@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/approvals.js

@@ -0,0 +1,213 @@
+import { ApiModule } from './api-module.js';
+import { stripePaymentIntentConfirmRequest } from './requests.js';
+import { AgentcardError } from './api-types.js';
+/** Your server's words for withdrawing a purchase (`approvals.cancel`); anything else is refused before any call. */
+export const CANCEL_REASONS = ['person_closed_sheet', 'person_changed_mind', 'business_cancelled'];
+/** How long `awaitResult` waits when the call names no `timeout_ms`. */
+const AWAIT_RESULT_TIMEOUT_MS = 60_000;
+/**
+ * The sandbox request: a first run's purchase, naming no processor. Under a sandbox client
+ * `approvals.create({ request: 'sandbox' })` sends this; the sandbox completes it without reaching any
+ * processor. A live client refuses it before any call (`sandbox_request_in_live`).
+ */
+export const SANDBOX_REQUEST = stripePaymentIntentConfirmRequest({
+    origin: 'https://sandbox.agentcard.sh',
+    intent: { id: 'pi_sandbox', client_secret: 'pi_sandbox_secret_sandbox', publishable_key: 'pk_test_sandbox' },
+});
+/**
+ * The origin a paused request pays from, when its `origin` header is one Agentcard admits as `checkout_origin`
+ * (an exact https origin, or http://localhost for a local run); null otherwise.
+ */
+function checkoutOriginOf(request) {
+    const header = Object.entries(request.headers ?? {}).find(([k]) => k.toLowerCase() === 'origin')?.[1];
+    if (typeof header !== 'string')
+        return null;
+    try {
+        const u = new URL(header);
+        return u.origin === header && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && u.hostname === 'localhost')) ? header : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The paying card as the API names it, read for its type; null for null or anything that is not one. */
+function cardOf(v) {
+    if (!v || typeof v !== 'object')
+        return null;
+    const c = v;
+    if (typeof c.id !== 'string' || !c.id)
+        return null;
+    return { id: c.id, name: typeof c.name === 'string' ? c.name : '', last4: typeof c.last4 === 'string' ? c.last4 : null, brand: typeof c.brand === 'string' ? c.brand : null, reason: typeof c.reason === 'string' ? c.reason : null };
+}
+/** The choosable cards as the API lists them; a list only, every entry a card. */
+function cardsOf(v) {
+    if (!Array.isArray(v))
+        return undefined;
+    const out = [];
+    for (const raw of v) {
+        const card = cardOf(raw);
+        if (!card)
+            continue;
+        const c = raw;
+        out.push({ ...card, recommended: c.recommended === true, ...(c.auto_approve === true ? { auto_approve: true } : {}) });
+    }
+    return out;
+}
+/** The fields a read carries beside its status, typed, and nothing the row does not carry. */
+function fieldsOf(a) {
+    const out = {};
+    if ('request_id' in a)
+        out.request_id = a.request_id ?? null;
+    if ('external_user_id' in a)
+        out.external_user_id = a.external_user_id ?? null;
+    if (typeof a.interval === 'number')
+        out.interval = a.interval;
+    if (typeof a.poll_interval_ms === 'number')
+        out.poll_interval_ms = a.poll_interval_ms;
+    if (typeof a.expires_at === 'string')
+        out.expires_at = a.expires_at;
+    if ('terminal_reason' in a)
+        out.terminal_reason = a.terminal_reason ?? null;
+    if (typeof a.execution_mode === 'string')
+        out.execution_mode = a.execution_mode;
+    if (typeof a.execution_reason === 'string')
+        out.execution_reason = a.execution_reason;
+    if (typeof a.execution_detail === 'string')
+        out.execution_detail = a.execution_detail;
+    if ('card' in a)
+        out.card = cardOf(a.card);
+    const cards = cardsOf(a.cards);
+    if (cards)
+        out.cards = cards;
+    return out;
+}
+/** A purchase as one read answers it: the status, what approved it, the request fields and the settlement. */
+function resultOf(a) {
+    // The settlement as the API carries it (the same object as on the finishing webhook), read defensively: an object
+    // with a status word, or null when there is nothing to read back; absent from an older API.
+    const settlement = 'settlement' in a
+        ? (a.settlement && typeof a.settlement === 'object' && typeof a.settlement.status === 'string' ? a.settlement : null)
+        : undefined;
+    // The API answers the link as `approvalUrl` on its reads; `approval_url` is read too.
