@hanzo/pay 0.1.0

package/dist/web/index.js

@@ -0,0 +1,218 @@
+import { PALETTE, REACH, Cancelled } from '../chunk-DXK2QDTX.js';
+
+// src/web/sdk.ts
+var PRODUCTION = "https://web.squarecdn.com/v1/square.js";
+var SANDBOX = "https://sandbox.web.squarecdn.com/v1/square.js";
+var pending = null;
+function load(src) {
+  if (pending) return pending;
+  if (typeof window !== "undefined" && window.Square) return pending = Promise.resolve();
+  pending = new Promise((resolve, reject) => {
+    const existing = document.querySelector(`script[src="${src}"]`);
+    if (existing) {
+      existing.addEventListener("load", () => resolve());
+      existing.addEventListener("error", () => reject(new Error("Square SDK failed to load")));
+      return;
+    }
+    const s = document.createElement("script");
+    s.src = src;
+    s.async = true;
+    s.onload = () => resolve();
+    s.onerror = () => reject(new Error("Square SDK failed to load"));
+    document.head.appendChild(s);
+  });
+  return pending;
+}
+function forget() {
+  pending = null;
+}
+
+// src/web/style.ts
+function rules(style2, selector) {
+  return style2[selector];
+}
+var RADIUS = "6px";
+function style(p) {
+  return {
+    // Borders and radius ONLY. Square's allowlist for this selector is
+    // borderColor/borderRadius/borderWidth; anything else throws "Invalid style
+    // property", and Square rejects the WHOLE style object when it does — so one
+    // stray property leaves the card unstyled and white.
+    ".input-container": {
+      borderColor: p.border,
+      borderRadius: RADIUS,
+      borderWidth: "1px"
+    },
+    ".input-container.is-focus": { borderColor: p.borderFocus },
+    ".input-container.is-error": { borderColor: p.error },
+    input: {
+      backgroundColor: p.field,
+      color: p.text,
+      fontSize: "14px"
+    },
+    // 16px on a small screen, because iOS Safari ZOOMS the page when a field
+    // under 16px takes focus — on a card form that throws the layout sideways
+    // mid-number and there is no way to zoom back without losing the caret.
+    // Square's own dark-mode example carries this media query for the same
+    // reason; it is the one place the field may disagree with the page's ramp.
+    "@media screen and (max-width: 600px)": {
+      input: { fontSize: "16px" }
+    },
+    "input::placeholder": { color: p.placeholder },
+    "input.is-error": { color: p.error },
+    ".message-text": { color: p.placeholder },
+    ".message-text.is-error": { color: p.error },
+    ".message-icon": { color: p.placeholder },
+    ".message-icon.is-error": { color: p.error }
+  };
+}
+function pin(doc) {
+  const d = doc ?? (typeof document === "undefined" ? void 0 : document);
+  if (!d) return;
+  const MARK = "hanzo-pay-scheme";
+  if (d.getElementById(MARK)) return;
+  const el = d.createElement("style");
+  el.id = MARK;
+  el.textContent = ".sq-card-iframe-container{color-scheme:auto}";
+  d.head.appendChild(el);
+}
+
+// src/web/terminal.ts
+var DRAWN = ["card", "gift", "google_pay", "cash_app"];
+function token(method, r) {
+  if (String(r.status).toUpperCase() === "CANCEL") throw new Cancelled(method);
+  if (r.status !== "OK" || !r.token) {
+    throw new Error(r.errors?.[0]?.message ?? `${method} could not be completed`);
+  }
+  return { value: r.token, method, card: r.details?.card };
+}
+function awaited(method, t) {
+  return new Promise((resolve, reject) => {
+    t.addEventListener?.("ontokenization", (e) => {
+      const detail = e?.detail;
+      if (detail?.error) {
+        reject(new Error(`${method} could not be completed`));
+        return;
+      }
+      if (!detail?.tokenResult) return;
+      try {
+        resolve(token(method, detail.tokenResult));
+      } catch (err) {
+        reject(err);
+      }
+    });
+  });
+}
+var Web = class {
+  constructor(payments, palette) {
+    this.payments = payments;
+    this.palette = palette;
+  }
+  payments;
+  built = /* @__PURE__ */ new Map();
+  palette;
+  /**
+   * Which rails can REALLY pay here, asked of the SDK one at a time.
+   *
+   * Building the rail IS the probe, and it is the only answer that accounts for
+   * the browser, the device, the buyer's saved cards AND whether the merchant
+   * account has the rail switched on. A rejection is a plain "not here", not an
+   * error worth showing anyone.
+   *
+   * The built objects are KEPT, and that is load-bearing rather than a cache:
+   * `collect('apple_pay')` must reach `tokenize()` with nothing awaited in front
+   * of it, so the object it needs has to already exist by then.
+   */
+  async offers(tender) {
+    const out = [];
+    for (const method of REACH.web) {
+      try {
+        this.built.set(method, await this.build(method, tender));
+        out.push(method);
+      } catch {
+      }
+    }
+    return out;
+  }
+  async build(method, tender) {
+    if (method === "card") return this.payments.card({ style: style(this.palette) });
+    if (method === "gift") return this.payments.giftCard();
+    if (method === "ach") {
+      return this.payments.ach({
+        // Square REJECTS a redirectURI carrying a query string, so the page's own
+        // path is used and anything that must survive the trip travels separately.
+        redirectURI: typeof window === "undefined" ? "" : window.location.origin + window.location.pathname,
+        transactionId: `${Date.now()}`
+      });
+    }
+    const req = this.payments.paymentRequest({
+      countryCode: tender.country,
+      currencyCode: tender.total.currency,
+      total: { amount: tender.total.amount, label: tender.label }
+    });
+    if (method === "apple_pay") return this.payments.applePay(req);
+    if (method === "google_pay") return this.payments.googlePay(req);
+    return this.payments.cashAppPay(req, {
+      // Where Cash App returns a MOBILE buyer. Desktop uses the QR and never
+      // leaves the page.
+      redirectURL: typeof window === "undefined" ? "" : window.location.href,
+      referenceId: `pay-${tender.total.amount}`
+    });
+  }
+  /** Draw a rail that renders inline. A rail that draws nothing is a no-op, not an error. */
+  async mount(method, target) {
+    const t = this.built.get(method);
+    if (!t) throw new Error(`${method} was not offered here`);
+    if (!DRAWN.includes(method)) return;
+    await t.attach?.(target);
+  }
+  /**
+   * Tokenize.
