@visa/cli 4.1.0-rc.297 → 4.1.0-rc.299

package/dist/checkout-engine/vgs-gateway/server-mint-client.js

@@ -1,493 +0,0 @@
-import { createDecipheriv, createHash, verify, createPublicKey, diffieHellman, hkdfSync, } from 'node:crypto';
-// Server-side mint client (Phase 1) — the checkout runner mints the payment
-// credential by calling the verify-web deployment's gateway routes with a
-// short-lived, purpose-scoped MINT TOKEN, instead of holding the shared VGS
-// service-account secret (the gateway client id/secret) on the machine.
-//
-// The mint token is issued at approval time (agent-approval/complete, which is
-// session + internal-tester + token-ownership gated) and released to this
-// runner by the claim leg. It is bound to the exact approved purchase, so these
-// calls can only mint the credential the human approved.
-//
-// Request derivation here mirrors ../fetch-credential.mjs EXACTLY (mandate cap,
-// consumer prompt, PENDING retry cadence) — the only change is the transport:
-// verify-web routes + Bearer mint token, never the VGS gateway + VGS secret.
-import { traceHandleFields } from '../trace-handles.js';
-const defaultSleep = (ms) => new Promise((r) => {
-    const t = setTimeout(r, ms);
-    t.unref?.();
-});
-function stripTrailingSlashes(value) {
-    let out = value;
-    while (out.endsWith('/'))
-        out = out.slice(0, -1);
-    return out;
-}
-/**
- * The merchant ORIGIN (scheme + host) — not the full checkout URL. A merchant's
- * identity is its origin; a real checkout URL can carry hundreds of chars of
- * campaign/tracking query params. Confirmed live: an oversized `merchantUrl`
- * (a ~280-char Wikimedia donation URL) makes the cryptogram mint fail downstream
- * with a vague `502 "card network could not complete"`, while the same merchant
- * with a trimmed URL mints fine. Sending the origin is both correct (that IS the
- * merchant) and safely bounded. Falls back to the raw value if it does not parse
- * — the mint must never throw here.
- */
-export function merchantOrigin(url) {
-    try {
-        return new URL(url).origin;
-    }
-    catch {
-        return url;
-    }
-}
-/**
- * A definitive refusal from the cryptogram mint route — the request will not
- * succeed if retried unchanged.
- *
- * `terminal` is the load-bearing field. Draw terminality used to be decided by
- * regex over the error MESSAGE, which made it hostage to text nobody controls:
- * this client now interpolates the provider's own `upstream_codes` into the
- * message for diagnosability, and a provider identifier such as
- * `request_timeout` would match the transient matcher's unanchored
- * `tim(e|ed)-out` alternative — flipping a permanent 422 back to "transient",
- * skipping markUnhonored, and stranding the mandate in the exact retry-forever
- * loop this whole change exists to kill. Terminality is therefore carried
- * structurally, and consumers must consult it BEFORE any message matching.
- */
-export class ServerCryptogramRefusedError extends Error {
-    status;
-    terminal = true;
-    constructor(status, detail) {
-        super(`server cryptogram refused (${status}): ${detail}`);
-        this.name = 'ServerCryptogramRefusedError';
-        this.status = status;
-    }
-}
-async function readRouteErrorDoc(res) {
-    return (await res.json().catch(() => null));
-}
-function routeErrorMessage(res, doc) {
-    const base = doc?.error || doc?.error_code || `HTTP ${res.status}`;
-    // Carry the provider's own status and rejected-attribute identifiers into the
-    // message when the route reflected them. Without this the operator sees only
-    // our status and has to go log-diving to learn WHICH field the gateway
-    // objected to — the gap that left a live create_intent 422 undiagnosable.
