@visa/cli 4.1.0-rc.13 → 4.1.0-rc.130

package/dist/checkout-engine/vgs-gateway/server-mint-client.js

@@ -0,0 +1,180 @@
+// Server-side mint client (Phase 1) — the checkout runner mints the payment
+// credential by calling the verify-web deployment's gateway routes with a
+// short-lived, purpose-scoped MINT TOKEN, instead of holding the shared VGS
+// service-account secret (the gateway client id/secret) on the machine.
+//
+// The mint token is issued at approval time (agent-approval/complete, which is
+// session + internal-tester + token-ownership gated) and released to this
+// runner by the claim leg. It is bound to the exact approved purchase, so these
+// calls can only mint the credential the human approved.
+//
+// Request derivation here mirrors ../fetch-credential.mjs EXACTLY (mandate cap,
+// consumer prompt, PENDING retry cadence) — the only change is the transport:
+// verify-web routes + Bearer mint token, never the VGS gateway + VGS secret.
+import { traceHandleFields } from '../trace-handles.js';
+const defaultSleep = (ms) => new Promise((r) => {
+    const t = setTimeout(r, ms);
+    t.unref?.();
+});
+function stripTrailingSlashes(value) {
+    let out = value;
+    while (out.endsWith('/'))
+        out = out.slice(0, -1);
+    return out;
+}
+/**
+ * The merchant ORIGIN (scheme + host) — not the full checkout URL. A merchant's
+ * identity is its origin; a real checkout URL can carry hundreds of chars of
+ * campaign/tracking query params. Confirmed live: an oversized `merchantUrl`
+ * (a ~280-char Wikimedia donation URL) makes the cryptogram mint fail downstream
+ * with a vague `502 "card network could not complete"`, while the same merchant
+ * with a trimmed URL mints fine. Sending the origin is both correct (that IS the
+ * merchant) and safely bounded. Falls back to the raw value if it does not parse
+ * — the mint must never throw here.
+ */
+export function merchantOrigin(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return url;
+    }
+}
+/** Read a stable, non-secret error message from a route's JSON body. */
+async function routeError(res) {
+    const doc = (await res.json().catch(() => null));
+    return doc?.error || doc?.error_code || `HTTP ${res.status}`;
+}
+function bearer(mintToken) {
+    return { 'content-type': 'application/json', authorization: `Bearer ${mintToken}` };
+}
+/**
+ * Create a fresh intent via POST {base}/api/vgs/intent. The server holds the VGS
+ * credential and calls the gateway; we send the same mandate shape the local
+ * path built (cap = ceil(amount)+10, min 25; merchant category Retail/5999) —
+ * unless `input.mandate` overrides the threshold/quantity/window for the
+ * card-mandate (budget) layer.
+ */
+export async function serverCreateIntent(base, mintToken, input, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const { tokenId, assuranceData, transaction: t } = input;
+    const override = input.mandate ?? {};
+    const defaultCap = Math.max(Math.ceil(Number(t.transactionAmount) || 0) + 10, 25);
+    const declineThresholdAmount = override.declineThresholdAmount ?? String(defaultCap);
+    const quantity = override.quantity ?? 1;
+    const effectiveUntil = override.effectiveUntil ?? new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString();
+    const consumerPrompt = override.consumerPrompt ??
+        `Buy an item from ${t.merchantName} for ${t.transactionCurrencyCode.toUpperCase()} ${t.transactionAmount}`;
+    const res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/intent`, {
+        method: 'POST',
+        headers: bearer(mintToken),
+        body: JSON.stringify({
+            tokenId,
+            consumerPrompt,
+            assuranceData,
+            mandates: [
+                {
+                    description: `Purchase at ${t.merchantName}`,
+                    declineThresholdAmount,
+                    declineThresholdCurrencyCode: t.transactionCurrencyCode.toUpperCase(),
+                    effectiveUntil,
+                    merchantCategory: 'Retail',
+                    merchantCategoryCode: '5999',
+                    preferredMerchantName: t.merchantName,
+                    quantity,
+                },
+            ],
+        }),
+    });
+    if (!res.ok)
+        throw new Error(`server intent failed (${res.status}): ${await routeError(res)}`);