+   *
+   * NOTHING IS AWAITED BEFORE `tokenize()`. Apple refuses a payment sheet that
+   * was not opened directly by the gesture that asked for it, so a single `await`
+   * placed above the call — loading the SDK, looking a rail up asynchronously,
+   * re-reading a total — silently breaks Apple Pay and nothing else. That is why
+   * `offers()` builds every rail up front and this only reads a map.
+   */
+  collect(method, tender, detail) {
+    const t = this.built.get(method);
+    if (!t) return Promise.reject(new Error(`${method} was not offered here`));
+    if (method === "cash_app") return awaited(method, t);
+    if (method === "ach") {
+      if (!detail?.name) {
+        return Promise.reject(new Error("ACH needs the account holder\u2019s name"));
+      }
+      const arrived = awaited(method, t);
+      void t.tokenize({
+        accountHolderName: detail.name,
+        intent: "CHARGE",
+        amount: tender.total.amount,
+        currency: tender.total.currency
+      });
+      return arrived;
+    }
+    return t.tokenize(detail?.verify).then((r) => token(method, r));
+  }
+  async release() {
+    await Promise.all([...this.built.values()].map((t) => t.destroy?.().catch(() => void 0)));
+    this.built.clear();
+  }
+};
+async function terminal(config) {
+  if (!config.applicationId || !config.locationId) {
+    throw new Error("Square is not configured for this deployment");
+  }
+  pin();
+  const src = (config.environment ?? "production").toLowerCase() === "sandbox" ? SANDBOX : PRODUCTION;
+  await load(src);
+  if (typeof window === "undefined" || !window.Square) {
+    throw new Error("Square SDK failed to load");
+  }
+  const payments = await window.Square.payments(config.applicationId, config.locationId);
+  return new Web(payments, config.palette ?? PALETTE.dark);
+}
+
+export { PRODUCTION, SANDBOX, forget, load, pin, rules, style, terminal };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/web/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/web/sdk.ts","../../src/web/style.ts","../../src/web/terminal.ts"],"names":["style"],"mappings":";;;AA4FO,IAAM,UAAA,GAAa;AACnB,IAAM,OAAA,GAAU;AAEvB,IAAI,OAAA,GAAgC,IAAA;AAG7B,SAAS,KAAK,GAAA,EAA4B;AAC/C,EAAA,IAAI,SAAS,OAAO,OAAA;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,IAAe,MAAA,CAAO,QAAQ,OAAQ,OAAA,GAAU,QAAQ,OAAA,EAAQ;AACtF,EAAA,OAAA,GAAU,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,CAAA,YAAA,EAAe,GAAG,CAAA,EAAA,CAAI,CAAA;AAC9D,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,QAAA,CAAS,gBAAA,CAAiB,MAAA,EAAQ,MAAM,OAAA,EAAS,CAAA;AACjD,MAAA,QAAA,CAAS,gBAAA,CAAiB,SAAS,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,2BAA2B,CAAC,CAAC,CAAA;AACvF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AACzC,IAAA,CAAA,CAAE,GAAA,GAAM,GAAA;AACR,IAAA,CAAA,CAAE,KAAA,GAAQ,IAAA;AACV,IAAA,CAAA,CAAE,MAAA,GAAS,MAAM,OAAA,EAAQ;AACzB,IAAA,CAAA,CAAE,UAAU,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,2BAA2B,CAAC,CAAA;AAC/D,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,EAC7B,CAAC,CAAA;AACD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,MAAA,GAAe;AAC7B,EAAA,OAAA,GAAU,IAAA;AACZ;;;AChGO,SAAS,KAAA,CAAMA,QAAc,QAAA,EAAyB;AAC3D,EAAA,OAAOA,OAAM,QAAQ,CAAA;AACvB;AAGA,IAAM,MAAA,GAAS,KAAA;AAyCR,SAAS,MAAM,CAAA,EAAmB;AACvC,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,kBAAA,EAAoB;AAAA,MAClB,aAAa,CAAA,CAAE,MAAA;AAAA,MACf,YAAA,EAAc,MAAA;AAAA,MACd,WAAA,EAAa;AAAA,KACf;AAAA,IACA,2BAAA,EAA6B,EAAE,WAAA,EAAa,CAAA,CAAE,WAAA,EAAY;AAAA,IAC1D,2BAAA,EAA6B,EAAE,WAAA,EAAa,CAAA,CAAE,KAAA,EAAM;AAAA,IACpD,KAAA,EAAO;AAAA,MACL,iBAAiB,CAAA,CAAE,KAAA;AAAA,MACnB,OAAO,CAAA,CAAE,IAAA;AAAA,MACT,QAAA,EAAU;AAAA,KACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,sCAAA,EAAwC;AAAA,MACtC,KAAA,EAAO,EAAE,QAAA,EAAU,MAAA;AAAO,KAC5B;AAAA,IACA,oBAAA,EAAsB,EAAE,KAAA,EAAO,CAAA,CAAE,WAAA,EAAY;AAAA,IAC7C,gBAAA,EAAkB,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM;AAAA,IACnC,eAAA,EAAiB,EAAE,KAAA,EAAO,CAAA,CAAE,WAAA,EAAY;AAAA,IACxC,wBAAA,EAA0B,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM;AAAA,IAC3C,eAAA,EAAiB,EAAE,KAAA,EAAO,CAAA,CAAE,WAAA,EAAY;AAAA,IACxC,wBAAA,EAA0B,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA;AAAM,GAC7C;AACF;AA4BO,SAAS,IAAI,GAAA,EAAsB;AACxC,EAAA,MAAM,CAAA,GAAI,GAAA,KAAQ,OAAO,QAAA,KAAa,cAAc,MAAA,GAAY,QAAA,CAAA;AAChE,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,MAAM,IAAA,GAAO,kBAAA;AACb,EAAA,IAAI,CAAA,CAAE,cAAA,CAAe,IAAI,CAAA,EAAG;AAC5B,EAAA,MAAM,EAAA,GAAK,CAAA,CAAE,aAAA,CAAc,OAAO,CAAA;AAClC,EAAA,EAAA,CAAG,EAAA,GAAK,IAAA;AACR,EAAA,EAAA,CAAG,WAAA,GAAc,8CAAA;AACjB,EAAA,CAAA,CAAE,IAAA,CAAK,YAAY,EAAE,CAAA;AACvB;;;AClGA,IAAM,KAAA,GAA2B,CAAC,MAAA,EAAQ,MAAA,EAAQ,cAAc,UAAU,CAAA;AAE1E,SAAS,KAAA,CAAM,QAAgB,CAAA,EAAkB;AAG/C,EAAA,IAAI,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,CAAE,WAAA,OAAkB,QAAA,EAAU,MAAM,IAAI,SAAA,CAAU,MAAM,CAAA;AAC3E,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAC,EAAE,KAAA,EAAO;AACjC,IAAA,MAAM,IAAI,MAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,EAAG,OAAA,IAAW,CAAA,EAAG,MAAM,CAAA,uBAAA,CAAyB,CAAA;AAAA,EAC9E;AACA,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,KAAA,EAAO,QAAQ,IAAA,EAAM,CAAA,CAAE,SAAS,IAAA,EAAK;AACzD;AAUA,SAAS,OAAA,CAAQ,QAAgB,CAAA,EAA8B;AAC7D,EAAA,OAAO,IAAI,OAAA,CAAe,CAAC,OAAA,EAAS,MAAA,KAAW;AAC7C,IAAA,CAAA,CAAE,gBAAA,GAAmB,gBAAA,EAAkB,CAAC,CAAA,KAAe;AACrD,MAAA,MAAM,SAAU,CAAA,EAA8D,MAAA;AAC9E,MAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,MAAM,yBAAyB,CAAC,CAAA;AACpD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AAC1B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAC,CAAA;AAAA,MAC3C,SAAS,GAAA,EAAK;AACZ,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ;AAAA,IACF,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,IAAM,MAAN,MAA8B;AAAA,EAI5B,WAAA,CACmB,UACjB,OAAA,EACA;AAFiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAGjB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAJmB,QAAA;AAAA,EAJF,KAAA,uBAAY,GAAA,EAAuB;AAAA,EACnC,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBjB,MAAM,OAAO,MAAA,EAAmC;AAC9C,IAAA,MAAM,MAAgB,EAAC;AACvB,IAAA,KAAA,MAAW,MAAA,IAAU,MAAM,GAAA,EAAK;AAC9B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAA,CAAM,IAAI,MAAA,EAAQ,MAAM,KAAK,KAAA,CAAM,MAAA,EAAQ,MAAM,CAAC,CAAA;AACvD,QAAA,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,MACjB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,MAAc,KAAA,CAAM,MAAA,EAAgB,MAAA,EAAoC;AACtE,IAAA,IAAI,MAAA,KAAW,MAAA,EAAQ,OAAO,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,EAAG,CAAA;AAC/E,IAAA,IAAI,MAAA,KAAW,MAAA,EAAQ,OAAO,IAAA,CAAK,SAAS,QAAA,EAAS;AACrD,IAAA,IAAI,WAAW,KAAA,EAAO;AACpB,MAAA,OAAO,IAAA,CAAK,SAAS,GAAA,CAAI;AAAA;AAAA;AAAA,QAGvB,WAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACd,KACA,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,QAAA;AAAA,QAC/C,aAAA,EAAe,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,CAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAIA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe;AAAA,MACvC,aAAa,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,OAAO,KAAA,CAAM,QAAA;AAAA,MAC3B,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,KAAA;AAAM,KAC3D,CAAA;AACD,IAAA,IAAI,WAAW,WAAA,EAAa,OAAO,IAAA,CAAK,QAAA,CAAS,SAAS,GAAG,CAAA;AAC7D,IAAA,IAAI,WAAW,YAAA,EAAc,OAAO,IAAA,CAAK,QAAA,CAAS,UAAU,GAAG,CAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,UAAA,CAAW,GAAA,EAAK;AAAA;AAAA;AAAA,MAGnC,aAAa,OAAO,MAAA,KAAW,WAAA,GAAc,EAAA,GAAK,OAAO,QAAA,CAAS,IAAA;AAAA,MAClE,WAAA,EAAa,CAAA,IAAA,EAAO,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAAA,KACxC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,CAAM,MAAA,EAAgB,MAAA,EAA+B;AACzD,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,qBAAA,CAAuB,CAAA;AACxD,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,EAAG;AAC7B,IAAA,MAAM,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAgB,MAAA,EAAiC;AACvE,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,qBAAA,CAAuB,CAAC,CAAA;AAIzE,IAAA,IAAI,MAAA,KAAW,UAAA,EAAY,OAAO,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAEnD,IAAA,IAAI,WAAW,KAAA,EAAO;AACpB,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,QAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,0CAAqC,CAAC,CAAA;AAAA,MACxE;AACA,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAGjC,MAAA,KAAK,EAAE,QAAA,CAAS;AAAA,QACd,mBAAmB,MAAA,CAAO,IAAA;AAAA,QAC1B,MAAA,EAAQ,QAAA;AAAA,QACR,MAAA,EAAQ,OAAO,KAAA,CAAM,MAAA;AAAA,QACrB,QAAA,EAAU,OAAO,KAAA,CAAM;AAAA,OACxB,CAAA;AACD,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,OAAO,CAAA,CAAE,QAAA,CAAS,MAAA,EAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,KAAA,CAAM,MAAA,EAAQ,CAAC,CAAC,CAAA;AAAA,EAChE;AAAA,EAEA,MAAM,OAAA,GAAyB;AAM7B,IAAA,MAAM,QAAQ,GAAA,CAAI,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,OAAA,IAAU,CAAE,MAAM,MAAM,MAAS,CAAC,CAAC,CAAA;AAC3F,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AAAA,EACnB;AACF,CAAA;AAYA,eAAsB,SAAS,MAAA,EAAmC;AAChE,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,IAAiB,CAAC,OAAO,UAAA,EAAY;AAC/C,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AAKA,EAAA,GAAA,EAAI;AACJ,EAAA,MAAM,OAAO,MAAA,CAAO,WAAA,IAAe,cAAc,WAAA,EAAY,KAAM,YAAY,OAAA,GAAU,UAAA;AACzF,EAAA,MAAM,KAAK,GAAG,CAAA;AACd,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,OAAO,MAAA,EAAQ;AACnD,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,MAAA,CAAO,aAAA,EAAe,OAAO,UAAU,CAAA;AACrF,EAAA,OAAO,IAAI,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,OAAA,IAAW,QAAQ,IAAI,CAAA;AACzD","file":"index.js","sourcesContent":["// The Square Web Payments SDK, as much of it as we actually call, typed.\n//\n// Square ships no types for the global it installs, so this is the contract we\n// hold it to. Every member below is exercised by this package; nothing is\n// declared speculatively.\n\n/** What `tokenize()` resolves with. `status` is `'OK'` | `'CANCEL'` | an error. */\nexport interface Result {\n  status: string\n  token?: string\n  details?: {\n    card?: { brand?: string; last4?: string; expMonth?: number; expYear?: number }\n  }\n  errors?: Array<{ message: string }>\n}\n\nexport interface Tokenizer {\n  tokenize(options?: Record<string, unknown>): Promise<Result>\n  /**\n   * Cash App Pay and ACH deliver their token on an `ontokenization` EVENT rather\n   * than from tokenize()'s return — the buyer leaves the page (for Cash App, or\n   * for their bank's login) and comes back. A caller that only reads the return\n   * value gets nothing from either, silently, on a payment that succeeded.\n   */\n  addEventListener?(event: string, handler: (e: unknown) => void): void\n  /**\n   * Optional because a WALLET may draw itself (Apple Pay does) rather than\n   * attach. The second argument is Cash App Pay's button options\n   * (`{ shape, width }`); every other rail ignores it.\n   */\n  attach?(selector: string, options?: Record<string, unknown>): Promise<void>\n  destroy?(): Promise<void>\n}\n\n/**\n * The CARD element always attaches and always destroys — it owns an iframe. Kept\n * distinct from the wallet tokenizer so the card path is not forced to\n * optional-chain calls that can never be absent.\n */\nexport interface Element extends Tokenizer {\n  attach(selector: string): Promise<void>\n  destroy(): Promise<void>\n}\n\nexport interface Request {\n  countryCode: string\n  currencyCode: string\n  total: { amount: string; label: string }\n}\n\nexport interface Payments {\n  card(options?: Record<string, unknown>): Promise<Element>\n  /**\n   * A Square gift card. Its own constructor and its own container — a gift card\n   * is a balance instrument, not a credit line, so Square keeps the two elements\n   * separate rather than switching one on a brand.\n   *\n   * It attaches and tokenizes exactly like a card, with one difference that\n   * matters to a caller: its `tokenize()` takes NO verification details. SCA\n   * covers cards, and a gift card has no issuer to challenge.