@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 2bf5a6f966e390caa86efaa4be753222abb5606a8689cc8cfa42c2466c65ded9
+// artifact-sha256: 66c54c571ca1294220b070eaca1ca3888feebcd7f2562b761d74ded25a453c57
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -237,6 +237,10 @@ var PAYRAILS_CAPABILITY = "payrails_device_encrypt";
 var PAYRAILS_OPERATION = "payrails.device_encrypted_card";
 var PAYRAILS_SAVE_PATH = "/public/payment/instruments";
 var PAYRAILS_SAVE_HOSTS = Object.freeze(["api-pub.payrails.io", "api-pub.staging.payrails.io", "sandbox-api-pub.staging.payrails.io"]);
+var PAYRAILS_MERCHANT_API_HOST = /^api-pub\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.payrails\.io$/;
+var PAYRAILS_AUTHORIZE_WORKFLOW = "payment-acceptance";
+var AUTHORIZE_PATH = /^\/public\/merchant\/workflows\/payment-acceptance\/executions\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/authorize$/;
+var EXECUTION_PATH = /^\/public\/merchant\/workflows\/payment-acceptance\/executions\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
 var PAYRAILS_JWE_HEADER = '{"alg":"RSA-OAEP-256","enc":"A256CBC-HS512"}';
 var PAYRAILS_JWE_HEADER_B64 = "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIn0";
 var PAYRAILS_KEY_BITS = Object.freeze([2048, 3072, 4096]);
@@ -292,21 +296,33 @@ function base64UrlDecode(text, max) {
     const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
     return base64UrlEncode(bytes) === text ? bytes : null;
 }
-function isPayrailsSaveUrl(url, { exact: exact2 = false } = {}) {
+function isPayrailsApiHost(hostname) {
+    return typeof hostname === "string" && (PAYRAILS_SAVE_HOSTS.includes(hostname) || PAYRAILS_MERCHANT_API_HOST.test(hostname));
+}
+function payrailsApiUrl(url, exact2) {
     if (typeof url !== "string" || url.length > 2048)
-        return false;
+        return null;
     let parsed;
     try {
         parsed = new URL(url);
     }
     catch {
-        return false;
+        return null;
     }
-    if (parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
-        return false;
-    if (!PAYRAILS_SAVE_HOSTS.includes(parsed.hostname) || parsed.pathname !== PAYRAILS_SAVE_PATH)
-        return false;
-    return !exact2 || parsed.search === "" && parsed.hash === "" && !/[?#]/.test(url);
+    if (parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !isPayrailsApiHost(parsed.hostname))
+        return null;
+    return !exact2 || parsed.search === "" && parsed.hash === "" && !/[?#]/.test(url) ? parsed : null;
+}
+function isPayrailsSaveUrl(url, { exact: exact2 = false } = {}) {
+    return payrailsApiUrl(url, exact2)?.pathname === PAYRAILS_SAVE_PATH;
+}
+function isPayrailsAuthorizeUrl(url, { exact: exact2 = false } = {}) {
+    const parsed = payrailsApiUrl(url, exact2);
+    return !!parsed && AUTHORIZE_PATH.test(parsed.pathname);
+}
+function payrailsExecutionId(url) {
+    const parsed = payrailsApiUrl(url, true);
+    return parsed ? AUTHORIZE_PATH.exec(parsed.pathname)?.[1] ?? null : null;
 }
 function payrailsJweParts(jwe) {
     if (typeof jwe !== "string" || jwe.length > 8192)
@@ -386,8 +402,141 @@ function payrailsCardOnFileRefusal(body) {
     const usage = payrailsKeepsCardFor(save.value);
     return usage === null || PAYRAILS_CARD_ON_FILE_CONSENTED.includes(usage) ? null : "payrails_card_on_file_consent_required";
 }
+var AUTHORIZE_LIMIT = 32768;
+var AUTHORIZE_KEYS = Object.freeze(["amount", "paymentComposition", "returnInfo", "meta"]);
+var COMPOSITION_KEYS = Object.freeze([
+    "paymentMethodCode",
+    "integrationType",
+    "amount",
+    "storeInstrument",
+    "paymentInstrumentData",
+    "enrollInstrumentToNetworkOffers"
+]);
+var RETURN_KEYS = Object.freeze(["success", "cancel", "error", "pending"]);
+var AMOUNT_VALUE = /^[0-9]{1,15}(?:\.[0-9]{1,12})?$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var scalar = (value) => value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) || typeof value === "string" && value.length <= 2048;
+var META_KEYS = Object.freeze(["clientContext", "risk", "order", "customer"]);
+var ORDER_KEYS = Object.freeze(["processingType"]);
+var CUSTOMER_KEYS = Object.freeze([]);
+var caseCollides = (value) => {
+    const lower = Object.keys(value).map((key) => key.toLowerCase());
