@conto_finance/sdk 0.1.0 → 0.4.0

package/dist/checkout-verifier.mjs

@@ -0,0 +1,372 @@
+import "./chunk-B7F5QLE5.mjs";
+
+// src/checkout-verifier.ts
+import { createHash, randomUUID } from "crypto";
+var CHECKOUT_CAPABILITY_MANIFEST_VERSION = "conto.checkout-capabilities.v1";
+var CHECKOUT_VERIFICATION_REPORT_VERSION = "conto.checkout-verification.v1";
+var CHECKOUT_METHOD_IDS = ["LINK", "CARD", "SHOP_PAY", "PAYPAL"];
+var CHECKOUT_CAPABILITY_KINDS = [
+  "GUARDED_CHECKOUT",
+  "NAVIGATION",
+  "INSPECTION",
+  "CLICK",
+  "FORM_SUBMIT",
+  "KEYBOARD_INPUT",
+  "SCRIPT_EVALUATION",
+  "CREDENTIAL_ACCESS",
+  "PROVIDER_CONTROL",
+  "ALTERNATE_PAYMENT"
+];
+var CHECKOUT_CONFORMANCE_PROBE_IDS = [
+  "DENIAL_NO_MUTATION",
+  "APPROVAL_SINGLE_USE",
+  "AMOUNT_TAMPER_FAILS_CLOSED",
+  "CART_TAMPER_FAILS_CLOSED",
+  "MERCHANT_TAMPER_FAILS_CLOSED",
+  "SESSION_TAMPER_FAILS_CLOSED",
+  "TAB_TAMPER_FAILS_CLOSED",
+  "TARGET_TAMPER_FAILS_CLOSED",
+  "ALTERNATE_PAYMENT_PATHS_BLOCKED",
+  "AMBIGUOUS_DISPATCH_NO_RETRY"
+];
+var COMPONENT_ID = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+var COMPONENT_VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
+var CAPABILITY_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var CHALLENGE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{15,127}$/;
+var EXPOSURES = /* @__PURE__ */ new Set([
+  "AGENT",
+  "PRIVILEGED_RUNTIME",
+  "AUTHENTICATED_OPERATOR"
+]);
+var PAYMENT_BOUNDARIES = /* @__PURE__ */ new Set([
+  "NOT_PAYMENT_CAPABLE",
+  "CONTO_GUARDED",
+  "UNRESTRICTED"
+]);
+var SESSION_BINDINGS = /* @__PURE__ */ new Set([
+  "CONTO_RUNTIME",
+  "PROOF_CARRYING_HANDOFF",
+  "CALLER_ASSERTED"
+]);
+var INVENTORY_SCOPES = /* @__PURE__ */ new Set([
+  "COMPLETE_AGENT_CAPABILITY_SET",
+  "DECLARED_SUBSET"
+]);
+var METHOD_IDS = new Set(CHECKOUT_METHOD_IDS);
+var CAPABILITY_KINDS = new Set(CHECKOUT_CAPABILITY_KINDS);
+var PROBE_OUTCOMES = /* @__PURE__ */ new Set([
+  "DENIED_NO_MUTATION",
+  "ONE_DISPATCH_REPLAY_BLOCKED",
+  "REJECTED_NO_MUTATION",
+  "INDETERMINATE_NO_RETRY"
+]);
+var PAYMENT_SENSITIVE_KINDS = /* @__PURE__ */ new Set([
+  "GUARDED_CHECKOUT",
+  "CLICK",
+  "FORM_SUBMIT",
+  "KEYBOARD_INPUT",
+  "SCRIPT_EVALUATION",
+  "CREDENTIAL_ACCESS",
+  "PROVIDER_CONTROL",
+  "ALTERNATE_PAYMENT"
+]);
+var EXPECTED_PROBE_OUTCOMES = {
+  DENIAL_NO_MUTATION: "DENIED_NO_MUTATION",
+  APPROVAL_SINGLE_USE: "ONE_DISPATCH_REPLAY_BLOCKED",
+  AMOUNT_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  CART_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  MERCHANT_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  SESSION_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  TAB_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  TARGET_TAMPER_FAILS_CLOSED: "REJECTED_NO_MUTATION",
+  ALTERNATE_PAYMENT_PATHS_BLOCKED: "REJECTED_NO_MUTATION",
+  AMBIGUOUS_DISPATCH_NO_RETRY: "INDETERMINATE_NO_RETRY"
+};
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function component(value) {
+  if (!isRecord(value) || !hasExactKeys(value, ["id", "version"])) return false;
+  return typeof value.id === "string" && COMPONENT_ID.test(value.id) && typeof value.version === "string" && COMPONENT_VERSION.test(value.version);
+}
+function capability(value) {