+    const approvalUrl = typeof a.approval_url === 'string' ? a.approval_url : typeof a.approvalUrl === 'string' ? a.approvalUrl : undefined;
+    return {
+        ...(typeof a.id === 'string' ? { id: a.id } : {}),
+        status: a.status,
+        ...(typeof a.approved_with === 'string' ? { approved_with: a.approved_with } : {}),
+        ...fieldsOf(a),
+        ...(settlement === undefined ? {} : { settlement }),
+        ...(approvalUrl && a.status === 'awaiting_approval' ? { approval_url: approvalUrl } : {}),
+    };
+}
+/** A random idempotency key for one create, so a retried call makes one purchase. */
+function idempotencyKey() {
+    const c = globalThis.crypto;
+    if (c?.randomUUID)
+        return c.randomUUID();
+    return 'ik_' + Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+/** `agentcard.approvals`: constructed by the client, never on its own. */
+export class ApprovalsModule extends ApiModule {
+    clientIsSandbox;
+    constructor(t, clientIsSandbox) {
+        super(t);
+        this.clientIsSandbox = clientIsSandbox;
+    }
+    /**
+     * Creates the purchase, paused for the person's approval on Agentcard's page, for the person `user_id`
+     * names. `execution_mode: 'autopilot'` means the person's rule took it and no approval follows.
+     * `request: 'sandbox'` is the first-run form: under a sandbox client (`sandbox: true`, an `sk_test_`
+     * credential, or a mode the token exchange named) it sends the sandbox request; a live client refuses it
+     * before the create leaves (`sandbox_request_in_live`). Every create carries an idempotency key, so a
+     * retried call makes one purchase.
+     */
+    async create(input) {
+        const user = input.user_id;
+        if (typeof user !== 'string' || !user)
+            throw new AgentcardError('not_connected', 'Name user_id: a person connected to your client. Refused before any call.');
+        let request;
+        if (input.request === 'sandbox') {
+            // A client that was not named sandbox may still learn it from the token exchange; the create itself has not left.
+            if (!this.clientIsSandbox())
+                await this.t.bearer();
+            if (!this.clientIsSandbox())
+                throw new AgentcardError('sandbox_request_in_live', "request: 'sandbox' is for a sandbox client. Under live credentials build the processor's request (checkout.requests.build) or hand over the request a browser purchase paused on. Refused before any call.");
+            request = SANDBOX_REQUEST;
+        }
+        else if (input.request && typeof input.request === 'object' && typeof input.request.url === 'string') {
+            request = input.request;
+        }
+        else {
+            throw new AgentcardError('invalid_request', "request must be a paused request ({ url, method, headers, body }) or 'sandbox'. Refused before any call.");
+        }
+        // The origin the purchase is paid from goes in the create (Agentcard keeps no `origin` header from the paused
+        // request), so a rule the person confirmed can take it; named on the call, else the paused request's own.
+        const checkoutOrigin = input.checkout_origin ?? checkoutOriginOf(request);
+        const body = await this.request('/v2/checkout/authorizations', {
+            method: 'POST',
+            body: {
+                user, merchant: input.merchant, amount: input.amount, currency: input.currency, psp: input.psp ?? 'stripe', mode: input.mode ?? 'token', request,
+                ...(input.return_url ? { return_url: input.return_url } : {}), ...(checkoutOrigin ? { checkout_origin: checkoutOrigin } : {}), ...(input.card_id ? { card_id: input.card_id } : {}),
+            },
+            headers: { 'idempotency-key': input.idempotency_key ?? idempotencyKey() },
+        });
+        const approvalUrl = body.approval_url ?? body.approvalUrl;
+        return {
+            id: body.id, status: body.status, ...fieldsOf(body),
+            ...(approvalUrl ? { approval_url: approvalUrl } : {}), ...(typeof body.return_url === 'string' ? { return_url: body.return_url } : {}),
+        };
+    }
+    /**
+     * One read of a purchase, with no wait: its status, what approved it, the request fields and the settlement
+     * once it finished. The way to ask "is it decided yet?" from a handler that cannot wait; `awaitResult` is the
+     * way to wait. `slow_down` is waited out.
