@agent-cards/sdk 0.23.28 → 0.24.0

package/dist/vtex-payments.generated.js

@@ -0,0 +1,544 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 07dfa13862b2c6a1a9256394c968c0a364e25eb763d8dee500aaed4f0fe259a7
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/registration.js
+var PARTS = {
+    psp: "id",
+    definitions: "list",
+    refusedOperations: "list",
+    settlementReadback: "any",
+    exactUrl: "rule",
+    bodyGate: "rule",
+    amount: "rule",
+    hostedEntry: "rule",
+    limitations: "sentences"
+};
+var DEVICE_PARTS = { psp: "id", testPans: "numbers", deviceCheck: "rule", fill: "rule", refusalCode: "rule", outcome: "rule", relayOnly: "flag" };
+var PSP_ID = /^[a-z][a-z0-9_]*$/;
+function problemsOf(spec, parts) {
+    if (!spec || typeof spec !== "object")
+        return ["a registration is an object"];
+    const psp = spec.psp;
+    if (typeof psp !== "string" || !PSP_ID.test(psp))
+        return [`${JSON.stringify(psp)} is not a processor id`];
+    const problems = Object.keys(spec).filter((key) => !(key in parts)).map((key) => `${psp}: ${key} is no registration part`);
+    for (const [key, kind] of Object.entries(parts)) {
+        const value = spec[key];
+        if (value === void 0)
+            continue;
+        if (kind === "rule" && typeof value !== "function")
+            problems.push(`${psp}: ${key} is not a function`);
+        if (kind === "flag" && value !== true)
+            problems.push(`${psp}: ${key} is not true`);
+        if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
+            problems.push(`${psp}: ${key} is not a list of card numbers`);
+        }
+        if (kind === "sentences" && !(Array.isArray(value) && value.length > 0 && value.every((s) => typeof s === "string" && s.trim() !== ""))) {
+            problems.push(`${psp}: ${key} is not a list of sentences`);
+        }
+    }
+    if ("definitions" in parts) {
+        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
+            problems.push(`${psp}: names no definition`);
+        else if (spec.definitions.some((definition) => definition?.psp !== psp))
+            problems.push(`${psp}: a definition names another processor`);
+        for (const id of spec.refusedOperations ?? []) {
+            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
+                problems.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
+        }
+        const pages = Array.isArray(spec.definitions) ? spec.definitions.filter((d) => d?.hostedForm?.cardIn === "processor_page") : [];
+        if (spec.hostedEntry !== void 0 && (pages.length === 0 || pages.some((d) => d.hostedForm.policy !== void 0))) {
+            problems.push(`${psp}: hostedEntry needs a definition whose hosted form takes the card on the processor's page and names no policy`);
+        }
+    }
+    return problems;
+}
+function registered(spec, parts) {
+    const problems = problemsOf(spec, parts);
+    if (problems.length)
+        throw new Error(`payment-core registration refused: ${problems.join("; ")}`);
+    return deepFreeze({ ...spec });
+}
+function registerProcessor(spec) {
+    return registered(spec, PARTS);
+}
+function registerDeviceRules(psp, rules) {
+    const checked = registered({ psp, ...rules }, DEVICE_PARTS);
+    return checked.testPans ? Object.freeze({ ...checked, testPans: new Set(checked.testPans) }) : checked;
+}
+// src/processors/vtex_payments.js
+var VTEX_PAYMENTS_PSP = "vtex_payments";
+var VTEX_PAYMENTS_CAPABILITY = "vtex_payments_card_payment";
+var VTEX_PAYMENTS_OPERATION = "vtex_payments.card_request";
+var VTEX_PAYMENTS_FALLBACK_HOST = "api.vtexvault.com";
+var VTEX_PAYMENTS_PREPARATION_URL = "https://api.vtexvault.com/api/payments/transactions/prepared/payments";
+var VTEX_PAYMENTS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "vtex_payments_url_refused",
+    "vtex_payments_fallback_refused",
+    "vtex_payments_headers_refused",