-    const parts = [];
-    if (typeof doc?.upstream_status === 'number')
-        parts.push(`upstream_status=${doc.upstream_status}`);
-    if (Array.isArray(doc?.upstream_codes) && doc.upstream_codes.length > 0) {
-        parts.push(`upstream_codes=${doc.upstream_codes.join(',')}`);
-    }
-    return parts.length > 0 ? `${base} [${parts.join(' ')}]` : base;
-}
-async function routeError(res) {
-    return routeErrorMessage(res, await readRouteErrorDoc(res));
-}
-const BOOTSTRAP_STATES = new Set([
-    'none',
-    'pending',
-    'created',
-    'ambiguous',
-    'conflict',
-    'unknown',
-]);
-function bootstrapStateOf(value) {
-    return typeof value === 'string' && BOOTSTRAP_STATES.has(value)
-        ? value
-        : 'unknown';
-}
-const SAFE_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/;
-function requestIdOf(res, doc) {
-    const candidate = res?.headers.get('x-request-id') ?? doc?.request_id ?? null;
-    return typeof candidate === 'string' && SAFE_REQUEST_ID.test(candidate) ? candidate : null;
-}
-/**
- * The budget-intent route's failure, kept structured (#8470). `status` 0 means
- * the request never produced an HTTP response (network failure or abort), which
- * is outcome-uncertain exactly like a 5xx: the server may have dispatched.
- */
-export class ServerIntentError extends Error {
-    facts;
-    code = 'SERVER_INTENT_FAILED';
-    constructor(message, facts) {
-        super(message);
-        this.facts = facts;
-        this.name = 'ServerIntentError';
-    }
-}
-function serverIntentErrorFrom(res, doc) {
-    const errorCode = typeof doc?.error_code === 'string'
-        ? doc.error_code
-        : typeof doc?.error === 'string' && /^[a-z0-9_]{1,64}$/.test(doc.error)
-            ? doc.error
-            : null;
-    const outcome = doc?.outcome === 'uncertain' || doc?.outcome === 'not_created'
-        ? doc.outcome
-        : res.status >= 500 || res.status === 0
-            ? 'uncertain'
-            : 'not_created';
-    return new ServerIntentError(`server intent failed (${res.status}): ${routeErrorMessage(res, doc)}`, {
-        status: res.status,
-        errorCode,
-        retryable: typeof doc?.retryable === 'boolean' ? doc.retryable : null,
-        requestId: requestIdOf(res, doc),
-        bootstrapState: bootstrapStateOf(doc?.bootstrap_state),
-        outcome,
-    });
-}
-function bearer(mintToken) {
-    return { 'content-type': 'application/json', authorization: `Bearer ${mintToken}` };
-}
-/**
- * Create a fresh intent via POST {base}/api/vgs/intent. The server holds the VGS
- * credential and calls the gateway; we send the same mandate shape the local
- * path built (cap = ceil(amount)+10, min 25; merchant category Retail/5999) —
- * unless `input.mandate` overrides the threshold/quantity/window for the
- * card-mandate (budget) layer.
- */
-export async function serverCreateIntent(base, mintToken, input, deps = {}) {
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    const { tokenId, assuranceData, transaction: t } = input;
-    const override = input.mandate ?? {};
-    const defaultCap = Math.max(Math.ceil(Number(t.transactionAmount) || 0) + 10, 25);
-    const declineThresholdAmount = override.declineThresholdAmount ?? String(defaultCap);
-    const quantity = override.quantity ?? 1;
-    const effectiveUntil = override.effectiveUntil ?? new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString();
-    const consumerPrompt = override.consumerPrompt ??
-        `Buy an item from ${t.merchantName} for ${t.transactionCurrencyCode.toUpperCase()} ${t.transactionAmount}`;
-    let res;
-    try {
-        res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/intent`, {
-            method: 'POST',
-            headers: bearer(mintToken),
-            body: JSON.stringify({
-                tokenId,
-                consumerPrompt,
-                assuranceData,
-                mandates: [
-                    {
-                        description: `Purchase at ${t.merchantName}`,
-                        declineThresholdAmount,
-                        declineThresholdCurrencyCode: t.transactionCurrencyCode.toUpperCase(),
-                        effectiveUntil,
-                        merchantCategory: 'Retail',
-                        merchantCategoryCode: '5999',
-                        preferredMerchantName: t.merchantName,
-                        quantity,
-                    },
-                ],
-            }),
-        });
-    }
-    catch (err) {
-        // No HTTP response at all: the request may or may not have reached the
-        // server, so this is outcome-uncertain, never a proven non-creation.