+    return new Set(lower).size !== lower.length;
+};
+var onlyKeys = (value, keys) => record(value) && !caseCollides(value) && Object.keys(value).every((key) => keys.includes(key));
+function payrailsMetaRefusal(meta) {
+    if (owns(meta, "subscription"))
+        return "payrails_future_usage_refused";
+    if (!onlyKeys(meta, META_KEYS))
+        return "payrails_request_malformed";
+    if (owns(meta, "clientContext") && !(record(meta.clientContext) && !caseCollides(meta.clientContext) && Object.values(meta.clientContext).every(scalar))) {
+        return "payrails_request_malformed";
+    }
+    if (owns(meta, "risk")) {
+        if (!record(meta.risk) || caseCollides(meta.risk))
+            return "payrails_request_malformed";
+        for (const [key, value] of Object.entries(meta.risk)) {
+            const sound = key === "sessionId" ? plainText(value, 256) : key === "sessions" ? Array.isArray(value) && value.length <= 8 && value.every((session) => record(session) && !caseCollides(session) && Object.values(session).every(scalar)) : key === "threeDSMode" ? value === "Default" : /^skip[A-Z]/.test(key) ? value === false : false;
+            if (!sound)
+                return "payrails_request_malformed";
+        }
+    }
+    if (owns(meta, "order")) {
+        const order = meta.order;
+        if (!onlyKeys(order, ORDER_KEYS))
+            return "payrails_request_malformed";
+        if (owns(order, "processingType") && order.processingType !== "Regular") {
+            if (order.processingType === "CardOnFile" || order.processingType === "UnscheduledCardOnFile")
+                return "payrails_card_on_file_consent_required";
+            return order.processingType === "Subscription" ? "payrails_future_usage_refused" : "payrails_request_malformed";
+        }
+    }
+    if (owns(meta, "customer") && !onlyKeys(meta.customer, CUSTOMER_KEYS))
+        return "payrails_request_malformed";
+    return null;
+}
+function readAmount(value) {
+    if (!record(value) || Object.keys(value).length !== 2 || typeof value.value !== "string" || !AMOUNT_VALUE.test(value.value) || typeof value.currency !== "string" || !CURRENCY.test(value.currency))
+        return null;
+    return value;
+}
+function readAuthorizeBody(body) {
+    const malformed = refusal("payrails_request_malformed");
+    if (typeof body !== "string" || body.length === 0 || body.length > AUTHORIZE_LIMIT)
+        return malformed;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return malformed;
+    }
+    if (!record(parsed) || !roundTrips(parsed, body) || !sameKeys(parsed, AUTHORIZE_KEYS) || !record(parsed.meta))
+        return malformed;
+    const amount = readAmount(parsed.amount);
+    const parts = parsed.paymentComposition;
+    const part = Array.isArray(parts) && parts.length === 1 && record(parts[0]) ? parts[0] : null;
+    if (!amount || !part || !sameKeys(part, COMPOSITION_KEYS) || part.paymentMethodCode !== "card" || part.integrationType !== "api")
+        return malformed;
+    const partAmount = readAmount(part.amount);
+    if (!partAmount || partAmount.value !== amount.value || partAmount.currency !== amount.currency)
+        return malformed;
+    if (typeof part.storeInstrument !== "boolean" || typeof part.enrollInstrumentToNetworkOffers !== "boolean")
+        return malformed;
+    const data = part.paymentInstrumentData;
+    const keys = record(data) ? Object.keys(data) : [];
+    if (keys[0] !== "encryptedData" || keys[1] !== "vaultProviderConfigId" || !(keys.length === 2 || keys.length === 3 && keys[2] === "billingAddress" && record(data.billingAddress)))
+        return malformed;
+    if (typeof data.vaultProviderConfigId !== "string" || !UUID.test(data.vaultProviderConfigId))
+        return malformed;
+    const back = parsed.returnInfo;
+    if (!record(back) || !sameKeys(back, RETURN_KEYS) || !RETURN_KEYS.every((key) => plainText(back[key], 2048)))
+        return malformed;
+    const metaRefusal = payrailsMetaRefusal(parsed.meta);
+    if (metaRefusal)
+        return refusal(metaRefusal);
+    const jwe = payrailsJweParts(data.encryptedData);
+    if (!jwe)
+        return refusal("payrails_jwe_malformed");
+    return {
+        value: Object.freeze({