+    "vtex_payments_saved_card",
+    "vtex_payments_split_payment",
+    "vtex_payments_installments",
+    "vtex_payments_body_unsupported"
+]);
+var VTEX_PAYMENTS_LINE_KEYS = /* @__PURE__ */ Object.freeze([
+    "currencyCode",
+    "paymentSystem",
+    "accountId",
+    "value",
+    "referenceValue",
+    "installments",
+    "installmentsInterestRate",
+    "installmentsValue",
+    "groupName",
+    "fields",
+    "transaction",
+    "id"
+]);
+var VTEX_PAYMENTS_FIELD_KEYS = /* @__PURE__ */ Object.freeze([
+    "address",
+    "accountId",
+    "validationCode",
+    "metadata",
+    "document",
+    "holderName",
+    "cardNumber",
+    "dueDate",
+    "deviceFingerprint",
+    "addressId"
+]);
+var VTEX_PAYMENTS_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
+    "street",
+    "complement",
+    "number",
+    "city",
+    "reference",
+    "addressType",
+    "neighborhood",
+    "addressId",
+    "state",
+    "country",
+    "postalCode"
+]);
+var VTEX_PAYMENTS_NETWORKS = /* @__PURE__ */ Object.freeze({ 1: "amex", 2: "visa", 4: "mastercard", 5: "discover" });
+var VTEX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ account: "alssports", origin: "https://www.als.com", merchant: "Al's Sporting Goods", currency: "USD" }),
+    Object.freeze({ account: "roadrunnersports", origin: "https://www.roadrunnersports.com", merchant: "Road Runner Sports", currency: "USD" })
+]);
+var BODY_LIMIT = 16384;
+var ACCOUNT_HOST = /^([a-z0-9]{1,63})\.vtexvault\.com$/;
+var PATH = /^\/api\/payments\/transactions\/([0-9A-Fa-f]{32})\/payments$/;
+var ORDER_GROUP = /^[0-9]{6,24}$/;
+var BASE64 = /^[A-Za-z0-9+/]{4,1020}={0,2}$/;
+var JSON_TYPE = /^application\/json(?:\s*;\s*charset=utf-8)?$/i;
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var DUE_DATE = /^(?:0[1-9]|1[0-2])\/[0-9]{2}$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var TRANSACTION_ID = /^[0-9A-Fa-f]{32}$/;
+var MERCHANT_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var SHORT_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var FINGERPRINT = /^[A-Za-z0-9_.:=+/-]{1,256}$/;
+var TEXT = /^[^\u0000-\u001f\u007f]{1,200}$/;
+var CARD_DIGITS = /[0-9]{12,}/;
+var DEVICE_INFO_KEYS = Object.freeze(["sw", "sh", "cd", "tz", "lang", "java", "sourceApplication"]);
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var inOrder = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var cardDigits = (text) => CARD_DIGITS.test(text.replace(/[^0-9A-Za-z]/g, ""));
+var plainText = (value) => typeof value === "string" && TEXT.test(value) && !cardDigits(value);
+var count = (value) => Number.isSafeInteger(value) && value >= 0;
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Text(input) {
+    if (input.length % 4 !== 0)
+        return null;
+    const stripped = input.replace(/={1,2}$/, "");
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const character of stripped) {
+        const sextet = BASE64_ALPHABET.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits & 255);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+function deviceInfoSound(text) {
+    if (typeof text !== "string" || !BASE64.test(text))
+        return false;
+    const decoded = base64Text(text);
+    if (decoded === null)
+        return false;
+    let info;
+    try {
+        info = JSON.parse(decoded);
+    }
+    catch {
+        return false;
+    }
+    if (!record(info) || !Object.keys(info).every((key) => DEVICE_INFO_KEYS.includes(key)))
+        return false;
+    for (const key of ["sw", "sh", "cd"])
+        if (own(info, key) && !(count(info[key]) && info[key] <= 1e5))
+            return false;
+    if (own(info, "tz") && !(Number.isSafeInteger(info.tz) && Math.abs(info.tz) <= 1440))
+        return false;
+    if (own(info, "lang") && !(typeof info.lang === "string" && /^[A-Za-z]{0,8}$/.test(info.lang)))
+        return false;
+    if (own(info, "java") && typeof info.java !== "boolean")
