@visa/cli 4.1.0-rc.297 → 4.1.0-rc.299

package/dist/checkout-engine/vgs-live-instrument.js

@@ -1,229 +0,0 @@
-import { traceHandleFields } from './trace-handles.js';
-/**
- * Our fail-closed freshness bound, matching the runner's 15-minute checkout
- * review window — NOT a claim about VGS's actual assurance TTL (unpublished).
- * The only proven-working configuration mints the intent right after the
- * ceremony; anything older is refused before an intent is created.
- */
-export const PURCHASE_ASSURANCE_MAX_AGE_MS = 15 * 60 * 1000;
-/** Tolerated forward clock skew on `mintedAt` before it is treated as invalid. */
-const PURCHASE_ASSURANCE_MAX_SKEW_MS = 2 * 60 * 1000;
-export function decimalToMinor(value) {
-    // JSON files routinely carry a number where the contract says decimal string
-    // ("transactionAmount": 5): refuse non-strings HERE so every caller surfaces
-    // its scoped invalid/mismatch remedy instead of a raw TypeError crash.
-    if (typeof value !== 'string')
-        return null;
-    if (!/^\d+(\.\d{1,2})?$/.test(value))
-        return null;
-    const [whole, fraction = ''] = value.split('.');
-    const minor = Number(whole) * 100 + Number(fraction.padEnd(2, '0'));
-    return Number.isSafeInteger(minor) ? minor : null;
-}
-/**
- * Currencies whose minor unit is 1/100 of the major unit (2 decimal places).
- * minorToDecimal's /100 + pad-to-2 rendering is ONLY correct for these. The
- * card mandate path accepts any 3-letter ISO code, so a 0- or 3-decimal
- * currency (JPY, BHD, …) would otherwise be emitted with a wrong wire amount.
- * We only support USD/USDC today; extend deliberately (and fix the exponent)
- * before adding any non-2-decimal currency.
- *
- * NOTE (scanner FP pre-empt): this is a CLIENT-SIDE currency-exponent lookup for
- * rendering a wire amount in @visa/checkout-engine — it is NOT the cross-store
- * `PAYMENT_CURRENCIES` enum governed by apps/auth/src/shared-validators.ts, and
- * this package cannot import from apps/auth (no dependency edge). It intentionally
- * does not mirror that enum's membership; do not "reconcile" the two.
- */
-export const TWO_DECIMAL_CURRENCIES = new Set(['USD', 'USDC']);
-/**
- * Inverse of decimalToMinor: render integer minor units as a major-unit decimal
- * string ("D.DD") for the VGS wire (e.g. a ceiling of 50000 minor → "500.00").
- * Integer-only; never floating-point money. Throws on a non-integer/negative so
- * a bad accounting value cannot silently reach the network.
- *
- * The /100 + pad-to-2 rendering assumes a 2-decimal (exponent-2) currency. Pass
- * `currencyCode` on any path that accepts arbitrary currencies (the mandate
- * path) and it REFUSES a non-2-decimal currency rather than emit a wrong wire
- * amount. Omit it only where the currency is already known to be USD/USDC.
- */
-export function minorToDecimal(minor, currencyCode) {
-    if (!Number.isSafeInteger(minor) || minor < 0) {
-        throw new Error('minor units must be a non-negative safe integer');
-    }
-    if (currencyCode !== undefined && !TWO_DECIMAL_CURRENCIES.has(currencyCode.toUpperCase())) {
-        throw new Error(`minorToDecimal only supports 2-decimal currencies (${[...TWO_DECIMAL_CURRENCIES].join('/')}); refusing to emit a wire amount for ${currencyCode}`);
-    }
-    const whole = Math.floor(minor / 100);
-    const fraction = minor % 100;
-    return `${whole}.${String(fraction).padStart(2, '0')}`;
-}
-function validateTarget(reference, ctx) {
-    if (typeof reference.merchantName !== 'string' ||
-        typeof reference.merchantCountryCode !== 'string' ||
-        !reference.merchantName.trim() ||
-        !/^[A-Z]{2}$/.test(reference.merchantCountryCode)) {
-        throw new Error('VGS checkout reference merchant name/country is invalid');
-    }
-    let referenceHost;
-    try {
-        referenceHost = new URL(reference.merchantUrl).hostname;
-    }
-    catch {
-        throw new Error('VGS checkout reference merchant URL is invalid');
-    }
-    if (referenceHost !== ctx.merchantHost) {
-        throw new Error(`VGS credential merchant mismatch: ${referenceHost} vs ${ctx.merchantHost}`);
-    }
-    const amountMinor = decimalToMinor(reference.transactionAmount);
-    if (amountMinor === null)
-        throw new Error('VGS checkout reference amount is invalid');
-    if (amountMinor !== ctx.amountMinor) {
-        throw new Error(`VGS credential amount mismatch: ${amountMinor} vs ${ctx.amountMinor} minor units`);
-    }
-    // String() so a JSON-number currency (840) mismatches with a readable
-    // message instead of crashing on .toUpperCase().
-    const currency = String(reference.transactionCurrencyCode).toUpperCase();
-    if (currency !== ctx.currency) {
-        throw new Error(`VGS credential currency mismatch: ${currency} vs ${ctx.currency}`);
-    }
-}
-/**
- * Refuse to mint an intent unless the assurance is fresh and its declared
- * scope matches the checkout target exactly. `now` is injectable so the
- * freshness rules are testable with a pinned clock (same pattern as
- * validateCredential).
- */
-export function validatePurchaseAssurance(value, target, now = new Date()) {
-    const remedy = 'run a fresh device-binding ceremony scoped to this exact merchant, amount, and ' +
-        'currency, and pass its output via --purchase-assurance-file (#5709)';
-    if (value == null || typeof value !== 'object') {
-        throw new Error(`purchase assurance is missing — ${remedy}`);
-    }
-    // A passkey-exempt approval (marked by the approval SERVER, never assumed
-    // locally) carries no assurance by design — every scope/freshness check
-    // below still applies to it unchanged.
-    if (value.assuranceData == null && value.assuranceExempt !== true) {
