npm - @klarna/add-to-klarna - Versions diffs - 0.0.1 → 1.0.0 - Mend

@klarna/add-to-klarna 0.0.1 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/LICENSE ADDED Viewed

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+   1. Definitions.
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+   END OF TERMS AND CONDITIONS
+   APPENDIX: How to apply the Apache License to your work.
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+   Copyright [yyyy] [name of copyright owner]
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+       http://www.apache.org/licenses/LICENSE-2.0
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md CHANGED Viewed

@@ -1,45 +1,268 @@
 # @klarna/add-to-klarna
-## ⚠️ IMPORTANT NOTICE ⚠️
+> Merchant integration library for generating Klarna "Add to Klarna" universal links.
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+[![Build Status][ci-image]][ci-url]
+[![License][license-image]][license-url]
+[![Developed at Klarna][klarna-image]][klarna-url]
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Lets a merchant page turn a `brandNickname` + `inputId` into a fully encrypted Klarna universal link in one call, without the merchant having to touch JWE, JWKS, key rotation, or URL encoding.
-## Purpose
+## Install
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@klarna/add-to-klarna`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+```bash
+yarn add @klarna/add-to-klarna
+# or
+npm install @klarna/add-to-klarna
+```
-## What is OIDC Trusted Publishing?
+The package is isomorphic. It works in:
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+- modern browsers (uses Web Crypto + `fetch`),
+- Node ≥ 20 (uses the built-in Web Crypto and global `fetch`).
-## Setup Instructions
+It has a single runtime dependency: [`jose`](https://github.com/panva/jose).
-To properly configure OIDC trusted publishing for this package:
+## Quick start
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+```ts
+import { createAddToKlarnaClient } from "@klarna/add-to-klarna";
-## DO NOT USE THIS PACKAGE
+const klarna = createAddToKlarnaClient({ region: "eu" });
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+document.querySelector("#add-to-klarna-button")?.addEventListener("click", async () => {
+  await klarna.redirect({
+    brandNickname: "your-brand-nickname",
+    inputId: "your-customer-id",
+  });
+});
+```
-## More Information
+`redirect()` calls `window.location.assign(...)` with the generated link. If
+you want the URL without navigating (e.g. to put in an `<a href>` or to send
+in an email from a server), use `buildLink()`:
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+```ts
+const url = await klarna.buildLink({
+  brandNickname: "your-brand-nickname",
+  inputId: "your-customer-id",
+});
+```
----
+## Without a build step
-**Maintained for OIDC setup purposes only**
+The published package also works without a bundler.
+### Node (CommonJS)
+The package ships both ESM and CJS entry points, so `require` works the same
+as `import`:
+```js
+const { createAddToKlarnaClient } = require("@klarna/add-to-klarna");
+const klarna = createAddToKlarnaClient({ region: "eu" });
+(async () => {
+  const url = await klarna.buildLink({
+    brandNickname: "your-brand-nickname",
+    inputId: "your-customer-id",
+  });
+  console.log(url);
+})();
+```
+### Browser (`<script type="module">` from a CDN)
+Drop the library straight into an HTML page via an ESM-aware CDN — no
+`npm`, no bundler:
+```html
+<script type="module">
+  import { createAddToKlarnaClient } from "https://esm.sh/@klarna/add-to-klarna@1.0.0";
+  const klarna = createAddToKlarnaClient({ region: "eu" });
+  document.querySelector("#add-to-klarna-button")?.addEventListener("click", async () => {
+    await klarna.redirect({
+      brandNickname: "your-brand-nickname",
+      inputId: "your-customer-id",
+    });
+  });
+</script>
+```
+`esm.sh` (above), `https://cdn.jsdelivr.net/npm/@klarna/add-to-klarna@1.0.0/+esm`,
+and `https://unpkg.com/@klarna/add-to-klarna@1.0.0?module` all serve the
+ESM build and resolve the `jose` dependency transparently. Always pin a
+version in production so a future release can't change behaviour under
+your page.
+## Configuration
+Just two options. Only `region` is required — `environment` defaults to
+`"production"`, so a merchant integration can usually pass just the region.
+| Option        | Type                        | Default        | Description                                                                                      |
+| ------------- | --------------------------- | -------------- | ------------------------------------------------------------------------------------------------ |
+| `environment` | `"production" \| "staging"` | `"production"` | Which Klarna deployment to target. Picks both the JWKS endpoint and the universal-link base URL. |
+| `region`      | `"eu" \| "us" \| "ap"`      | _(required)_   | Which deployment region to target. Picks the key inside the JWKS via a `kid-{region}-` prefix.   |
+That's it. There are no other knobs — by design. The JWKS endpoint, the
+universal-link host, the clock, the UUID generator, and the `fetch`
+implementation are all fixed (the library uses `globalThis.fetch`,
+`Date.now`, and `globalThis.crypto.randomUUID`).
+## URL shape
+The library always emits a URL of this shape:
+```
+<base>/<brandNickname>/<base64UrlEncodedPayload>
+```
+The `<base>` is fixed per environment (and already contains the
+`/add-to-klarna` route segment):
+| Environment  | Base URL                                                |
+| ------------ | ------------------------------------------------------- |
+| `production` | `https://app.klarna.com/loyalty-cards-v2/add-to-klarna` |
+| `staging`    | `klarnadev://loyalty-cards-v2/add-to-klarna`            |
+The `<base64UrlEncodedPayload>` is the JWE compact serialization wrapped in an
+extra base64url so the entire ciphertext fits in a single URL path component.
+## API
+### `createAddToKlarnaClient(options)`
+Returns an `AddToKlarnaClient`. Construction is cheap and synchronous; the
+first network call happens on the first `buildLink` / `redirect`.
+### `client.buildLink({ brandNickname, inputId })`
+Returns `Promise<string>` — the fully-formed universal link URL.
+A fresh `linkId` is minted on every call (and embedded inside the encrypted
+payload, not exposed on the surface). The Klarna backend enforces single-use
+semantics, so do **not** cache the returned URL — generate a new one per
+click.
+### `client.redirect({ brandNickname, inputId })`
+Calls `buildLink()` and then `window.location.assign(url)`. Throws
+`AddToKlarnaError` with `code: "NAVIGATION_UNAVAILABLE"` if `window` is not
+present.
+## Caching
+The library does **not** maintain any in-memory cache. Every `buildLink`
+re-fetches the JWKS. Caching is delegated to the HTTP layer:
+- the production JWKS is served from `app.klarna.com` through Klarna's CDN,
+  which sets the `Cache-Control` policy authoritatively;
+- the browser's HTTP cache (or Node's fetch cache, where configured) honors
+  those headers on subsequent calls.
+This means a key rotation propagates as soon as the CDN edge cache expires —
+no client release required.
+## Key selection by region
+Both published JWKS files contain keys for every region. Each key is
+namespaced by its `kid`, which always starts with `kid-{region}-`:
+```
+kid-eu-66caf84b-…
+kid-us-…
+kid-ap-…
+```
+`region` in the client options decides which prefix the library filters for.
+A region with no matching key in the JWKS produces a typed
+`NO_MATCHING_KEY` error rather than silently picking the wrong region.
+## Security model
+The JWKS is fetched over HTTPS from `app.klarna.com`; certificate
+validation is delegated to Web PKI + HSTS. The library doesn't ship
+custom cert pinning — no portable browser API for it, and the cost of
+rotating a pin across every merchant integration outweighs the marginal
+protection.
+The JWE profile is pinned end-to-end instead:
+| Field | Pinned value     |
+| ----- | ---------------- |
+| `use` | `enc`            |
+| `alg` | `ECDH-ES+A256KW` |
+| `kty` | `EC`             |
+| `crv` | `P-256`          |
+| `enc` | `A256GCM`        |
+Any JWKS key not matching this tuple is rejected with `NO_MATCHING_KEY`,
+so drift or a substituted JWKS fails closed rather than silently
+downgrading.
+## Errors
+Every failure surfaces as an `AddToKlarnaError` with a stable `.code`. Branch
+on the code, not on the message.
+| Code                     | Meaning                                                                                                                      |
+| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| `INVALID_CONFIG`         | A client option was invalid (e.g. unknown `environment` or `region`).                                                        |
+| `INVALID_INPUT`          | Missing / malformed `brandNickname` or `inputId`.                                                                            |
+| `JWKS_FETCH_FAILED`      | Could not reach the JWKS endpoint, or the endpoint returned a non-2xx HTTP status.                                           |
+| `JWKS_INVALID`           | The JWKS body was not valid JSON, or did not contain a `keys` array.                                                         |
+| `NO_MATCHING_KEY`        | The JWKS contains no key with the `kid-{region}-` prefix matching the pinned `alg`/`kty`/`crv` tuple (see _Security model_). |
+| `ENCRYPTION_FAILED`      | The JWE could not be produced (key import or encryption step threw).                                                         |
+| `NAVIGATION_UNAVAILABLE` | `redirect()` was called outside a browser context.                                                                           |
+```ts
+import { AddToKlarnaError, isAddToKlarnaError } from "@klarna/add-to-klarna";
+try {
+  await klarna.redirect({ brandNickname, inputId });
+} catch (err) {
+  if (isAddToKlarnaError(err) && err.code === "JWKS_FETCH_FAILED") {
+    // Show a connectivity error UI.
+  } else {
+    throw err;
+  }
+}
+```
+## Development setup
+```bash
+yarn install
+yarn test         # jest, one shot
+yarn test:watch   # jest, watch mode
+yarn typecheck    # tsc --noEmit
+yarn lint
+yarn build        # tsup → ESM + CJS + .d.ts in dist/
+```
+Tests use [Jest](https://jestjs.io/) with `ts-jest`'s ESM preset. They mock
+`globalThis.fetch`, `Date.now` and `globalThis.crypto.randomUUID` via
+`jest.spyOn` / `jest.fn` rather than relying on dependency injection.