+            amount: Object.freeze({ value: amount.value, currency: amount.currency }),
+            storeInstrument: part.storeInstrument,
+            enrollInstrumentToNetworkOffers: part.enrollInstrumentToNetworkOffers,
+            encryptedData: data.encryptedData,
+            vaultProviderConfigId: data.vaultProviderConfigId,
+            wrappedKeyBytes: jwe.wrappedKey.length
+        })
+    };
+}
+function payrailsAuthorizeRefusal(body) {
+    const payment = readAuthorizeBody(body);
+    if (payment.code)
+        return payment.code;
+    return payment.value.storeInstrument || payment.value.enrollInstrumentToNetworkOffers ? "payrails_card_on_file_consent_required" : null;
+}
+function parsePayrailsAuthorize(body) {
+    return readAuthorizeBody(body).value ?? null;
+}
+function authorizeShaped(body) {
+    if (typeof body !== "string" || body.length > AUTHORIZE_LIMIT)
+        return false;
+    try {
+        const parsed = JSON.parse(body);
+        return record(parsed) && owns(parsed, "paymentComposition");
+    }
+    catch {
+        return false;
+    }
+}
+function compositionCiphertext(parsed) {
+    const parts = record(parsed) ? parsed.paymentComposition : null;
+    const part = Array.isArray(parts) ? parts[0] : null;
+    const data = record(part) ? part.paymentInstrumentData : null;
+    return record(data) && owns(data, "encryptedData") ? data.encryptedData : void 0;
+}
 function classifyPayrailsRequest(url, method, body) {
-    if (method !== "POST" || !isPayrailsSaveUrl(url))
+    if (method !== "POST" || !(isPayrailsSaveUrl(url) || isPayrailsAuthorizeUrl(url)))
         return null;
     if (typeof body !== "string" || body === "")
         return "continue";
@@ -399,8 +548,8 @@ function classifyPayrailsRequest(url, method, body) {
         return "continue";
     }
     const data = record(parsed) ? parsed.data : null;
-    const value = record(data) && owns(data, "encryptedData") ? data.encryptedData : void 0;
-    return typeof value === "string" && value !== "" || typeof value === "number" ? "card" : "continue";
+    const holds = (value) => typeof value === "string" && value !== "" || typeof value === "number";
+    return holds(record(data) && owns(data, "encryptedData") ? data.encryptedData : void 0) || holds(compositionCiphertext(parsed)) ? "card" : "continue";
 }
 function payrailsAuthorizeCarriesCard(url, method, body) {
     if (method !== "POST" || typeof url !== "string" || typeof body !== "string" || body.length > 262144)
@@ -437,13 +586,13 @@ function payrailsSessionKeyBytes(spki) {
     }
 }
 function payrailsSessionKeyRefusal(spki, body) {
-    const save = readSaveBody(body);
-    if (save.code)
-        return save.code;
+    const request = authorizeShaped(body) ? readAuthorizeBody(body) : readSaveBody(body);
+    if (request.code)
+        return request.code;
     const size = payrailsSessionKeyBytes(spki);
     if (size === null)
         return "payrails_key_invalid";
-    return size === save.value.wrappedKeyBytes ? null : "payrails_key_mismatch";
+    return size === request.value.wrappedKeyBytes ? null : "payrails_key_mismatch";
 }
 var TOKEN_LIMIT = 8192;
 var CLAIM_NAME = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;
@@ -571,7 +720,43 @@ function instrumentMatchesCard(instrument, card) {
     const data = instrument.data;
     return number.length >= 12 && data.suffix === number.slice(-4) && exact(/^(?:0[1-9]|1[0-2])$/, data.expiryMonth) && Number(data.expiryMonth) === month && exact(/^(?:[0-9]{2}|[0-9]{4})$/, data.expiryYear) && Number(data.expiryYear) % 100 === year % 100;
 }
-function payrailsResponseOutcome(status, text, { card } = {}) {
+var ACTION_TIME = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?(?:Z|[+-][0-9]{2}:[0-9]{2})$/;
+function payrailsLink(value) {
+    if (!plainText(value, 2048))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    return parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && /(?:^|\.)payrails\.io$/.test(parsed.hostname) ? value : null;
+}
+function readAuthorizeAction(text) {
+    const value = readJson(text);
+    if (!record(value) || value.name !== "authorize" || typeof value.actionId !== "string" || !UUID.test(value.actionId) || !record(value.links))
+        return null;
+    const execution = payrailsLink(value.links.execution);