+    const doc = (await res.json().catch(() => null));
+    if (!doc?.intentId)
+        throw new Error('server intent response missing intentId');
+    return { intentId: doc.intentId, status: typeof doc.status === 'string' ? doc.status : null };
+}
+/**
+ * Mint the FULL payment credential via POST {base}/api/vgs/payment-cryptogram.
+ * The server's route does a SINGLE gateway call and 502s on a not-COMPLETED
+ * (e.g. PENDING) cryptogram, but live intent approval is asynchronous and the
+ * first cryptogram answer can be PENDING (#5709). So we retry the route on any
+ * non-2xx up to PENDING_ATTEMPTS, matching fetch-credential.mjs's cadence
+ * exactly — a genuinely hard failure just surfaces after the same bounded wait.
+ * Re-POSTing for the same intentId is idempotent (mirrors the old client loop).
+ */
+export async function serverFetchCryptogram(base, mintToken, input, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const env = deps.env ?? process.env;
+    const attempts = Math.max(1, Number(env.VGS_CRYPTOGRAM_PENDING_ATTEMPTS) || 4);
+    const waitMs = Number.isFinite(Number(env.VGS_CRYPTOGRAM_PENDING_WAIT_MS))
+        ? Number(env.VGS_CRYPTOGRAM_PENDING_WAIT_MS)
+        : 5000;
+    const { tokenId, intentId, transaction: t } = input;
+    const body = JSON.stringify({
+        tokenId,
+        intentId,
+        transaction: {
+            merchantName: t.merchantName,
+            // Send the merchant ORIGIN, not the full (possibly huge) checkout URL — an
+            // oversized merchantUrl makes the downstream cryptogram mint 502 (proven live).
+            merchantUrl: merchantOrigin(t.merchantUrl),
+            merchantCountryCode: t.merchantCountryCode,
+            transactionAmount: t.transactionAmount,
+            transactionCurrencyCode: t.transactionCurrencyCode.toUpperCase(),
+        },
+    });
+    let lastError = 'unknown';
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        const res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/payment-cryptogram`, {
+            method: 'POST',
+            headers: bearer(mintToken),
+            body,
+        });
+        if (res.ok) {
+            const c = (await res.json().catch(() => null));
+            if (!c || typeof c.networkToken !== 'string' || typeof c.cryptogramValue !== 'string') {
+                throw new Error('server cryptogram response missing credential fields');
+            }
+            return {
+                networkToken: c.networkToken,
+                expMonth: Number(c.expMonth) || 0,
+                expYear: Number(c.expYear) || 0,
+                cryptogramType: c.cryptogramType ?? '',
+                cryptogramValue: c.cryptogramValue,
+                ...(typeof c.cryptogramExpiresAt === 'string'
+                    ? { cryptogramExpiresAt: c.cryptogramExpiresAt }
+                    : {}),
+                ...traceHandleFields(c),
+            };
+        }
+        // A 4xx (bad request / binding refusal / auth) is terminal — never retry it.
+        if (res.status >= 400 && res.status < 500) {
+            throw new Error(`server cryptogram refused (${res.status}): ${await routeError(res)}`);
+        }
+        lastError = `${res.status}: ${await routeError(res)}`;
+        if (attempt < attempts)
+            await sleep(waitMs);
+    }
+    throw new Error(`server cryptogram not completed after ${attempts} attempts (last: ${lastError})`);
+}
+/** Report the observed merchant outcome via POST {base}/api/vgs/confirmation. */
+export async function serverPostConfirmation(base, mintToken, input, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/confirmation`, {
+        method: 'POST',
+        headers: bearer(mintToken),
+        body: JSON.stringify({
+            tokenId: input.tokenId,
+            intentId: input.intentId,
+            transactionStatus: input.transactionStatus,
+            transactionType: input.transactionType,
+            transactionTimestamp: input.transactionTimestamp,
+            transactionAmount: input.transaction.transactionAmount,
+            transactionCurrencyCode: input.transaction.transactionCurrencyCode.toUpperCase(),
+        }),
+    });
+    if (!res.ok)
+        throw new Error(`server confirmation failed (${res.status}): ${await routeError(res)}`);
+    return { ok: true };
+}