+     */
+    async get(authorizationId) {
+        const a = await this.read(`/v2/checkout/authorizations/${encodeURIComponent(authorizationId)}`);
+        return resultOf(a);
+    }
+    /**
+     * Withdraws a purchase that still awaits the person, in your server's own words: the person closed the
+     * page (`person_closed_sheet`), the person changed their mind (`person_changed_mind`), or a reason of your
+     * own (`business_cancelled`). The purchase reads `status: 'cancelled'` from then on, and the reason is its
+     * `terminal_reason` on every read and on the `checkout_authorization.cancelled` webhook. Idempotent: a
+     * purchase already withdrawn answers what it became. One the person already approved cannot be withdrawn
+     * (`409 already_finalized` once it finished, `409 outcome_unknown` while the card is with the processor).
+     */
+    async cancel(authorizationId, opts) {
+        const reason = opts?.reason;
+        if (!CANCEL_REASONS.includes(reason))
+            throw new AgentcardError('invalid_cancel_reason', `reason must be one of ${CANCEL_REASONS.join(', ')}.`);
+        const body = await this.request(`/v2/checkout/authorizations/${encodeURIComponent(authorizationId)}/cancel`, { method: 'POST', body: { reason } });
+        const stamped = CANCEL_REASONS.includes(body.reason) ? body.reason : reason;
+        return { id: body.id ?? authorizationId, status: 'cancelled', reason: stamped, terminal_reason: (typeof body.terminal_reason === 'string' ? body.terminal_reason : stamped), request_id: body.request_id ?? null };
+    }
+    /**
+     * Polls the purchase until it leaves `awaiting_approval`; `{ status: 'timeout' }` at the deadline (60 s unless
+     * `timeout_ms` names another). The first read's `interval` (seconds) is the least this waits between reads, and
+     * a `slow_down` answer backs off to the interval it names and keeps polling.
+     */
+    async awaitResult(authorizationId, opts = {}) {
+        let intervalMs;
+        const timeoutMs = opts.timeout_ms ?? AWAIT_RESULT_TIMEOUT_MS;
+        const deadline = Date.now() + timeoutMs;
+        return this.poll(async () => {
+            let a;
+            try {
+                // The shared read waits out slow_down up to this call's deadline; past it the refusal is the poll
+                // loop's cue to space its next read by the interval named, and the deadline reads `timeout`.
+                a = await this.read(`/v2/checkout/authorizations/${encodeURIComponent(authorizationId)}`, { deadline, onInterval: (ms) => { intervalMs = ms; } });
+            }
+            catch (err) {
+                if (err instanceof AgentcardError && err.code === 'slow_down')
+                    return undefined;
+                throw err;
+            }
+            if (typeof a.interval === 'number')
+                intervalMs = a.interval * 1000;
+            if (a.status === 'awaiting_approval')
+                return undefined;
+            return resultOf(a);
+        }, timeoutMs, () => ({ status: 'timeout' }), () => intervalMs);
+    }
+}

package/dist/aurus.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Aurus Pay's ecom card frame (O'Reilly Auto Parts' card form), as this SDK reads it.
+ *
+ * The store frames https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, the card fields sit inside that frame,
+ * and when the store asks the frame for a token the frame's own script seals the card and posts it to
+ * /storeservices/ecom/oneTimeToken on its own host. That post is the one request this SDK pauses, and only when the frame
+ * that sent it is Aurus's card frame: the same post from the store's page, another frame, or a frame the adapter cannot
+ * read is stopped in the browser with nothing created, so no other page can hand the cardholder an Aurus approval.
+ *
+ * isAurusTokenRequestUrl takes the URLs payment-core's isAurusTokenUrl takes, and isAurusCardFrameUrl the frames its
+ * isAurusFrameUrl takes; aurus.test.mjs pins both to payment-core.
+ */
+import type { PreClaimGate } from './pre-claim.js';
+export declare const AURUS_PSP = "aurus";
+/** The dark-launch capability the API serves Aurus's recognizer behind (payment-core processors/aurus.js). */
+export declare const AURUS_CAPABILITY = "aurus_one_time_token";
+/** Exactly https://pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken?d1=es<NN>.auruspay.com&d2=es<NN>.auruspay.com. */
+export declare function isAurusTokenRequestUrl(url: string): boolean;
+/** Whether a frame's URL is Aurus's card frame: https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, any query. */
+export declare function isAurusCardFrameUrl(url: string | undefined): boolean;
+/**
+ * Who sent an Aurus card request, as far as it decides the pause: 'frame' when the sender is Aurus's card frame,
+ * 'outside' when it is any other frame or the page, 'unread' when the adapter could not read the sender.