+    if (!execution)
+        return null;
+    return compact({ name: "authorize", actionId: value.actionId, executedAt: pick(value.executedAt, ACTION_TIME), links: { execution } });
+}
+function namesPausedExecution(link, url) {
+    const paused = payrailsApiUrl(url, true);
+    const id = paused ? AUTHORIZE_PATH.exec(paused.pathname)?.[1] : void 0;
+    const named = payrailsApiUrl(link, true);
+    return !!id && !!named && named.hostname === paused.hostname && EXECUTION_PATH.exec(named.pathname)?.[1] === id;
+}
+function sanitizePayrailsAuthorizeResponse(text, url) {
+    const action = readAuthorizeAction(text);
+    if (!action)
+        throw new Error("Refusing to record: the Payrails answer is not an authorize action.");
+    if (!namesPausedExecution(action.links.execution, url))
+        throw new Error("Refusing to record: the Payrails answer names another payment.");
+    return JSON.stringify(action);
+}
+function payrailsResponseOutcome(status, text, { card, url } = {}) {
     if (!Number.isInteger(status))
         return { outcome: "unknown", reason: "payrails_unconfirmed" };
     if (status === 409 || status === 429)
@@ -580,6 +765,16 @@ function payrailsResponseOutcome(status, text, { card } = {}) {
         return { outcome: "refused", code: payrailsFacts(text).refusalCode || `http_${status}` };
     if (status >= 500)
         return { outcome: "unknown", reason: "server_error" };
+    if (isPayrailsAuthorizeUrl(url)) {
+        if (status < 200 || status > 299)
+            return { outcome: "unknown", reason: "payrails_unconfirmed" };
+        const action = readAuthorizeAction(text);
+        if (!action)
+            return { outcome: "unknown", reason: "payrails_unsafe_response" };
+        if (!namesPausedExecution(action.links.execution, url))
+            return { outcome: "unknown", reason: "payrails_execution_mismatch" };
+        return { outcome: "approved", body: JSON.stringify(action) };
+    }
     if (status !== 201)
         return { outcome: "unknown", reason: "payrails_unconfirmed" };
     const instrument = readInstrument(text);
@@ -593,4 +788,4 @@ function payrailsResponseOutcome(status, text, { card } = {}) {
         return { outcome: "unknown", reason: "payrails_instrument_mismatch" };
     return { outcome: "approved", body: sanitizePayrailsResponse(text) };
 }
-export { PAYRAILS_CAPABILITY, PAYRAILS_CARD_ON_FILE_CONSENTED, PAYRAILS_FUTURE_USAGES, PAYRAILS_JWE_HEADER, PAYRAILS_JWE_HEADER_B64, PAYRAILS_KEY_BITS, PAYRAILS_OPERATION, PAYRAILS_PSP, PAYRAILS_REFUSALS, PAYRAILS_SAVE_HOSTS, PAYRAILS_SAVE_PATH, PAYRAILS_SERVED_CARD_FACTS, PAYRAILS_SESSION_MIN_SECONDS, PAYRAILS_UNUSABLE_STATUSES, PAYRAILS_USABLE_STATUSES, base64UrlDecode, base64UrlEncode, classifyPayrailsRequest, isPayrailsSaveUrl, parsePayrailsSave, payrailsAuthorizeCarriesCard, payrailsCardOnFileRefusal, payrailsFacts, payrailsJweParts, payrailsKeepsCardFor, payrailsRefusalMessage, payrailsResponseOutcome, payrailsSessionKeyBytes, payrailsSessionKeyRefusal, payrailsTemplateRefusal, payrailsTokenClaims, payrailsWorkspacePinRefusal, sanitizePayrailsResponse };
+export { PAYRAILS_AUTHORIZE_WORKFLOW, PAYRAILS_CAPABILITY, PAYRAILS_CARD_ON_FILE_CONSENTED, PAYRAILS_FUTURE_USAGES, PAYRAILS_JWE_HEADER, PAYRAILS_JWE_HEADER_B64, PAYRAILS_KEY_BITS, PAYRAILS_MERCHANT_API_HOST, PAYRAILS_OPERATION, PAYRAILS_PSP, PAYRAILS_REFUSALS, PAYRAILS_SAVE_HOSTS, PAYRAILS_SAVE_PATH, PAYRAILS_SERVED_CARD_FACTS, PAYRAILS_SESSION_MIN_SECONDS, PAYRAILS_UNUSABLE_STATUSES, PAYRAILS_USABLE_STATUSES, base64UrlDecode, base64UrlEncode, classifyPayrailsRequest, isPayrailsApiHost, isPayrailsAuthorizeUrl, isPayrailsSaveUrl, parsePayrailsAuthorize, parsePayrailsSave, payrailsAuthorizeCarriesCard, payrailsAuthorizeRefusal, payrailsCardOnFileRefusal, payrailsExecutionId, payrailsFacts, payrailsJweParts, payrailsKeepsCardFor, payrailsRefusalMessage, payrailsResponseOutcome, payrailsSessionKeyBytes, payrailsSessionKeyRefusal, payrailsTemplateRefusal, payrailsTokenClaims, payrailsWorkspacePinRefusal, sanitizePayrailsAuthorizeResponse, sanitizePayrailsResponse };

package/dist/payrails.js

@@ -1,17 +1,28 @@
-// Payrails web SDK v6 secure fields (Blacklane's consumer checkout), as the checkout SDK sees it.
