@agent-cards/sdk 0.23.27 → 0.24.0

package/dist/wspay.generated.js

@@ -1,6 +1,174 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 9ba65916c5dc5ee3ca830d630cafbde62d537e61991c33c80f1520ac93ef0b0d
+// artifact-sha256: f3d9221468606ad3d7512105a7eb6c2eef4b813d5772cb2a5c31042874cb4984
+// src/three-ds-step.js
+var RUN = /[A-Za-z0-9+/_-]{12,}/g;
+var RUN_LENGTH = 12;
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var LAYERS = 2;
+var PAREQ = /pareq/i;
+var PAGE_PAREQ = /\bname\s*=\s*["']?[^"'\s>]*pareq/i;
+var THREE_DS_STEP_UNREADABLE = "unreadable_three_ds_step";
+var THREE_DS_STEP_HOLDS_CARD = "card_in_three_ds_step";
+var PERCENT_LAYERS = 8;
+function percentDecoded(text2) {
+    let out = text2;
+    for (let layer = 0; layer < PERCENT_LAYERS; layer += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            break;
+        out = next;
+    }
+    return out;
+}
+var NAMED = /* @__PURE__ */ Object.freeze({
+    amp: "&",
+    percnt: "%",
+    num: "#",
+    quest: "?",
+    semi: ";",
+    excl: "!",
+    dollar: "$",
+    lpar: "(",
+    rpar: ")",
+    ast: "*",
+    comma: ",",
+    commat: "@",
+    lsqb: "[",
+    rsqb: "]",
+    lcub: "{",
+    rcub: "}",
+    verbar: "|",
+    bsol: "\\",
+    hat: "^",
+    grave: "`",
+    plus: "+",
+    sol: "/",
+    equals: "=",
+    lowbar: "_",
+    period: ".",
+    colon: ":",
+    quot: '"',
+    apos: "'",
+    lt: "<",
+    gt: ">"
+});
+var NUMERIC = "#(?:[xX]([0-9a-fA-F]+)|([0-9]+));?";
+var BARE_NAME = "(sup[123]|frac(?:12|14|34)|[A-Za-z]+);?";
+var referenceText = (hex, decimal, name) => {
+    if (name !== void 0)
+        return Object.prototype.hasOwnProperty.call(NAMED, name.toLowerCase()) ? NAMED[name.toLowerCase()] : " ";
+    const point = hex === void 0 ? parseInt(decimal, 10) : parseInt(hex, 16);
+    return point <= 1114111 ? String.fromCodePoint(point) : "";
+};
+function referenceReadings(text2) {
+    const read = (pattern) => text2.replace(new RegExp(`&(?:${NUMERIC}|${pattern})`, "g"), (_, hex, decimal, name) => referenceText(hex, decimal, name));
+    return [read("([A-Za-z][A-Za-z0-9]*);"), read(BARE_NAME)];
+}
+function readings(text2) {
+    const out = /* @__PURE__ */ new Set([text2, percentDecoded(text2)]);
+    for (const reading of [...out])
+        for (const decoded of referenceReadings(reading))
+            out.add(decoded).add(percentDecoded(decoded));
+    return out;
+}
+function base64Bytes(run, skip) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (let i = skip; i < run.length; i += 1) {
+        const char = run[i];
+        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : ALPHABET.indexOf(char));
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+var compressed = (bytes) => bytes.charCodeAt(0) === 31 && bytes.charCodeAt(1) === 139 || bytes.charCodeAt(0) === 120 && (30720 + bytes.charCodeAt(1)) % 31 === 0;
+function holdsStream(text2, layers) {
+    for (const reading of readings(text2)) {
+        for (const [run] of reading.matchAll(RUN)) {
+            const starts = [0];
+            for (let slash = run.indexOf("/"); slash >= 0; slash = run.indexOf("/", slash + 1))
+                starts.push(slash + 1);
+            if (starts.some((start) => run.length - start >= RUN_LENGTH && compressed(base64Bytes(run.slice(start, start + 4), 0))))
+                return true;
+            for (let skip = 0; layers > 0 && skip < 4; skip += 1)
+                if (holdsStream(base64Bytes(run, skip), layers - 1))
+                    return true;
+        }
+    }
+    return false;
+}
+function numberPattern(card) {
+    const number = card && (typeof card.number === "string" || typeof card.number === "number") ? String(card.number).replace(/[^0-9]/g, "") : "";
+    return number.length >= 12 && number.length <= 19 ? new RegExp(number.split("").join("[^0-9A-Za-z]{0,3}")) : null;
+}
