@klarna/add-to-klarna 0.0.1 → 2.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,45 +1,293 @@
 # @klarna/add-to-klarna
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+> Merchant integration library for generating Klarna "Add to Klarna" AppsFlyer OneLinks.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+[![Build Status][ci-image]][ci-url]
+[![License][license-image]][license-url]
+[![Developed at Klarna][klarna-image]][klarna-url]
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Lets a merchant page turn a `brandNickname` + `inputId` into a fully encrypted Klarna AppsFlyer OneLink in one call, without the merchant having to touch JWE, JWKS, key rotation, or URL encoding.
 
-## Purpose
+## Install
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@klarna/add-to-klarna`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+```bash
+yarn add @klarna/add-to-klarna
+# or
+npm install @klarna/add-to-klarna
+```
 
-## What is OIDC Trusted Publishing?
+The package is isomorphic. It works in:
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+- modern browsers (uses Web Crypto + `fetch`),
+- Node ≥ 20 (uses the built-in Web Crypto and global `fetch`).
 
-## Setup Instructions
+It has a single runtime dependency: [`jose`](https://github.com/panva/jose).
 
-To properly configure OIDC trusted publishing for this package:
+## Quick start
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+```ts
+import { createAddToKlarnaClient } from "@klarna/add-to-klarna";
 
-## DO NOT USE THIS PACKAGE
+const klarna = createAddToKlarnaClient({ region: "eu" });
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+document.querySelector("#add-to-klarna-button")?.addEventListener("click", async () => {
+  await klarna.redirect({
+    brandNickname: "your-brand-nickname",
+    inputId: "your-customer-id",
+  });
+});
+```
 
-## More Information
+`redirect()` calls `window.location.assign(...)` with the generated link. If
+you want the URL without navigating (e.g. to put in an `<a href>` or to send
+in an email from a server), use `buildLink()`:
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+```ts
+const url = await klarna.buildLink({
+  brandNickname: "your-brand-nickname",
+  inputId: "your-customer-id",
+});
+```
 