+        return false;
+    return !own(info, "sourceApplication") || typeof info.sourceApplication === "string" && /^[A-Za-z0-9_.-]{1,32}$/.test(info.sourceApplication);
+}
+function vtexPaymentsCardTarget(url) {
+    if (typeof url !== "string" || url.length > 8192)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hash)
+        return null;
+    const path = PATH.exec(parsed.pathname);
+    const host = ACCOUNT_HOST.exec(parsed.hostname);
+    if (!path || !host)
+        return null;
+    const fallback = parsed.hostname === VTEX_PAYMENTS_FALLBACK_HOST;
+    const names = [...parsed.searchParams.keys()];
+    const expected = ["orderId", "deviceInfo", ...parsed.searchParams.has("callbackUrl") ? ["callbackUrl"] : [], ...fallback ? ["an"] : []];
+    if (names.length !== expected.length || names.some((name, i) => name !== expected[i]))
+        return null;
+    const orderId = parsed.searchParams.get("orderId");
+    if (!ORDER_GROUP.test(orderId) || !deviceInfoSound(parsed.searchParams.get("deviceInfo")))
+        return null;
+    if (parsed.searchParams.has("callbackUrl")) {
+        let callback;
+        try {
+            callback = new URL(parsed.searchParams.get("callbackUrl"));
+        }
+        catch {
+            return null;
+        }
+        if (callback.protocol !== "https:" || callback.username || callback.password || callback.searchParams.get("step") !== "payment" || callback.searchParams.get("og") !== orderId)
+            return null;
+    }
+    const account = fallback ? parsed.searchParams.get("an") : host[1];
+    if (!/^[a-z0-9]{1,63}$/.test(account) || account === "api")
+        return null;
+    return Object.freeze({ account, transactionId: path[1], orderId, fallback });
+}
+function isVtexPaymentsCardUrl(url) {
+    const target = vtexPaymentsCardTarget(url);
+    return target !== null && !target.fallback;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!Array.isArray(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function cardLine(line) {
+    if (!record(line))
+        return false;
+    const fields = record(line.fields) ? line.fields : {};
+    return line.groupName === "creditCardPaymentGroup" || line.groupName === "debitCardPaymentGroup" || own(line, "accountId") || own(fields, "accountId") || own(fields, "cardNumber") || own(fields, "validationCode") || own(fields, "dueDate");
+}
+function addressSound(address) {
+    if (!record(address) || !inOrder(address, VTEX_PAYMENTS_ADDRESS_KEYS))
+        return false;
+    for (const [key, value] of Object.entries(address)) {
+        if (key === "addressType") {
+            if (value !== "billing")
+                return false;
+            continue;
+        }
+        if (key === "addressId") {
+            if (!(typeof value === "string" && SHORT_ID.test(value)))
+                return false;
+            continue;
+        }
+        if (value === null && (key === "complement" || key === "reference"))
+            continue;
+        if (!(value === "" || plainText(value)))
+            return false;
+    }
+    return true;
+}
+function fieldsSound(fields) {
+    if (!record(fields) || !inOrder(fields, VTEX_PAYMENTS_FIELD_KEYS) || own(fields, "metadata"))
+        return false;
+    if (!(typeof fields.cardNumber === "string" && CARD_NUMBER.test(fields.cardNumber)))
+        return false;
+    if (!(typeof fields.validationCode === "string" && SECURITY_CODE.test(fields.validationCode)))
+        return false;
+    if (!(typeof fields.dueDate === "string" && DUE_DATE.test(fields.dueDate)))
+        return false;
+    if (!plainText(fields.holderName))
+        return false;
+    if (own(fields, "document") && !(fields.document === "" || plainText(fields.document) && fields.document.length <= 32))
+        return false;
+    if (own(fields, "address") && !addressSound(fields.address))
+        return false;