\n   */\n  giftCard(options?: Record<string, unknown>): Promise<Element>\n  paymentRequest(req: Request): unknown\n  applePay(req: unknown): Promise<Tokenizer>\n  googlePay(req: unknown): Promise<Tokenizer>\n  cashAppPay(req: unknown, opts: Record<string, unknown>): Promise<Tokenizer>\n  /**\n   * ACH bank transfer. Square runs PLAID'S instant bank authentication itself,\n   * so this needs no Plaid account of ours — which is why the rail sat marked\n   * \"coming soon\" for want of an integration that was already included. US-only.\n   *\n   * THE ARGUMENT IS OPTIONAL BECAUSE SQUARE ACCEPTS TWO SHAPES, and a type that\n   * admitted only one would reject working code. The redirect form\n   * (`ach({ redirectURI, transactionId })`, what this package calls and what\n   * hanzoai/pay has run in production) sends the buyer to their bank and back;\n   * Square's own quickstart instead calls `ach()` bare and passes\n   * `{ accountHolderName, intent, amount, currency }` to `tokenize()`. Both\n   * deliver the token the same way — on the event, never from the return.\n   */\n  ach(opts?: { redirectURI?: string; transactionId?: string }): Promise<Tokenizer>\n}\n\ninterface SDK {\n  payments(appId: string, locationId: string): Promise<Payments>\n}\n\ndeclare global {\n  interface Window {\n    Square?: SDK\n  }\n}\n\nexport const PRODUCTION = 'https://web.squarecdn.com/v1/square.js'\nexport const SANDBOX = 'https://sandbox.web.squarecdn.com/v1/square.js'\n\nlet pending: Promise<void> | null = null\n\n/** Load the SDK once per page, whichever surface asks first. */\nexport function load(src: string): Promise<void> {\n  if (pending) return pending\n  if (typeof window !== 'undefined' && window.Square) return (pending = Promise.resolve())\n  pending = new Promise((resolve, reject) => {\n    const existing = document.querySelector(`script[src=\"${src}\"]`)\n    if (existing) {\n      existing.addEventListener('load', () => resolve())\n      existing.addEventListener('error', () => reject(new Error('Square SDK failed to load')))\n      return\n    }\n    const s = document.createElement('script')\n    s.src = src\n    s.async = true\n    s.onload = () => resolve()\n    s.onerror = () => reject(new Error('Square SDK failed to load'))\n    document.head.appendChild(s)\n  })\n  return pending\n}\n\n/** Drop the memoized load. For tests only — a page loads the SDK once. */\nexport function forget(): void {\n  pending = null\n}\n","// A `Palette` rendered as the style object `payments.card({ style })` accepts.\n//\n// Measured against the live SDK, not read off a doc page. Where a comment says\n// \"confirmed\", it was driven and inspected.\n\nimport type { Palette } from '../palette'\n\n/** A selector's CSS property bag. */\nexport type Rules = Record<string, string>\n\n/**\n * What `payments.card({ style })` accepts: selector -> properties, plus `@media`\n * keys whose value is a nested block of the same. Square resolves the media query\n * INSIDE the iframe, which is the only way in — the frame cannot see the page's\n * own breakpoints.\n */\nexport type Style = Record<string, Rules | Record<string, Rules>>\n\n/**\n * One selector's properties.\n *\n * A `@media` key holds a nested block, so the map's value type is a union and\n * every read of a plain selector would otherwise need its own cast. This is that\n * cast, written once, where the shape is known.\n */\nexport function rules(style: Style, selector: string): Rules {\n  return style[selector] as Rules\n}\n\n/** The input/button radius of @hanzo/design's ramp (--radius-sm), in the px Square expects. */\nconst RADIUS = '6px'\n\n/**\n * The style object for a card element painted in `p`.\n *\n * THE GROUND AND THE INK ARE ONE PALETTE, and that is the whole point. The field\n * shipped as `input.backgroundColor: 'transparent'` beside `input.color:\n * '#fafafa'` — so Square painted near-white digits onto its own default white\n * iframe and the customer's card number was invisible as they typed it. Two\n * properties, set in two places, describing one surface. Reading them off one\n * `Palette` is what stops them disagreeing again; `legible()` proves they have not.\n *\n * `input.backgroundColor` IS the supported way in, and it is not a workaround.\n * Square maps that one property onto the container behind the iframe rather than\n * onto the input:\n *\n *     selectorPropertyMappings[input] = [{ property: 'backgroundColor',\n *       toSelectors: ['#<id>.sq-card-wrapper .sq-card-iframe-container'] }]\n *\n * Measured, not read: driving build 1.84.0 with the object below and inspecting\n * the result gives `.sq-card-iframe-container { background-color: #0a0a0a }` in\n * the parent document, with `<body>`, `<html>` and all four inputs inside the\n * cross-origin frame computing to `rgba(0,0,0,0)`. The frame is transparent by\n * design and the container is the surface — so painting the container IS painting\n * the field.\n *\n * AND IT IS STILL NOT ENOUGH ON ITS OWN — see `pin()` below, which this package\n * applies for you. The declaration above lands and is then overpainted, so a\n * style object shipped without that rule is accepted and silently ignored. That\n * gap was misread once as an SDK bug to wait out; it was ours.\n *\n * `.input-container { backgroundColor }` is ALSO accepted on 1.84.0 (it throws\n * nothing). It is still not set: it would be a second way to paint the one\n * surface `input.backgroundColor` already paints, and the two could then\n * disagree. One property, one surface.\n *\n * `fontFamily` is deliberately absent: Square validates it against its own\n * loadable list and throws on both CSS-wide stacks and arbitrary names, which\n * blocks the iframe from attaching at all. Its default is a system sans, which is\n * what --font-sans resolves to anyway.