+## Release History
+See our [changelog](CHANGELOG.md).
+## License
+Copyright © 2026 Klarna Bank AB
+Licensed under the [Apache License, Version 2.0](./LICENSE). For license details, see the [LICENSE](LICENSE) file in the root of this project.
+<!-- Markdown link & img dfn's -->
+[ci-image]: https://img.shields.io/badge/build-passing-brightgreen?style=flat-square
+[ci-url]: https://github.com/klarna-incubator/TODO
+[license-image]: https://img.shields.io/badge/license-Apache%202-blue?style=flat-square
+[license-url]: http://www.apache.org/licenses/LICENSE-2.0
+[klarna-image]: https://img.shields.io/badge/%20-Developed%20at%20Klarna-black?style=flat-square&labelColor=ffb3c7&logo=klarna&logoColor=black
+[klarna-url]: https://klarna.github.io

package/dist/index.cjs ADDED Viewed

@@ -0,0 +1,208 @@
+'use strict';
+var jose = require('jose');
+// src/errors.ts
+var AddToKlarnaError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "AddToKlarnaError";
+    this.code = code;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function isAddToKlarnaError(err) {
+  return err instanceof AddToKlarnaError;
+}
+// src/utils.ts
+function toBase64Url(input) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(input, "utf8").toString("base64url");
+  }
+  const bytes = new TextEncoder().encode(input);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+// src/buildLinkUrl.ts
+function buildLinkUrl(baseUrl, brandNickname, jweCompact) {
+  if (typeof brandNickname !== "string" || brandNickname.length === 0) {
+    throw new AddToKlarnaError("INVALID_INPUT", "`brandNickname` must be a non-empty string.");
+  }
+  if (/[\s/?#]/.test(brandNickname)) {
+    throw new AddToKlarnaError(
+      "INVALID_INPUT",
+      `\`brandNickname\` contains invalid characters (whitespace, "/", "?" or "#"): ${brandNickname}`
+    );
+  }
+  if (typeof jweCompact !== "string" || jweCompact.length === 0) {
+    throw new AddToKlarnaError("ENCRYPTION_FAILED", "Empty JWE returned from encryptor.");
+  }
+  const encryptedPayload = toBase64Url(jweCompact);
+  return `${baseUrl}/${encodeURIComponent(brandNickname)}/${encryptedPayload}`;
+}
+// src/buildPayload.ts
+function buildPayload(inputId) {
+  if (typeof inputId !== "string" || inputId.length === 0) {
+    throw new AddToKlarnaError("INVALID_INPUT", "`inputId` must be a non-empty string.");
+  }
+  return {
+    inputId,
+    linkId: globalThis.crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3)
+  };
+}
+// src/config.ts
+var JWKS_URLS = {
+  production: "https://app.klarna.com/.well-known/jwks.json",
+  staging: "https://eu-non-production-klarna-static-assets.s3.eu-west-1.amazonaws.com/klapp/.well-known/jwks.json"
+};
+var LINK_BASE_URLS = {
+  production: "https://app.klarna.com/loyalty-cards-v2/add-to-klarna",
+  staging: "klarnadev://loyalty-cards-v2/add-to-klarna"
+};
+function resolveConfig(options) {
+  const { environment = "production", region } = options ?? {};
+  if (environment !== "production" && environment !== "staging") {
+    throw new AddToKlarnaError(
+      "INVALID_CONFIG",
+      `Unknown environment: ${String(environment)}. Expected "production" or "staging".`
+    );
+  }
+  if (region !== "eu" && region !== "us" && region !== "ap") {
+    throw new AddToKlarnaError(
+      "INVALID_CONFIG",
+      `Unknown region: ${String(region)}. Expected "eu", "us" or "ap".`
+    );
+  }
+  return {
+    jwksUrl: JWKS_URLS[environment],
+    linkBaseUrl: LINK_BASE_URLS[environment],
+    region
+  };
+}
+var ALG = "ECDH-ES+A256KW";
+var ENC = "A256GCM";
+async function encryptJwe(payload, key) {
+  let imported;
+  try {
+    imported = await jose.importJWK(key, ALG);
+  } catch (cause) {
+    throw new AddToKlarnaError(
+      "ENCRYPTION_FAILED",
+      `Could not import JWK with kid="${key.kid}" for alg="${ALG}".`,
+      { cause }
+    );
+  }
+  try {
+    return await new jose.EncryptJWT({
+      inputId: payload.inputId,
+      linkId: payload.linkId
+    }).setProtectedHeader({
+      alg: ALG,
+      enc: ENC,
+      kid: key.kid,
+      typ: "JWT",
+      cty: "application/json"
+    }).setIssuedAt(payload.iat).encrypt(imported);
+  } catch (cause) {
+    throw new AddToKlarnaError("ENCRYPTION_FAILED", `JWE encryption failed for kid="${key.kid}".`, {
+      cause
+    });
+  }
+}
+// src/jwksClient.ts
+var REQUIRED_KTY = "EC";
+var REQUIRED_CRV = "P-256";
+async function fetchJwks(url) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+  } catch (cause) {
+    throw new AddToKlarnaError("JWKS_FETCH_FAILED", `Failed to fetch JWKS from ${url}`, { cause });
+  }
+  if (!response.ok) {
+    throw new AddToKlarnaError(
+      "JWKS_FETCH_FAILED",
+      `JWKS fetch returned HTTP ${response.status} ${response.statusText} for ${url}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (cause) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS response body was not valid JSON.", { cause });
+  }
+  return assertJwks(body);
+}
+function pickEncryptionKey(jwks, region) {
+  const prefix = `kid-${region}-`;
+  const chosen = jwks.keys.find(
+    (k) => k.use === "enc" && typeof k.kid === "string" && k.kid.startsWith(prefix) && k.alg === ALG && k.kty === REQUIRED_KTY && k.crv === REQUIRED_CRV
+  );
+  if (!chosen || typeof chosen.kid !== "string") {
+    throw new AddToKlarnaError(
+      "NO_MATCHING_KEY",
+      `JWKS contains no usable encryption key with kid prefix "${prefix}" (need use="enc", alg="${ALG}", kty="${REQUIRED_KTY}", crv="${REQUIRED_CRV}").`
+    );
+  }
+  return chosen;
+}
+function assertJwks(body) {
+  if (!body || typeof body !== "object" || !("keys" in body)) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS response is missing a `keys` array.");
+  }
+  const keys = body.keys;
+  if (!Array.isArray(keys)) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS `keys` is not an array.");
+  }
+  return { keys };
+}
+// src/client.ts
+function createAddToKlarnaClient(options) {
+  const config = resolveConfig(options);
+  async function buildLink(input) {
+    if (!input || typeof input !== "object") {
+      throw new AddToKlarnaError(
+        "INVALID_INPUT",
+        "buildLink() requires an object with `brandNickname` and `inputId`."
+      );
+    }
+    const payload = buildPayload(input.inputId);
+    const jwks = await fetchJwks(config.jwksUrl);
+    const key = pickEncryptionKey(jwks, config.region);
+    const jwe = await encryptJwe(payload, key);
+    return buildLinkUrl(config.linkBaseUrl, input.brandNickname, jwe);
+  }
+  async function redirect(input) {
+    const url = await buildLink(input);
+    const w = globalThis.window;
+    const assign = w?.location?.assign;
+    if (typeof assign !== "function") {
+      throw new AddToKlarnaError(
+        "NAVIGATION_UNAVAILABLE",
+        "redirect() requires a browser context with `window.location.assign`. Use buildLink() and navigate yourself in non-browser environments."