+    if (own(fields, "deviceFingerprint") && !(typeof fields.deviceFingerprint === "string" && FINGERPRINT.test(fields.deviceFingerprint)))
+        return false;
+    return !own(fields, "addressId") || typeof fields.addressId === "string" && SHORT_ID.test(fields.addressId);
+}
+function vtexPaymentsBodyVerdict(body, target) {
+    const lines = readBody(body);
+    if (lines === null || lines.length === 0 || !lines.every(record))
+        return refuse("vtex_payments_body_unsupported");
+    const cards = lines.filter(cardLine);
+    if (cards.some((line2) => own(line2, "accountId") || own(line2.fields ?? {}, "accountId")))
+        return refuse("vtex_payments_saved_card");
+    if (cards.length === 0)
+        return refuse("vtex_payments_body_unsupported");
+    if (lines.length !== 1 || own(lines[0], "id"))
+        return refuse("vtex_payments_split_payment");
+    const line = lines[0];
+    if (!inOrder(line, VTEX_PAYMENTS_LINE_KEYS) || line.groupName !== "creditCardPaymentGroup")
+        return refuse("vtex_payments_body_unsupported");
+    if (!(typeof line.currencyCode === "string" && CURRENCY.test(line.currencyCode)) || !own(VTEX_PAYMENTS_NETWORKS, line.paymentSystem) || !Number.isSafeInteger(line.paymentSystem) || !(count(line.value) && line.value > 0))
+        return refuse("vtex_payments_body_unsupported");
+    if (line.installments !== 1 || line.referenceValue !== line.value || own(line, "installmentsInterestRate") && line.installmentsInterestRate !== 0 || own(line, "installmentsValue") && line.installmentsValue !== line.value)
+        return refuse("vtex_payments_installments");
+    const transaction = line.transaction;
+    if (!record(transaction) || Object.keys(transaction).join() !== "id,merchantName" || !(typeof transaction.id === "string" && TRANSACTION_ID.test(transaction.id)) || !(typeof transaction.merchantName === "string" && MERCHANT_NAME.test(transaction.merchantName)))
+        return refuse("vtex_payments_body_unsupported");
+    if (target && transaction.id.toUpperCase() !== target.transactionId.toUpperCase())
+        return refuse("vtex_payments_split_payment");
+    return fieldsSound(line.fields) ? CARD : refuse("vtex_payments_body_unsupported");
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    if (found.length === 0)
+        return void 0;
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function vtexPaymentsRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "vtex_payments_url_refused";
+    const target = vtexPaymentsCardTarget(request.url);
+    if (target === null)
+        return "vtex_payments_url_refused";
+    if (target.fallback)
+        return "vtex_payments_fallback_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    if (typeof contentType !== "string" || !JSON_TYPE.test(contentType.trim()) || Object.keys(headers).length !== new Set(Object.keys(headers).map((key) => key.toLowerCase())).size) {
+        return "vtex_payments_headers_refused";
+    }
+    const verdict = vtexPaymentsBodyVerdict(request.body, target);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedVtexPaymentsRequest(url, method, body, environment, headers) {
+    return environment === "production" && typeof method === "string" && method.toUpperCase() === "POST" && vtexPaymentsRequestRefusal({ url, method: "POST", headers: record(headers) ? headers : {}, body }) === null;
+}
+function vtexPaymentsOriginPin(merchantOrigin, pins = VTEX_PAYMENTS_MERCHANT_PINS) {
+    return typeof merchantOrigin === "string" ? pins.find((pin) => pin.origin === merchantOrigin) ?? null : null;
+}
+function vtexPaymentsAccountPin(account, pins = VTEX_PAYMENTS_MERCHANT_PINS) {
+    return typeof account === "string" ? pins.find((pin) => pin.account === account) ?? null : null;
+}
+function linePinned(body, pin) {
+    if (vtexPaymentsBodyVerdict(body).verdict !== "card")
+        return false;
+    const [line] = JSON.parse(body);