-        throw new Error(`purchase assurance requires assuranceData — ${remedy}`);
-    }
-    const mintedAtMs = typeof value.mintedAt === 'string' ? Date.parse(value.mintedAt) : NaN;
-    if (!Number.isFinite(mintedAtMs)) {
-        throw new Error(`purchase assurance requires an ISO 8601 mintedAt — ${remedy}`);
-    }
-    const age = now.getTime() - mintedAtMs;
-    if (age < -PURCHASE_ASSURANCE_MAX_SKEW_MS) {
-        throw new Error(`purchase assurance mintedAt is in the future — ${remedy}`);
-    }
-    if (age > PURCHASE_ASSURANCE_MAX_AGE_MS) {
-        throw new Error(`purchase assurance is stale (minted ${value.mintedAt}, limit ` +
-            `${PURCHASE_ASSURANCE_MAX_AGE_MS / 60000} minutes) — ${remedy}`);
-    }
-    let targetHost;
-    try {
-        targetHost = new URL(target.merchantUrl).hostname;
-    }
-    catch {
-        throw new Error('VGS checkout reference merchant URL is invalid');
-    }
-    if (value.merchantHost !== targetHost) {
-        throw new Error(`purchase assurance merchant mismatch: ${value.merchantHost} vs ${targetHost} — ${remedy}`);
-    }
-    const assuranceMinor = decimalToMinor(value.transactionAmount);
-    const targetMinor = decimalToMinor(target.transactionAmount);
-    if (assuranceMinor === null || assuranceMinor !== targetMinor) {
-        throw new Error(`purchase assurance amount mismatch: ${value.transactionAmount} vs ` +
-            `${target.transactionAmount} — ${remedy}`);
-    }
-    if (typeof value.transactionCurrencyCode !== 'string' ||
-        value.transactionCurrencyCode.toUpperCase() !==
-            String(target.transactionCurrencyCode).toUpperCase()) {
-        throw new Error(`purchase assurance currency mismatch: ${value.transactionCurrencyCode} vs ` +
-            `${target.transactionCurrencyCode} — ${remedy}`);
-    }
-}
-// `now` is injectable so expiry rules are testable with a pinned clock.
-export function validateCredential(value, now = new Date()) {
-    if (!/^\d{12,19}$/.test(value.networkToken)) {
-        throw new Error('VGS credential network token must contain 12-19 digits');
-    }
-    if (!/^\d{3,4}$/.test(value.cryptogramValue)) {
-        throw new Error('VGS credential short DAVV must contain 3-4 digits');
-    }
-    if (typeof value.cryptogramType !== 'string' || value.cryptogramType.toUpperCase() !== 'DAVV') {
-        throw new Error(`VGS credential type ${value.cryptogramType || '<missing>'} is not DAVV`);
-    }
-    if (!Number.isInteger(value.expMonth) || value.expMonth < 1 || value.expMonth > 12) {
-        throw new Error('VGS credential expiration month is invalid');
-    }
-    if (!Number.isInteger(value.expYear) ||
-        value.expYear < now.getFullYear() ||
-        (value.expYear === now.getFullYear() && value.expMonth < now.getMonth() + 1)) {
-        throw new Error('VGS credential is expired');
-    }
-    if (value.cryptogramExpiresAt === undefined) {
-        throw new Error('VGS credential expiry is missing');
-    }
-    const expiresAtMs = Date.parse(value.cryptogramExpiresAt);
-    if (!Number.isFinite(expiresAtMs))
-        throw new Error('VGS credential expiry is invalid');
-    if (expiresAtMs - now.getTime() < 60_000) {
-        throw new Error('VGS credential has less than 60 seconds of validity remaining');
-    }
-}
-/**
- * Mints the full DPAN + short DAVV only after the executor revalidates the
- * reviewed merchant, amount, and currency. The payment credential remains in
- * memory, is never returned to the caller, and can be requested only once.
- */
-export class VgsLiveInstrument {
-    reference;
-    cardholderName;
-    fetchCredential;
-    kind = 'agentic-token';
-    used = false;
-    minted = null;
-    constructor(reference, cardholderName, fetchCredential) {
-        this.reference = reference;
-        this.cardholderName = cardholderName;
-        this.fetchCredential = fetchCredential;
-    }
-    /**
-     * Non-null once VGS has actually issued a credential (the intent is consumed
-     * from that moment, even if local validation later rejects the credential) —
-     * exactly the population a VIC confirmation can be owed for.
-     */
-    confirmationTarget() {
-        return this.minted;
-    }
-    async getCredential(ctx) {
-        if (this.used)
-            throw new Error('VGS live credential instrument is single-use');
-        this.used = true;
-        validateTarget(this.reference, ctx);
-        if (!this.reference.tokenId || !this.reference.intentId) {
-            throw new Error('VGS checkout reference requires tokenId and intentId');
-        }
-        if (!this.cardholderName.trim())
-            throw new Error('cardholder name is required');
-        const { tokenId, intentId, ...transaction } = this.reference;
-        const value = await this.fetchCredential({ tokenId, intentId, transaction });
-        this.minted = { tokenId, intentId };
-        try {
-            validateCredential(value);
-        }
-        catch (err) {
-            // VGS already issued a cryptogram for this intent even though we refuse
-            // to fill it; "correct inputs and retry" would silently reuse a consumed
-            // intent, so steer the operator to a fresh one.
-            throw new Error(`${err.message} — a credential was issued by VGS but rejected locally; obtain a fresh intent before retrying`);
-        }
-        return {
-            pan: value.networkToken,
-            expMonth: value.expMonth,
-            expYear: value.expYear,
-            cvc: value.cryptogramValue,
-            cardholderName: this.cardholderName.trim(),
-            ...(value.cryptogramExpiresAt ? { credentialExpiresAt: value.cryptogramExpiresAt } : {}),
-            ...traceHandleFields(value),
-        };
-    }
-}