+      );
+    }
+    assign.call(w.location, url);
+  }
+  return { buildLink, redirect };
+}
+exports.AddToKlarnaError = AddToKlarnaError;
+exports.createAddToKlarnaClient = createAddToKlarnaClient;
+exports.isAddToKlarnaError = isAddToKlarnaError;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/errors.ts","../src/utils.ts","../src/buildLinkUrl.ts","../src/buildPayload.ts","../src/config.ts","../src/encryptJwe.ts","../src/jwksClient.ts","../src/client.ts"],"names":["importJWK","EncryptJWT"],"mappings":";;;;;AAkBO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAiB,OAAA,EAAiB,OAAA,EAA+B;AAC3E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAEZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,SAAS,mBAAmB,GAAA,EAAuC;AACxE,EAAA,OAAO,GAAA,YAAe,gBAAA;AACxB;;;ACxBO,SAAS,YAAY,KAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,IAAA,OAAO,OAAO,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAA,IAAU,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACJO,SAAS,YAAA,CAAa,OAAA,EAAiB,aAAA,EAAuB,UAAA,EAA4B;AAC/F,EAAA,IAAI,OAAO,aAAA,KAAkB,QAAA,IAAY,aAAA,CAAc,WAAW,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,gBAAA,CAAiB,eAAA,EAAiB,6CAA6C,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,SAAA,CAAU,IAAA,CAAK,aAAa,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,eAAA;AAAA,MACA,gFAAgF,aAAa,CAAA;AAAA,KAC/F;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,CAAA,EAAG;AAC7D,IAAA,MAAM,IAAI,gBAAA,CAAiB,mBAAA,EAAqB,oCAAoC,CAAA;AAAA,EACtF;AACA,EAAA,MAAM,gBAAA,GAAmB,YAAY,UAAU,CAAA;AAC/C,EAAA,OAAO,GAAG,OAAO,CAAA,CAAA,EAAI,mBAAmB,aAAa,CAAC,IAAI,gBAAgB,CAAA,CAAA;AAC5E;;;ACpBO,SAAS,aAAa,OAAA,EAAmC;AAC9D,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,WAAW,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,gBAAA,CAAiB,eAAA,EAAiB,uCAAuC,CAAA;AAAA,EACrF;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,MAAA,EAAQ,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW;AAAA,IACrC,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI;AAAA,GACnC;AACF;;;ACAA,IAAM,SAAA,GAAyC;AAAA,EAC7C,UAAA,EAAY,8CAAA;AAAA,EACZ,OAAA,EACE;AACJ,CAAA;AAUA,IAAM,cAAA,GAA8C;AAAA,EAClD,UAAA,EAAY,uDAAA;AAAA,EACZ,OAAA,EAAS;AACX,CAAA;AASO,SAAS,cAAc,OAAA,EAAwC;AACpE,EAAA,MAAM,EAAE,WAAA,GAAc,YAAA,EAAc,MAAA,EAAO,GAAI,WAAY,EAAC;AAE5D,EAAA,IAAI,WAAA,KAAgB,YAAA,IAAgB,WAAA,KAAgB,SAAA,EAAW;AAC7D,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,gBAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,MAAA,CAAO,WAAW,CAAC,CAAA,qCAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,IAAA,IAAQ,WAAW,IAAA,EAAM;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,gBAAA;AAAA,MACA,CAAA,gBAAA,EAAmB,MAAA,CAAO,MAAM,CAAC,CAAA,8BAAA;AAAA,KACnC;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAU,WAAW,CAAA;AAAA,IAC9B,WAAA,EAAa,eAAe,WAAW,CAAA;AAAA,IACvC;AAAA,GACF;AACF;ACjDO,IAAM,GAAA,GAAM,gBAAA;AACZ,IAAM,GAAA,GAAM,SAAA;AAMnB,eAAsB,UAAA,CACpB,SACA,GAAA,EACiB;AACjB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAMA,cAAA,CAAU,GAAA,EAAK,GAAG,CAAA;AAAA,EACrC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,+BAAA,EAAkC,GAAA,CAAI,GAAG,CAAA,WAAA,EAAc,GAAG,CAAA,EAAA,CAAA;AAAA,MAC1D,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAIC,eAAA,CAAW;AAAA,MAC1B,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,QAAQ,OAAA,CAAQ;AAAA,KACjB,EACE,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAK,GAAA;AAAA,MACL,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,CAAI,GAAA;AAAA,MACT,GAAA,EAAK,KAAA;AAAA,MACL,GAAA,EAAK;AAAA,KACN,CAAA,CACA,WAAA,CAAY,QAAQ,GAAG,CAAA,CACvB,QAAQ,QAAQ,CAAA;AAAA,EACrB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA,CAAiB,mBAAA,EAAqB,CAAA,+BAAA,EAAkC,GAAA,CAAI,GAAG,CAAA,EAAA,CAAA,EAAM;AAAA,MAC7F;AAAA,KACD,CAAA;AAAA,EACH;AACF;;;AC7BA,IAAM,YAAA,GAAe,IAAA;AACrB,IAAM,YAAA,GAAe,OAAA;AAOrB,eAAsB,UAAU,GAAA,EAA4B;AAC1D,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,MAAM,GAAA,EAAK;AAAA,MAC1B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,KACvC,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,iBAAiB,mBAAA,EAAqB,CAAA,0BAAA,EAA6B,GAAG,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAAA,EAC/F;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,mBAAA;AAAA,MACA,4BAA4B,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,UAAU,QAAQ,GAAG,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,wCAAA,EAA0C,EAAE,OAAO,CAAA;AAAA,EAChG;AAEA,EAAA,OAAO,WAAW,IAAI,CAAA;AACxB;AAeO,SAAS,iBAAA,CAAkB,MAAY,MAAA,EAAuC;AACnF,EAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA,CAAA,CAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,CAAK,IAAA;AAAA,IACvB,CAAC,MACC,CAAA,CAAE,GAAA,KAAQ,SACV,OAAO,CAAA,CAAE,QAAQ,QAAA,IACjB,CAAA,CAAE,IAAI,UAAA,CAAW,MAAM,KACvB,CAAA,CAAE,GAAA,KAAQ,OACV,CAAA,CAAE,GAAA,KAAQ,YAAA,IACV,CAAA,CAAE,GAAA,KAAQ;AAAA,GACd;AAEA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,QAAQ,QAAA,EAAU;AAC7C,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,iBAAA;AAAA,MACA,2DAA2D,MAAM,CAAA,wBAAA,EACtC,GAAG,CAAA,QAAA,EAAW,YAAY,WAAW,YAAY,CAAA,GAAA;AAAA,KAC9E;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,WAAW,IAAA,EAAqB;AACvC,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,SAAS,QAAA,IAAY,EAAE,UAAU,IAAA,CAAA,EAAO;AAC1D,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,0CAA0C,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,OAAQ,IAAA,CAA2B,IAAA;AACzC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,8BAA8B,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,EAAE,IAAA,EAA2B;AACtC;;;AC3FO,SAAS,wBAAwB,OAAA,EAA2C;AACjF,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,eAAe,UAAU,KAAA,EAAwC;AAC/D,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR,eAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AAC3C,IAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA;AACzC,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,WAAA,EAAa,KAAA,CAAM,eAAe,GAAG,CAAA;AAAA,EAClE;AAEA,EAAA,eAAe,SAAS,KAAA,EAAsC;AAC5D,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,KAAK,CAAA;AACjC,IAAA,MAAM,IAAK,UAAA,CAA4E,MAAA;AACvF,IAAA,MAAM,MAAA,GAAS,GAAG,QAAA,EAAU,MAAA;AAC5B,IAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,CAAG,QAAA,EAAU,GAAG,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,EAAE,WAAW,QAAA,EAAS;AAC/B","file":"index.cjs","sourcesContent":["/**\n * Stable error codes. Merchant integrations should branch on these, not on\n * the human-readable message.\n */\nexport type ErrorCode =\n | \"INVALID_INPUT\"\n | \"INVALID_CONFIG\"\n | \"JWKS_FETCH_FAILED\"\n | \"JWKS_INVALID\"\n | \"NO_MATCHING_KEY\"\n | \"ENCRYPTION_FAILED\"\n | \"NAVIGATION_UNAVAILABLE\";\n\n/**\n * The single error type thrown by every public API in this package. Always\n * carries a stable {@link ErrorCode} on `code` and, where relevant, the\n * underlying error on `cause`.\n */\nexport class AddToKlarnaError extends Error {\n public readonly code: ErrorCode;\n\n constructor(code: ErrorCode, message: string, options?: { cause?: unknown }) {\n super(message, options);\n this.name = \"AddToKlarnaError\";\n this.code = code;\n // Restore prototype chain for ES5-targeted bundles. No-op on modern targets.\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\nexport function isAddToKlarnaError(err: unknown): err is AddToKlarnaError {\n return err instanceof AddToKlarnaError;\n}\n","/**\n * Encode a UTF-8 string as base64url, without padding. Works in both Node\n * and browsers.\n *\n * Used to wrap the JWE compact serialization into a single URL path segment\n * (without the wrap, the dots inside the JWE break path matching on Klarna's\n * web router).\n */\nexport function toBase64Url(input: string): string {\n if (typeof Buffer !== \"undefined\") {\n return Buffer.from(input, \"utf8\").toString(\"base64url\");\n }\n const bytes = new TextEncoder().encode(input);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]!);\n }\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Decode a base64url string back to UTF-8. Inverse of {@link toBase64Url}.\n * Exported mostly so tests can assert on the round-trip.\n */\nexport function fromBase64Url(input: string): string {\n const padded =\n input.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (input.length % 4)) % 4);\n\n if (typeof Buffer !== \"undefined\") {\n return Buffer.from(padded, \"base64\").toString(\"utf8\");\n }\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return new TextDecoder().decode(bytes);\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport { toBase64Url } from \"./utils.js\";\n\n/**\n * Compose the final universal-link URL:\n *\n * <baseUrl>/<brandNickname>/<encryptedSegment>\n *\n * `baseUrl` already includes the `/add-to-klarna` route segment (resolved in\n * {@link resolveConfig}). `encryptedSegment` is the JWE compact serialization\n * wrapped in a single base64url — the wrap is required by the Klarna web\n * router because the dots in the JWE compact form would otherwise break\n * path matching.\n */\nexport function buildLinkUrl(baseUrl: string, brandNickname: string, jweCompact: string): string {\n if (typeof brandNickname !== \"string\" || brandNickname.length === 0) {\n throw new AddToKlarnaError(\"INVALID_INPUT\", \"`brandNickname` must be a non-empty string.\");\n }\n if (/[\\s/?#]/.test(brandNickname)) {\n throw new AddToKlarnaError(\n \"INVALID_INPUT\",\n `\\`brandNickname\\` contains invalid characters (whitespace, \"/\", \"?\" or \"#\"): ${brandNickname}`,\n );\n }\n if (typeof jweCompact !== \"string\" || jweCompact.length === 0) {\n throw new AddToKlarnaError(\"ENCRYPTION_FAILED\", \"Empty JWE returned from encryptor.\");\n }\n const encryptedPayload = toBase64Url(jweCompact);\n return `${baseUrl}/${encodeURIComponent(brandNickname)}/${encryptedPayload}`;\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport type { DecryptedPayload } from \"./types.js\";\n\n/**\n * Build the plaintext payload that goes inside the JWE.\n *\n * The schema is `{ inputId, linkId, iat }`. Klarna's backend validates this\n * shape on decryption, so the field names and types must remain stable.