+    return line.currencyCode === pin.currency && line.transaction.merchantName.toLowerCase() === pin.account;
+}
+function callbackPinned(url, pin) {
+    let callback;
+    try {
+        const parsed = new URL(url);
+        if (!parsed.searchParams.has("callbackUrl"))
+            return true;
+        callback = new URL(parsed.searchParams.get("callbackUrl"));
+    }
+    catch {
+        return false;
+    }
+    return callback.origin === pin.origin;
+}
+function vtexPaymentsMerchantRefusal(merchantOrigin, request, pins = VTEX_PAYMENTS_MERCHANT_PINS) {
+    const pin = vtexPaymentsOriginPin(merchantOrigin, pins);
+    const target = record(request) ? vtexPaymentsCardTarget(request.url) : null;
+    return pin !== null && target !== null && !target.fallback && target.account === pin.account && linePinned(request.body, pin) && callbackPinned(request.url, pin) ? null : "vtex_payments_merchant_unreviewed";
+}
+function vtexPaymentsAmount(body) {
+    if (vtexPaymentsBodyVerdict(body).verdict !== "card")
+        return null;
+    const [line] = JSON.parse(body);
+    return { amountCents: line.value, currency: line.currencyCode.toLowerCase() };
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    vtex_payments_url_refused: "Refusing to pay: this VTEX card request does not go to the store's own VTEX payments address as the checkout sends it. Nothing was sent.",
+    vtex_payments_fallback_refused: "Refusing to pay: this VTEX card request is the checkout's resend to VTEX's shared host, which never takes the card. Nothing was sent.",
+    vtex_payments_headers_refused: "Refusing to pay: this VTEX card request does not carry the checkout's own headers. Nothing was sent.",
+    vtex_payments_saved_card: "Refusing to pay: this VTEX payment would charge a card the store keeps on file, not the card you chose. Nothing was sent.",
+    vtex_payments_split_payment: "Refusing to pay: this VTEX payment splits the price with a gift card, another card or another seller. Nothing was sent.",
+    vtex_payments_installments: "Refusing to pay: this VTEX payment is in installments or adds interest to the price. Nothing was sent.",
+    vtex_payments_body_unsupported: "Refusing to pay: this is not the card request of the store's VTEX checkout. Nothing was sent.",
+    vtex_payments_merchant_unreviewed: "Refusing to pay: this VTEX payment goes to a store Agentcard has not reviewed. Nothing was sent."
+});
+function vtexPaymentsRefusalMessage(code) {
+    return own(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.vtex_payments_body_unsupported;
+}
+function vtexPaymentsDeviceRefusal(request) {
+    const refusal = vtexPaymentsRequestRefusal(request);
+    if (refusal)
+        return refusal;
+    const pin = vtexPaymentsAccountPin(vtexPaymentsCardTarget(request.url).account);
+    return pin !== null && linePinned(request.body, pin) && callbackPinned(request.url, pin) ? null : "vtex_payments_merchant_unreviewed";
+}
+var FILL_FAILED = "Could not fill the card fields for VTEX. Nothing was sent.";
+var cardText = (value) => typeof value === "string" ? value : Number.isSafeInteger(value) ? String(value) : "";
+var NETWORK_OF = Object.freeze({
+    visa: (number) => /^4[0-9]{12}(?:[0-9]{3}){0,2}$/.test(number),
+    mastercard: (number) => /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/.test(number),
+    amex: (number) => /^3[47][0-9]{13}$/.test(number),
+    discover: (number) => /^(?:6011[0-9]{12}|64[4-9][0-9]{13}|65[0-9]{14})$/.test(number)
+});
+var NETWORK_NAME = Object.freeze({ visa: "Visa", mastercard: "Mastercard", amex: "American Express", discover: "Discover" });
+var whole = (value) => {
+    if (Number.isSafeInteger(value) && value >= 0)
+        return value;
+    return typeof value === "string" && /^[0-9]{1,4}$/.test(value) ? Number(value) : NaN;
+};
+function injectVtexPaymentsCard(body, card) {