+ */
+export declare function aurusSender(frames: readonly string[] | undefined): 'frame' | 'outside' | 'unread';
+/**
+ * The pre-claim gate (pre-claim.ts PSP_PRE_CLAIM_GATES). Once this build's registry serves Aurus's card request (a
+ * capability the API serves only to a company Aurus is turned on for), a POST to its exact URL that the registry
+ * recognizes is judged by who sent it: from Aurus's card frame it defers, and the terminal arbiter pauses it for the
+ * claim flow like any card request; from anywhere else, or from a sender the adapter could not read, it is aborted with
+ * a `blocked` event, `aurus_request_outside_frame`, and nothing is created. Every other request is not this gate's.
+ */
+export declare const aurusPreClaim: PreClaimGate;

package/dist/aurus.js

@@ -0,0 +1,75 @@
+export const AURUS_PSP = 'aurus';
+/** The dark-launch capability the API serves Aurus's recognizer behind (payment-core processors/aurus.js). */
+export const AURUS_CAPABILITY = 'aurus_one_time_token';
+const HOST = /^pecst[0-9]{2}\.aurusepay\.com$/;
+const SERVER = /^es[0-9]{2}\.auruspay\.com$/;
+/** Exactly https://pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken?d1=es<NN>.auruspay.com&d2=es<NN>.auruspay.com. */
+export function isAurusTokenRequestUrl(url) {
+    if (typeof url !== 'string' || url.length > 256 || url.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.href !== url || parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password
+        || !HOST.test(parsed.hostname) || parsed.pathname !== '/storeservices/ecom/oneTimeToken')
+        return false;
+    const query = parsed.search.slice(1).split('&').map((pair) => pair.split('='));
+    return query.length === 2 && query[0].length === 2 && query[1].length === 2 && query[0][0] === 'd1' && query[1][0] === 'd2'
+        && SERVER.test(query[0][1]) && SERVER.test(query[1][1]);
+}
+/** Whether a frame's URL is Aurus's card frame: https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, any query. */
+export function isAurusCardFrameUrl(url) {
+    if (typeof url !== 'string')
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.port && !parsed.username && !parsed.password
+        && HOST.test(parsed.hostname) && parsed.pathname === '/storeservices/ecom/getiframe';
+}
+/**
+ * Who sent an Aurus card request, as far as it decides the pause: 'frame' when the sender is Aurus's card frame,
+ * 'outside' when it is any other frame or the page, 'unread' when the adapter could not read the sender.
+ */
+export function aurusSender(frames) {
+    if (!frames || frames.length === 0)
+        return 'unread';
+    return isAurusCardFrameUrl(frames[0]) ? 'frame' : 'outside';
+}
+/**
+ * The pre-claim gate (pre-claim.ts PSP_PRE_CLAIM_GATES). Once this build's registry serves Aurus's card request (a
+ * capability the API serves only to a company Aurus is turned on for), a POST to its exact URL that the registry
+ * recognizes is judged by who sent it: from Aurus's card frame it defers, and the terminal arbiter pauses it for the
+ * claim flow like any card request; from anywhere else, or from a sender the adapter could not read, it is aborted with
+ * a `blocked` event, `aurus_request_outside_frame`, and nothing is created. Every other request is not this gate's.