\n */\nexport function buildPayload(inputId: string): DecryptedPayload {\n if (typeof inputId !== \"string\" || inputId.length === 0) {\n throw new AddToKlarnaError(\"INVALID_INPUT\", \"`inputId` must be a non-empty string.\");\n }\n return {\n inputId,\n linkId: globalThis.crypto.randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n };\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport type { ClientOptions, Environment, Region } from \"./types.js\";\n\n/**\n * Resolved configuration used internally. Everything has been collapsed down\n * to concrete strings by the time we construct one.\n */\nexport interface ResolvedConfig {\n jwksUrl: string;\n linkBaseUrl: string;\n region: Region;\n}\n\n/**\n * JWKS endpoints per environment. **Independent of region.** Every published\n * JWKS file contains keys for every region, namespaced by a `kid-{region}-`\n * prefix; the picker selects the right one.\n */\nconst JWKS_URLS: Record<Environment, string> = {\n production: \"https://app.klarna.com/.well-known/jwks.json\",\n staging:\n \"https://eu-non-production-klarna-static-assets.s3.eu-west-1.amazonaws.com/klapp/.well-known/jwks.json\",\n};\n\n/**\n * Base URLs for the universal link. The final URL appended is:\n *\n * <base>/<brandNickname>/<encryptedPayload>\n *\n * Production uses an HTTPS Universal Link. Staging uses the dev custom scheme\n * so taps open the staging app build directly.\n */\nconst LINK_BASE_URLS: Record<Environment, string> = {\n production: \"https://app.klarna.com/loyalty-cards-v2/add-to-klarna\",\n staging: \"klarnadev://loyalty-cards-v2/add-to-klarna\",\n};\n\n/**\n * Resolve user-facing client options into a concrete config.\n *\n * Validates inputs up-front so any misconfiguration surfaces as an\n * `INVALID_CONFIG` `AddToKlarnaError` *before* the merchant page issues any\n * network calls.\n */\nexport function resolveConfig(options: ClientOptions): ResolvedConfig {\n const { environment = \"production\", region } = options ?? ({} as ClientOptions);\n\n if (environment !== \"production\" && environment !== \"staging\") {\n throw new AddToKlarnaError(\n \"INVALID_CONFIG\",\n `Unknown environment: ${String(environment)}. Expected \"production\" or \"staging\".`,\n );\n }\n if (region !== \"eu\" && region !== \"us\" && region !== \"ap\") {\n throw new AddToKlarnaError(\n \"INVALID_CONFIG\",\n `Unknown region: ${String(region)}. Expected \"eu\", \"us\" or \"ap\".`,\n );\n }\n\n return {\n jwksUrl: JWKS_URLS[environment],\n linkBaseUrl: LINK_BASE_URLS[environment],\n region,\n };\n}\n","import { EncryptJWT, importJWK, type JWK } from \"jose\";\n\nimport { AddToKlarnaError } from \"./errors.js\";\nimport type { DecryptedPayload } from \"./types.js\";\n\n/**\n * The JWE profile this library produces. Pinned end-to-end:\n *\n * - `ALG` (key-encryption algorithm)\n * - `ENC` (content-encryption algorithm)\n *\n * `pickEncryptionKey` enforces the matching `kty`/`crv` on the JWKS side,\n * so a JWKS that drifts off this profile fails closed with `NO_MATCHING_KEY`\n * instead of silently producing a non-decryptable link. Changing either\n * constant is an SDK-coordinated event with Klarna's backend.\n */\nexport const ALG = \"ECDH-ES+A256KW\";\nexport const ENC = \"A256GCM\";\n\n/**\n * Encrypt the plaintext payload as a JWE using the given JWK. Produces the\n * compact serialization (five dot-separated base64url segments).\n */\nexport async function encryptJwe(\n payload: DecryptedPayload,\n key: JWK & { kid: string },\n): Promise<string> {\n let imported: Awaited<ReturnType<typeof importJWK>>;\n try {\n imported = await importJWK(key, ALG);\n } catch (cause) {\n throw new AddToKlarnaError(\n \"ENCRYPTION_FAILED\",\n `Could not import JWK with kid=\"${key.kid}\" for alg=\"${ALG}\".`,\n { cause },\n );\n }\n\n try {\n return await new EncryptJWT({\n inputId: payload.inputId,\n linkId: payload.linkId,\n })\n .setProtectedHeader({\n alg: ALG,\n enc: ENC,\n kid: key.kid,\n typ: \"JWT\",\n cty: \"application/json\",\n })\n .setIssuedAt(payload.iat)\n .encrypt(imported);\n } catch (cause) {\n throw new AddToKlarnaError(\"ENCRYPTION_FAILED\", `JWE encryption failed for kid=\"${key.kid}\".`, {\n cause,\n });\n }\n}\n","import type { JWK } from \"jose\";\n\nimport { ALG } from \"./encryptJwe.js\";\nimport { AddToKlarnaError } from \"./errors.js\";\nimport type { Region } from \"./types.js\";\n\n/**\n * The minimal JWKS shape we depend on. The actual file may contain extra\n * fields per RFC 7517; we ignore everything we do not need.\n */\nexport interface Jwks {\n keys: Array<JWK & { kid?: string; alg?: string; use?: string }>;\n}\n\n/**\n * The single key shape this library accepts off the JWKS. Pinned to the\n * tuple Klarna's backend publishes today:\n *\n * alg = ECDH-ES+A256KW\n * kty = EC\n * crv = P-256\n *\n * Anything else is rejected with `NO_MATCHING_KEY`, so a JWKS that ever\n * drifts off this profile — whether by mistake or because someone\n * managed to substitute it past TLS — fails closed instead of\n * silently using a weaker or symmetric algorithm. Any change to this\n * tuple is an SDK-coordinated event with the backend.\n */\nconst REQUIRED_KTY = \"EC\";\nconst REQUIRED_CRV = \"P-256\";\n\n/**\n * Fetch and parse the JWKS at `url`. There is no in-memory cache — caching is\n * delegated to the HTTP layer and Klarna's CDN. Wraps every failure mode in\n * a typed `AddToKlarnaError`.\n */\nexport async function fetchJwks(url: string): Promise<Jwks> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: \"GET\",\n headers: { Accept: \"application/json\" },\n });\n } catch (cause) {\n throw new AddToKlarnaError(\"JWKS_FETCH_FAILED\", `Failed to fetch JWKS from ${url}`, { cause });\n }\n\n if (!response.ok) {\n throw new AddToKlarnaError(\n \"JWKS_FETCH_FAILED\",\n `JWKS fetch returned HTTP ${response.status} ${response.statusText} for ${url}`,\n );\n }\n\n let body: unknown;\n try {\n body = await response.json();\n } catch (cause) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS response body was not valid JSON.\", { cause });\n }\n\n return assertJwks(body);\n}\n\n/**\n * Pick the encryption key for `region` from a JWKS document.\n *\n * A key is usable iff it declares all of:\n *\n * - `use === \"enc\"`\n * - `kid` starting with `kid-{region}-`\n * - `alg === ALG`, `kty === \"EC\"`, `crv === \"P-256\"` (see file header)\n *\n * If multiple keys match, the first one in document order wins — the JWKS\n * is published with the most recent key first. Throws `NO_MATCHING_KEY`\n * when nothing matches.\n */\nexport function pickEncryptionKey(jwks: Jwks, region: Region): JWK & { kid: string } {\n const prefix = `kid-${region}-`;\n const chosen = jwks.keys.find(\n (k) =>\n k.use === \"enc\" &&\n typeof k.kid === \"string\" &&\n k.kid.startsWith(prefix) &&\n k.alg === ALG &&\n k.kty === REQUIRED_KTY &&\n k.crv === REQUIRED_CRV,\n );\n\n if (!chosen || typeof chosen.kid !== \"string\") {\n throw new AddToKlarnaError(\n \"NO_MATCHING_KEY\",\n `JWKS contains no usable encryption key with kid prefix \"${prefix}\" ` +\n `(need use=\"enc\", alg=\"${ALG}\", kty=\"${REQUIRED_KTY}\", crv=\"${REQUIRED_CRV}\").`,\n );\n }\n return chosen as JWK & { kid: string };\n}\n\nfunction assertJwks(body: unknown): Jwks {\n if (!body || typeof body !== \"object\" || !(\"keys\" in body)) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS response is missing a `keys` array.\");\n }\n const keys = (body as { keys: unknown }).keys;\n if (!Array.isArray(keys)) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS `keys` is not an array.\");\n }\n return { keys: keys as Jwks[\"keys\"] };\n}\n","import { buildLinkUrl } from \"./buildLinkUrl.js\";\nimport { buildPayload } from \"./buildPayload.js\";\nimport { resolveConfig } from \"./config.js\";\nimport { encryptJwe } from \"./encryptJwe.js\";\nimport { AddToKlarnaError } from \"./errors.js\";\nimport { fetchJwks, pickEncryptionKey } from \"./jwksClient.js\";\nimport type { AddToKlarnaClient, BuildLinkInput, ClientOptions } from \"./types.js\";\n\n/**\n * Create an Add-to-Klarna client.\n *\n * Construction is cheap and synchronous: it validates options and wires up\n * the pipeline. The first network call happens on the first\n * {@link AddToKlarnaClient.buildLink} / {@link AddToKlarnaClient.redirect}.\n * Every `buildLink` re-fetches the JWKS — caching is handled by the HTTP\n * layer and Klarna's CDN, not in memory.\n */\nexport function createAddToKlarnaClient(options: ClientOptions): AddToKlarnaClient {\n const config = resolveConfig(options);\n\n async function buildLink(input: BuildLinkInput): Promise<string> {\n if (!input || typeof input !== \"object\") {\n throw new AddToKlarnaError(\n \"INVALID_INPUT\",\n \"buildLink() requires an object with `brandNickname` and `inputId`.\",\n );\n }\n const payload = buildPayload(input.inputId);\n const jwks = await fetchJwks(config.jwksUrl);\n const key = pickEncryptionKey(jwks, config.region);\n const jwe = await encryptJwe(payload, key);\n return buildLinkUrl(config.linkBaseUrl, input.brandNickname, jwe);\n }\n\n async function redirect(input: BuildLinkInput): Promise<void> {\n const url = await buildLink(input);\n const w = (globalThis as { window?: { location?: { assign?: (u: string) => void } } }).window;\n const assign = w?.location?.assign;\n if (typeof assign !== \"function\") {\n throw new AddToKlarnaError(\n \"NAVIGATION_UNAVAILABLE\",\n \"redirect() requires a browser context with `window.location.assign`. Use buildLink() and navigate yourself in non-browser environments.\",\n );\n }\n assign.call(w!.location, url);\n }\n\n return { buildLink, redirect };\n}\n"]}

package/dist/index.d.cts ADDED Viewed

@@ -0,0 +1,100 @@
+/**
+ * The Klarna deployment region the link should target. Selects which key the
+ * library picks out of the JWKS (keys are namespaced via a `kid-{region}-`
+ * prefix). Does *not* change the JWKS URL or the universal-link host — both
+ * are determined solely by {@link Environment}.