+    const verdict = vtexPaymentsBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(vtexPaymentsRefusalMessage(verdict.code));
+    const number = card ? cardText(card.number) : "";
+    const cvc = card ? cardText(card.cvc) : "";
+    const month = card ? whole(card.month) : NaN;
+    const rawYear = card ? whole(card.year) : NaN;
+    const year = rawYear >= 2e3 && rawYear <= 2099 ? rawYear - 2e3 : rawYear;
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvc) || !(month >= 1 && month <= 12) || !(year >= 0 && year <= 99))
+        throw new Error(FILL_FAILED);
+    const lines = JSON.parse(body);
+    const network = VTEX_PAYMENTS_NETWORKS[lines[0].paymentSystem];
+    if (!NETWORK_OF[network](number)) {
+        throw new Error(`Refusing to pay: the store's checkout routes this payment as ${NETWORK_NAME[network]}, and the card you chose is not one. Nothing was sent.`);
+    }
+    if (cvc.length !== (network === "amex" ? 4 : 3))
+        throw new Error(FILL_FAILED);
+    const fields = lines[0].fields;
+    fields.cardNumber = number;
+    fields.validationCode = cvc;
+    fields.dueDate = `${String(month).padStart(2, "0")}/${String(year).padStart(2, "0")}`;
+    const where = ["fields.cardNumber", "fields.validationCode", "fields.dueDate"];
+    const name = card && typeof card.name === "string" ? card.name.trim() : "";
+    if (name && plainText(name)) {
+        fields.holderName = name;
+        where.push("fields.holderName");
+    }
+    return { body: JSON.stringify(lines), where };
+}
+var ANSWER_LIMIT = 65536;
+var ERROR_CODE = /^[A-Za-z0-9_.-]{1,48}$/;
+function vtexPaymentsRefusalCode(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    let answer;
+    try {
+        answer = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const code = record(answer) && record(answer.error) ? answer.error.code : void 0;
+    return typeof code === "string" && ERROR_CODE.test(code) && !cardDigits(code) ? `vtex_payments_${code}` : null;
+}
+function vtexPaymentsAnswerOutcome(status, text) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "vtex_payments_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400)
+        return { outcome: "refused", code: vtexPaymentsRefusalCode(text) ?? `http_${status}` };
+    if (status === 201 && (text === "" || text === void 0 || text === null))
+        return { outcome: "approved", body: "", pending: "processing" };
+    return { outcome: "unknown", reason: "vtex_payments_unconfirmed" };
+}
+var vtex_payments_default = /* @__PURE__ */ registerProcessor({
+    psp: VTEX_PAYMENTS_PSP,
+    definitions: [
+        {
+            psp: "vtex_payments",
+            // Ollie's card post to a VTEX account's own vault, as the header above reads it, and the fallback host, which
+            // the gate recognizes only to refuse, so the agent's placeholder never reaches it either. VTEX has no test host:
+            // every request is live. Prepared only: Ollie gives the post 12 seconds. Ships dark: served only to a client that
+            // declares `vtex_payments_card_payment`, on for Agentcard's own company alone (backend
+            // checkout-processor-gate.ts), and autopilot never sends it.
+            capability: "vtex_payments_card_payment",
+            match: "[a-z0-9-]{1,63}\\.vtexvault\\.com/api/payments/transactions/[A-Za-z0-9-]{1,64}/payments(?![\\w/.%-])",
+            hosts: ["^[a-z0-9-]{1,63}\\.vtexvault\\.com$"],
+            preparationRequired: true,
+            encoding: "json",
+            // Ollie's fetch sets the JSON content type alone. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            jsonCardFields: [[0, "fields", "cardNumber"]]
+        }
+    ],
+    // Only the cardholder's device sends it, after a person approves; no reviewed list names vtex_payments.
+    refusedOperations: [VTEX_PAYMENTS_OPERATION],
+    // Not surveyed: VTEX names a payment's end only to the store's own API keys and at the gatewayCallback that follows.