+ */
+export const aurusPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isAurusTokenRequestUrl(url) || !ctx.vault.isCardRequest(url, method))
+        return undefined;
+    const decide = (frames) => {
+        const sender = aurusSender(frames);
+        return sender === 'frame' ? undefined : aurusOutsideFrame(ctx, sender);
+    };
+    let frames;
+    try {
+        frames = ctx.initiatorFrames?.();
+    }
+    catch {
+        frames = undefined;
+    }
+    return frames instanceof Promise ? frames.then(decide, () => decide(undefined)) : decide(frames);
+};
+async function aurusOutsideFrame(ctx, sender) {
+    ctx.onEvent?.({ type: 'blocked', detail: { reason: 'aurus_request_outside_frame', sender } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize|checkout\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i, /^x-internal-correlation-id$/i, /^x-app-version$/i, /^x-transactionsource$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(?:card-acquisition-gateway(?:\.sandbox)?\.checkout\.com\/tokens|(?:[a-z0-9]+\.)?api(?:\.sandbox)?\.checkout\.com\/tokens|(?:[a-z0-9]+\.)?devices\.api(?:\.sandbox)?\.checkout\.com\/(?:cag\/)?tokens)/i, "hosts": ["^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.checkout\\.com$", "^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize|checkout\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i, /^x-internal-correlation-id$/i, /^x-app-version$/i, /^x-transactionsource$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/buy.d.ts

@@ -1,29 +1,19 @@
 /**
  * The buy module of the SDK: `agentcard.buy.*`. The Purchase API from the
- * same client the voice module uses: one pair of client credentials, one
+ * same client the checkout module uses: one pair of client credentials, one
  * token. A business asks for a cart on behalf of a person it connected,
  * confirms the cart by its hash, and, when it already holds an approval the
- * person gave by voice, names that approval on the confirm so the API places
+ * person gave, names that approval on the confirm so the API places
  * against it and asks the person for nothing a second time (decision 234).
- * With `approval: 'voice'` the confirm asks the API to mint the purchase's
- * own approval instead of an approval page, the business runs the key word
- * in its app on that id, and the same confirm placed again completes the
- * order (decision 237).
  *
  * Every call names `user_id`, the person the connect exchange returned, so a
  * server serving many people never buys for the wrong one. A person who is
  * not connected to this client is refused with `user_not_connected`.
  */
 import { ApiModule, type ApiTransport } from './api-module.js';
-import { AgentcardError } from './voice-types.js';
-/** Where a turn stands. `needs_input` is the common case: a question, or a cart waiting for its confirm; `needs_approval` is a confirm under `approval: 'voice'` waiting for the person's verdict on `authorization_id`; `approved_not_charged` is a sandbox browser checkout the person approved, where the card was never sent to the store. */
-export type BuyStatus = 'needs_input' | 'needs_approval' | 'order_placed' | 'partially_placed' | 'declined' | 'approved_not_charged';
-/** How a confirm that pays with the person's own card asks them: `page`, Agentcard's approval page on `approval_url` (the default); `voice`, the key word inside your app on the purchase's own `authorization_id`. */
-export type BuyApproval = 'voice' | 'page';
-/** The two ways a purchase approved by voice ends without an order: the person declined it, or the approval ran out before a confirm placed against it. */
-export type BuyVoiceDeclineCode = 'voice_declined' | 'approval_expired';
-/** The one refusal a store makes under `approval: 'voice'`: its connector cannot place under a voice verdict, and the business takes its own path. A 409, as `BuyError.code`. */
-export declare const VOICE_EXECUTION_UNSUPPORTED = "voice_execution_unsupported";
+import { AgentcardError } from './api-types.js';
+/** Where a turn stands. `needs_input` is the common case: a question, or a cart waiting for its confirm; `approved_not_charged` is a sandbox browser checkout the person approved, where the card was never sent to the store. */
+export type BuyStatus = 'needs_input' | 'order_placed' | 'partially_placed' | 'declined' | 'approved_not_charged';
 /** One line of a cart as the API shows it; `product_id` is the merchant's id for the line, null on a cart recorded before it was kept. */
 export interface BuyCartLine {
     name: string;
@@ -50,7 +40,10 @@ export interface BuyCart {
     /** The store the cart is at, when one is known: for `retail`, the retailer every line is at. Null otherwise. */
     store: BuyStore | null;
     items: BuyCartLine[];
-    serviceFeesCents: number;
+    /** Fees on top of the items, or null while the store has not quoted them (`serviceFeesStatus` says which). */
+    serviceFeesCents: number | null;
+    /** `known` when `serviceFeesCents` is the quoted amount, `pending` before the store quotes its fees, `unknown` otherwise. */
+    serviceFeesStatus: 'known' | 'pending' | 'unknown';
     tipCents: number;
     totalCents: number;
     approvedCeilingCents: number | null;
@@ -78,11 +71,10 @@ export interface BuyPaymentSource {
  * The typed outcome of a checkout attempt, every field null when no checkout
  * ran on the call. `decline_code` is a refusal's machine code
  * (`authorization_not_approved`, `authorization_mismatch`,
- * `authorization_spent`, `user_not_connected`, `voice_declined`,
- * `approval_expired`, a gate's or a merchant's code); `approval_url` is
+ * `authorization_spent`, `user_not_connected`, a gate's or a merchant's
+ * code); `approval_url` is
  * where the person approves when the confirm paused for one;
- * `authorization_id` is the approval the order was placed against, or, on a
- * `needs_approval` turn, the one the person is about to give by voice.