+// Payrails web SDK secure fields (Blacklane's consumer checkout, FlixBus's guest checkout), as the
+// checkout SDK sees it.
 //
 // payrails.js 6.5.0 saves a card with one fetch from the merchant page: a POST to the session's
 // vaultConfiguration.links.saveInstrument.href (https://api-pub.payrails.io/public/payment/instruments;
-// test hosts api-pub.staging.payrails.io and sandbox-api-pub.staging.payrails.io). Its body carries
-// the whole card as one JWE, made in Payrails' secure frame under a per-session RSA key. That key
-// is not in the paused request: it comes in the init payload ({version, data}) the merchant's
-// backend hands the page before the card form renders. So the runtime reads the page's own XHR and
-// fetch answers for that payload and keeps, per attachment and in memory only, each session's
-// token, holderReference, providerConfigId, saveInstrument href and key. When a card save pauses,
-// exactly one captured session must match it on all four, seen at most nine minutes before. Its key
-// rides on the create (request.payrails.encryption_public_key); the cardholder's device encrypts
-// the real card under it and sends the save itself (mode device_encrypt); and the page receives
-// only Payrails' 201, rebuilt from an allow-list. The device's ciphertext never reaches this runtime.
+// test hosts api-pub.staging.payrails.io and sandbox-api-pub.staging.payrails.io). The card form's Pay
+// button (web SDK 5.50.0 at FlixBus) pays with the card instead: a POST to the session's execution
+// authorize link, /public/merchant/workflows/payment-acceptance/executions/<id>/authorize. A merchant
+// can have its own public API host, api-pub.<merchant>.payrails.io (FlixBus: api-pub.flix.payrails.io).
+// Either body carries the whole card as one JWE, made in Payrails' secure frame under a per-session RSA
+// key. That key is not in the paused request: it comes in the init payload ({version, data}) the
+// merchant's backend hands the page before the card form renders, at the top of an answer
+// (Blacklane) or deep inside one (FlixBus's /payment/configuration/list, six levels down). So the
+// runtime reads the page's own XHR and fetch answers for that payload and keeps, per attachment and
+// in memory only, each session's token, holderReference, providerConfigId, saveInstrument href,
+// execution id and key. When a card request pauses, exactly one captured session must match it, seen
+// at most nine minutes before: a save on its token, its URL, its holderReference and its
+// providerConfigId; a card-form payment on its token, its execution and host, and its
+// providerConfigId. Its key rides on the create (request.payrails.encryption_public_key), and for a
+// payment its holderReference too (request.payrails.holder_reference), which the payment's JWE
+// carries and its body does not. The cardholder's device encrypts the real card under the key and
+// sends the request itself (mode device_encrypt), and the page receives only Payrails' answer, rebuilt
+// from an allow-list: a save's 201, or the authorize action a payment's 202 names, whose execution
+// link the page's SDK then polls for the issuer's answer. The device's ciphertext never reaches this
+// runtime.
 //
 // The registry entry ships dark (capability payrails_device_encrypt). This build declares the
 // capability and the mode on syncRegistry, and the API serves the entry only to an org Agentcard
@@ -26,33 +37,43 @@
 //     merchant's integration decides that shape, so the page's next save would be the same;
 //   - a card save with no captured session, or whose captured key is not as long as the key the
 //     page's frame wrapped, aborts alone: the agent reloads the checkout and tries again;
-//   - a payment that carries an encrypted card inside paymentComposition (paying with the card
-//     form, or a stored card with a CVC field) aborts as an unsupported checkout, so the agent's
-//     placeholder card never reaches an authorization;
+//   - the card form's payment on an authorize link the registry recognizes is judged the same
+//     way: payment-core's guard first (a payment that stores the card at the merchant aborts as
+//     payrails_card_on_file_consent_required, another shape as unsupported_payrails_card_payment,
+//     and the attachment holds), then the captured session, which a miss aborts alone;
+//   - any other payment that carries an encrypted card inside paymentComposition (a stored card
+//     with a CVC field, a split payment, another link, or a registry that does not recognize the
+//     payment) aborts as an unsupported checkout, so the agent's placeholder card never reaches
+//     an authorization;
 //   - a POST with no body the gate can read (none, an empty one, or one the adapter could not
 //     read) aborts alone, on both adapters alike (pre-claim.ts says why), except on Payrails'
 //     static host, which serves files and takes no payment;
 //   - every other request continues.