+function holdsNumber(text2, pattern, layers) {
+    for (const reading of readings(text2)) {
+        if (pattern.test(reading))
+            return true;
+        if (layers === 0)
+            continue;
+        for (const [run] of reading.matchAll(RUN)) {
+            for (let skip = 0; skip < 4; skip += 1)
+                if (holdsNumber(base64Bytes(run, skip), pattern, layers - 1))
+                    return true;
+        }
+    }
+    return false;
+}
+function addressTexts(value) {
+    if (typeof value !== "string")
+        return null;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    const names = [];
+    const texts = [value, ...url.pathname.split("/")];
+    for (const pair of `${url.search.slice(1)}&${url.hash.slice(1)}`.split("&")) {
+        if (pair === "")
+            continue;
+        const at = pair.indexOf("=");
+        names.push(at < 0 ? pair : pair.slice(0, at));
+        if (at >= 0)
+            texts.push(pair.slice(at + 1));
+    }
+    return { names, texts: [...texts, ...names] };
+}
+var textOf = (value) => typeof value === "string" ? value : JSON.stringify(value) ?? "";
+function threeDsStepLeak(card, step) {
+    const names = [];
+    const texts = [];
+    for (const url of step.urls ?? []) {
+        const address = addressTexts(url);
+        if (!address)
+            return THREE_DS_STEP_UNREADABLE;
+        names.push(...address.names);
+        texts.push(...address.texts);
+    }
+    for (const [name, value] of step.fields ?? []) {
+        names.push(textOf(name));
+        texts.push(textOf(name), textOf(value));
+    }
+    for (const page of step.pages ?? []) {
+        if ([...readings(textOf(page))].some((reading) => PAGE_PAREQ.test(reading)))
+            return THREE_DS_STEP_UNREADABLE;
+        texts.push(textOf(page));
+    }
+    if (names.some((name) => [...readings(name)].some((reading) => PAREQ.test(reading))) || texts.some((text2) => holdsStream(text2, LAYERS)))
+        return THREE_DS_STEP_UNREADABLE;
+    const pattern = numberPattern(card);
+    return pattern && texts.some((text2) => holdsNumber(text2, pattern, LAYERS)) ? THREE_DS_STEP_HOLDS_CARD : null;
+}
 // src/wspay.js
 var WSPAY_CONFIRM_HOSTS = Object.freeze(["proxy.wspay.biz", "proxy-test.wspay.biz"]);
 var WSPAY_TEST_HOST = "proxy-test.wspay.biz";
@@ -303,7 +471,7 @@ function responseCode(result) {
     const code = record(trx) ? trx.response_code : null;
     return exact(/^[0-9]{4}$/, code) ? code : null;
 }
-function wspayResponseOutcome(status, text2) {
+function wspayResponseOutcome(status, text2, card) {
     if (status !== 200)
         return { outcome: "unknown", reason: "wspay_status_unconfirmed" };
     const value = readJson(text2);
@@ -319,8 +487,12 @@ function wspayResponseOutcome(status, text2) {
     }
     if (value.status === "approved" && approvedResult(result))
         return { outcome: "approved" };
-    if (value.status === "action_required" && (result === null || result === void 0) && keysWithin(value.action_required, ["acs_url", "redirect_to"]) && httpsUrl(value.action_required.acs_url) && httpsUrl(value.action_required.redirect_to))
+    if (value.status === "action_required" && (result === null || result === void 0) && keysWithin(value.action_required, ["acs_url", "redirect_to"]) && httpsUrl(value.action_required.acs_url) && httpsUrl(value.action_required.redirect_to)) {
+        const leak = threeDsStepLeak(card, { urls: [value.action_required.acs_url, value.action_required.redirect_to] });
+        if (leak)
+            return { outcome: "unknown", reason: leak === THREE_DS_STEP_UNREADABLE ? "wspay_three_ds_unreadable" : "wspay_answer_holds_card" };
         return { outcome: "approved", pending: "three_ds" };
+    }
     return { outcome: "unknown", reason: "wspay_unconfirmed" };
 }
 function sanitizeWspayResponse(text2, options) {