+    settlementReadback: "not_surveyed",
+    exactUrl: isVtexPaymentsCardUrl,
+    bodyGate: (url, body) => {
+        if (url === void 0)
+            return vtexPaymentsBodyVerdict(body);
+        const target = vtexPaymentsCardTarget(url);
+        if (target === null)
+            return refuse("vtex_payments_url_refused");
+        return target.fallback ? refuse("vtex_payments_fallback_refused") : vtexPaymentsBodyVerdict(body, target);
+    },
+    amount: (template) => record(template) && isVtexPaymentsCardUrl(template.url) ? vtexPaymentsAmount(template.body) : null
+});
+var device = /* @__PURE__ */ registerDeviceRules(VTEX_PAYMENTS_PSP, {
+    deviceCheck: (request) => {
+        const refusal = vtexPaymentsDeviceRefusal(request);
+        return refusal ? vtexPaymentsRefusalMessage(refusal) : null;
+    },
+    fill: injectVtexPaymentsCard,
+    refusalCode: (text) => vtexPaymentsRefusalCode(text),
+    outcome: (status, text) => vtexPaymentsAnswerOutcome(status, text)
+});
+export { VTEX_PAYMENTS_ADDRESS_KEYS, VTEX_PAYMENTS_CAPABILITY, VTEX_PAYMENTS_FALLBACK_HOST, VTEX_PAYMENTS_FIELD_KEYS, VTEX_PAYMENTS_LINE_KEYS, VTEX_PAYMENTS_MERCHANT_PINS, VTEX_PAYMENTS_NETWORKS, VTEX_PAYMENTS_OPERATION, VTEX_PAYMENTS_PREPARATION_URL, VTEX_PAYMENTS_PSP, VTEX_PAYMENTS_REFUSAL_CODES, vtex_payments_default as default, device, injectVtexPaymentsCard, isPreparedVtexPaymentsRequest, isVtexPaymentsCardUrl, vtexPaymentsAccountPin, vtexPaymentsAmount, vtexPaymentsAnswerOutcome, vtexPaymentsBodyVerdict, vtexPaymentsCardTarget, vtexPaymentsDeviceRefusal, vtexPaymentsMerchantRefusal, vtexPaymentsOriginPin, vtexPaymentsRefusalCode, vtexPaymentsRefusalMessage, vtexPaymentsRequestRefusal };

package/dist/webhooks.d.ts

@@ -7,9 +7,9 @@
  * missed event, and hands back the event typed by its `type`. WebCrypto only,
  * so it runs wherever the client runs.
  */
-import { type AuthorizationStatus, type Settlement, type TerminalReason } from './voice-types.js';
+import { type AuthorizationStatus, type Settlement, type TerminalReason } from './api-types.js';
 /** The purchase events an endpoint receives, `checkout_authorization.*`. */
-export declare const CHECKOUT_AUTHORIZATION_EVENT_TYPES: readonly ["checkout_authorization.created", "checkout_authorization.notified", "checkout_authorization.watched", "checkout_authorization.approved", "checkout_authorization.declined", "checkout_authorization.refused", "checkout_authorization.expired", "checkout_authorization.cancelled", "checkout_authorization.submitted", "checkout_authorization.submitted_on_device", "checkout_authorization.replay_started", "checkout_authorization.amount_mismatch", "checkout_authorization.duplicate_charge", "checkout_authorization.duplicate_guard_reported", "checkout_authorization.outcome_reported", "checkout_authorization.continuation_checked", "checkout_authorization.bank_check_started", "checkout_authorization.settled", "checkout_authorization.settlement_unconfirmed", "checkout_authorization.autopilot_dispatched", "checkout_authorization.autopilot_completed", "checkout_authorization.voice_dispatched"];
+export declare const CHECKOUT_AUTHORIZATION_EVENT_TYPES: readonly ["checkout_authorization.created", "checkout_authorization.notified", "checkout_authorization.watched", "checkout_authorization.approved", "checkout_authorization.declined", "checkout_authorization.refused", "checkout_authorization.expired", "checkout_authorization.cancelled", "checkout_authorization.submitted", "checkout_authorization.submitted_on_device", "checkout_authorization.replay_started", "checkout_authorization.amount_mismatch", "checkout_authorization.duplicate_charge", "checkout_authorization.duplicate_guard_reported", "checkout_authorization.outcome_reported", "checkout_authorization.continuation_checked", "checkout_authorization.bank_check_started", "checkout_authorization.settled", "checkout_authorization.settlement_unconfirmed", "checkout_authorization.autopilot_dispatched", "checkout_authorization.autopilot_completed"];
 export type CheckoutAuthorizationEventType = (typeof CHECKOUT_AUTHORIZATION_EVENT_TYPES)[number];
 /** The Vault events, `vault.*`: a person connected, stored a card, added or used a passkey. */
 export declare const VAULT_EVENT_TYPES: readonly ["vault.session_linked", "vault.card_stored", "vault.passkey_added", "vault.passkey_signin"];

package/dist/webhooks.js

@@ -7,7 +7,7 @@
  * missed event, and hands back the event typed by its `type`. WebCrypto only,
  * so it runs wherever the client runs.