+ */
+type Region = "eu" | "us" | "ap";
+/**
+ * The Klarna environment to target.
+ *
+ * - `production` — the production JWKS and universal-link host.
+ * - `staging` — the non-production JWKS and a custom URL scheme that opens
+ *   Klarna's staging app build. Use this for development and testing only.
+ */
+type Environment = "production" | "staging";
+/**
+ * Options accepted by {@link createAddToKlarnaClient}.
+ *
+ * Deliberately tiny: just where you are (environment) and which region's key
+ * to use. The JWKS endpoint and universal-link host are derived from
+ * `environment` alone — they are not configurable.
+ */
+interface ClientOptions {
+    environment?: Environment;
+    region: Region;
+}
+/**
+ * Inputs the merchant provides on every call.
+ */
+interface BuildLinkInput {
+    /**
+     * Klarna's canonical short identifier for the loyalty program. Case-sensitive.
+     * Must be non-empty and contain no whitespace, `/`, `?` or `#`.
+     */
+    brandNickname: string;
+    /**
+     * The merchant's identifier for this loyalty card holder — typically the
+     * loyalty card number. The value is encrypted before it leaves the merchant's
+     * browser; Klarna only decrypts it server-side.
+     */
+    inputId: string;
+}
+/**
+ * The public client surface.
+ */
+interface AddToKlarnaClient {
+    /**
+     * Build a universal link URL without navigating to it.
+     *
+     * Each call mints a fresh `linkId` and re-fetches the JWKS — no in-memory
+     * cache. Caching is delegated to the HTTP layer + Klarna's CDN.
+     */
+    buildLink(input: BuildLinkInput): Promise<string>;
+    /**
+     * Build a link and immediately navigate the current browser tab to it.
+     * Throws (without navigating) if any step fails. Only valid in a browser
+     * context where `window.location.assign` is available.
+     */
+    redirect(input: BuildLinkInput): Promise<void>;
+}
+/**
+ * The plaintext payload Klarna's backend decrypts and validates. Exported
+ * mostly for test fixtures; merchants do not need to construct this directly.
+ */
+interface DecryptedPayload {
+    inputId: string;
+    linkId: string;
+    iat: number;
+}
+/**
+ * Create an Add-to-Klarna client.
+ *
+ * Construction is cheap and synchronous: it validates options and wires up
+ * the pipeline. The first network call happens on the first
+ * {@link AddToKlarnaClient.buildLink} / {@link AddToKlarnaClient.redirect}.
+ * Every `buildLink` re-fetches the JWKS — caching is handled by the HTTP
+ * layer and Klarna's CDN, not in memory.
+ */
+declare function createAddToKlarnaClient(options: ClientOptions): AddToKlarnaClient;
+/**
+ * Stable error codes. Merchant integrations should branch on these, not on
+ * the human-readable message.
+ */
+type ErrorCode = "INVALID_INPUT" | "INVALID_CONFIG" | "JWKS_FETCH_FAILED" | "JWKS_INVALID" | "NO_MATCHING_KEY" | "ENCRYPTION_FAILED" | "NAVIGATION_UNAVAILABLE";
+/**
+ * The single error type thrown by every public API in this package. Always
+ * carries a stable {@link ErrorCode} on `code` and, where relevant, the
+ * underlying error on `cause`.
+ */
+declare class AddToKlarnaError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+declare function isAddToKlarnaError(err: unknown): err is AddToKlarnaError;
+export { type AddToKlarnaClient, AddToKlarnaError, type BuildLinkInput, type ClientOptions, type DecryptedPayload, type Environment, type ErrorCode, type Region, createAddToKlarnaClient, isAddToKlarnaError };

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,100 @@
+/**
+ * The Klarna deployment region the link should target. Selects which key the
+ * library picks out of the JWKS (keys are namespaced via a `kid-{region}-`
+ * prefix). Does *not* change the JWKS URL or the universal-link host — both
+ * are determined solely by {@link Environment}.
+ */
+type Region = "eu" | "us" | "ap";
+/**
+ * The Klarna environment to target.
+ *
+ * - `production` — the production JWKS and universal-link host.
+ * - `staging` — the non-production JWKS and a custom URL scheme that opens
+ *   Klarna's staging app build. Use this for development and testing only.
+ */
+type Environment = "production" | "staging";
+/**
+ * Options accepted by {@link createAddToKlarnaClient}.
+ *
+ * Deliberately tiny: just where you are (environment) and which region's key
+ * to use. The JWKS endpoint and universal-link host are derived from
+ * `environment` alone — they are not configurable.
+ */
+interface ClientOptions {
+    environment?: Environment;
+    region: Region;
+}
+/**
+ * Inputs the merchant provides on every call.
+ */
+interface BuildLinkInput {
+    /**
+     * Klarna's canonical short identifier for the loyalty program. Case-sensitive.
+     * Must be non-empty and contain no whitespace, `/`, `?` or `#`.
+     */
+    brandNickname: string;
+    /**
+     * The merchant's identifier for this loyalty card holder — typically the
+     * loyalty card number. The value is encrypted before it leaves the merchant's
+     * browser; Klarna only decrypts it server-side.
+     */
+    inputId: string;
+}
+/**
+ * The public client surface.
+ */
+interface AddToKlarnaClient {
+    /**
+     * Build a universal link URL without navigating to it.
+     *
+     * Each call mints a fresh `linkId` and re-fetches the JWKS — no in-memory
+     * cache. Caching is delegated to the HTTP layer + Klarna's CDN.
+     */
+    buildLink(input: BuildLinkInput): Promise<string>;
+    /**
+     * Build a link and immediately navigate the current browser tab to it.
+     * Throws (without navigating) if any step fails. Only valid in a browser
+     * context where `window.location.assign` is available.
+     */
+    redirect(input: BuildLinkInput): Promise<void>;
+}
+/**
+ * The plaintext payload Klarna's backend decrypts and validates. Exported
+ * mostly for test fixtures; merchants do not need to construct this directly.
+ */
+interface DecryptedPayload {
+    inputId: string;
+    linkId: string;
+    iat: number;
+}
+/**
+ * Create an Add-to-Klarna client.
+ *
+ * Construction is cheap and synchronous: it validates options and wires up
+ * the pipeline. The first network call happens on the first
+ * {@link AddToKlarnaClient.buildLink} / {@link AddToKlarnaClient.redirect}.
+ * Every `buildLink` re-fetches the JWKS — caching is handled by the HTTP
+ * layer and Klarna's CDN, not in memory.
+ */
+declare function createAddToKlarnaClient(options: ClientOptions): AddToKlarnaClient;
+/**
+ * Stable error codes. Merchant integrations should branch on these, not on
+ * the human-readable message.
+ */
+type ErrorCode = "INVALID_INPUT" | "INVALID_CONFIG" | "JWKS_FETCH_FAILED" | "JWKS_INVALID" | "NO_MATCHING_KEY" | "ENCRYPTION_FAILED" | "NAVIGATION_UNAVAILABLE";
+/**
+ * The single error type thrown by every public API in this package. Always
+ * carries a stable {@link ErrorCode} on `code` and, where relevant, the
+ * underlying error on `cause`.