package/dist/checkout-engine/vic-confirmation.d.ts

@@ -1,52 +0,0 @@
-import type { CheckoutOutcome } from './executor.js';
-import type { VicConfirmationTarget } from './vgs-live-instrument.js';
-export type VicTransactionStatus = 'APPROVED' | 'DECLINED';
-export type PostVicConfirmation = (input: {
-    tokenId: string;
-    intentId: string;
-    transactionStatus: VicTransactionStatus;
-    transactionType: 'PURCHASE';
-    transactionTimestamp: string;
-    transaction: {
-        transactionAmount: string;
-        transactionCurrencyCode: string;
-    };
-}) => Promise<unknown>;
-/**
- * Why a confirmation was not posted, as a BOUNDED value rather than prose.
- *
- * `reason` below is a human sentence built for the local receipt; it embeds
- * upstream error text and is useless as an aggregate. These three codes are the
- * whole space, and they mean very different things:
- *
- *  - `outcome_not_definitive` — the merchant never gave a definitive answer, so
- *    there is nothing truthful to report. Expected, not a fault.
- *  - `no_credential_minted` — no VIC credential existed for this run, so there
- *    is no intent to confirm against. Expected, not a fault.
- *  - `post_failed` — we HAD a definitive outcome and an intent to report it
- *    against, and the POST did not land. This one is a fault: the processor
- *    lifecycle row is never written, so the purchase can never rank above the
- *    platform's own record no matter how well it actually went.
- */
-export type VicConfirmationSkipCode = 'outcome_not_definitive' | 'no_credential_minted' | 'post_failed';
-export type VicConfirmationReport = {
-    posted: true;
-    transactionStatus: VicTransactionStatus;
-} | {
-    posted: false;
-    code: VicConfirmationSkipCode;
-    reason: string;
-};
-/** Definitive merchant answers map to a status; everything else maps to none. */
-export declare function outcomeToTransactionStatus(outcome: CheckoutOutcome): VicTransactionStatus | null;
-export declare function reportVicOutcome(input: {
-    target: VicConfirmationTarget | null;
-    outcome: CheckoutOutcome;
-    transaction: {
-        transactionAmount: string;
-        transactionCurrencyCode: string;
-    };
-    post: PostVicConfirmation;
-    /** Injectable for tests; defaults to now. */
-    timestamp?: Date;
-}): Promise<VicConfirmationReport>;