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "7f65e0f07138296b0cbff7dd1ed4331842b6dd45e2950f08273fcc772c7f63f6",
+  "catalog_sha256": "d27bf03744adafed6b1e6731f61439bb410e90ab4937dcb279d3e5db46784784",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.27",
-  "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
+  "version": "0.24.0",
+  "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,16 +24,15 @@
     "access": "public"
   },
   "scripts": {
-    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts), the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones), and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned.",
-    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && node scripts/generate-url-masks.mjs && node scripts/generate-capabilities.mjs && node scripts/generate-agent-amount.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
+    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts) and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned. The build starts from an empty dist, so a module the source no longer has never reaches a packed tarball.",
+    "build": "node scripts/clean-dist.mjs && node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-url-masks.mjs && node scripts/generate-capabilities.mjs && node scripts/generate-agent-amount.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
     "prepublishOnly": "pnpm build",
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
-    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
+    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs pin-payments.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
-    "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",
     "test:preflight:browser": "node preflight-browser.test.mjs",
     "pack:preview": "node scripts/pack-preflight-preview.mjs",
@@ -46,7 +45,6 @@
     "browser-automation",
     "pci",
     "checkout",
-    "voice",
     "agentcard"
   ],
   "engines": {

package/dist/languages.d.ts

@@ -1,23 +0,0 @@
-/** A language tag as BCP 47 spells it: `en`, `es`, `pt-BR`. */
-export type Language = string;
-/** One language Agentcard speaks, as the API lists it. */
-export interface LanguageInfo {
-    /** The BCP 47 tag your calls name (`en`). */
-    tag: Language;
-    /** The language's own name for itself (`English`, `Español`). */
-    name: string;
-}
-export declare class Languages {
-    private readonly request;
-    private cached;
-    private inflight;
-    constructor(request: <T>(path: string) => Promise<T>);
-    /**
-     * The languages Agentcard speaks, read once and kept for ten minutes. `null`
-     * when the API does not serve the list (an API older than the route), in
-     * which case tags are passed through unchecked and the API judges them.
-     */
-    list(): Promise<LanguageInfo[] | null>;
-    /** Refuses a tag the API did not list (`unsupported_language`) before any call leaves; a well-formed tag passes when the API serves no list. */
-    check(tag: Language | undefined): Promise<void>;
-}