+  if (!isRecord(value) || !hasExactKeys(value, ["id", "kind", "exposure", "paymentBoundary"])) {
+    return false;
+  }
+  return typeof value.id === "string" && CAPABILITY_ID.test(value.id) && typeof value.kind === "string" && CAPABILITY_KINDS.has(value.kind) && typeof value.exposure === "string" && EXPOSURES.has(value.exposure) && typeof value.paymentBoundary === "string" && PAYMENT_BOUNDARIES.has(value.paymentBoundary);
+}
+function manifest(value) {
+  if (!isRecord(value) || !hasExactKeys(value, [
+    "schemaVersion",
+    "agentHost",
+    "browserProvider",
+    "adapter",
+    "checkoutMethods",
+    "sessionBinding",
+    "inventoryScope",
+    "capabilities"
+  ]) || value.schemaVersion !== CHECKOUT_CAPABILITY_MANIFEST_VERSION || !component(value.agentHost) || !component(value.browserProvider) || !component(value.adapter) || !Array.isArray(value.checkoutMethods) || value.checkoutMethods.length === 0 || value.checkoutMethods.length > CHECKOUT_METHOD_IDS.length || !value.checkoutMethods.every(
+    (method) => typeof method === "string" && METHOD_IDS.has(method)
+  ) || new Set(value.checkoutMethods).size !== value.checkoutMethods.length || typeof value.sessionBinding !== "string" || !SESSION_BINDINGS.has(value.sessionBinding) || typeof value.inventoryScope !== "string" || !INVENTORY_SCOPES.has(value.inventoryScope) || !Array.isArray(value.capabilities) || value.capabilities.length === 0 || value.capabilities.length > 100 || !value.capabilities.every(capability)) {
+    return false;
+  }
+  return new Set(value.capabilities.map(({ id }) => id)).size === value.capabilities.length;
+}
+function fingerprint(value) {
+  const canonical = {
+    schemaVersion: value.schemaVersion,
+    agentHost: { id: value.agentHost.id, version: value.agentHost.version },
+    browserProvider: { id: value.browserProvider.id, version: value.browserProvider.version },
+    adapter: { id: value.adapter.id, version: value.adapter.version },
+    checkoutMethods: [...value.checkoutMethods].sort(),
+    sessionBinding: value.sessionBinding,
+    inventoryScope: value.inventoryScope,
+    capabilities: value.capabilities.map(({ id, kind, exposure, paymentBoundary }) => ({
+      id,
+      kind,
+      exposure,
+      paymentBoundary
+    })).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0)
+  };
+  return `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+}
+function emptyProbeResults(status) {
+  return CHECKOUT_CONFORMANCE_PROBE_IDS.map((probeId) => ({
+    probeId,
+    status,
+    expectedOutcome: EXPECTED_PROBE_OUTCOMES[probeId]
+  }));
+}
+function report(input) {
+  return Object.freeze({
+    schemaVersion: CHECKOUT_VERIFICATION_REPORT_VERSION,
+    status: input.status,
+    canBypass: input.status !== "ENFORCEABLE",
+    ...input.manifestFingerprint ? { manifestFingerprint: input.manifestFingerprint } : {},
+    verifiedAt: input.verifiedAt,
+    inventory: Object.freeze({
+      ...input.inventory,
+      bypassCapabilityIds: Object.freeze([...input.inventory.bypassCapabilityIds])
+    }),
+    findings: Object.freeze(input.findings.map((finding) => Object.freeze({ ...finding }))),
+    probes: Object.freeze(input.probes.map((probe) => Object.freeze({ ...probe })))