-import { PAYRAILS_CAPABILITY, PAYRAILS_PSP, PAYRAILS_SAVE_HOSTS, PAYRAILS_SAVE_PATH, classifyPayrailsRequest, isPayrailsSaveUrl, payrailsAuthorizeCarriesCard, payrailsCardOnFileRefusal, payrailsResponseOutcome, payrailsSessionKeyRefusal, } from './payrails.generated.js';
+import { PAYRAILS_CAPABILITY, PAYRAILS_PSP, PAYRAILS_SAVE_HOSTS, PAYRAILS_SAVE_PATH, classifyPayrailsRequest, isPayrailsAuthorizeUrl, isPayrailsSaveUrl, payrailsAuthorizeCarriesCard, payrailsAuthorizeRefusal, payrailsCardOnFileRefusal, payrailsExecutionId, payrailsResponseOutcome, payrailsSessionKeyRefusal, } from './payrails.generated.js';
 export { PAYRAILS_CAPABILITY, PAYRAILS_PSP };
 /**
  * How the pre-claim gate reads a POST to a Payrails host: `card` for a card save on a save URL
  * (data.encryptedData present, payment-core's pause predicate), `card_payment` for a payment that
- * carries an encrypted card inside paymentComposition, and null for anything else, which continues.
+ * carries an encrypted card inside paymentComposition, the card form's included, and null for
+ * anything else, which continues.
  */
 export function payrailsRequestKind(url, method, body) {
     if (method.toUpperCase() !== 'POST')
         return null;
-    if (classifyPayrailsRequest(url, 'POST', body) === 'card')
+    if (isPayrailsSaveUrl(url) && classifyPayrailsRequest(url, 'POST', body) === 'card')
         return 'card';
     return payrailsAuthorizeCarriesCard(url, 'POST', body) ? 'card_payment' : null;
 }
-/** Refusals of the save's own shape: the page's next save would be the same, so the attachment holds. */
+/** Whether `url` is exactly a payment-acceptance execution's authorize link on a Payrails API host, where a card-form payment may pause. */
+export function isPayrailsPaymentUrl(url) {
+    return isPayrailsAuthorizeUrl(url, { exact: true });
+}
+/** Refusals of the request's own shape: the page's next one would be the same, so the attachment holds. */
 export const PAYRAILS_HOLDING_REASONS = [
     'unsupported_payrails_card_payment', 'payrails_request_malformed', 'payrails_not_card_save',
     'payrails_jwe_malformed', 'payrails_future_usage_refused', 'payrails_card_on_file_consent_required',
 ];
-/** What the agent reads when a save's session cannot be bound. Not shown to the cardholder. */
+/** What the agent reads when a card request's session cannot be bound. Not shown to the cardholder. */
 export const PAYRAILS_SESSION_MESSAGE = 'Payrails session expired, reload the checkout';
 /** Captured sessions kept per attachment; the oldest is dropped first. */
 export const PAYRAILS_CAPTURE_LIMIT = 8;
@@ -81,6 +102,7 @@ function base64Json(value) {
         return null;
     }
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 /** The binding fields of one init payload `{version, data}`, or null when `candidate` is not one. */
 function sessionOf(candidate) {
     if (!record(candidate) || typeof candidate.version !== 'string' || typeof candidate.data !== 'string')
@@ -94,14 +116,22 @@ function sessionOf(candidate) {
     if (!text(data.token, 8192) || !text(data.holderReference, 256) || !text(vault.providerConfigId, 64)
         || !text(vault.encryptionPublicKey, 1024) || !text(href, 2048) || !isPayrailsSaveUrl(href, { exact: true }))
         return null;
+    const execution = record(data.execution) && typeof data.execution.id === 'string' && UUID.test(data.execution.id) ? data.execution.id : null;
     return { token: data.token, holderReference: data.holderReference, providerConfigId: vault.providerConfigId,
-        saveInstrumentHref: href, encryptionPublicKey: vault.encryptionPublicKey };
+        saveInstrumentHref: href, executionId: execution, encryptionPublicKey: vault.encryptionPublicKey };
 }
+/** How deep inside an answer an init payload is looked for, and how many of its objects at most. */
+export const PAYRAILS_INIT_SEARCH_DEPTH = 8;
+export const PAYRAILS_INIT_SEARCH_NODES = 4096;
 /**
- * Every Payrails init payload one JSON answer body carries: the body itself, or its members one
- * level down (an object's values or an array's items). An init payload is `{version, data}` whose
- * `data` decodes to JSON with a token, a holderReference and a vaultConfiguration naming its
- * providerConfigId, its encryptionPublicKey and a saveInstrument href on a Payrails save URL.
+ * Every Payrails init payload one JSON answer body carries: the body itself, or any object or array
+ * item inside it at most PAYRAILS_INIT_SEARCH_DEPTH levels down, read breadth first over at most
+ * PAYRAILS_INIT_SEARCH_NODES of them. Blacklane's session answer is the payload itself; FlixBus's
+ * /payment/configuration/list carries it six levels down
+ * (options.initialState.selection.paymentMethods[i].paymentToken). An init payload is
+ * `{version, data}` whose `data` decodes to JSON with a token, a holderReference and a
+ * vaultConfiguration naming its providerConfigId, its encryptionPublicKey and a saveInstrument href
+ * on a Payrails save URL; nothing inside one is read further.