package/dist/checkout-engine/vgs-live-instrument.d.ts

@@ -42,6 +42,15 @@ export type PurchaseAssurance = {
     transactionAmount: string;
     /** ISO 4217 currency the ceremony was scoped to. */
     transactionCurrencyCode: string;
+    /**
+     * True iff the approval server marked this token passkey-exempt ('otp'
+     * cardholder ID&V / 'none' — verified against the owner's account card
+     * record at complete-time): no ceremony ran, `assuranceData` is null by
+     * design, and the intent is minted without it (the signed mint token
+     * carries the same exemption for the server's own check). Absent/false →
+     * assuranceData is REQUIRED, exactly the historical contract.
+     */
+    assuranceExempt?: boolean;
 };
 /**
  * Our fail-closed freshness bound, matching the runner's 15-minute checkout
@@ -57,6 +66,8 @@ export type VgsPaymentCredential = {
     cryptogramType: string;
     cryptogramValue: string;
     cryptogramExpiresAt?: string;
+    vgsTraceId?: string;
+    networkCorrelationId?: string;
 };
 export type FetchVgsPaymentCredential = (input: {
     tokenId: string;
@@ -83,6 +94,33 @@ export type VicConfirmationTarget = {
     intentId: string;
 };
 export declare function decimalToMinor(value: unknown): number | null;
+/**
+ * Currencies whose minor unit is 1/100 of the major unit (2 decimal places).
+ * minorToDecimal's /100 + pad-to-2 rendering is ONLY correct for these. The
+ * card mandate path accepts any 3-letter ISO code, so a 0- or 3-decimal
+ * currency (JPY, BHD, …) would otherwise be emitted with a wrong wire amount.
+ * We only support USD/USDC today; extend deliberately (and fix the exponent)
+ * before adding any non-2-decimal currency.
+ *
+ * NOTE (scanner FP pre-empt): this is a CLIENT-SIDE currency-exponent lookup for
+ * rendering a wire amount in @visa/checkout-engine — it is NOT the cross-store
+ * `PAYMENT_CURRENCIES` enum governed by apps/auth/src/shared-validators.ts, and
+ * this package cannot import from apps/auth (no dependency edge). It intentionally
+ * does not mirror that enum's membership; do not "reconcile" the two.
+ */
+export declare const TWO_DECIMAL_CURRENCIES: Set<string>;
+/**
+ * Inverse of decimalToMinor: render integer minor units as a major-unit decimal
+ * string ("D.DD") for the VGS wire (e.g. a ceiling of 50000 minor → "500.00").
+ * Integer-only; never floating-point money. Throws on a non-integer/negative so
+ * a bad accounting value cannot silently reach the network.
+ *
+ * The /100 + pad-to-2 rendering assumes a 2-decimal (exponent-2) currency. Pass
+ * `currencyCode` on any path that accepts arbitrary currencies (the mandate
+ * path) and it REFUSES a non-2-decimal currency rather than emit a wrong wire
+ * amount. Omit it only where the currency is already known to be USD/USDC.
+ */
+export declare function minorToDecimal(minor: number, currencyCode?: string): string;
 /**
  * Refuse to mint an intent unless the assurance is fresh and its declared
  * scope matches the checkout target exactly. `now` is injectable so the