+  });
+}
+function probeObservation(value, request) {
+  if (!isRecord(value) || !hasExactKeys(value, ["probeId", "challengeId", "outcome"])) return false;
+  return value.probeId === request.probeId && value.challengeId === request.challengeId && typeof value.outcome === "string" && PROBE_OUTCOMES.has(value.outcome);
+}
+async function verifyCheckoutIntegration(value, options = {}) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  let verifiedAtDate;
+  try {
+    verifiedAtDate = now();
+  } catch {
+    verifiedAtDate = null;
+  }
+  const validVerifiedAt = verifiedAtDate instanceof Date && Number.isFinite(verifiedAtDate.getTime());
+  const verifiedAt = validVerifiedAt ? verifiedAtDate.toISOString() : (/* @__PURE__ */ new Date(0)).toISOString();
+  const emptyInventory = {
+    totalCapabilities: 0,
+    agentExposedCapabilities: 0,
+    paymentSensitiveCapabilities: 0,
+    bypassCapabilityIds: []
+  };
+  if (!validVerifiedAt || !manifest(value)) {
+    return report({
+      status: "MISCONFIGURED",
+      verifiedAt,
+      inventory: emptyInventory,
+      findings: [
+        {
+          code: "MANIFEST_INVALID",
+          severity: "BLOCKER",
+          message: "The checkout capability manifest is invalid."
+        }
+      ],
+      probes: emptyProbeResults("NOT_RUN")
+    });
+  }
+  const manifestFingerprint = fingerprint(value);
+  const agentCapabilities = value.capabilities.filter(({ exposure }) => exposure === "AGENT");
+  const paymentSensitiveCapabilities = value.capabilities.filter(
+    ({ kind, paymentBoundary }) => paymentBoundary === "UNRESTRICTED" || PAYMENT_SENSITIVE_KINDS.has(kind)
+  );
+  const bypassCapabilities = agentCapabilities.filter(
+    ({ paymentBoundary }) => paymentBoundary === "UNRESTRICTED"
+  );
+  const inventory = {
+    totalCapabilities: value.capabilities.length,
+    agentExposedCapabilities: agentCapabilities.length,
+    paymentSensitiveCapabilities: paymentSensitiveCapabilities.length,
+    bypassCapabilityIds: bypassCapabilities.map(({ id }) => id).sort()
+  };
+  const findings = [];
+  const guardedCheckoutPresent = agentCapabilities.some(
+    ({ kind, paymentBoundary }) => kind === "GUARDED_CHECKOUT" && paymentBoundary === "CONTO_GUARDED"
+  );
+  if (!guardedCheckoutPresent) {
+    findings.push({
+      code: "GUARDED_CHECKOUT_MISSING",
+      severity: "BLOCKER",
+      message: "No agent-facing checkout capability is bound to the Conto guarded runtime."
+    });
+  }
+  if (value.inventoryScope === "DECLARED_SUBSET") {
+    findings.push({
+      code: "CAPABILITY_INVENTORY_INCOMPLETE",
+      severity: "BLOCKER",
+      message: "The manifest does not cover every capability exposed to the agent."
+    });
+  }
+  if (value.sessionBinding === "CALLER_ASSERTED") {
+    findings.push({
+      code: "SESSION_BINDING_NOT_PROVEN",
+      severity: "BLOCKER",
+      message: "Browser-session ownership is caller asserted rather than runtime owned or proven."
+    });
+  }
+  for (const bypass of bypassCapabilities) {
+    findings.push({
+      code: "AGENT_PAYMENT_BYPASS",
+      severity: "BLOCKER",
+      capabilityId: bypass.id,
+      message: "An agent-exposed capability can trigger payment outside the Conto guard."