  */
 export function payrailsInitSessions(body) {
     if (typeof body !== 'string' || body.length === 0 || body.length > PAYRAILS_INIT_BODY_LIMIT)
@@ -113,11 +143,23 @@ export function payrailsInitSessions(body) {
     catch {
         return [];
     }
-    const top = sessionOf(parsed);
-    if (top)
-        return [top];
-    const members = Array.isArray(parsed) ? parsed : record(parsed) ? Object.values(parsed) : [];
-    return members.map(sessionOf).filter((session) => session !== null);
+    const found = [];
+    const queue = [{ node: parsed, depth: 0 }];
+    for (let next = 0; next < queue.length && next < PAYRAILS_INIT_SEARCH_NODES; next++) {
+        const { node, depth } = queue[next];
+        const session = sessionOf(node);
+        if (session) {
+            found.push(session);
+            continue;
+        }
+        if (depth >= PAYRAILS_INIT_SEARCH_DEPTH)
+            continue;
+        for (const member of Array.isArray(node) ? node : record(node) ? Object.values(node) : []) {
+            if (member !== null && typeof member === 'object')
+                queue.push({ node: member, depth: depth + 1 });
+        }
+    }
+    return found;
 }
 /** Whether an answer may carry an init payload worth reading: a 2xx XHR or fetch with a JSON type. */
 export function payrailsInitCandidate(resourceType, status, contentType) {
@@ -127,7 +169,16 @@ export function payrailsInitCandidate(resourceType, status, contentType) {
 }
 const sameSession = (a, b) => a.token === b.token && a.holderReference === b.holderReference
     && a.providerConfigId === b.providerConfigId && a.saveInstrumentHref === b.saveInstrumentHref
-    && a.encryptionPublicKey === b.encryptionPublicKey;
+    && a.executionId === b.executionId && a.encryptionPublicKey === b.encryptionPublicKey;
+/** The hostname of a URL, or null. */
+function hostnameOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
 /** The bearer token a paused save carries in `authorization`, any case of the name; null otherwise. */
 function bearerOf(headers) {
     const values = Object.entries(headers ?? {}).filter(([name]) => name.toLowerCase() === 'authorization').map(([, value]) => value);
@@ -149,6 +200,19 @@ function saveBindingOf(body) {
         return null;
     }
 }
+/** A card-form payment body's paymentComposition[0].paymentInstrumentData.vaultProviderConfigId, read leniently; null when absent. */
+function paymentProviderConfigOf(body) {
+    try {
+        const parsed = JSON.parse(body);
+        const parts = record(parsed) ? parsed.paymentComposition : undefined;
+        const part = Array.isArray(parts) ? parts[0] : undefined;
+        const data = record(part) ? part.paymentInstrumentData : undefined;
+        return record(data) && typeof data.vaultProviderConfigId === 'string' ? data.vaultProviderConfigId : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * The Payrails sessions one attachment has seen, in memory only: at most PAYRAILS_CAPTURE_LIMIT,
  * each dropped PAYRAILS_CAPTURE_TTL_MS after it was first seen. Nothing here is ever logged or
@@ -207,18 +271,48 @@ export class PayrailsSessionCapture {
      * The session key for a paused card save: the key of the captured session whose token is the
      * save's bearer token, whose saveInstrument href is the save's URL, and whose holderReference and
      * providerConfigId are the body's, first seen at most PAYRAILS_SESSION_MAX_AGE_MS before `now`.
-     * Null when none matches, or when matching sessions disagree on the key.
+     * Null when none matches, or when matching sessions disagree on the key. bind() reads a card-form
+     * payment too.
      */
     keyFor(request, now = Date.now()) {
+        return isPayrailsSaveUrl(request.url) ? this.bind(request, now)?.key ?? null : null;
+    }
+    /**
+     * The session a paused card request binds to: its key and holderReference. A save binds as keyFor
+     * says. A card-form payment binds to the captured session whose token is the payment's bearer
+     * token, whose execution is the one the authorize link names, whose saveInstrument href is on the
+     * link's host, and whose providerConfigId is the payment's vaultProviderConfigId, first seen at most
+     * PAYRAILS_SESSION_MAX_AGE_MS before `now`. Null when none matches, or when matching sessions
+     * disagree on the key or the holderReference.