+ * `authorization_id` is the approval the order was placed against.
  */
 export interface BuyOutcome {
     order_id: string | null;
@@ -226,30 +218,7 @@ export type BuyDeclined = BuyTurn & {
     status: 'declined';
 };
 /** True for a turn the API declined; `decline_code` says why (it is null when the loop refused in prose only). */
-export declare function isBuyDeclined(turn: BuyTurn | BuyVoiceUnsupported): turn is BuyDeclined;
-/** A confirm under `approval: 'voice'` waiting for the person: `authorization_id` is the purchase's own approval, minted by the API, for `voice.challengeForHost`. `isBuyNeedsApproval` narrows to it. */
-export type BuyNeedsApproval = BuyTurn & {
-    status: 'needs_approval';
-    authorization_id: string;
-};
-/** True for a confirm waiting for the person's verdict by voice; `authorization_id` is the id your app runs the key word on. */
-export declare function isBuyNeedsApproval(turn: BuyTurn | BuyVoiceUnsupported): turn is BuyNeedsApproval;
-/**
- * The store's refusal to place under a voice verdict, as `buy.approveByVoice`
- * returns it instead of throwing: `status: 'voice_execution_unsupported'`,
- * the conversation, the approval the API had minted when it had, and the
- * `BuyError` as the confirm raised it. The business takes its own path.
- */
-export interface BuyVoiceUnsupported {
-    status: typeof VOICE_EXECUTION_UNSUPPORTED;
-    conversation_id: string;
-    authorization_id: string | null;
-    error: BuyError;
-}
-/** True when the store could not place under a voice verdict; `error` is the refusal. */
-export declare function isBuyVoiceUnsupported(turn: BuyTurn | BuyVoiceUnsupported): turn is BuyVoiceUnsupported;
-/** What `buy.approveByVoice` returns: the final turn (`order_placed`, `declined`, or `needs_approval` when the verdict was still out on the retry), or the store's refusal to run under a voice verdict. */
-export type BuyVoiceTurn = BuyTurn | BuyVoiceUnsupported;
+export declare function isBuyDeclined(turn: BuyTurn): turn is BuyDeclined;
 /** An order a conversation placed, from the ledger. */
 export interface BuyOrder {
     order_id: string | null;
@@ -318,9 +287,8 @@ export interface BuyConfirmInput {
     /** The hash of the cart the person saw (`turn.cart.hash`), or several carts' hashes to place each as its own order. */
     confirm: string | string[];
     /**
-     * An approval the business already holds for this purchase, `cauth_…`, as
-     * `voice.authorizations.create` minted it and `voice.awaitResult` read it
-     * approved. The API places the cart against it and asks the person for
+     * An approval the business already holds for this purchase, `cauth_…`.
+     * The API places the cart against it and asks the person for
      * nothing a second time. Sent only when named.
      */
     authorization_id?: string;
@@ -328,16 +296,6 @@ export interface BuyConfirmInput {
     delivery_address?: BuyDeliveryAddress;
     /** `'vault'`: pay with the person's own stored card; the confirm pauses with an `approval_url` until they approve. */
     payment_source?: 'vault';
-    /**
-     * How the person approves a confirm that pays with their own card. `page`
-     * (the default, and today's behaviour): the API answers `declined` with the
-     * `approval_url` they approve on. `voice`: the API mints the purchase's
-     * own approval and answers `needs_approval` with its `authorization_id`;
-     * your app runs the key word on it (`voice.challengeForHost(id)`), and the
-     * same confirm sent again places the order, or answers `declined` with
-     * `voice_declined` or `approval_expired`. Sent only when named.