package/dist/languages.js

@@ -1,76 +0,0 @@
-/**
- * Languages are data, not types. A language is a BCP 47 tag (`en`, `es`,
- * `pt-BR`), and the list Agentcard speaks is read from the API
- * (`GET /api/v2/voice/languages`), so a language added on Agentcard's side
- * needs no release of this package. Every call that names a `lang` asks this
- * guard first and is refused with `unsupported_language` before anything is
- * sent when the tag is not on the list.
- */
-import { AgentcardError } from './voice-types.js';
-/** The list out of either wire shape: `data` on the list envelope, else `languages`; null when neither is a list. */
-function listOf(body) {
-    if (Array.isArray(body?.data))
-        return body.data;
-    if (Array.isArray(body?.languages))
-        return body.languages;
-    return null;
-}
-/** A tag's shape, before the list is consulted: a primary subtag and optional subtags, letters and digits only. */
-const TAG_SHAPE = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{1,8})*$/;
-/** How long a read list is trusted before it is read again. */
-const LIST_TTL_MS = 10 * 60_000;
-export class Languages {
-    request;
-    cached = null;
-    inflight = null;
-    constructor(request) {
-        this.request = request;
-    }
-    /**
-     * The languages Agentcard speaks, read once and kept for ten minutes. `null`
-     * when the API does not serve the list (an API older than the route), in
-     * which case tags are passed through unchecked and the API judges them.
-     */
-    async list() {
-        if (this.cached && Date.now() - this.cached.at < LIST_TTL_MS)
-            return this.cached.list;
-        if (this.inflight)
-            return this.inflight;
-        this.inflight = (async () => {
-            let list;
-            try {
-                const body = await this.request('/api/v2/voice/languages');
-                const wire = listOf(body);
-                list = wire
-                    ? wire.flatMap((l) => (l && typeof l === 'object' && typeof l.tag === 'string'
-                        ? [{ tag: l.tag, name: typeof l.name === 'string' ? l.name : l.tag }]
-                        : []))
-                    : null;
-            }
-            catch (err) {
-                // An API that has no list yet answers 404; the tag then travels unchecked. Anything else is the caller's to see.
-                if (err instanceof AgentcardError && (err.status === 404 || err.code === 'not_found'))
-                    list = null;
-                else
-                    throw err;
-            }
-            this.cached = { list, at: Date.now() };
-            return list;
-        })().finally(() => { this.inflight = null; });
-        return this.inflight;
-    }
-    /** Refuses a tag the API did not list (`unsupported_language`) before any call leaves; a well-formed tag passes when the API serves no list. */
-    async check(tag) {
-        if (tag === undefined)
-            return;
-        if (typeof tag !== 'string' || !TAG_SHAPE.test(tag)) {
-            throw new AgentcardError('unsupported_language', `'${String(tag)}' is not a language tag (BCP 47: en, es, pt-BR). Refused before any call.`);
-        }
-        const list = await this.list();
-        if (list === null)
-            return;
-        if (!list.some((l) => l.tag.toLowerCase() === tag.toLowerCase())) {