----
+## Without a build step
 
-**Maintained for OIDC setup purposes only**
+The published package also works without a bundler.
+
+### Node (CommonJS)
+
+The package ships both ESM and CJS entry points, so `require` works the same
+as `import`:
+
+```js
+const { createAddToKlarnaClient } = require("@klarna/add-to-klarna");
+
+const klarna = createAddToKlarnaClient({ region: "eu" });
+
+(async () => {
+  const url = await klarna.buildLink({
+    brandNickname: "your-brand-nickname",
+    inputId: "your-customer-id",
+  });
+  console.log(url);
+})();
+```
+
+### Browser (`<script type="module">` from a CDN)
+
+Drop the library straight into an HTML page via an ESM-aware CDN — no
+`npm`, no bundler:
+
+```html
+<script type="module">
+  import { createAddToKlarnaClient } from "https://esm.sh/@klarna/add-to-klarna@2.0.0";
+
+  const klarna = createAddToKlarnaClient({ region: "eu" });
+
+  document.querySelector("#add-to-klarna-button")?.addEventListener("click", async () => {
+    await klarna.redirect({
+      brandNickname: "your-brand-nickname",
+      inputId: "your-customer-id",
+    });
+  });
+</script>
+```
+
+`esm.sh` (above), `https://cdn.jsdelivr.net/npm/@klarna/add-to-klarna@2.0.0/+esm`,
+and `https://unpkg.com/@klarna/add-to-klarna@2.0.0?module` all serve the
+ESM build and resolve the `jose` dependency transparently. Always pin a
+version in production so a future release can't change behaviour under
+your page.
+
+## Configuration
+
+Only `region` is required. `environment` defaults to `"production"` and
+`clientTarget` defaults to `"pink"` — the public production Klarna app —
+so a merchant integration can usually pass just the region.
+
+| Option         | Type                                                                       | Default        | Description                                                                                                                                                            |
+| -------------- | -------------------------------------------------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `environment`  | `"production" \| "staging"`                                                | `"production"` | Which Klarna backend to target. Picks the JWKS endpoint. Desktop fallback is the same production page for every environment.                                           |
+| `clientTarget` | `"pink" \| "internalpink" \| "yellow" \| "staging" \| "oneoff" \| "local"` | `"pink"`       | Which Klarna client application to target. Picks the AppsFlyer OneLink base URL. Merchants should leave this at `"pink"`; the other values are Klarna-internal builds. |
+| `region`       | `"eu" \| "us" \| "ap"`                                                     | _(required)_   | Which deployment region to target. Picks the key inside the JWKS via a `kid-{region}-` prefix.                                                                         |
+
+`environment` and `clientTarget` are independent by design: internal builds
+of the Klarna app (`yellow`, `oneoff`, `local`, …) can point at either the
+production or the staging backend, so the JWKS host and the AppsFlyer host
+are configured separately.
+
+There are no other knobs — by design. The clock, the UUID generator, and
+the `fetch` implementation are all fixed (the library uses
+`globalThis.fetch`, `Date.now`, and `globalThis.crypto.randomUUID`).
+
+## URL shape
+
+The library emits an [AppsFlyer OneLink](https://support.appsflyer.com/hc/en-us/articles/207032246-OneLink-link-management) URL that routes based on the device:
+
+- **Mobile with the Klarna app installed** — opens the app to the add-to-klarna deep link.
+- **Mobile without the app** — AppsFlyer routes to the App Store / Play Store per the OneLink template configuration and replays the deep link after install (deferred deep linking).
+- **Desktop** — falls back to `https://klarna.com/add-to-klarna` (`af_web_dp`).
+
+The composed URL has the shape:
+
+```
+<oneLinkBase>?pid=WebApp
+  &c=add-to-klarna
+  &deep_link_value=<url-encoded /loyalty-cards-v2/add-to-klarna/<brandNickname>/<encryptedPayload>>
+  &af_web_dp=<desktop fallback URL>
+```
+
+The `<oneLinkBase>` is fixed per `clientTarget`:
+
+| `clientTarget` | OneLink base URL                             |
+| -------------- | -------------------------------------------- |
+| `pink`         | `https://l.klarna.com/22XC`                  |
+| `internalpink` | `https://klarnainternalpink.onelink.me/lXgD` |
+| `yellow`       | `https://klarnayellow.onelink.me/JQ8X`       |
+| `staging`      | `https://klarnastaging.onelink.me/hV1K`      |
+| `oneoff`       | `https://klarnaoneoff.onelink.me/FaEr`       |
+| `local`        | `https://klarnalocal.onelink.me/dxUs`        |
+
+The library only sets `af_web_dp` (the desktop fallback) on the URL itself.
+The App Store / Play Store fallbacks for mobile are configured on the
+AppsFlyer OneLink template, not on the URL. Desktop fallback is always
+`https://klarna.com/add-to-klarna` — the same production page for every
+`environment` and `clientTarget`. Merchants don't (and can't) configure it.
+This keeps the merchant API surface identical to v1: just `brandNickname`
+and `inputId`.
+
+The `<encryptedPayload>` inside `deep_link_value` is the JWE compact serialization wrapped in an extra base64url so the entire ciphertext fits in a single deep-link path component (the dots in the JWE compact form would otherwise break the Klarna app's in-app router).