+ */
+declare class AddToKlarnaError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+declare function isAddToKlarnaError(err: unknown): err is AddToKlarnaError;
+export { type AddToKlarnaClient, AddToKlarnaError, type BuildLinkInput, type ClientOptions, type DecryptedPayload, type Environment, type ErrorCode, type Region, createAddToKlarnaClient, isAddToKlarnaError };

package/dist/index.js ADDED Viewed

@@ -0,0 +1,204 @@
+import { importJWK, EncryptJWT } from 'jose';
+// src/errors.ts
+var AddToKlarnaError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "AddToKlarnaError";
+    this.code = code;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function isAddToKlarnaError(err) {
+  return err instanceof AddToKlarnaError;
+}
+// src/utils.ts
+function toBase64Url(input) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(input, "utf8").toString("base64url");
+  }
+  const bytes = new TextEncoder().encode(input);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+// src/buildLinkUrl.ts
+function buildLinkUrl(baseUrl, brandNickname, jweCompact) {
+  if (typeof brandNickname !== "string" || brandNickname.length === 0) {
+    throw new AddToKlarnaError("INVALID_INPUT", "`brandNickname` must be a non-empty string.");
+  }
+  if (/[\s/?#]/.test(brandNickname)) {
+    throw new AddToKlarnaError(
+      "INVALID_INPUT",
+      `\`brandNickname\` contains invalid characters (whitespace, "/", "?" or "#"): ${brandNickname}`
+    );
+  }
+  if (typeof jweCompact !== "string" || jweCompact.length === 0) {
+    throw new AddToKlarnaError("ENCRYPTION_FAILED", "Empty JWE returned from encryptor.");
+  }
+  const encryptedPayload = toBase64Url(jweCompact);
+  return `${baseUrl}/${encodeURIComponent(brandNickname)}/${encryptedPayload}`;
+}
+// src/buildPayload.ts
+function buildPayload(inputId) {
+  if (typeof inputId !== "string" || inputId.length === 0) {
+    throw new AddToKlarnaError("INVALID_INPUT", "`inputId` must be a non-empty string.");
+  }
+  return {
+    inputId,
+    linkId: globalThis.crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3)
+  };
+}
+// src/config.ts
+var JWKS_URLS = {
+  production: "https://app.klarna.com/.well-known/jwks.json",
+  staging: "https://eu-non-production-klarna-static-assets.s3.eu-west-1.amazonaws.com/klapp/.well-known/jwks.json"
+};
+var LINK_BASE_URLS = {
+  production: "https://app.klarna.com/loyalty-cards-v2/add-to-klarna",
+  staging: "klarnadev://loyalty-cards-v2/add-to-klarna"
+};
+function resolveConfig(options) {
+  const { environment = "production", region } = options ?? {};
+  if (environment !== "production" && environment !== "staging") {
+    throw new AddToKlarnaError(
+      "INVALID_CONFIG",
+      `Unknown environment: ${String(environment)}. Expected "production" or "staging".`
+    );
+  }
+  if (region !== "eu" && region !== "us" && region !== "ap") {
+    throw new AddToKlarnaError(
+      "INVALID_CONFIG",
+      `Unknown region: ${String(region)}. Expected "eu", "us" or "ap".`
+    );
+  }
+  return {
+    jwksUrl: JWKS_URLS[environment],
+    linkBaseUrl: LINK_BASE_URLS[environment],
+    region
+  };
+}
+var ALG = "ECDH-ES+A256KW";
+var ENC = "A256GCM";
+async function encryptJwe(payload, key) {
+  let imported;
+  try {
+    imported = await importJWK(key, ALG);
+  } catch (cause) {
+    throw new AddToKlarnaError(
+      "ENCRYPTION_FAILED",
+      `Could not import JWK with kid="${key.kid}" for alg="${ALG}".`,
+      { cause }
+    );
+  }
+  try {
+    return await new EncryptJWT({
+      inputId: payload.inputId,
+      linkId: payload.linkId
+    }).setProtectedHeader({
+      alg: ALG,
+      enc: ENC,
+      kid: key.kid,
+      typ: "JWT",
+      cty: "application/json"
+    }).setIssuedAt(payload.iat).encrypt(imported);
+  } catch (cause) {
+    throw new AddToKlarnaError("ENCRYPTION_FAILED", `JWE encryption failed for kid="${key.kid}".`, {
+      cause
+    });
+  }
+}
+// src/jwksClient.ts
+var REQUIRED_KTY = "EC";
+var REQUIRED_CRV = "P-256";
+async function fetchJwks(url) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      headers: { Accept: "application/json" }
+    });
+  } catch (cause) {
+    throw new AddToKlarnaError("JWKS_FETCH_FAILED", `Failed to fetch JWKS from ${url}`, { cause });
+  }
+  if (!response.ok) {
+    throw new AddToKlarnaError(
+      "JWKS_FETCH_FAILED",
+      `JWKS fetch returned HTTP ${response.status} ${response.statusText} for ${url}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (cause) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS response body was not valid JSON.", { cause });
+  }
+  return assertJwks(body);
+}
+function pickEncryptionKey(jwks, region) {
+  const prefix = `kid-${region}-`;
+  const chosen = jwks.keys.find(
+    (k) => k.use === "enc" && typeof k.kid === "string" && k.kid.startsWith(prefix) && k.alg === ALG && k.kty === REQUIRED_KTY && k.crv === REQUIRED_CRV
+  );
+  if (!chosen || typeof chosen.kid !== "string") {
+    throw new AddToKlarnaError(
+      "NO_MATCHING_KEY",
+      `JWKS contains no usable encryption key with kid prefix "${prefix}" (need use="enc", alg="${ALG}", kty="${REQUIRED_KTY}", crv="${REQUIRED_CRV}").`
+    );
+  }
+  return chosen;
+}
+function assertJwks(body) {
+  if (!body || typeof body !== "object" || !("keys" in body)) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS response is missing a `keys` array.");
+  }
+  const keys = body.keys;
+  if (!Array.isArray(keys)) {
+    throw new AddToKlarnaError("JWKS_INVALID", "JWKS `keys` is not an array.");
+  }
+  return { keys };
+}
+// src/client.ts
+function createAddToKlarnaClient(options) {
+  const config = resolveConfig(options);
+  async function buildLink(input) {
+    if (!input || typeof input !== "object") {
+      throw new AddToKlarnaError(
+        "INVALID_INPUT",
+        "buildLink() requires an object with `brandNickname` and `inputId`."
+      );
+    }
+    const payload = buildPayload(input.inputId);
+    const jwks = await fetchJwks(config.jwksUrl);
+    const key = pickEncryptionKey(jwks, config.region);
+    const jwe = await encryptJwe(payload, key);
+    return buildLinkUrl(config.linkBaseUrl, input.brandNickname, jwe);
+  }
+  async function redirect(input) {
+    const url = await buildLink(input);
+    const w = globalThis.window;
+    const assign = w?.location?.assign;
+    if (typeof assign !== "function") {
+      throw new AddToKlarnaError(
+        "NAVIGATION_UNAVAILABLE",
+        "redirect() requires a browser context with `window.location.assign`. Use buildLink() and navigate yourself in non-browser environments."
+      );
+    }
+    assign.call(w.location, url);
+  }
+  return { buildLink, redirect };
+}
+export { AddToKlarnaError, createAddToKlarnaClient, isAddToKlarnaError };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/errors.ts","../src/utils.ts","../src/buildLinkUrl.ts","../src/buildPayload.ts","../src/config.ts","../src/encryptJwe.ts","../src/jwksClient.ts","../src/client.ts"],"names":[],"mappings":";;;AAkBO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAiB,OAAA,EAAiB,OAAA,EAA+B;AAC3E,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAEZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,SAAS,mBAAmB,GAAA,EAAuC;AACxE,EAAA,OAAO,GAAA,YAAe,gBAAA;AACxB;;;ACxBO,SAAS,YAAY,KAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,IAAA,OAAO,OAAO,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAA,IAAU,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACJO,SAAS,YAAA,CAAa,OAAA,EAAiB,aAAA,EAAuB,UAAA,EAA4B;AAC/F,EAAA,IAAI,OAAO,aAAA,KAAkB,QAAA,IAAY,aAAA,CAAc,WAAW,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,gBAAA,CAAiB,eAAA,EAAiB,6CAA6C,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,SAAA,CAAU,IAAA,CAAK,aAAa,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,eAAA;AAAA,MACA,gFAAgF,aAAa,CAAA;AAAA,KAC/F;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,CAAA,EAAG;AAC7D,IAAA,MAAM,IAAI,gBAAA,CAAiB,mBAAA,EAAqB,oCAAoC,CAAA;AAAA,EACtF;AACA,EAAA,MAAM,gBAAA,GAAmB,YAAY,UAAU,CAAA;AAC/C,EAAA,OAAO,GAAG,OAAO,CAAA,CAAA,EAAI,mBAAmB,aAAa,CAAC,IAAI,gBAAgB,CAAA,CAAA;AAC5E;;;ACpBO,SAAS,aAAa,OAAA,EAAmC;AAC9D,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,WAAW,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,gBAAA,CAAiB,eAAA,EAAiB,uCAAuC,CAAA;AAAA,EACrF;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,MAAA,EAAQ,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW;AAAA,IACrC,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI;AAAA,GACnC;AACF;;;ACAA,IAAM,SAAA,GAAyC;AAAA,EAC7C,UAAA,EAAY,8CAAA;AAAA,EACZ,OAAA,EACE;AACJ,CAAA;AAUA,IAAM,cAAA,GAA8C;AAAA,EAClD,UAAA,EAAY,uDAAA;AAAA,EACZ,OAAA,EAAS;AACX,CAAA;AASO,SAAS,cAAc,OAAA,EAAwC;AACpE,EAAA,MAAM,EAAE,WAAA,GAAc,YAAA,EAAc,MAAA,EAAO,GAAI,WAAY,EAAC;AAE5D,EAAA,IAAI,WAAA,KAAgB,YAAA,IAAgB,WAAA,KAAgB,SAAA,EAAW;AAC7D,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,gBAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,MAAA,CAAO,WAAW,CAAC,CAAA,qCAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,IAAA,IAAQ,WAAW,IAAA,EAAM;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,gBAAA;AAAA,MACA,CAAA,gBAAA,EAAmB,MAAA,CAAO,MAAM,CAAC,CAAA,8BAAA;AAAA,KACnC;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAU,WAAW,CAAA;AAAA,IAC9B,WAAA,EAAa,eAAe,WAAW,CAAA;AAAA,IACvC;AAAA,GACF;AACF;ACjDO,IAAM,GAAA,GAAM,gBAAA;AACZ,IAAM,GAAA,GAAM,SAAA;AAMnB,eAAsB,UAAA,CACpB,SACA,GAAA,EACiB;AACjB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,EAAK,GAAG,CAAA;AAAA,EACrC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,+BAAA,EAAkC,GAAA,CAAI,GAAG,CAAA,WAAA,EAAc,GAAG,CAAA,EAAA,CAAA;AAAA,MAC1D,EAAE,KAAA;AAAM,KACV;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,UAAA,CAAW;AAAA,MAC1B,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,QAAQ,OAAA,CAAQ;AAAA,KACjB,EACE,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAK,GAAA;AAAA,MACL,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,CAAI,GAAA;AAAA,MACT,GAAA,EAAK,KAAA;AAAA,MACL,GAAA,EAAK;AAAA,KACN,CAAA,CACA,WAAA,CAAY,QAAQ,GAAG,CAAA,CACvB,QAAQ,QAAQ,CAAA;AAAA,EACrB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA,CAAiB,mBAAA,EAAqB,CAAA,+BAAA,EAAkC,GAAA,CAAI,GAAG,CAAA,EAAA,CAAA,EAAM;AAAA,MAC7F;AAAA,KACD,CAAA;AAAA,EACH;AACF;;;AC7BA,IAAM,YAAA,GAAe,IAAA;AACrB,IAAM,YAAA,GAAe,OAAA;AAOrB,eAAsB,UAAU,GAAA,EAA4B;AAC1D,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,MAAM,GAAA,EAAK;AAAA,MAC1B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,KACvC,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,iBAAiB,mBAAA,EAAqB,CAAA,0BAAA,EAA6B,GAAG,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAAA,EAC/F;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,mBAAA;AAAA,MACA,4BAA4B,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,UAAU,QAAQ,GAAG,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,wCAAA,EAA0C,EAAE,OAAO,CAAA;AAAA,EAChG;AAEA,EAAA,OAAO,WAAW,IAAI,CAAA;AACxB;AAeO,SAAS,iBAAA,CAAkB,MAAY,MAAA,EAAuC;AACnF,EAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA,CAAA,CAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,CAAK,IAAA;AAAA,IACvB,CAAC,MACC,CAAA,CAAE,GAAA,KAAQ,SACV,OAAO,CAAA,CAAE,QAAQ,QAAA,IACjB,CAAA,CAAE,IAAI,UAAA,CAAW,MAAM,KACvB,CAAA,CAAE,GAAA,KAAQ,OACV,CAAA,CAAE,GAAA,KAAQ,YAAA,IACV,CAAA,CAAE,GAAA,KAAQ;AAAA,GACd;AAEA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,QAAQ,QAAA,EAAU;AAC7C,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,iBAAA;AAAA,MACA,2DAA2D,MAAM,CAAA,wBAAA,EACtC,GAAG,CAAA,QAAA,EAAW,YAAY,WAAW,YAAY,CAAA,GAAA;AAAA,KAC9E;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,WAAW,IAAA,EAAqB;AACvC,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,SAAS,QAAA,IAAY,EAAE,UAAU,IAAA,CAAA,EAAO;AAC1D,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,0CAA0C,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,OAAQ,IAAA,CAA2B,IAAA;AACzC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,gBAAA,CAAiB,cAAA,EAAgB,8BAA8B,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,EAAE,IAAA,EAA2B;AACtC;;;AC3FO,SAAS,wBAAwB,OAAA,EAA2C;AACjF,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,eAAe,UAAU,KAAA,EAAwC;AAC/D,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR,eAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AAC3C,IAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA;AACzC,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,WAAA,EAAa,KAAA,CAAM,eAAe,GAAG,CAAA;AAAA,EAClE;AAEA,EAAA,eAAe,SAAS,KAAA,EAAsC;AAC5D,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,KAAK,CAAA;AACjC,IAAA,MAAM,IAAK,UAAA,CAA4E,MAAA;AACvF,IAAA,MAAM,MAAA,GAAS,GAAG,QAAA,EAAU,MAAA;AAC5B,IAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR,wBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,CAAG,QAAA,EAAU,GAAG,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,EAAE,WAAW,QAAA,EAAS;AAC/B","file":"index.js","sourcesContent":["/**\n * Stable error codes. Merchant integrations should branch on these, not on\n * the human-readable message.\n */\nexport type ErrorCode =\n | \"INVALID_INPUT\"\n | \"INVALID_CONFIG\"\n | \"JWKS_FETCH_FAILED\"\n | \"JWKS_INVALID\"\n | \"NO_MATCHING_KEY\"\n | \"ENCRYPTION_FAILED\"\n | \"NAVIGATION_UNAVAILABLE\";\n\n/**\n * The single error type thrown by every public API in this package. Always\n * carries a stable {@link ErrorCode} on `code` and, where relevant, the\n * underlying error on `cause`.\n */\nexport class AddToKlarnaError extends Error {\n public readonly code: ErrorCode;\n\n constructor(code: ErrorCode, message: string, options?: { cause?: unknown }) {\n super(message, options);\n this.name = \"AddToKlarnaError\";\n this.code = code;\n // Restore prototype chain for ES5-targeted bundles. No-op on modern targets.\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\nexport function isAddToKlarnaError(err: unknown): err is AddToKlarnaError {\n return err instanceof AddToKlarnaError;\n}\n","/**\n * Encode a UTF-8 string as base64url, without padding. Works in both Node\n * and browsers.\n *\n * Used to wrap the JWE compact serialization into a single URL path segment\n * (without the wrap, the dots inside the JWE break path matching on Klarna's\n * web router).\n */\nexport function toBase64Url(input: string): string {\n if (typeof Buffer !== \"undefined\") {\n return Buffer.from(input, \"utf8\").toString(\"base64url\");\n }\n const bytes = new TextEncoder().encode(input);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]!);\n }\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Decode a base64url string back to UTF-8. Inverse of {@link toBase64Url}.\n * Exported mostly so tests can assert on the round-trip.\n */\nexport function fromBase64Url(input: string): string {\n const padded =\n input.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (input.length % 4)) % 4);\n\n if (typeof Buffer !== \"undefined\") {\n return Buffer.from(padded, \"base64\").toString(\"utf8\");\n }\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return new TextDecoder().decode(bytes);\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport { toBase64Url } from \"./utils.js\";\n\n/**\n * Compose the final universal-link URL:\n *\n * <baseUrl>/<brandNickname>/<encryptedSegment>\n *\n * `baseUrl` already includes the `/add-to-klarna` route segment (resolved in\n * {@link resolveConfig}). `encryptedSegment` is the JWE compact serialization\n * wrapped in a single base64url — the wrap is required by the Klarna web\n * router because the dots in the JWE compact form would otherwise break\n * path matching.\n */\nexport function buildLinkUrl(baseUrl: string, brandNickname: string, jweCompact: string): string {\n if (typeof brandNickname !== \"string\" || brandNickname.length === 0) {\n throw new AddToKlarnaError(\"INVALID_INPUT\", \"`brandNickname` must be a non-empty string.\");\n }\n if (/[\\s/?#]/.test(brandNickname)) {\n throw new AddToKlarnaError(\n \"INVALID_INPUT\",\n `\\`brandNickname\\` contains invalid characters (whitespace, \"/\", \"?\" or \"#\"): ${brandNickname}`,\n );\n }\n if (typeof jweCompact !== \"string\" || jweCompact.length === 0) {\n throw new AddToKlarnaError(\"ENCRYPTION_FAILED\", \"Empty JWE returned from encryptor.\");\n }\n const encryptedPayload = toBase64Url(jweCompact);\n return `${baseUrl}/${encodeURIComponent(brandNickname)}/${encryptedPayload}`;\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport type { DecryptedPayload } from \"./types.js\";\n\n/**\n * Build the plaintext payload that goes inside the JWE.\n *\n * The schema is `{ inputId, linkId, iat }`. Klarna's backend validates this\n * shape on decryption, so the field names and types must remain stable.\n */\nexport function buildPayload(inputId: string): DecryptedPayload {\n if (typeof inputId !== \"string\" || inputId.length === 0) {\n throw new AddToKlarnaError(\"INVALID_INPUT\", \"`inputId` must be a non-empty string.\");\n }\n return {\n inputId,\n linkId: globalThis.crypto.randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n };\n}\n","import { AddToKlarnaError } from \"./errors.js\";\nimport type { ClientOptions, Environment, Region } from \"./types.js\";\n\n/**\n * Resolved configuration used internally. Everything has been collapsed down\n * to concrete strings by the time we construct one.\n */\nexport interface ResolvedConfig {\n jwksUrl: string;\n linkBaseUrl: string;\n region: Region;\n}\n\n/**\n * JWKS endpoints per environment. **Independent of region.** Every published\n * JWKS file contains keys for every region, namespaced by a `kid-{region}-`\n * prefix; the picker selects the right one.\n */\nconst JWKS_URLS: Record<Environment, string> = {\n production: \"https://app.klarna.com/.well-known/jwks.json\",\n staging:\n \"https://eu-non-production-klarna-static-assets.s3.eu-west-1.amazonaws.com/klapp/.well-known/jwks.json\",\n};\n\n/**\n * Base URLs for the universal link. The final URL appended is:\n *\n * <base>/<brandNickname>/<encryptedPayload>\n *\n * Production uses an HTTPS Universal Link. Staging uses the dev custom scheme\n * so taps open the staging app build directly.\n */\nconst LINK_BASE_URLS: Record<Environment, string> = {\n production: \"https://app.klarna.com/loyalty-cards-v2/add-to-klarna\",\n staging: \"klarnadev://loyalty-cards-v2/add-to-klarna\",\n};\n\n/**\n * Resolve user-facing client options into a concrete config.\n *\n * Validates inputs up-front so any misconfiguration surfaces as an\n * `INVALID_CONFIG` `AddToKlarnaError` *before* the merchant page issues any\n * network calls.