-     */
-    approval?: BuyApproval;
     /**
      * On a repeat confirm of a browser cart waiting for the person's approval,
      * hold up to 25 seconds and answer the moment they decide, instead of
@@ -348,28 +306,6 @@ export interface BuyConfirmInput {
     /** How long this call waits for the turn. Default 130 seconds. */
     timeout_ms?: number;
 }
-/** `buy.approveByVoice`: the cart, the person, and the approval your app runs on the id the API mints. */
-export interface BuyApproveByVoiceInput {
-    /** The person the connect exchange returned. Required on every call. */
-    user_id: string;
-    /** The conversation the cart was shown in. */
-    conversation_id: string;
-    /** The hash of the cart the person saw (`turn.cart.hash`), or several carts' hashes. */
-    confirm: string | string[];
-    /** The delivery address the cart was built for, when the ask named one. */
-    delivery_address?: BuyDeliveryAddress;
-    /**
-     * Your app's approval: given the `authorization_id` the API minted (and the
-     * `needs_approval` turn it rode on), mint the key word with
-     * `voice.challengeForHost(authorizationId)`, hand the bundle to the app,
-     * and resolve once the verdict is in (`voice.awaitResult`, or the app's
-     * own word). The confirm is sent again when this resolves; a rejection is
-     * thrown as it came and nothing is placed.
-     */
-    challenge: (authorizationId: string, turn: BuyNeedsApproval) => Promise<void>;
-    /** How long each confirm waits for its turn. Default 130 seconds. */
-    timeout_ms?: number;
-}
 /** `buy.conversation`: one read of where a conversation stands. */
 export interface BuyConversationInput {
     /** The person the connect exchange returned. Required on every call. */
@@ -381,11 +317,10 @@ export interface BuyConversationInput {
  * API's (`user_not_connected`, `authorization_not_approved`,
  * `authorization_mismatch`, `authorization_spent`, `turn_in_progress`,
  * `delivery_address_changed`, `cart_changed`, `nothing_to_confirm`,
- * `conversation_not_found`, `conversation_closed`,
- * `voice_execution_unsupported`) or the client's own before any call
+ * `conversation_not_found`, `conversation_closed`) or the client's own before any call
  * (`not_connected`, `invalid_ask`, `invalid_cart_hash`,
- * `invalid_authorization_id`, `invalid_payment_source`, `invalid_approval`,
- * `missing_conversation_id`, `missing_authorization_id`). `carts` carries the
+ * `invalid_authorization_id`, `invalid_payment_source`,
+ * `missing_conversation_id`). `carts` carries the
  * carts as they stand when the refusal named them, so a confirm of a changed
  * cart reads the fresh hash from the error.
  */
@@ -416,8 +351,8 @@ export declare class BuyModule extends ApiModule {
     ask(input: BuyAskInput): Promise<BuyTurn>;
     /**
      * Places the cart the person saw, by its hash, for the person `user_id`
-     * names. With `authorization_id`, the approval the person already gave by
-     * voice for this purchase, the API places against that approval and asks
+     * names. With `authorization_id`, the approval the person already gave
+     * for this purchase, the API places against that approval and asks
      * for nothing a second time; the answer carries `authorization_id` back.
      * Without it the confirm runs as before: the person's rules, or the
      * approval the API asks for on `approval_url`. A cart that changed since
@@ -427,22 +362,6 @@ export declare class BuyModule extends ApiModule {
      * `authorization_spent`, and nothing is charged.
      */
     confirm(input: BuyConfirmInput): Promise<BuyTurn>;
-    /**
-     * The whole approval by voice, for a business whose app holds the person:
-     * confirms the cart with the person's own card and `approval: 'voice'`,
-     * hands the `authorization_id` the API minted to your `challenge` (your
-     * app runs the key word on it; you resolve when the verdict is in), then
-     * sends the same confirm again and returns what it answered:
-     * `order_placed` with `order_id`, `declined` with `voice_declined` or
-     * `approval_expired`, or `needs_approval` again when the verdict was still
-     * out. A store whose connector cannot place under a voice verdict is
-     * returned as `status: 'voice_execution_unsupported'`, not thrown, so the
-     * business falls back to its own path; every other refusal throws as
-     * `buy.confirm` does. A first confirm the API completes without asking (a
-     * rule took it, or it declined outright) is returned as it came and
-     * `challenge` is never called. Two confirms at most; nothing is polled.
-     */
-    approveByVoice(input: BuyApproveByVoiceInput): Promise<BuyVoiceTurn>;
     /**
      * One read of a conversation, with no wait: whether a turn is still
      * running, the last checkout attempt, every order it placed from the