-        throw new ServerIntentError(`server intent failed (0): ${err instanceof Error ? err.message : String(err)}`, {
-            status: 0,
-            errorCode: null,
-            retryable: false,
-            requestId: null,
-            bootstrapState: 'unknown',
-            outcome: 'uncertain',
-        });
-    }
-    if (!res.ok)
-        throw serverIntentErrorFrom(res, await readRouteErrorDoc(res));
-    const doc = (await res.json().catch(() => null));
-    if (!doc?.intentId)
-        throw new Error('server intent response missing intentId');
-    return { intentId: doc.intentId, status: typeof doc.status === 'string' ? doc.status : null };
-}
-/**
- * Read the durable budget-bootstrap state for a budget mint token via
- * GET {base}/api/vgs/intent (#8470). A `created` answer carries the intent the
- * server already minted under this token, so the runner registers it instead
- * of dispatching again; `pending` and `ambiguous` are never redispatched.
- */
-export async function serverReadIntentBootstrap(base, mintToken, deps = {}) {
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    let res;
-    try {
-        res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/intent`, {
-            method: 'GET',
-            headers: bearer(mintToken),
-        });
-    }
-    catch (err) {
-        throw new ServerIntentError(`server intent status failed (0): ${err instanceof Error ? err.message : String(err)}`, {
-            status: 0,
-            errorCode: null,
-            retryable: true,
-            requestId: null,
-            bootstrapState: 'unknown',
-            outcome: 'unknown',
-        });
-    }
-    const doc = (await res.json().catch(() => null));
-    if (!res.ok) {
-        const error = serverIntentErrorFrom(res, doc);
-        throw new ServerIntentError(error.message.replace('server intent failed', 'server intent status failed'), {
-            ...error.facts,
-            retryable: error.facts.retryable || res.status === 503,
-            outcome: 'unknown',
-        });
-    }
-    const state = bootstrapStateOf(doc?.bootstrap_state);
-    const intentId = typeof doc?.intent?.intentId === 'string' && doc.intent.intentId ? doc.intent.intentId : null;
-    return {
-        state: state === 'created' && !intentId ? 'unknown' : state,
-        intentId,
-        intentStatus: typeof doc?.intent?.status === 'string' ? doc.intent.status : null,
-        requestId: requestIdOf(res, doc),
-    };
-}
-/**
- * Mint the FULL payment credential via POST {base}/api/vgs/payment-cryptogram.
- * The server's route does a SINGLE gateway call and 502s on a not-COMPLETED
- * (e.g. PENDING) cryptogram, but live intent approval is asynchronous and the
- * first cryptogram answer can be PENDING (#5709). So we retry the route on any
- * non-2xx up to PENDING_ATTEMPTS, matching fetch-credential.mjs's cadence
- * exactly — a genuinely hard failure just surfaces after the same bounded wait.
- * Re-POSTing for the same intentId is idempotent (mirrors the old client loop).
- */
-export async function serverFetchCryptogram(base, mintToken, input, deps = {}) {
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    const sleep = deps.sleep ?? defaultSleep;
-    const env = deps.env ?? process.env;
-    const attempts = Math.max(1, Number(env.VGS_CRYPTOGRAM_PENDING_ATTEMPTS) || 4);
-    const waitMs = Number.isFinite(Number(env.VGS_CRYPTOGRAM_PENDING_WAIT_MS))
-        ? Number(env.VGS_CRYPTOGRAM_PENDING_WAIT_MS)
-        : 5000;
-    const { tokenId, intentId, transaction: t } = input;
-    const body = JSON.stringify({
-        tokenId,
-        intentId,
-        transaction: {
-            merchantName: t.merchantName,
-            // Send the merchant ORIGIN, not the full (possibly huge) checkout URL — an
-            // oversized merchantUrl makes the downstream cryptogram mint 502 (proven live).