package/dist/checkout-engine/vgs-live-instrument.js

@@ -1,3 +1,4 @@
+import { traceHandleFields } from './trace-handles.js';
 /**
  * Our fail-closed freshness bound, matching the runner's 15-minute checkout
  * review window — NOT a claim about VGS's actual assurance TTL (unpublished).
@@ -19,6 +20,43 @@ export function decimalToMinor(value) {
     const minor = Number(whole) * 100 + Number(fraction.padEnd(2, '0'));
     return Number.isSafeInteger(minor) ? minor : null;
 }
+/**
+ * Currencies whose minor unit is 1/100 of the major unit (2 decimal places).
+ * minorToDecimal's /100 + pad-to-2 rendering is ONLY correct for these. The
+ * card mandate path accepts any 3-letter ISO code, so a 0- or 3-decimal
+ * currency (JPY, BHD, …) would otherwise be emitted with a wrong wire amount.
+ * We only support USD/USDC today; extend deliberately (and fix the exponent)
+ * before adding any non-2-decimal currency.
+ *
+ * NOTE (scanner FP pre-empt): this is a CLIENT-SIDE currency-exponent lookup for
+ * rendering a wire amount in @visa/checkout-engine — it is NOT the cross-store
+ * `PAYMENT_CURRENCIES` enum governed by apps/auth/src/shared-validators.ts, and
+ * this package cannot import from apps/auth (no dependency edge). It intentionally
+ * does not mirror that enum's membership; do not "reconcile" the two.
+ */
+export const TWO_DECIMAL_CURRENCIES = new Set(['USD', 'USDC']);
+/**
+ * Inverse of decimalToMinor: render integer minor units as a major-unit decimal
+ * string ("D.DD") for the VGS wire (e.g. a ceiling of 50000 minor → "500.00").
+ * Integer-only; never floating-point money. Throws on a non-integer/negative so
+ * a bad accounting value cannot silently reach the network.
+ *
+ * The /100 + pad-to-2 rendering assumes a 2-decimal (exponent-2) currency. Pass
+ * `currencyCode` on any path that accepts arbitrary currencies (the mandate
+ * path) and it REFUSES a non-2-decimal currency rather than emit a wrong wire
+ * amount. Omit it only where the currency is already known to be USD/USDC.
+ */
+export function minorToDecimal(minor, currencyCode) {
+    if (!Number.isSafeInteger(minor) || minor < 0) {
+        throw new Error('minor units must be a non-negative safe integer');
+    }
+    if (currencyCode !== undefined && !TWO_DECIMAL_CURRENCIES.has(currencyCode.toUpperCase())) {
+        throw new Error(`minorToDecimal only supports 2-decimal currencies (${[...TWO_DECIMAL_CURRENCIES].join('/')}); refusing to emit a wire amount for ${currencyCode}`);
+    }
+    const whole = Math.floor(minor / 100);
+    const fraction = minor % 100;
+    return `${whole}.${String(fraction).padStart(2, '0')}`;
+}
 function validateTarget(reference, ctx) {
     if (typeof reference.merchantName !== 'string' ||
         typeof reference.merchantCountryCode !== 'string' ||
@@ -68,7 +106,10 @@ export function validatePurchaseAssurance(value, target, now = new Date()) {
     if (value == null || typeof value !== 'object') {
         throw new Error(`purchase assurance is missing — ${remedy}`);
     }
-    if (value.assuranceData == null) {
+    // A passkey-exempt approval (marked by the approval SERVER, never assumed
+    // locally) carries no assurance by design — every scope/freshness check
+    // below still applies to it unchanged.
+    if (value.assuranceData == null && value.assuranceExempt !== true) {
         throw new Error(`purchase assurance requires assuranceData — ${remedy}`);
     }
     const mintedAtMs = typeof value.mintedAt === 'string' ? Date.parse(value.mintedAt) : NaN;
@@ -125,13 +166,14 @@ export function validateCredential(value, now = new Date()) {
         (value.expYear === now.getFullYear() && value.expMonth < now.getMonth() + 1)) {
         throw new Error('VGS credential is expired');
     }
-    if (value.cryptogramExpiresAt !== undefined) {
-        const expiresAtMs = Date.parse(value.cryptogramExpiresAt);
-        if (!Number.isFinite(expiresAtMs))
-            throw new Error('VGS credential expiry is invalid');
-        if (expiresAtMs - now.getTime() < 60_000) {
-            throw new Error('VGS credential has less than 60 seconds of validity remaining');
-        }
+    if (value.cryptogramExpiresAt === undefined) {
+        throw new Error('VGS credential expiry is missing');
+    }
+    const expiresAtMs = Date.parse(value.cryptogramExpiresAt);
+    if (!Number.isFinite(expiresAtMs))
+        throw new Error('VGS credential expiry is invalid');
+    if (expiresAtMs - now.getTime() < 60_000) {
+        throw new Error('VGS credential has less than 60 seconds of validity remaining');
     }
 }
 /**
@@ -188,6 +230,7 @@ export class VgsLiveInstrument {
             cvc: value.cryptogramValue,
             cardholderName: this.cardholderName.trim(),
             ...(value.cryptogramExpiresAt ? { credentialExpiresAt: value.cryptogramExpiresAt } : {}),
+            ...traceHandleFields(value),
         };
     }
 }
@@ -247,6 +290,7 @@ export class VgsAssuranceInstrument {
             cvc: value.cryptogramValue,
             cardholderName: this.cardholderName.trim(),
             ...(value.cryptogramExpiresAt ? { credentialExpiresAt: value.cryptogramExpiresAt } : {}),
+            ...traceHandleFields(value),
         };
     }
 }

package/dist/checkout-engine/vic-confirmation.js

@@ -32,8 +32,8 @@ export async function reportVicOutcome(input) {
     catch (err) {
         return {
             posted: false,
-            reason: `confirmation POST failed: ${err.message} — the merchant outcome stands; ` +
-                'retry the confirmation for this intent out-of-band',
+            reason: `confirmation POST failed: ${err.message} — the merchant-reported outcome ` +
+                'remains unverified; retry the confirmation for this intent out-of-band',
         };
     }
 }