+     */
+    bind(request, now = Date.now()) {
         this.prune(now);
         const token = bearerOf(request.headers);
-        const binding = typeof request.body === 'string' ? saveBindingOf(request.body) : null;
-        if (!token || !binding)
+        if (!token || typeof request.body !== 'string')
             return null;
-        const keys = new Set(this.sessions.filter((session) => session.token === token && session.saveInstrumentHref === request.url
-            && session.holderReference === binding.holderReference && session.providerConfigId === binding.providerConfigId
-            && session.seenAt <= now && now - session.seenAt <= PAYRAILS_SESSION_MAX_AGE_MS).map((session) => session.encryptionPublicKey));
-        return keys.size === 1 ? [...keys][0] : null;
+        const fresh = (session) => session.token === token && session.seenAt <= now && now - session.seenAt <= PAYRAILS_SESSION_MAX_AGE_MS;
+        let matches;
+        if (isPayrailsSaveUrl(request.url)) {
+            const binding = saveBindingOf(request.body);
+            if (!binding)
+                return null;
+            matches = this.sessions.filter((session) => fresh(session) && session.saveInstrumentHref === request.url
+                && session.holderReference === binding.holderReference && session.providerConfigId === binding.providerConfigId);
+        }
+        else {
+            const executionId = payrailsExecutionId(request.url);
+            const host = hostnameOf(request.url);
+            const providerConfigId = paymentProviderConfigOf(request.body);
+            if (!executionId || !host || !providerConfigId)
+                return null;
+            matches = this.sessions.filter((session) => fresh(session) && session.executionId === executionId
+                && hostnameOf(session.saveInstrumentHref) === host && session.providerConfigId === providerConfigId);
+        }
+        const bindings = new Map(matches.map((session) => [`${session.encryptionPublicKey}\n${session.holderReference}`, session]));
+        if (bindings.size !== 1)
+            return null;
+        const [session] = bindings.values();
+        return { key: session.encryptionPublicKey, holderReference: session.holderReference };
     }
     /** How many sessions are held; for tests. */
     get size() { return this.sessions.length; }
@@ -276,9 +370,27 @@ export function payrailsSaveRefusal(body) {
         return 'payrails_request_malformed';
     }
 }
+/**
+ * payment-core's judgement of a card-form payment's own shape, before any session is looked up:
+ * null when it is the SDK's own payment that pays once, else the reason. A payment that stores the
+ * card at the merchant reads as payrails_card_on_file_consent_required, one that sets up a
+ * subscription as payrails_future_usage_refused, and a ciphertext of another shape as
+ * payrails_jwe_malformed; every other shape (a stored card's CVC, a split or installment payment, a
+ * preferred scheme) is one this build does not take over, unsupported_payrails_card_payment. A guard
+ * that throws refuses.
+ */
+export function payrailsPaymentRefusal(body) {
+    try {
+        const code = payrailsAuthorizeRefusal(body);
+        return code === 'payrails_request_malformed' ? 'unsupported_payrails_card_payment' : code ?? null;
+    }
+    catch {
+        return 'unsupported_payrails_card_payment';
+    }
+}
 /**
  * The key check for a bound session: null when the captured key is an RSA-2048, 3072 or 4096 key as
- * long as the key the page's frame wrapped for this save, else the refusal code.
+ * long as the key the page's frame wrapped for this save or payment, else the refusal code.
  */
 export function payrailsKeyRefusal(key, body) {
     try {
@@ -289,17 +401,26 @@ export function payrailsKeyRefusal(key, body) {
     }
 }
 /**
- * The only answer the page may receive for an approved Payrails save: Payrails' 201 for a card
- * instrument, rebuilt from payment-core's allow-list (the BIN cut to six digits), under a JSON
- * content type. Null for anything else.
+ * The only answer the page may receive for an approved Payrails card request, by the paused `url`: for
+ * a save, Payrails' 201 for a card instrument, rebuilt from payment-core's allow-list (the BIN cut to
+ * six digits); for a card-form payment, Payrails' 2xx for the authorize action it accepted, rebuilt to
+ * its name, id, time and execution link, which the page's SDK polls for the issuer's answer. That link
+ * must be the paused payment's own execution on its own host, or the page would poll another payment's
+ * result. Under a JSON content type; null for anything else.
  */
-export function payrailsSaveAnswer(status, body) {
+export function payrailsAnswer(status, body, url) {
     try {
-        const verdict = payrailsResponseOutcome(status, body);
+        const verdict = payrailsResponseOutcome(status, body, { url });
         const answer = verdict.outcome === 'approved' ? verdict.body : undefined;
-        return typeof answer === 'string' ? { status: 201, headers: { 'content-type': 'application/json' }, body: answer } : null;
+        if (typeof answer !== 'string')
+            return null;
+        return { status: isPayrailsAuthorizeUrl(url) ? status : 201, headers: { 'content-type': 'application/json' }, body: answer };
     }
     catch {
         return null;
     }
 }
+/** payrailsAnswer for a save. */
+export function payrailsSaveAnswer(status, body) {
+    return payrailsAnswer(status, body, `https://${PAYRAILS_SAVE_HOSTS[0]}${PAYRAILS_SAVE_PATH}`);
+}