-            merchantUrl: merchantOrigin(t.merchantUrl),
-            merchantCountryCode: t.merchantCountryCode,
-            transactionAmount: t.transactionAmount,
-            transactionCurrencyCode: t.transactionCurrencyCode.toUpperCase(),
-        },
-    });
-    let lastError = 'unknown';
-    for (let attempt = 1; attempt <= attempts; attempt++) {
-        const res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/payment-cryptogram`, {
-            method: 'POST',
-            headers: bearer(mintToken),
-            body,
-        });
-        if (res.ok) {
-            const c = (await res.json().catch(() => null));
-            if (!c || typeof c.networkToken !== 'string' || typeof c.cryptogramValue !== 'string') {
-                throw new Error('server cryptogram response missing credential fields');
-            }
-            return {
-                networkToken: c.networkToken,
-                expMonth: Number(c.expMonth) || 0,
-                expYear: Number(c.expYear) || 0,
-                cryptogramType: c.cryptogramType ?? '',
-                cryptogramValue: c.cryptogramValue,
-                ...(typeof c.cryptogramExpiresAt === 'string'
-                    ? { cryptogramExpiresAt: c.cryptogramExpiresAt }
-                    : {}),
-                ...traceHandleFields(c),
-            };
-        }
-        // A 4xx (bad request / binding refusal / auth) is terminal — never retry it.
-        // 429 is the sole exception: it is an explicitly retryable 4xx, and treating
-        // it as terminal would let a transient rate limit permanently disable a
-        // healthy mandate. The route maps upstream rate limits to 503 today, so this
-        // is a guard against a future emitter, not a live path.
-        if (res.status >= 400 && res.status < 500 && res.status !== 429) {
-            throw new ServerCryptogramRefusedError(res.status, await routeError(res));
-        }
-        lastError = `${res.status}: ${await routeError(res)}`;
-        if (attempt < attempts)
-            await sleep(waitMs);
-    }
-    throw new Error(`server cryptogram not completed after ${attempts} attempts (last: ${lastError})`);
-}
-/** Report the observed merchant outcome via POST {base}/api/vgs/confirmation. */
-export async function serverPostConfirmation(base, mintToken, input, deps = {}) {
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    const res = await fetchImpl(`${stripTrailingSlashes(base)}/api/vgs/confirmation`, {
-        method: 'POST',
-        headers: bearer(mintToken),
-        body: JSON.stringify({
-            tokenId: input.tokenId,
-            intentId: input.intentId,
-            transactionStatus: input.transactionStatus,
-            transactionType: input.transactionType,
-            transactionTimestamp: input.transactionTimestamp,
-            transactionAmount: input.transaction.transactionAmount,
-            transactionCurrencyCode: input.transaction.transactionCurrencyCode.toUpperCase(),
-        }),
-    });
-    if (!res.ok)
-        throw new Error(`server confirmation failed (${res.status}): ${await routeError(res)}`);
-    return { ok: true };
-}
-function cardEvidence(token, key, typ, fields) {
-    const fail = () => {
-        throw new Error('protected_card_evidence_invalid');
-    };
-    if (key.type !== 'public' ||
-        key.asymmetricKeyType !== 'ed25519' ||
-        typeof token !== 'string' ||
-        token.length > 16384)
-        return fail();
-    const parts = token.split('.');
-    if (parts.length !== 3)
-        return fail();
-    const jwk = key.export({ format: 'jwk' });
-    const kid = createHash('sha256')
-        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x }))
-        .digest('base64url');
-    const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString());
-    const claims = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-    if (!header ||
-        Object.keys(header).sort().join(',') !== 'alg,kid,typ' ||
-        header.alg !== 'EdDSA' ||
-        header.typ !== typ ||
-        header.kid !== kid ||
-        !claims ||
-        Object.keys(claims).sort().join(',') !== fields.sort().join(',') ||
-        claims.v !== 1 ||
-        typeof claims.jti !== 'string' ||
-        !claims.jti ||