\n */\nexport function style(p: Palette): Style {\n  return {\n    // Borders and radius ONLY. Square's allowlist for this selector is\n    // borderColor/borderRadius/borderWidth; anything else throws \"Invalid style\n    // property\", and Square rejects the WHOLE style object when it does — so one\n    // stray property leaves the card unstyled and white.\n    '.input-container': {\n      borderColor: p.border,\n      borderRadius: RADIUS,\n      borderWidth: '1px',\n    },\n    '.input-container.is-focus': { borderColor: p.borderFocus },\n    '.input-container.is-error': { borderColor: p.error },\n    input: {\n      backgroundColor: p.field,\n      color: p.text,\n      fontSize: '14px',\n    },\n    // 16px on a small screen, because iOS Safari ZOOMS the page when a field\n    // under 16px takes focus — on a card form that throws the layout sideways\n    // mid-number and there is no way to zoom back without losing the caret.\n    // Square's own dark-mode example carries this media query for the same\n    // reason; it is the one place the field may disagree with the page's ramp.\n    '@media screen and (max-width: 600px)': {\n      input: { fontSize: '16px' },\n    },\n    'input::placeholder': { color: p.placeholder },\n    'input.is-error': { color: p.error },\n    '.message-text': { color: p.placeholder },\n    '.message-text.is-error': { color: p.error },\n    '.message-icon': { color: p.placeholder },\n    '.message-icon.is-error': { color: p.error },\n  }\n}\n\n/**\n * The rule without which everything above is decoration.\n *\n * Square's `input.backgroundColor` is accepted and then IGNORED: the field\n * renders white on a black checkout no matter what is passed. The cause is not\n * Square's, and it is one property. A page that sets `color-scheme` on\n * `<html>` — which is the correct thing to do, and what every themed app does so\n * the UA paints scrollbars and form controls to match — leaks it INTO the\n * cross-origin iframe, because `color-scheme` inherits. Inside the frame the UA\n * then paints form controls on its own scheme background, over anything the SDK\n * declared. Pinning the container back to `auto` lets our ground through.\n *\n * (A Square forum user reported the same thing after two years of the docs' own\n * recipe not working. Same fix, arrived at from the other end.)\n *\n * THIS IS APPLIED FOR YOU, by `terminal()`, before any card can attach — it must\n * be in the stylesheet BEFORE the element mounts, because the container is styled\n * as the card attaches, and a rule added afterwards is a rule that arrived too\n * late. It is not left to a host to remember, and it is not a stylesheet a host\n * can forget to import: this package produced the style object, so this package\n * owes the one rule that makes it mean anything.\n *\n * Idempotent, and a no-op without a document. A host that already ships the rule\n * (hanzoai/pay does, in `index.css`) gets an identical declaration — same\n * property, same value — so there is nothing for the two to disagree about.\n */\nexport function pin(doc?: Document): void {\n  const d = doc ?? (typeof document === 'undefined' ? undefined : document)\n  if (!d) return\n  const MARK = 'hanzo-pay-scheme'\n  if (d.getElementById(MARK)) return\n  const el = d.createElement('style')\n  el.id = MARK\n  el.textContent = '.sq-card-iframe-container{color-scheme:auto}'\n  d.head.appendChild(el)\n}\n","// The Square Web Payments SDK behind the one `Terminal` interface.\n//\n// Every rail here mints the SAME single-use token, bound for the same server\n// call — so none of them needed server work beyond the one that already existed.\n// What they do NOT share is how the token arrives, and treating them as one shape\n// is a silent failure in three of the six:\n//\n//   card, gift   attach() into a container, then tokenize() returns the token.\n//   google_pay   attach() into a container Square draws its button in, then\n//                tokenize() from our click.\n//   apple_pay    NO attach() — Square's docs are explicit. The host renders the\n//                button (Apple's own CSS appearance), and tokenize() must be\n//                called IMMEDIATELY in the click handler.\n//   cash_app     attach(), and then the token arrives on an `ontokenization`\n//                EVENT after the buyer approves in the app or by QR. Calling\n//                tokenize() ourselves does nothing and the payment never lands.\n//   ach          NO attach() — the flow IS tokenize(). The token likewise arrives\n//                on `ontokenization`, because the buyer leaves for their bank.\n\nimport {\n  type Detail,\n  type Method,\n  type Tender,\n  type Terminal,\n  type Token,\n  Cancelled,\n  REACH,\n} from '../terminal'\nimport { type Palette, PALETTE } from '../palette'\nimport { load, PRODUCTION, SANDBOX, type Payments, type Result, type Tokenizer } from './sdk'\nimport { pin, style } from './style'\n\n/** The org's PUBLIC Square config, exactly as commerce publishes it. */\nexport interface Config {\n  applicationId: string\n  locationId: string\n  /** `'sandbox'` tokenizes against Square's sandbox. Anything else is production. */\n  environment?: string\n  /** The card field's colours. Defaults to @hanzo/design's dark table. */\n  palette?: Palette\n}\n\n/** Rails that draw themselves into a container the host positions. */\nconst DRAWN: readonly Method[] = ['card', 'gift', 'google_pay', 'cash_app']\n\nfunction token(method: Method, r: Result): Token {\n  // CANCEL is the buyer changing their mind. It is not a failure and must never\n  // be shown as one.\n  if (String(r.status).toUpperCase() === 'CANCEL') throw new Cancelled(method)\n  if (r.status !== 'OK' || !r.token) {\n    throw new Error(r.errors?.[0]?.message ?? `${method} could not be completed`)\n  }\n  return { value: r.token, method, card: r.details?.card }\n}\n\n/**\n * The token that arrives on an EVENT rather than from a return — Cash App Pay\n * and ACH, for the same underlying reason: the buyer leaves the page.