time guest checkout here. Nothing was sent.",
+    toast_body_malformed: "Refusing to pay: this is not the card request of Toast's card form. Nothing was sent."
+});
+function toastRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.toast_body_malformed;
+}
+export { TOAST_CAPABILITY, TOAST_CIPHERTEXT_BYTES, TOAST_KEY, TOAST_KEY_ID, TOAST_OPERATION, TOAST_PAYMENT_METHODS_URL, TOAST_PSP, TOAST_REFUSAL_CODES, TOAST_SUBSTITUTION, isToastCiphertext, isToastHost, isToastPaymentMethodsUrl, readToastBody, toastBodyVerdict, toastRefusalMessage, toastRequestRefusal };

package/dist/tokenex-iframe.d.ts

@@ -0,0 +1,93 @@
+import type { ReplayResponse } from './client.js';
+/** The PSP id the API and the recognizer name this lane. */
+export declare const TOKENEX_IFRAME_PSP: string;
+/** The dark-launch capability the API serves the tokenex_iframe recognizer behind. */
+export declare const TOKENEX_IFRAME_CAPABILITY: string;
+/**
+ * Why the SDK refuses a TokenEx card post before anything is claimed, created or prompted: a post on the frame's
+ * /iframe/v3 path that carries a value in Data and is not the PCI card-number frame's own card post (a cvvOnly or
+ * PCI-only frame, a Token key, another key, order or type, a query this lane has not read or that names another
+ * account than the body, a URL variant or one longer than the recognizer reads, a content type other than JSON).
+ * The API answers the same code at create, so the refusal here only keeps the agent's placeholder from reaching
+ * TokenEx and saves the round trip.
+ */
+export type TokenexIframeRefusalReason = 'invalid_tokenex_iframe_request';
+export declare const INVALID_TOKENEX_IFRAME_REQUEST: TokenexIframeRefusalReason;
+/** True when the URL parses onto one of TokenEx's two iframe hosts and the /iframe/v3 path, however it is spelled or queried. */
+export declare function isTokenexIframePath(url: string): boolean;
+/** Whether this build's registry serves the TokenEx iframe: a company Agentcard turned it on for, on a build that declares it. */
+export declare function servesTokenexIframe(vault: {
+    recognizesProcessor?(psp: string): boolean;
+} | undefined): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on the frame's /iframe/v3 path and this
+ * build's registry serves the TokenEx iframe. The recognizer matches only the exact card URL, so a variant (another
+ * query, a case or dot spelling) would otherwise never reach the gate that refuses it. attachToPlaywright's route
+ * predicate asks this; attachToCdp arms the two hosts from the recognizer's own host list.
+ */
+export declare function isArmedTokenexIframeUrl(vault: {
+    recognizesProcessor?(psp: string): boolean;
+} | undefined, url: string): boolean;
+/**
+ * The pause decision for a POST on the frame's path, by payment-core's classifyTokenexIframeRequest:
+ *   'card'  the exact card URL with the JSON content type and the sound pcicvv card post bound to its query: it pauses;
+ *   'invalid_tokenex_iframe_request'  a post with a value in Data that is not that: it is refused in the browser;
+ *   null    not a card post (no value in Data, another path, BinLookup, Forter): the SDK's ordinary handling
+ *           decides, and an empty-Data post continues untouched through the recognizer's passWithoutCard.
+ * A URL longer than payment-core reads (over 2,048 characters) classifies as null, as an unrelated request does, and
+ * the exact recognizer refuses it too, so a post on the frame's own path that carries a value in Data is refused here
+ * rather than sent to TokenEx with the agent's placeholder.
+ */
+export declare function tokenexIframePauseDecision(request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string | null;
+}): 'card' | TokenexIframeRefusalReason | null;
+/**
+ * The answer the paused card post may receive, rebuilt from payment-core's allow-list under a JSON content type:
+ * only TokenEx's 200 with a sound sixTOKENfour token (tokenexIframeResponseOutcome reads it as approved), keys TokenEx
+ * documents for a success and nothing else (sanitizeTokenexIframeResponse). Null for anything else: an error answer,
+ * another status, a body out of bounds. The frame adds its own `cardType` before the page reads the answer.
+ */
+export declare function tokenexIframePageAnswer(status: number, body: string): {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+} | null;
+/** Whether the frame reads `number` as the network `brand` (lowercase, as GET /api/v2/vault_cards names it). */
+export declare function tokenexIframePlaceholderFits(brand: string, number: string): boolean;
+/** The longest an iframe key lives, and so the longest a stored answer is handed out: TokenEx's ExpiresInSeconds maximum. */
+export declare const TOKENEX_IFRAME_REPEAT_WINDOW_MS = 1200000;
+/** A stored answer handed to a repeat, with the approval it came from. */
+export interface TokenexIframeRepeatAnswer {
+    authorizationId: string;
+    response: {
+        status: number;
+        headers: Record<string, string>;
+        body: string;
+    };
+}
+/**
+ * The approved TokenEx answers one attachment handed to a card post, per frame. `frame` is the adapter's identity
+ * for the request's frame (the CDP frameId of the out-of-process iframe, the Playwright Frame); a request whose
+ * frame is unknown is never remembered and never answered. Only an answer payment-core reads as approved (a sound
+ * sixTOKENfour token) to the sound card post is kept: an error answer leaves the next post a new question, so the
+ * page can try again.
+ */
+export declare class TokenexIframeRepeats {
+    private readonly now;
+    private remembered;
+    constructor(now?: () => number);
+    /**
+     * Keep the answer a token replay handed to this card post, when TokenEx approved it. Called after the answer
+     * reached the browser, so it never throws: a failure here only leaves the page's next post a new question.
+     */
+    remember(frame: unknown, url: string, body: string | null, replay: ReplayResponse): void;
+    /**
+     * The stored answer for the same frame's same post, byte for byte, or null. Only an answer from `authorizationId`,
+     * the approval the attachment is handing off now, is handed out, and every answer from another approval is
+     * dropped: a later authorization ends the window of every earlier one.
+     */
+    answerFor(frame: unknown, url: string, body: string | null, authorizationId: string | null): TokenexIframeRepeatAnswer | null;
+    private prune;
+}