-        !Number.isSafeInteger(claims.iat) ||
-        !verify(null, Buffer.from(parts.slice(0, 2).join('.')), key, Buffer.from(parts[2], 'base64url')))
-        return fail();
-    return claims;
-}
-export async function serverFetchProtectedCryptogram(base, input, deps = {}) {
-    const hash = Buffer.from(input.requestHash, 'base64url');
-    if (hash.length !== 32 ||
-        hash.toString('base64url') !== input.requestHash ||
-        input.deliveryKey.type !== 'private' ||
-        input.deliveryKey.asymmetricKeyType !== 'x25519')
-        throw new Error('protected_card_delivery_key_invalid');
-    const response = await (deps.fetchImpl ?? fetch)(`${stripTrailingSlashes(base)}/api/vgs/payment-cryptogram`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', 'x-visa-card-protected': 'v1' },
-        body: JSON.stringify({
-            financialAdmission: input.financialAdmission,
-            request: input.request,
-        }),
-        redirect: 'error',
-    });
-    if (response.status === 202)
-        throw new Error('protected_card_recovery_pending');
-    if (!response.ok)
-        throw new Error(`protected_card_refused_${response.status}`);
-    const reader = response.body?.getReader();
-    if (!reader)
-        throw new Error('protected_card_response_invalid');
-    const chunks = [];
-    let size = 0;
-    try {
-        for (;;) {
-            const part = await reader.read();
-            if (part.done)
-                break;
-            size += part.value.byteLength;
-            if (size > 65536) {
-                await reader.cancel();
-                throw new Error('protected_card_response_invalid');
-            }
-            chunks.push(part.value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const envelope = JSON.parse(Buffer.concat(chunks).toString());
-    if (!envelope ||
-        Object.keys(envelope).sort().join(',') !==
-            'acknowledgement,ciphertext,ephemeralPublicJwk,iv,outcome,tag,v' ||
-        envelope.v !== 1)
-        throw new Error('protected_card_response_invalid');
-    const coordinates = [
-        'v',
-        'aud',
-        'jti',
-        'attemptId',
-        'requestHash',
-        'admissionId',
-        'issuanceGeneration',
-        'iat',
-    ];
-    const outcome = cardEvidence(envelope.outcome, input.pins.executor, 'visa-card-delivery-outcome+jwt', [...coordinates, 'outcome', 'providerRef', 'credentialSha256']);
-    const ack = cardEvidence(envelope.acknowledgement, input.pins.issuer, 'visa-card-delivery-state+jwt', [...coordinates, 'action', 'outcomeHash', 'exp']);
-    const permit = JSON.parse(Buffer.from(input.financialAdmission.split('.')[1], 'base64url').toString());
-    const now = Math.floor(Date.now() / 1000);
-    if (outcome.aud !== 'urn:visa:authority:card-outcome' ||
-        outcome.outcome !== 'credential_observed' ||
-        outcome.requestHash !== input.requestHash ||
-        outcome.attemptId !== permit.attemptId ||
-        outcome.admissionId !== permit.jti ||
-        outcome.issuanceGeneration !== permit.issuanceGeneration ||
-        ack.aud !== 'urn:visa:executor:card-vic' ||
-        ack.action !== 'recover_only' ||
-        ack.requestHash !== outcome.requestHash ||
-        ack.attemptId !== outcome.attemptId ||
-        ack.admissionId !== outcome.admissionId ||
-        ack.issuanceGeneration !== outcome.issuanceGeneration ||
-        !Number.isSafeInteger(ack.exp) ||
-        ack.exp <= now ||
-        ack.iat > now + 5 ||
-        ack.exp <= ack.iat ||
-        ack.exp - ack.iat > 60 ||
-        ack.outcomeHash !== createHash('sha256').update(envelope.outcome).digest('base64url'))
-        throw new Error('protected_card_evidence_invalid');
-    const jwk = envelope.ephemeralPublicJwk;
-    if (!jwk ||
-        Object.keys(jwk).sort().join(',') !== 'crv,kty,x' ||
-        jwk.kty !== 'OKP' ||
-        jwk.crv !== 'X25519')
-        throw new Error('protected_card_response_invalid');
-    const decode = (value, size) => {
-        if (typeof value !== 'string')
-            throw new Error('protected_card_response_invalid');
-        const decoded = Buffer.from(value, 'base64url');
-        if (decoded.toString('base64url') !== value || (size !== undefined && decoded.length !== size))