-            throw new AgentcardError('unsupported_language', `Agentcard does not speak '${tag}' yet. It speaks ${list.map((l) => l.tag).join(', ') || 'no language on this API'}; read voice.languages() for the list. Refused before any call.`, undefined, { tag, languages: list.map((l) => l.tag) });
-        }
-    }
-}

package/dist/voice-pkce.d.ts

@@ -1,49 +0,0 @@
-/**
- * The grant's client half: a PKCE verifier and its S256
- * challenge (RFC 7636), and the opaque `state` the return link carries back.
- * Random bytes come from the platform's WebCrypto; SHA-256 from WebCrypto
- * where it exists (Node, browsers, workers), else from the small
- * implementation below, so the module keeps zero dependencies on a phone
- * runtime with no `crypto.subtle`. A runtime with no secure random source
- * names one through `VoiceOptions.pkce.randomBytes`; nothing here ever
- * falls back to `Math.random`.
- */
-import { type ReturnLink } from './voice-types.js';
-/** Seams for a runtime without WebCrypto (a React Native app running the demo's adapter). */
-export interface PkceCrypto {
-    /** `n` cryptographically random bytes. Default: `crypto.getRandomValues`. */
-    randomBytes?: (n: number) => Uint8Array;
-    /** SHA-256 of the bytes. Default: `crypto.subtle.digest`, else the built-in implementation. */
-    sha256?: (bytes: Uint8Array) => Promise<Uint8Array> | Uint8Array;
-}
-export declare const PKCE_UNAVAILABLE_MESSAGE = "This runtime has no crypto.getRandomValues, so the client cannot mint a PKCE verifier. Name voice: { pkce: { randomBytes } } with a secure source, or pass pkce: false to connect (the polling shape, deprecated).";
-export declare function randomBytes(n: number, seam: PkceCrypto | undefined): Uint8Array;
-export declare function sha256(bytes: Uint8Array, seam: PkceCrypto | undefined): Promise<Uint8Array>;
-/** RFC 4648 §5, no padding: what a verifier, a challenge and a state are made of. */
-export declare function base64url(bytes: Uint8Array): string;
-/** The ASCII bytes of a verifier (it is base64url, so ASCII by construction). */
-export declare function asciiBytes(s: string): Uint8Array;
-export interface PkcePair {
-    /** 43 characters of base64url (32 random bytes): within RFC 7636's 43–128. */
-    code_verifier: string;
-    /** base64url(SHA-256(code_verifier)). */
-    code_challenge: string;
-    code_challenge_method: 'S256';
-    /** 22 characters of base64url (16 random bytes), opaque. */
-    state: string;
-}
-export declare function mintPkce(seam: PkceCrypto | undefined): Promise<PkcePair>;
-/** The `code` and `state` a return link carries, read from its query alone; the scheme may be an app's own. */
-export declare function grantFromReturnLink(url: string): {
-    code: string | null;
-    state: string | null;
-};
-/**
- * A return link, read from its query alone (the scheme may be an app's own, `yourapp://connected?…`): the
- * grant's `code` and `state` (null on a link minted to poll: a reset, an action, `pkce: false`) and the
- * `voice_reset` outcome the Vault appends when the visit reset the person's voice key (`done`, `unchanged`,
- * `failed`; null when the link says nothing about a reset, and for any other word). A pure function with no
- * client behind it: the app half reads the sheet's result with it too.
- */
-export declare function readReturnLink(url: string): ReturnLink;
-export declare function sha256Pure(input: Uint8Array): Uint8Array;