package/dist/tokenex-iframe.generated.d.ts

@@ -0,0 +1,81 @@
+declare var TOKENEX_IFRAME_PSP: string;
+declare var TOKENEX_IFRAME_CAPABILITY: string;
+declare var TOKENEX_IFRAME_OPERATION: string;
+declare var TOKENEX_IFRAME_HOSTS: readonly string[];
+declare var TOKENEX_IFRAME_PATH: string;
+declare var TOKENEX_IFRAME_REFUSAL_REASONS: readonly string[];
+declare var TOKENEX_IFRAME_BODY_KEYS: readonly string[];
+declare var TOKENEX_IFRAME_TOKEN_SCHEMES: readonly string[];
+declare var TOKENEX_IFRAME_REVIEWED_ACCOUNTS: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>;
+declare var TOKENEX_IFRAME_ACCOUNT_NAMES: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>;
+declare function tokenexIframeTarget(url: any): {
+    host: string;
+    query: Map<any, any>;
+} | null;
+declare function isTokenexIframeUrl(url: any, method?: string): boolean;
+declare function tokenexIframeBodyRefusal(body: any): "unsupported" | null;
+declare function tokenexIframeRequestRefusal(request: any): "unsupported" | null;
+declare function isTokenexIframeRequest(request: any): boolean;
+declare var TOKENEX_IFRAME_GATE_CODES: readonly string[];
+declare function tokenexIframeBodyVerdict(body: any, url: any): {
+    verdict: string;
+    code?: undefined;
+} | {
+    verdict: string;
+    code: string;
+};
+declare function classifyTokenexIframeRequest(url: any, method: any, body: any, headers: any): "card" | "unsupported" | null;
+declare function tokenexIframeAccount(request: any): {
+    host: string;
+    tokenExId: any;
+    origin: any;
+} | null;
+declare function tokenexIframeAccountRefusal(request: any, accounts?: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>): "unreviewed_account" | null;
+declare function tokenexIframeAccountName(request: any, accounts?: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>, names?: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>): string | null;
+declare function tokenexIframeCardType(number: any): string | RegExp | null;
+declare function tokenexIframeBrandRefusal(body: any, card: any): "unsupported" | "brand_mismatch" | null;
+declare function tokenexIframeDeviceRefusal(request: any, card: any, accounts?: Readonly<{
+    "htp.tokenex.com": Readonly<{}>;
+    "test-htp.tokenex.com": Readonly<{}>;
+}>): "unsupported" | "brand_mismatch" | "unreviewed_account" | null;
+declare function tokenexIframeRefusalMessage(reason: any): string;
+declare function injectTokenexIframeCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isTokenexIframeDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function tokenexIframeErrorCode(message: any): string | RegExp;
+declare function tokenexIframeResponseOutcome(status: any, body: any, card: any): {
+    outcome: string;
+    code: string | RegExp;
+    reason?: undefined;
+} | {
+    outcome: string;
+    reason: string | undefined;
+    code?: undefined;
+} | {
+    outcome: string;
+    code?: undefined;
+    reason?: undefined;
+};
+declare function sanitizeTokenexIframeResponse(body: any): string;
+declare function tokenexIframeFacts(status: any, body: any): {
+    outcome: string;
+    refusalCode: string | RegExp | null | undefined;
+};
+export { TOKENEX_IFRAME_ACCOUNT_NAMES, TOKENEX_IFRAME_BODY_KEYS, TOKENEX_IFRAME_CAPABILITY, TOKENEX_IFRAME_GATE_CODES, TOKENEX_IFRAME_HOSTS, TOKENEX_IFRAME_OPERATION, TOKENEX_IFRAME_PATH, TOKENEX_IFRAME_PSP, TOKENEX_IFRAME_REFUSAL_REASONS, TOKENEX_IFRAME_REVIEWED_ACCOUNTS, TOKENEX_IFRAME_TOKEN_SCHEMES, classifyTokenexIframeRequest, injectTokenexIframeCard, isTokenexIframeDeviceRequest, isTokenexIframeRequest, isTokenexIframeUrl, sanitizeTokenexIframeResponse, tokenexIframeAccount, tokenexIframeAccountName, tokenexIframeAccountRefusal, tokenexIframeBodyRefusal, tokenexIframeBodyVerdict, tokenexIframeBrandRefusal, tokenexIframeCardType, tokenexIframeDeviceRefusal, tokenexIframeErrorCode, tokenexIframeFacts, tokenexIframeRefusalMessage, tokenexIframeRequestRefusal, tokenexIframeResponseOutcome, tokenexIframeTarget };