-            throw new Error('protected_card_response_invalid');
-        return decoded;
-    };
-    decode(jwk.x, 32);
-    const shared = diffieHellman({
-        privateKey: input.deliveryKey,
-        publicKey: createPublicKey({ key: jwk, format: 'jwk' }),
-    });
-    const key = Buffer.from(hkdfSync('sha256', shared, hash, 'visa-card-delivery-v1', 32));
-    shared.fill(0);
-    let clear;
-    try {
-        const decipher = createDecipheriv('aes-256-gcm', key, decode(envelope.iv, 12));
-        decipher.setAAD(Buffer.from(input.requestHash));
-        decipher.setAuthTag(decode(envelope.tag, 16));
-        clear = Buffer.concat([decipher.update(decode(envelope.ciphertext)), decipher.final()]);
-        if (createHash('sha256').update(clear).digest('base64url') !== outcome.credentialSha256)
-            throw new Error('protected_card_credential_invalid');
-        const credential = JSON.parse(clear.toString());
-        if (!credential ||
-            typeof credential.networkToken !== 'string' ||
-            typeof credential.cryptogramValue !== 'string' ||
-            !Number.isInteger(credential.expMonth) ||
-            credential.expMonth < 1 ||
-            credential.expMonth > 12 ||
-            !Number.isInteger(credential.expYear) ||
-            credential.expYear < 2000 ||
-            typeof credential.cryptogramType !== 'string')
-            throw new Error('protected_card_credential_invalid');
-        return credential;
-    }
-    finally {
-        key.fill(0);
-        clear?.fill(0);
-    }
-}

package/dist/checkout-engine/vgs-live-instrument.d.ts

@@ -1,144 +0,0 @@
-import type { CardCredential, Instrument, InstrumentContext } from './instrument.js';
-export type VgsCheckoutReference = {
-    tokenId: string;
-    intentId: string;
-    merchantName: string;
-    merchantUrl: string;
-    merchantCountryCode: string;
-    transactionAmount: string;
-    transactionCurrencyCode: string;
-};
-export type VgsCheckoutTarget = Omit<VgsCheckoutReference, 'tokenId' | 'intentId'>;
-export type CliAgentCredential = {
-    tokenId: string;
-    /** Present only in artifacts claimed by older CLI versions — never read
-     * here: enrollment-time assurance is not purchase authorization (#5709),
-     * and current CLIs no longer persist it at all. */
-    assuranceData?: unknown;
-    name?: string;
-    agentJkt?: string;
-    claimedAt?: string;
-    source?: string;
-};
-/**
- * Fresh, purchase-scoped assurance from a device-binding passkey ceremony run
- * for THIS purchase. Issue #5709 (confirmed live 2026-07-17): VGS accepts an
- * intent minted from the enrollment-time assurance — and even from a fresh
- * assurance scoped to a DIFFERENT merchant — but the cryptogram then
- * deterministically never completes. Only a ceremony scoped to the actual
- * merchant + amount + currency yields a payable credential, so the declared
- * scope here is validated against the checkout target before any intent is
- * minted, and the enrollment artifact's stored assurance is never used as
- * purchase authorization.
- */
-export type PurchaseAssurance = {
-    /** Opaque VgsAgenticAuth output — never inspected, only forwarded. */
-    assuranceData: unknown;
-    /** ISO 8601 completion time of the ceremony this assurance came from. */
-    mintedAt: string;
-    /** Host of the merchant checkout URL the ceremony was scoped to. */
-    merchantHost: string;
-    /** Decimal major-unit amount the ceremony was scoped to. */
-    transactionAmount: string;
-    /** ISO 4217 currency the ceremony was scoped to. */
-    transactionCurrencyCode: string;
-    /**
-     * True iff the approval server marked this token passkey-exempt ('otp'
-     * cardholder ID&V / 'none' — verified against the owner's account card
-     * record at complete-time): no ceremony ran, `assuranceData` is null by
-     * design, and the intent is minted without it (the signed mint token
-     * carries the same exemption for the server's own check). Absent/false →
-     * assuranceData is REQUIRED, exactly the historical contract.
-     */
-    assuranceExempt?: boolean;
-};
-/**
- * Our fail-closed freshness bound, matching the runner's 15-minute checkout
- * review window — NOT a claim about VGS's actual assurance TTL (unpublished).