+
+## API
+
+### `createAddToKlarnaClient(options)`
+
+Returns an `AddToKlarnaClient`. Construction is cheap and synchronous; the
+first network call happens on the first `buildLink` / `redirect`.
+
+### `client.buildLink({ brandNickname, inputId })`
+
+Returns `Promise<string>` — the fully-formed AppsFlyer OneLink URL.
+
+A fresh `linkId` is minted on every call (and embedded inside the encrypted
+payload, not exposed on the surface). The Klarna backend enforces single-use
+semantics, so do **not** cache the returned URL — generate a new one per
+click.
+
+### `client.redirect({ brandNickname, inputId })`
+
+Calls `buildLink()` and then `window.location.assign(url)`. Throws
+`AddToKlarnaError` with `code: "NAVIGATION_UNAVAILABLE"` if `window` is not
+present.
+
+## Caching
+
+The library does **not** maintain any in-memory cache. Every `buildLink`
+re-fetches the JWKS. Caching is delegated to the HTTP layer:
+
+- the production JWKS is served from `app.klarna.com` through Klarna's CDN,
+  which sets the `Cache-Control` policy authoritatively;
+- the browser's HTTP cache (or Node's fetch cache, where configured) honors
+  those headers on subsequent calls.
+
+This means a key rotation propagates as soon as the CDN edge cache expires —
+no client release required.
+
+## Key selection by region
+
+Both published JWKS files contain keys for every region. Each key is
+namespaced by its `kid`, which always starts with `kid-{region}-`:
+
+```
+kid-eu-66caf84b-…
+kid-us-…
+kid-ap-…
+```
+
+`region` in the client options decides which prefix the library filters for.
+A region with no matching key in the JWKS produces a typed
+`NO_MATCHING_KEY` error rather than silently picking the wrong region.
+
+## Security model
+
+The JWKS is fetched over HTTPS from `app.klarna.com`; certificate
+validation is delegated to Web PKI + HSTS. The library doesn't ship
+custom cert pinning — no portable browser API for it, and the cost of
+rotating a pin across every merchant integration outweighs the marginal
+protection.
+
+The JWE profile is pinned end-to-end instead:
+
+| Field | Pinned value     |
+| ----- | ---------------- |
+| `use` | `enc`            |
+| `alg` | `ECDH-ES+A256KW` |
+| `kty` | `EC`             |
+| `crv` | `P-256`          |
+| `enc` | `A256GCM`        |
+
+Any JWKS key not matching this tuple is rejected with `NO_MATCHING_KEY`,
+so drift or a substituted JWKS fails closed rather than silently
+downgrading.
+
+## Errors
+
+Every failure surfaces as an `AddToKlarnaError` with a stable `.code`. Branch
+on the code, not on the message.
+
+| Code                     | Meaning                                                                                                                      |
+| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| `INVALID_CONFIG`         | A client option was invalid (e.g. unknown `environment`, `clientTarget` or `region`).                                        |
+| `INVALID_INPUT`          | Missing / malformed `brandNickname` or `inputId`.                                                                            |
+| `JWKS_FETCH_FAILED`      | Could not reach the JWKS endpoint, or the endpoint returned a non-2xx HTTP status.                                           |
+| `JWKS_INVALID`           | The JWKS body was not valid JSON, or did not contain a `keys` array.                                                         |
+| `NO_MATCHING_KEY`        | The JWKS contains no key with the `kid-{region}-` prefix matching the pinned `alg`/`kty`/`crv` tuple (see _Security model_). |
+| `ENCRYPTION_FAILED`      | The JWE could not be produced (key import or encryption step threw).                                                         |
+| `NAVIGATION_UNAVAILABLE` | `redirect()` was called outside a browser context.                                                                           |
+
+```ts
+import { AddToKlarnaError, isAddToKlarnaError } from "@klarna/add-to-klarna";
+
+try {
+  await klarna.redirect({ brandNickname, inputId });
+} catch (err) {
+  if (isAddToKlarnaError(err) && err.code === "JWKS_FETCH_FAILED") {
+    // Show a connectivity error UI.
+  } else {
+    throw err;
+  }
+}
+```
+
+## Development setup
+
+```bash
+yarn install
+yarn test         # jest, one shot
+yarn test:watch   # jest, watch mode
+yarn typecheck    # tsc --noEmit
+yarn lint
+yarn build        # tsup → ESM + CJS + .d.ts in dist/
+```
+
+Tests use [Jest](https://jestjs.io/) with `ts-jest`'s ESM preset. They mock
+`globalThis.fetch`, `Date.now` and `globalThis.crypto.randomUUID` via
+`jest.spyOn` / `jest.fn` rather than relying on dependency injection.
+
+## Release History
+
+See our [changelog](CHANGELOG.md).
+
+## License
+
+Copyright © 2026 Klarna Bank AB
+
+Licensed under the [Apache License, Version 2.0](./LICENSE). For license details, see the [LICENSE](LICENSE) file in the root of this project.
+
+<!-- Markdown link & img dfn's -->
+
+[ci-image]: https://img.shields.io/badge/build-passing-brightgreen?style=flat-square
+[ci-url]: https://github.com/klarna-incubator/TODO
+[license-image]: https://img.shields.io/badge/license-Apache%202-blue?style=flat-square
+[license-url]: http://www.apache.org/licenses/LICENSE-2.0
+[klarna-image]: https://img.shields.io/badge/%20-Developed%20at%20Klarna-black?style=flat-square&labelColor=ffb3c7&logo=klarna&logoColor=black
+[klarna-url]: https://klarna.github.io