\n *\n * One listener per collect(), removed when it settles. Square's own quickstart\n * registers a fresh listener on every submission and never removes one, so a\n * buyer who retries gets their token delivered to every previous attempt too.\n */\nfunction awaited(method: Method, t: Tokenizer): Promise<Token> {\n  return new Promise<Token>((resolve, reject) => {\n    t.addEventListener?.('ontokenization', (e: unknown) => {\n      const detail = (e as { detail?: { tokenResult?: Result; error?: unknown } })?.detail\n      if (detail?.error) {\n        reject(new Error(`${method} could not be completed`))\n        return\n      }\n      if (!detail?.tokenResult) return\n      try {\n        resolve(token(method, detail.tokenResult))\n      } catch (err) {\n        reject(err)\n      }\n    })\n  })\n}\n\nclass Web implements Terminal {\n  private readonly built = new Map<Method, Tokenizer>()\n  private readonly palette: Palette\n\n  constructor(\n    private readonly payments: Payments,\n    palette: Palette,\n  ) {\n    this.palette = palette\n  }\n\n  /**\n   * Which rails can REALLY pay here, asked of the SDK one at a time.\n   *\n   * Building the rail IS the probe, and it is the only answer that accounts for\n   * the browser, the device, the buyer's saved cards AND whether the merchant\n   * account has the rail switched on. A rejection is a plain \"not here\", not an\n   * error worth showing anyone.\n   *\n   * The built objects are KEPT, and that is load-bearing rather than a cache:\n   * `collect('apple_pay')` must reach `tokenize()` with nothing awaited in front\n   * of it, so the object it needs has to already exist by then.\n   */\n  async offers(tender: Tender): Promise<Method[]> {\n    const out: Method[] = []\n    for (const method of REACH.web) {\n      try {\n        this.built.set(method, await this.build(method, tender))\n        out.push(method)\n      } catch {\n        // Not offerable here. Say nothing and show nothing.\n      }\n    }\n    return out\n  }\n\n  private async build(method: Method, tender: Tender): Promise<Tokenizer> {\n    if (method === 'card') return this.payments.card({ style: style(this.palette) })\n    if (method === 'gift') return this.payments.giftCard()\n    if (method === 'ach') {\n      return this.payments.ach({\n        // Square REJECTS a redirectURI carrying a query string, so the page's own\n        // path is used and anything that must survive the trip travels separately.\n        redirectURI:\n          typeof window === 'undefined'\n            ? ''\n            : window.location.origin + window.location.pathname,\n        transactionId: `${Date.now()}`,\n      })\n    }\n    // A FRESH paymentRequest per wallet: Square binds it into the object it\n    // builds, so two wallets sharing one request is one wallet quoting the\n    // other's total.\n    const req = this.payments.paymentRequest({\n      countryCode: tender.country,\n      currencyCode: tender.total.currency,\n      total: { amount: tender.total.amount, label: tender.label },\n    })\n    if (method === 'apple_pay') return this.payments.applePay(req)\n    if (method === 'google_pay') return this.payments.googlePay(req)\n    return this.payments.cashAppPay(req, {\n      // Where Cash App returns a MOBILE buyer. Desktop uses the QR and never\n      // leaves the page.\n      redirectURL: typeof window === 'undefined' ? '' : window.location.href,\n      referenceId: `pay-${tender.total.amount}`,\n    })\n  }\n\n  /** Draw a rail that renders inline. A rail that draws nothing is a no-op, not an error. */\n  async mount(method: Method, target: string): Promise<void> {\n    const t = this.built.get(method)\n    if (!t) throw new Error(`${method} was not offered here`)\n    if (!DRAWN.includes(method)) return\n    await t.attach?.(target)\n  }\n\n  /**\n   * Tokenize.\n   *\n   * NOTHING IS AWAITED BEFORE `tokenize()`. Apple refuses a payment sheet that\n   * was not opened directly by the gesture that asked for it, so a single `await`\n   * placed above the call — loading the SDK, looking a rail up asynchronously,\n   * re-reading a total — silently breaks Apple Pay and nothing else. That is why\n   * `offers()` builds every rail up front and this only reads a map.\n   */\n  collect(method: Method, tender: Tender, detail?: Detail): Promise<Token> {\n    const t = this.built.get(method)\n    if (!t) return Promise.reject(new Error(`${method} was not offered here`))\n\n    // Cash App draws its own button and delivers on the event; a tokenize() call\n    // here does nothing at all.\n    if (method === 'cash_app') return awaited(method, t)\n\n    if (method === 'ach') {\n      if (!detail?.name) {\n        return Promise.reject(new Error('ACH needs the account holder’s name'))\n      }\n      const arrived = awaited(method, t)\n      // The flow IS tokenize() for ACH — it opens the bank login — but the token\n      // comes back on the event, so the return value is deliberately dropped.\n      void t.tokenize({\n        accountHolderName: detail.name,\n        intent: 'CHARGE',\n        amount: tender.total.amount,\n        currency: tender.total.currency,\n      })\n      return arrived\n    }\n\n    return t.tokenize(detail?.verify).then((r) => token(method, r))\n  }\n\n  async release(): Promise<void> {\n    // Square's `destroy()` empties the mount node when it resolves, so a create\n    // that overlaps a destroy gets its fresh iframe swept away by the old\n    // element's cleanup — the form then sits empty forever with no error to\n    // explain it. Callers await this before building the next terminal, which is\n    // what makes a theme change survivable.\n    await Promise.all([...this.built.values()].map((t) => t.destroy?.().catch(() => undefined)))\n    this.built.clear()\n  }\n}\n\n/**\n * A terminal for this browser. Loads the SDK once per page, whichever surface\n * asks first.