- * The only proven-working configuration mints the intent right after the
- * ceremony; anything older is refused before an intent is created.
- */
-export declare const PURCHASE_ASSURANCE_MAX_AGE_MS: number;
-export type VgsPaymentCredential = {
-    networkToken: string;
-    expMonth: number;
-    expYear: number;
-    cryptogramType: string;
-    cryptogramValue: string;
-    cryptogramExpiresAt?: string;
-    vgsTraceId?: string;
-    networkCorrelationId?: string;
-};
-export type FetchVgsPaymentCredential = (input: {
-    tokenId: string;
-    intentId: string;
-    transaction: {
-        merchantName: string;
-        merchantUrl: string;
-        merchantCountryCode: string;
-        transactionAmount: string;
-        transactionCurrencyCode: string;
-    };
-}) => Promise<VgsPaymentCredential>;
-/** The (token, intent) pair a VIC confirmation is posted against. */
-export type VicConfirmationTarget = {
-    tokenId: string;
-    intentId: string;
-};
-export declare function decimalToMinor(value: unknown): number | null;
-/**
- * Currencies whose minor unit is 1/100 of the major unit (2 decimal places).
- * minorToDecimal's /100 + pad-to-2 rendering is ONLY correct for these. The
- * card mandate path accepts any 3-letter ISO code, so a 0- or 3-decimal
- * currency (JPY, BHD, …) would otherwise be emitted with a wrong wire amount.
- * We only support USD/USDC today; extend deliberately (and fix the exponent)
- * before adding any non-2-decimal currency.
- *
- * NOTE (scanner FP pre-empt): this is a CLIENT-SIDE currency-exponent lookup for
- * rendering a wire amount in @visa/checkout-engine — it is NOT the cross-store
- * `PAYMENT_CURRENCIES` enum governed by apps/auth/src/shared-validators.ts, and
- * this package cannot import from apps/auth (no dependency edge). It intentionally
- * does not mirror that enum's membership; do not "reconcile" the two.
- */
-export declare const TWO_DECIMAL_CURRENCIES: Set<string>;
-/**
- * Inverse of decimalToMinor: render integer minor units as a major-unit decimal
- * string ("D.DD") for the VGS wire (e.g. a ceiling of 50000 minor → "500.00").
- * Integer-only; never floating-point money. Throws on a non-integer/negative so
- * a bad accounting value cannot silently reach the network.
- *
- * The /100 + pad-to-2 rendering assumes a 2-decimal (exponent-2) currency. Pass
- * `currencyCode` on any path that accepts arbitrary currencies (the mandate
- * path) and it REFUSES a non-2-decimal currency rather than emit a wrong wire
- * amount. Omit it only where the currency is already known to be USD/USDC.
- */
-export declare function minorToDecimal(minor: number, currencyCode?: string): string;
-/**
- * Refuse to mint an intent unless the assurance is fresh and its declared
- * scope matches the checkout target exactly. `now` is injectable so the
- * freshness rules are testable with a pinned clock (same pattern as
- * validateCredential).
- */
-export declare function validatePurchaseAssurance(value: PurchaseAssurance, target: VgsCheckoutTarget, now?: Date): void;
-export declare function validateCredential(value: VgsPaymentCredential, now?: Date): void;
-/**
- * Mints the full DPAN + short DAVV only after the executor revalidates the
- * reviewed merchant, amount, and currency. The payment credential remains in
- * memory, is never returned to the caller, and can be requested only once.
- */
-export declare class VgsLiveInstrument implements Instrument {
-    private readonly reference;
-    private readonly cardholderName;
-    private readonly fetchCredential;
-    readonly kind: "agentic-token";
-    private used;
-    private minted;
-    constructor(reference: VgsCheckoutReference, cardholderName: string, fetchCredential: FetchVgsPaymentCredential);
-    /**
-     * Non-null once VGS has actually issued a credential (the intent is consumed
-     * from that moment, even if local validation later rejects the credential) —
-     * exactly the population a VIC confirmation can be owed for.
-     */
-    confirmationTarget(): VicConfirmationTarget | null;
-    getCredential(ctx: InstrumentContext): Promise<CardCredential>;
-}