package/dist/voice-pkce.js

@@ -1,147 +0,0 @@
-/**
- * The grant's client half: a PKCE verifier and its S256
- * challenge (RFC 7636), and the opaque `state` the return link carries back.
- * Random bytes come from the platform's WebCrypto; SHA-256 from WebCrypto
- * where it exists (Node, browsers, workers), else from the small
- * implementation below, so the module keeps zero dependencies on a phone
- * runtime with no `crypto.subtle`. A runtime with no secure random source
- * names one through `VoiceOptions.pkce.randomBytes`; nothing here ever
- * falls back to `Math.random`.
- */
-import { AgentcardError } from './voice-types.js';
-export const PKCE_UNAVAILABLE_MESSAGE = 'This runtime has no crypto.getRandomValues, so the client cannot mint a PKCE verifier. Name voice: { pkce: { randomBytes } } with a secure source, or pass pkce: false to connect (the polling shape, deprecated).';
-export function randomBytes(n, seam) {
-    if (seam?.randomBytes) {
-        const out = seam.randomBytes(n);
-        if (!(out instanceof Uint8Array) || out.length !== n)
-            throw new AgentcardError('pkce_unavailable', `voice.pkce.randomBytes must return ${n} bytes.`);
-        return out;
-    }
-    const c = globalThis.crypto;
-    if (!c?.getRandomValues)
-        throw new AgentcardError('pkce_unavailable', PKCE_UNAVAILABLE_MESSAGE);
-    return c.getRandomValues(new Uint8Array(n));
-}
-export async function sha256(bytes, seam) {
-    if (seam?.sha256)
-        return seam.sha256(bytes);
-    const subtle = globalThis.crypto?.subtle;
-    if (subtle?.digest)
-        return new Uint8Array(await subtle.digest('SHA-256', bytes));
-    return sha256Pure(bytes);
-}
-/** RFC 4648 §5, no padding: what a verifier, a challenge and a state are made of. */
-export function base64url(bytes) {
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
-    let out = '';
-    for (let i = 0; i < bytes.length; i += 3) {
-        const a = bytes[i], b = bytes[i + 1], c = bytes[i + 2];
-        const n = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);
-        out += alphabet[(n >>> 18) & 63] + alphabet[(n >>> 12) & 63];
-        if (b !== undefined)
-            out += alphabet[(n >>> 6) & 63];
-        if (c !== undefined)
-            out += alphabet[n & 63];
-    }
-    return out;
-}
-/** The ASCII bytes of a verifier (it is base64url, so ASCII by construction). */
-export function asciiBytes(s) {
-    const out = new Uint8Array(s.length);
-    for (let i = 0; i < s.length; i++)
-        out[i] = s.charCodeAt(i) & 0x7f;
-    return out;
-}
-export async function mintPkce(seam) {
-    const code_verifier = base64url(randomBytes(32, seam));
-    const code_challenge = base64url(await sha256(asciiBytes(code_verifier), seam));
-    const state = base64url(randomBytes(16, seam));
-    return { code_verifier, code_challenge, code_challenge_method: 'S256', state };
-}
-/** The `code` and `state` a return link carries, read from its query alone; the scheme may be an app's own. */
-export function grantFromReturnLink(url) {
-    const { code, state } = readReturnLink(url);
-    return { code, state };
-}
-/**
- * A return link, read from its query alone (the scheme may be an app's own, `yourapp://connected?…`): the
- * grant's `code` and `state` (null on a link minted to poll: a reset, an action, `pkce: false`) and the
- * `voice_reset` outcome the Vault appends when the visit reset the person's voice key (`done`, `unchanged`,
- * `failed`; null when the link says nothing about a reset, and for any other word). A pure function with no
- * client behind it: the app half reads the sheet's result with it too.
- */
-export function readReturnLink(url) {
-    const q = url.indexOf('?');
-    if (q < 0)
-        return { code: null, state: null, voice_reset: null };
-    const hash = url.indexOf('#', q);
-    const params = new URLSearchParams(url.slice(q + 1, hash < 0 ? undefined : hash));
-    const reset = params.get('voice_reset');
-    return {
-        code: params.get('code'),
-        state: params.get('state'),
-        voice_reset: reset === 'done' || reset === 'unchanged' || reset === 'failed' ? reset : null,
-    };
-}
-// ─── SHA-256, FIPS 180-4, for a runtime without crypto.subtle ───────────────
-const K = new Uint32Array([
-    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
-]);
-export function sha256Pure(input) {
-    const bitLength = input.length * 8;
-    const padded = new Uint8Array(((input.length + 9 + 63) >> 6) << 6);
-    padded.set(input);
-    padded[input.length] = 0x80;
-    const view = new DataView(padded.buffer);
-    view.setUint32(padded.length - 8, Math.floor(bitLength / 0x100000000));
-    view.setUint32(padded.length - 4, bitLength >>> 0);
-    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
-    const w = new Uint32Array(64);
-    const rotr = (x, n) => (x >>> n) | (x << (32 - n));
-    for (let off = 0; off < padded.length; off += 64) {
-        for (let i = 0; i < 16; i++)
-            w[i] = view.getUint32(off + i * 4);
-        for (let i = 16; i < 64; i++) {
-            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
-            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
-            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
-        }
-        let [a, b, c, d, e, f, g, hh] = h;
-        for (let i = 0; i < 64; i++) {
-            const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
-            const ch = (e & f) ^ (~e & g);
-            const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
-            const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
-            const maj = (a & b) ^ (a & c) ^ (b & c);
-            const t2 = (S0 + maj) >>> 0;
-            hh = g;
-            g = f;
-            f = e;
-            e = (d + t1) >>> 0;
-            d = c;
-            c = b;
-            b = a;
-            a = (t1 + t2) >>> 0;
-        }
-        h[0] = (h[0] + a) >>> 0;
-        h[1] = (h[1] + b) >>> 0;
-        h[2] = (h[2] + c) >>> 0;
-        h[3] = (h[3] + d) >>> 0;
-        h[4] = (h[4] + e) >>> 0;
-        h[5] = (h[5] + f) >>> 0;
-        h[6] = (h[6] + g) >>> 0;
-        h[7] = (h[7] + hh) >>> 0;
-    }
-    const out = new Uint8Array(32);
-    const ov = new DataView(out.buffer);
-    for (let i = 0; i < 8; i++)
-        ov.setUint32(i * 4, h[i]);
-    return out;
-}