\n *\n * The palette is fixed at construction because SQUARE HAS NO API TO RESTYLE A\n * LIVE CARD — the fields are a cross-origin iframe, told their colours once, at\n * creation. Following a theme change therefore means `release()` then a new\n * terminal, and making the palette a constructor argument is what forces that to\n * happen by construction rather than by remembering to.\n */\nexport async function terminal(config: Config): Promise<Terminal> {\n  if (!config.applicationId || !config.locationId) {\n    throw new Error('Square is not configured for this deployment')\n  }\n  // BEFORE the SDK loads, let alone attaches. The container is styled as the\n  // card mounts, so this rule has to already be in the sheet by then — see\n  // `pin()`. Doing it here is what makes it impossible to ship the style object\n  // without the one rule that makes it visible.\n  pin()\n  const src = (config.environment ?? 'production').toLowerCase() === 'sandbox' ? SANDBOX : PRODUCTION\n  await load(src)\n  if (typeof window === 'undefined' || !window.Square) {\n    throw new Error('Square SDK failed to load')\n  }\n  const payments = await window.Square.payments(config.applicationId, config.locationId)\n  return new Web(payments, config.palette ?? PALETTE.dark)\n}\n"]}

package/dist/web/sdk.d.ts

@@ -0,0 +1,99 @@
+/** What `tokenize()` resolves with. `status` is `'OK'` | `'CANCEL'` | an error. */
+export interface Result {
+    status: string;
+    token?: string;
+    details?: {
+        card?: {
+            brand?: string;
+            last4?: string;
+            expMonth?: number;
+            expYear?: number;
+        };
+    };
+    errors?: Array<{
+        message: string;
+    }>;
+}
+export interface Tokenizer {
+    tokenize(options?: Record<string, unknown>): Promise<Result>;
+    /**
+     * Cash App Pay and ACH deliver their token on an `ontokenization` EVENT rather
+     * than from tokenize()'s return — the buyer leaves the page (for Cash App, or
+     * for their bank's login) and comes back. A caller that only reads the return
+     * value gets nothing from either, silently, on a payment that succeeded.
+     */
+    addEventListener?(event: string, handler: (e: unknown) => void): void;
+    /**
+     * Optional because a WALLET may draw itself (Apple Pay does) rather than
+     * attach. The second argument is Cash App Pay's button options
+     * (`{ shape, width }`); every other rail ignores it.
+     */
+    attach?(selector: string, options?: Record<string, unknown>): Promise<void>;
+    destroy?(): Promise<void>;
+}
+/**
+ * The CARD element always attaches and always destroys — it owns an iframe. Kept
+ * distinct from the wallet tokenizer so the card path is not forced to
+ * optional-chain calls that can never be absent.
+ */
+export interface Element extends Tokenizer {
+    attach(selector: string): Promise<void>;
+    destroy(): Promise<void>;
+}
+export interface Request {
+    countryCode: string;
+    currencyCode: string;
+    total: {
+        amount: string;
+        label: string;
+    };
+}
+export interface Payments {
+    card(options?: Record<string, unknown>): Promise<Element>;
+    /**
+     * A Square gift card. Its own constructor and its own container — a gift card
+     * is a balance instrument, not a credit line, so Square keeps the two elements
+     * separate rather than switching one on a brand.
+     *
+     * It attaches and tokenizes exactly like a card, with one difference that
+     * matters to a caller: its `tokenize()` takes NO verification details. SCA
+     * covers cards, and a gift card has no issuer to challenge.
+     */
+    giftCard(options?: Record<string, unknown>): Promise<Element>;
+    paymentRequest(req: Request): unknown;
+    applePay(req: unknown): Promise<Tokenizer>;
+    googlePay(req: unknown): Promise<Tokenizer>;
+    cashAppPay(req: unknown, opts: Record<string, unknown>): Promise<Tokenizer>;
+    /**
+     * ACH bank transfer. Square runs PLAID'S instant bank authentication itself,
+     * so this needs no Plaid account of ours — which is why the rail sat marked
+     * "coming soon" for want of an integration that was already included. US-only.
+     *
+     * THE ARGUMENT IS OPTIONAL BECAUSE SQUARE ACCEPTS TWO SHAPES, and a type that
+     * admitted only one would reject working code. The redirect form
+     * (`ach({ redirectURI, transactionId })`, what this package calls and what
+     * hanzoai/pay has run in production) sends the buyer to their bank and back;
+     * Square's own quickstart instead calls `ach()` bare and passes
+     * `{ accountHolderName, intent, amount, currency }` to `tokenize()`. Both
+     * deliver the token the same way — on the event, never from the return.
+     */
+    ach(opts?: {
+        redirectURI?: string;
+        transactionId?: string;
+    }): Promise<Tokenizer>;
+}
+interface SDK {
+    payments(appId: string, locationId: string): Promise<Payments>;
+}
+declare global {
+    interface Window {
+        Square?: SDK;
+    }
+}
+export declare const PRODUCTION = "https://web.squarecdn.com/v1/square.js";
+export declare const SANDBOX = "https://sandbox.web.squarecdn.com/v1/square.js";
+/** Load the SDK once per page, whichever surface asks first. */
+export declare function load(src: string): Promise<void>;
+/** Drop the memoized load. For tests only — a page loads the SDK once. */
+export declare function forget(): void;
+export {};

package/dist/web/style.d.ts

@@ -0,0 +1,85 @@
+import type { Palette } from '../palette';
+/** A selector's CSS property bag. */
+export type Rules = Record<string, string>;
+/**
+ * What `payments.card({ style })` accepts: selector -> properties, plus `@media`
+ * keys whose value is a nested block of the same. Square resolves the media query
+ * INSIDE the iframe, which is the only way in — the frame cannot see the page's
+ * own breakpoints.