  */
-import { AgentcardError } from './voice-types.js';
+import { AgentcardError } from './api-types.js';
 /** The purchase events an endpoint receives, `checkout_authorization.*`. */
 export const CHECKOUT_AUTHORIZATION_EVENT_TYPES = [
     'checkout_authorization.created', 'checkout_authorization.notified', 'checkout_authorization.watched', 'checkout_authorization.approved',
@@ -16,7 +16,7 @@ export const CHECKOUT_AUTHORIZATION_EVENT_TYPES = [
     'checkout_authorization.amount_mismatch', 'checkout_authorization.duplicate_charge', 'checkout_authorization.duplicate_guard_reported',
     'checkout_authorization.outcome_reported', 'checkout_authorization.continuation_checked', 'checkout_authorization.bank_check_started',
     'checkout_authorization.settled', 'checkout_authorization.settlement_unconfirmed',
-    'checkout_authorization.autopilot_dispatched', 'checkout_authorization.autopilot_completed', 'checkout_authorization.voice_dispatched',
+    'checkout_authorization.autopilot_dispatched', 'checkout_authorization.autopilot_completed',
 ];
 /** The Vault events, `vault.*`: a person connected, stored a card, added or used a passkey. */
 export const VAULT_EVENT_TYPES = ['vault.session_linked', 'vault.card_stored', 'vault.passkey_added', 'vault.passkey_signin'];

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "7f65e0f07138296b0cbff7dd1ed4331842b6dd45e2950f08273fcc772c7f63f6",
+  "catalog_sha256": "d27bf03744adafed6b1e6731f61439bb410e90ab4937dcb279d3e5db46784784",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.28",
-  "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
+  "version": "0.24.0",
+  "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,16 +24,15 @@
     "access": "public"
   },
   "scripts": {
-    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts), the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones), and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned.",
-    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && node scripts/generate-url-masks.mjs && node scripts/generate-capabilities.mjs && node scripts/generate-agent-amount.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
+    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core (src/*.generated.ts) and the Kernel kit's inventory from the built catalog; git ignores every file it writes. TypeScript remains pinned. The build starts from an empty dist, so a module the source no longer has never reaches a packed tarball.",
+    "build": "node scripts/clean-dist.mjs && node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-url-masks.mjs && node scripts/generate-capabilities.mjs && node scripts/generate-agent-amount.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs && node scripts/generate-kernel-native-inventory.mjs",
     "prepublishOnly": "pnpm build",
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
-    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
+    "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs pin-payments.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
-    "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",
     "test:preflight:browser": "node preflight-browser.test.mjs",
     "pack:preview": "node scripts/pack-preflight-preview.mjs",
@@ -46,7 +45,6 @@
     "browser-automation",
     "pci",
     "checkout",
-    "voice",
     "agentcard"
   ],
   "engines": {