+    });
+  }
+  if (findings.length > 0) {
+    const advisory = guardedCheckoutPresent && findings.every(
+      ({ code }) => [
+        "CAPABILITY_INVENTORY_INCOMPLETE",
+        "SESSION_BINDING_NOT_PROVEN",
+        "AGENT_PAYMENT_BYPASS"
+      ].includes(code)
+    );
+    return report({
+      status: advisory ? "ADVISORY" : "MISCONFIGURED",
+      manifestFingerprint,
+      verifiedAt,
+      inventory,
+      findings,
+      probes: emptyProbeResults("NOT_RUN")
+    });
+  }
+  if (!options.runProbe) {
+    return report({
+      status: "UNVERIFIED",
+      manifestFingerprint,
+      verifiedAt,
+      inventory,
+      findings: [
+        {
+          code: "CONFORMANCE_PROBES_NOT_RUN",
+          severity: "WARNING",
+          message: "Static isolation passed, but active checkout conformance probes were not run."
+        }
+      ],
+      probes: emptyProbeResults("NOT_RUN")
+    });
+  }
+  const makeChallengeId = options.challengeId ?? randomUUID;
+  const usedChallenges = /* @__PURE__ */ new Set();
+  const probes = [];
+  for (const probeId of CHECKOUT_CONFORMANCE_PROBE_IDS) {
+    const expectedOutcome = EXPECTED_PROBE_OUTCOMES[probeId];
+    let challengeId;
+    try {
+      challengeId = makeChallengeId();
+    } catch {
+      challengeId = null;
+    }
+    if (typeof challengeId !== "string" || !CHALLENGE_ID.test(challengeId) || usedChallenges.has(challengeId)) {
+      probes.push({
+        probeId,
+        status: "FAILED",
+        expectedOutcome,
+        observedOutcome: "INVALID_RESULT"
+      });
+      findings.push({
+        code: "CONFORMANCE_PROBE_FAILED",
+        severity: "BLOCKER",
+        probeId,
+        message: "The checkout conformance probe did not return a valid fresh result."
+      });
+      continue;
+    }
+    usedChallenges.add(challengeId);
+    const request = Object.freeze({ probeId, challengeId, manifestFingerprint });
+    try {
+      const observation = await options.runProbe(request);
+      if (!probeObservation(observation, request)) {
+        probes.push({
+          probeId,
+          status: "FAILED",
+          expectedOutcome,
+          observedOutcome: "INVALID_RESULT"
+        });
+        findings.push({
+          code: "CONFORMANCE_PROBE_FAILED",
+          severity: "BLOCKER",
+          probeId,
+          message: "The checkout conformance probe returned an invalid or failing result."
+        });
+        continue;
+      }
+      if (observation.outcome !== expectedOutcome) {
+        probes.push({
+          probeId,
+          status: "FAILED",
+          expectedOutcome,
+          observedOutcome: observation.outcome
+        });
+        findings.push({
+          code: "CONFORMANCE_PROBE_FAILED",
+          severity: "BLOCKER",
+          probeId,
+          message: "The checkout conformance probe observed a failing outcome."
+        });
+        continue;
+      }
+      probes.push({
+        probeId,
+        status: "PASSED",
+        expectedOutcome,
+        observedOutcome: observation.outcome
+      });
+    } catch {
+      probes.push({
+        probeId,
+        status: "FAILED",
+        expectedOutcome,
+        observedOutcome: "RUNNER_ERROR"
+      });
+      findings.push({
+        code: "CONFORMANCE_PROBE_FAILED",
+        severity: "BLOCKER",
+        probeId,
+        message: "The checkout conformance probe runner failed."
+      });
+    }
+  }
+  return report({
+    status: findings.length === 0 ? "ENFORCEABLE" : "MISCONFIGURED",
+    manifestFingerprint,
+    verifiedAt,
+    inventory,
+    findings,
+    probes
+  });
+}
+export {
+  CHECKOUT_CAPABILITY_KINDS,
+  CHECKOUT_CAPABILITY_MANIFEST_VERSION,
+  CHECKOUT_CONFORMANCE_PROBE_IDS,
+  CHECKOUT_METHOD_IDS,
+  CHECKOUT_VERIFICATION_REPORT_VERSION,
+  verifyCheckoutIntegration
+};

package/dist/chunk-B7F5QLE5.mjs

@@ -0,0 +1,34 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __commonJS,
+  __toESM
+};