+ */
+export type Style = Record<string, Rules | Record<string, Rules>>;
+/**
+ * One selector's properties.
+ *
+ * A `@media` key holds a nested block, so the map's value type is a union and
+ * every read of a plain selector would otherwise need its own cast. This is that
+ * cast, written once, where the shape is known.
+ */
+export declare function rules(style: Style, selector: string): Rules;
+/**
+ * The style object for a card element painted in `p`.
+ *
+ * THE GROUND AND THE INK ARE ONE PALETTE, and that is the whole point. The field
+ * shipped as `input.backgroundColor: 'transparent'` beside `input.color:
+ * '#fafafa'` — so Square painted near-white digits onto its own default white
+ * iframe and the customer's card number was invisible as they typed it. Two
+ * properties, set in two places, describing one surface. Reading them off one
+ * `Palette` is what stops them disagreeing again; `legible()` proves they have not.
+ *
+ * `input.backgroundColor` IS the supported way in, and it is not a workaround.
+ * Square maps that one property onto the container behind the iframe rather than
+ * onto the input:
+ *
+ *     selectorPropertyMappings[input] = [{ property: 'backgroundColor',
+ *       toSelectors: ['#<id>.sq-card-wrapper .sq-card-iframe-container'] }]
+ *
+ * Measured, not read: driving build 1.84.0 with the object below and inspecting
+ * the result gives `.sq-card-iframe-container { background-color: #0a0a0a }` in
+ * the parent document, with `<body>`, `<html>` and all four inputs inside the
+ * cross-origin frame computing to `rgba(0,0,0,0)`. The frame is transparent by
+ * design and the container is the surface — so painting the container IS painting
+ * the field.
+ *
+ * AND IT IS STILL NOT ENOUGH ON ITS OWN — see `pin()` below, which this package
+ * applies for you. The declaration above lands and is then overpainted, so a
+ * style object shipped without that rule is accepted and silently ignored. That
+ * gap was misread once as an SDK bug to wait out; it was ours.
+ *
+ * `.input-container { backgroundColor }` is ALSO accepted on 1.84.0 (it throws
+ * nothing). It is still not set: it would be a second way to paint the one
+ * surface `input.backgroundColor` already paints, and the two could then
+ * disagree. One property, one surface.
+ *
+ * `fontFamily` is deliberately absent: Square validates it against its own
+ * loadable list and throws on both CSS-wide stacks and arbitrary names, which
+ * blocks the iframe from attaching at all. Its default is a system sans, which is
+ * what --font-sans resolves to anyway.
+ */
+export declare function style(p: Palette): Style;
+/**
+ * The rule without which everything above is decoration.
+ *
+ * Square's `input.backgroundColor` is accepted and then IGNORED: the field
+ * renders white on a black checkout no matter what is passed. The cause is not
+ * Square's, and it is one property. A page that sets `color-scheme` on
+ * `<html>` — which is the correct thing to do, and what every themed app does so
+ * the UA paints scrollbars and form controls to match — leaks it INTO the
+ * cross-origin iframe, because `color-scheme` inherits. Inside the frame the UA
+ * then paints form controls on its own scheme background, over anything the SDK
+ * declared. Pinning the container back to `auto` lets our ground through.
+ *
+ * (A Square forum user reported the same thing after two years of the docs' own
+ * recipe not working. Same fix, arrived at from the other end.)
+ *
+ * THIS IS APPLIED FOR YOU, by `terminal()`, before any card can attach — it must
+ * be in the stylesheet BEFORE the element mounts, because the container is styled
+ * as the card attaches, and a rule added afterwards is a rule that arrived too
+ * late. It is not left to a host to remember, and it is not a stylesheet a host
+ * can forget to import: this package produced the style object, so this package
+ * owes the one rule that makes it mean anything.
+ *
+ * Idempotent, and a no-op without a document. A host that already ships the rule
+ * (hanzoai/pay does, in `index.css`) gets an identical declaration — same
+ * property, same value — so there is nothing for the two to disagree about.
+ */
+export declare function pin(doc?: Document): void;

package/dist/web/terminal.d.ts

@@ -0,0 +1,22 @@
+import { type Terminal } from '../terminal';
+import { type Palette } from '../palette';
+/** The org's PUBLIC Square config, exactly as commerce publishes it. */
+export interface Config {
+    applicationId: string;
+    locationId: string;
+    /** `'sandbox'` tokenizes against Square's sandbox. Anything else is production. */
+    environment?: string;
+    /** The card field's colours. Defaults to @hanzo/design's dark table. */
+    palette?: Palette;
+}
+/**
+ * A terminal for this browser. Loads the SDK once per page, whichever surface
+ * asks first.
+ *
+ * The palette is fixed at construction because SQUARE HAS NO API TO RESTYLE A
+ * LIVE CARD — the fields are a cross-origin iframe, told their colours once, at
+ * creation. Following a theme change therefore means `release()` then a new
+ * terminal, and making the palette a constructor argument is what forces that to
+ * happen by construction rather than by remembering to.
+ */
+export declare function terminal(config: Config): Promise<Terminal>;

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@hanzo/pay",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Square payments for web and native behind one interface. Card, Apple Pay, Google Pay, Cash App Pay, ACH and gift cards, feature-detected — with one colour table that dresses the web iframe and the native sheet alike.",
+  "license": "Apache-2.0",
+  "author": "Hanzo AI <dev@hanzo.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hanzoai/pay.git",
+    "directory": "pkg/pay"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    },
+    "./web": {
+      "types": "./dist/web/index.d.ts",
+      "import": "./dist/web/index.js",
+      "require": "./dist/web/index.cjs",
+      "default": "./dist/web/index.js"
+    },
+    "./native": {
+      "types": "./dist/native/index.d.ts",
+      "import": "./dist/native/index.js",
+      "require": "./dist/native/index.cjs",
+      "default": "./dist/native/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup && tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "prepack": "pnpm run build",
+    "tc": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "peerDependencies": {
+    "react-native-square-in-app-payments": ">=2.1.0"
+  },
+  "peerDependenciesMeta": {
+    "react-native-square-in-app-payments": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "react-native-square-in-app-payments": "2.1.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.7.2",
+    "vitest": "^4.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "square",
+    "payments",
+    "react-native",
+    "apple-pay",
+    "google-pay",
+    "cash-app-pay",
+    "ach"
+  ]
+}