@agent-cards/sdk 0.23.21 → 0.23.22

package/dist/toast.generated.js

@@ -0,0 +1,113 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: d0c3bda9a5b7939a6984156929cbcb7ba7d427fa38c544aad65c4593cf272d05
+// src/toast.js
+var TOAST_PSP = "toast";
+var TOAST_CAPABILITY = "toast_pinned_key";
+var TOAST_OPERATION = "toast.encrypted_card";
+var TOAST_PAYMENT_METHODS_URL = "https://payments.toasttab.com/v1/payment-methods";
+var TOAST_KEY_ID = "RSA-OAEP-SHA1::bacb4887-8314-4c23-98fc-d5ef7bc99e94_oo-legacy-browsers";
+var TOAST_KEY = /* @__PURE__ */ Object.freeze({
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB",
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e"
+});
+var TOAST_CIPHERTEXT_BYTES = 256;
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+var TOAST_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(["toast_url_refused", "toast_foreign_key", "toast_keeps_card", "toast_body_malformed"]);
+var BODY_LIMIT = 8192;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["type", "card", "sessionSecret", "usage", "setupFutureUsage", "billingDetails"]);
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["keyId", "cardData"]);
+var WALLETS = /* @__PURE__ */ Object.freeze(["APPLE_PAY", "GOOGLE_PAY"]);
+var SESSION_SECRET = /^[\x21-\x7e]{1,1024}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var failed = (code) => (
+/** @type {ToastBodyReadJs} */
+Object.freeze({ ok: false, code }));
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function isWalletBody(parsed) {
+    const card = parsed.card;
+    const rootOk = sameKeys(parsed, ["type", "card", "sessionSecret"]) || sameKeys(parsed, ["type", "card", "sessionSecret", "billingDetails"]) && record(parsed.billingDetails);
+    return rootOk && WALLETS.includes(parsed.type) && record(card) && sameKeys(card, ["keyId", "cardData", "wallet"]) && card.keyId === null && typeof card.cardData === "string" && record(card.wallet) && sameKeys(card.wallet, ["type"]) && card.wallet.type === parsed.type && typeof parsed.sessionSecret === "string";
+}
+function isToastPaymentMethodsUrl(url) {
+    return url === TOAST_PAYMENT_METHODS_URL;
+}
+function isToastHost(url) {
+    if (typeof url !== "string")
+        return false;
+    try {
+        return new URL(url).hostname.toLowerCase().replace(/\.$/, "") === "payments.toasttab.com";
+    }
+    catch {
+        return false;
+    }
+}
+function isToastCiphertext(value) {
+    return typeof value === "string" && CIPHERTEXT_B64.test(value);
+}
+function readToastBody(body) {
+    const malformed = failed("toast_body_malformed");
+    if (typeof body !== "string" || body.length > BODY_LIMIT)
+        return malformed;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return malformed;
+    }
+    if (!record(parsed) || JSON.stringify(parsed) !== body)
+        return malformed;
+    if (isWalletBody(parsed))
+        return (
+        /** @type {ToastBodyReadJs} */
+        Object.freeze({ ok: false, wallet: true }));
+    const card = parsed.card;
+    if (!sameKeys(parsed, ROOT_KEYS) || parsed.type !== "CARD" || !record(card) || !sameKeys(card, CARD_KEYS))
+        return malformed;
+    if (typeof card.keyId !== "string")
+        return malformed;
+    if (card.keyId !== TOAST_KEY_ID)
+        return failed("toast_foreign_key");
+    if (!isToastCiphertext(card.cardData))
+        return malformed;
+    if (typeof parsed.sessionSecret !== "string" || !SESSION_SECRET.test(parsed.sessionSecret))
+        return malformed;
+    if (parsed.usage !== null || parsed.setupFutureUsage !== null)
+        return failed("toast_keeps_card");
+    const billing = parsed.billingDetails;
+    if (!record(billing) || !sameKeys(billing, ["postalCode"]) || typeof billing.postalCode !== "string" || !POSTAL_CODE.test(billing.postalCode))
+        return malformed;
+    const read = { ok: true, sessionSecret: parsed.sessionSecret, postalCode: billing.postalCode, cardData: card.cardData };
+    return Object.freeze(read);
+}
+function toastBodyVerdict(body) {
+    const read = readToastBody(body);
+    if (read.ok)
+        return CARD;
+    return read.wallet ? CONTINUE : refuse(read.code);
+}
+function toastRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST" || !isToastPaymentMethodsUrl(request.url))
+        return "toast_url_refused";
+    const read = readToastBody(request.body);
+    return read.ok ? null : read.code ?? "toast_body_malformed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    toast_url_refused: "Refusing to pay: this Toast card request does not go to the address Toast's card form sends cards to. Nothing was sent.",
+    toast_foreign_key: "Refusing to pay: this Toast card request is encrypted under a key Agentcard has not reviewed. Nothing was sent.",
+    toast_keeps_card: "Refusing to pay: this Toast checkout asks to keep the card for later payments, and Agentcard pays only a one-time guest checkout here. Nothing was sent.",
+    toast_body_malformed: "Refusing to pay: this is not the card request of Toast's card form. Nothing was sent."
+});
+function toastRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.toast_body_malformed;
+}
+export { TOAST_CAPABILITY, TOAST_CIPHERTEXT_BYTES, TOAST_KEY, TOAST_KEY_ID, TOAST_OPERATION, TOAST_PAYMENT_METHODS_URL, TOAST_PSP, TOAST_REFUSAL_CODES, TOAST_SUBSTITUTION, isToastCiphertext, isToastHost, isToastPaymentMethodsUrl, readToastBody, toastBodyVerdict, toastRefusalMessage, toastRequestRefusal };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.21",
+  "version": "0.23.22",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs twoc2p.test.mjs pay-nl.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",