\n */\nexport function resolveConfig(options: ClientOptions): ResolvedConfig {\n const { environment = \"production\", region } = options ?? ({} as ClientOptions);\n\n if (environment !== \"production\" && environment !== \"staging\") {\n throw new AddToKlarnaError(\n \"INVALID_CONFIG\",\n `Unknown environment: ${String(environment)}. Expected \"production\" or \"staging\".`,\n );\n }\n if (region !== \"eu\" && region !== \"us\" && region !== \"ap\") {\n throw new AddToKlarnaError(\n \"INVALID_CONFIG\",\n `Unknown region: ${String(region)}. Expected \"eu\", \"us\" or \"ap\".`,\n );\n }\n\n return {\n jwksUrl: JWKS_URLS[environment],\n linkBaseUrl: LINK_BASE_URLS[environment],\n region,\n };\n}\n","import { EncryptJWT, importJWK, type JWK } from \"jose\";\n\nimport { AddToKlarnaError } from \"./errors.js\";\nimport type { DecryptedPayload } from \"./types.js\";\n\n/**\n * The JWE profile this library produces. Pinned end-to-end:\n *\n * - `ALG` (key-encryption algorithm)\n * - `ENC` (content-encryption algorithm)\n *\n * `pickEncryptionKey` enforces the matching `kty`/`crv` on the JWKS side,\n * so a JWKS that drifts off this profile fails closed with `NO_MATCHING_KEY`\n * instead of silently producing a non-decryptable link. Changing either\n * constant is an SDK-coordinated event with Klarna's backend.\n */\nexport const ALG = \"ECDH-ES+A256KW\";\nexport const ENC = \"A256GCM\";\n\n/**\n * Encrypt the plaintext payload as a JWE using the given JWK. Produces the\n * compact serialization (five dot-separated base64url segments).\n */\nexport async function encryptJwe(\n payload: DecryptedPayload,\n key: JWK & { kid: string },\n): Promise<string> {\n let imported: Awaited<ReturnType<typeof importJWK>>;\n try {\n imported = await importJWK(key, ALG);\n } catch (cause) {\n throw new AddToKlarnaError(\n \"ENCRYPTION_FAILED\",\n `Could not import JWK with kid=\"${key.kid}\" for alg=\"${ALG}\".`,\n { cause },\n );\n }\n\n try {\n return await new EncryptJWT({\n inputId: payload.inputId,\n linkId: payload.linkId,\n })\n .setProtectedHeader({\n alg: ALG,\n enc: ENC,\n kid: key.kid,\n typ: \"JWT\",\n cty: \"application/json\",\n })\n .setIssuedAt(payload.iat)\n .encrypt(imported);\n } catch (cause) {\n throw new AddToKlarnaError(\"ENCRYPTION_FAILED\", `JWE encryption failed for kid=\"${key.kid}\".`, {\n cause,\n });\n }\n}\n","import type { JWK } from \"jose\";\n\nimport { ALG } from \"./encryptJwe.js\";\nimport { AddToKlarnaError } from \"./errors.js\";\nimport type { Region } from \"./types.js\";\n\n/**\n * The minimal JWKS shape we depend on. The actual file may contain extra\n * fields per RFC 7517; we ignore everything we do not need.\n */\nexport interface Jwks {\n keys: Array<JWK & { kid?: string; alg?: string; use?: string }>;\n}\n\n/**\n * The single key shape this library accepts off the JWKS. Pinned to the\n * tuple Klarna's backend publishes today:\n *\n * alg = ECDH-ES+A256KW\n * kty = EC\n * crv = P-256\n *\n * Anything else is rejected with `NO_MATCHING_KEY`, so a JWKS that ever\n * drifts off this profile — whether by mistake or because someone\n * managed to substitute it past TLS — fails closed instead of\n * silently using a weaker or symmetric algorithm. Any change to this\n * tuple is an SDK-coordinated event with the backend.\n */\nconst REQUIRED_KTY = \"EC\";\nconst REQUIRED_CRV = \"P-256\";\n\n/**\n * Fetch and parse the JWKS at `url`. There is no in-memory cache — caching is\n * delegated to the HTTP layer and Klarna's CDN. Wraps every failure mode in\n * a typed `AddToKlarnaError`.\n */\nexport async function fetchJwks(url: string): Promise<Jwks> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: \"GET\",\n headers: { Accept: \"application/json\" },\n });\n } catch (cause) {\n throw new AddToKlarnaError(\"JWKS_FETCH_FAILED\", `Failed to fetch JWKS from ${url}`, { cause });\n }\n\n if (!response.ok) {\n throw new AddToKlarnaError(\n \"JWKS_FETCH_FAILED\",\n `JWKS fetch returned HTTP ${response.status} ${response.statusText} for ${url}`,\n );\n }\n\n let body: unknown;\n try {\n body = await response.json();\n } catch (cause) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS response body was not valid JSON.\", { cause });\n }\n\n return assertJwks(body);\n}\n\n/**\n * Pick the encryption key for `region` from a JWKS document.\n *\n * A key is usable iff it declares all of:\n *\n * - `use === \"enc\"`\n * - `kid` starting with `kid-{region}-`\n * - `alg === ALG`, `kty === \"EC\"`, `crv === \"P-256\"` (see file header)\n *\n * If multiple keys match, the first one in document order wins — the JWKS\n * is published with the most recent key first. Throws `NO_MATCHING_KEY`\n * when nothing matches.\n */\nexport function pickEncryptionKey(jwks: Jwks, region: Region): JWK & { kid: string } {\n const prefix = `kid-${region}-`;\n const chosen = jwks.keys.find(\n (k) =>\n k.use === \"enc\" &&\n typeof k.kid === \"string\" &&\n k.kid.startsWith(prefix) &&\n k.alg === ALG &&\n k.kty === REQUIRED_KTY &&\n k.crv === REQUIRED_CRV,\n );\n\n if (!chosen || typeof chosen.kid !== \"string\") {\n throw new AddToKlarnaError(\n \"NO_MATCHING_KEY\",\n `JWKS contains no usable encryption key with kid prefix \"${prefix}\" ` +\n `(need use=\"enc\", alg=\"${ALG}\", kty=\"${REQUIRED_KTY}\", crv=\"${REQUIRED_CRV}\").`,\n );\n }\n return chosen as JWK & { kid: string };\n}\n\nfunction assertJwks(body: unknown): Jwks {\n if (!body || typeof body !== \"object\" || !(\"keys\" in body)) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS response is missing a `keys` array.\");\n }\n const keys = (body as { keys: unknown }).keys;\n if (!Array.isArray(keys)) {\n throw new AddToKlarnaError(\"JWKS_INVALID\", \"JWKS `keys` is not an array.\");\n }\n return { keys: keys as Jwks[\"keys\"] };\n}\n","import { buildLinkUrl } from \"./buildLinkUrl.js\";\nimport { buildPayload } from \"./buildPayload.js\";\nimport { resolveConfig } from \"./config.js\";\nimport { encryptJwe } from \"./encryptJwe.js\";\nimport { AddToKlarnaError } from \"./errors.js\";\nimport { fetchJwks, pickEncryptionKey } from \"./jwksClient.js\";\nimport type { AddToKlarnaClient, BuildLinkInput, ClientOptions } from \"./types.js\";\n\n/**\n * Create an Add-to-Klarna client.\n *\n * Construction is cheap and synchronous: it validates options and wires up\n * the pipeline. The first network call happens on the first\n * {@link AddToKlarnaClient.buildLink} / {@link AddToKlarnaClient.redirect}.\n * Every `buildLink` re-fetches the JWKS — caching is handled by the HTTP\n * layer and Klarna's CDN, not in memory.\n */\nexport function createAddToKlarnaClient(options: ClientOptions): AddToKlarnaClient {\n const config = resolveConfig(options);\n\n async function buildLink(input: BuildLinkInput): Promise<string> {\n if (!input || typeof input !== \"object\") {\n throw new AddToKlarnaError(\n \"INVALID_INPUT\",\n \"buildLink() requires an object with `brandNickname` and `inputId`.\",\n );\n }\n const payload = buildPayload(input.inputId);\n const jwks = await fetchJwks(config.jwksUrl);\n const key = pickEncryptionKey(jwks, config.region);\n const jwe = await encryptJwe(payload, key);\n return buildLinkUrl(config.linkBaseUrl, input.brandNickname, jwe);\n }\n\n async function redirect(input: BuildLinkInput): Promise<void> {\n const url = await buildLink(input);\n const w = (globalThis as { window?: { location?: { assign?: (u: string) => void } } }).window;\n const assign = w?.location?.assign;\n if (typeof assign !== \"function\") {\n throw new AddToKlarnaError(\n \"NAVIGATION_UNAVAILABLE\",\n \"redirect() requires a browser context with `window.location.assign`. Use buildLink() and navigate yourself in non-browser environments.\",\n );\n }\n assign.call(w!.location, url);\n }\n\n return { buildLink, redirect };\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,10 +1,61 @@
 {
   "name": "@klarna/add-to-klarna",
-  "version": "0.0.1",
-  "description": "OIDC trusted publishing setup package for @klarna/add-to-klarna",
-  "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
+  "version": "1.0.0",
+  "description": "Merchant integration library for generating Klarna 'Add to Klarna' universal links.",
+  "repository": "https://github.com/klarna-incubator/add-to-klarna-js",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist coverage",
+    "dev": "tsup --watch",
+    "encrypt": "node examples/usage.mjs",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
+    "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",
+    "test:coverage": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "yarn clean && yarn build && yarn test"
+  },
+  "packageManager": "yarn@4.14.1",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "jose": "^6.2.3"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.10.0",
+    "@jest/globals": "^29.7.0",
+    "@types/jest": "^29.5.13",
+    "@types/node": "^22.7.0",
+    "@typescript-eslint/eslint-plugin": "^8.6.0",
+    "@typescript-eslint/parser": "^8.6.0",
+    "eslint": "^9.10.0",
+    "eslint-config-prettier": "^9.1.0",
+    "jest": "^29.7.0",
+    "prettier": "^3.3.3",
+    "ts-jest": "^29.2.5",
+    "tsup": "^8.3.0",
+    "typescript": "^5.6.2"
+  }
 }