package/dist/checkout-engine/vic-confirmation.js

@@ -1,45 +0,0 @@
-/** Definitive merchant answers map to a status; everything else maps to none. */
-export function outcomeToTransactionStatus(outcome) {
-    if (outcome === 'confirmed')
-        return 'APPROVED';
-    if (outcome === 'declined')
-        return 'DECLINED';
-    return null;
-}
-export async function reportVicOutcome(input) {
-    const transactionStatus = outcomeToTransactionStatus(input.outcome);
-    if (!transactionStatus) {
-        return {
-            posted: false,
-            code: 'outcome_not_definitive',
-            reason: `outcome '${input.outcome}' is not a definitive merchant answer — ` +
-                'resolve it with the merchant, then post the confirmation manually',
-        };
-    }
-    if (!input.target) {
-        return {
-            posted: false,
-            code: 'no_credential_minted',
-            reason: 'no VIC credential was minted in this run',
-        };
-    }
-    try {
-        await input.post({
-            tokenId: input.target.tokenId,
-            intentId: input.target.intentId,
-            transactionStatus,
-            transactionType: 'PURCHASE',
-            transactionTimestamp: (input.timestamp ?? new Date()).toISOString(),
-            transaction: input.transaction,
-        });
-        return { posted: true, transactionStatus };
-    }
-    catch (err) {
-        return {
-            posted: false,
-            code: 'post_failed',
-            reason: `confirmation POST failed: ${err.message} — the merchant-reported outcome ` +
-                'remains unverified; retry the confirmation for this intent out-of-band',
-        };
-    }
-}

package/dist/checkout-engine/web-bot-auth.d.ts

@@ -1,98 +0,0 @@
-/** Signature validity ceiling. A signature is a bearer-ish artifact for as long
- *  as it is valid, so the window stays short even if a caller asks for more. */
-export declare const WEB_BOT_AUTH_MAX_TTL_SECONDS = 300;
-/** Default validity. Long enough to survive a redirect chain and a slow TLS
- *  handshake, short enough that a captured signature is near-useless. */
-export declare const WEB_BOT_AUTH_DEFAULT_TTL_SECONDS = 60;
-/** Label for the single signature we emit. RFC 9421 allows several per request. */
-export declare const WEB_BOT_AUTH_SIGNATURE_LABEL = "sig1";
-/** Tag fixed by the Web Bot Auth draft; verifiers select on it. */
-export declare const WEB_BOT_AUTH_TAG = "web-bot-auth";
-/** Components covered by the signature, in the order they appear in the base. */
-export declare const WEB_BOT_AUTH_COVERED_COMPONENTS: readonly ["@authority", "signature-agent"];
-/** Ed25519 private key in JWK form, as stored in the agent's runtime key file. */
-export interface WebBotAuthPrivateJwk {
-    kty: 'OKP';
-    crv: 'Ed25519';
-    x: string;
-    d: string;
-}
-export interface WebBotAuthSigningKey {
-    /** RFC 7638 thumbprint. Must match a `kid` published in the directory. */
-    keyId: string;
-    privateJwk?: WebBotAuthPrivateJwk;
-    signFn?: (signingInput: Uint8Array) => Promise<Uint8Array>;
-}
-export interface WebBotAuthConfig {
-    /** Absolute https URL of the operator-hosted signature directory. */
-    directoryUrl: string;
-    key: WebBotAuthSigningKey;
-    ttlSeconds?: number;
-}
-export interface WebBotAuthHeaders {
-    'Signature-Input': string;
-    Signature: string;
-    'Signature-Agent': string;
-    [header: string]: string;
-}
-export interface SignatureBaseParams {
-    authority: string;
-    directoryUrl: string;
-    keyId: string;
-    created: number;
-    expires: number;
-}
-/**
- * Build the RFC 9421 signature base.
- *
- * The base is what actually gets signed, so its exact bytes are the contract
- * with every verifier — one wrong space or a reordered parameter and the
- * signature fails against a correct key. It is exported and pinned by a
- * deterministic test vector for that reason.
- */
-export declare function buildSignatureBase(params: SignatureBaseParams): string;
-/**
- * The `@signature-params` value, which appears twice: as the final line of the
- * signature base, and verbatim as the `Signature-Input` header value. Building
- * it once is what keeps those two identical — a verifier rederives the base
- * from the header it received, so any divergence fails every signature.
- */
-export declare function buildSignatureParams(params: SignatureBaseParams): string;
-export interface BuildHeadersParams {
-    /** Host (and port, if non-default) of the request being signed. */
-    authority: string;
-    config: WebBotAuthConfig;
-    /** Unix seconds. Injected so tests are deterministic and never wall-clock. */
-    nowSeconds: number;
-}
-/**
- * Produce the three Web Bot Auth headers for one request authority.
- *
- * Throws on unusable key material rather than emitting an unverifiable
- * signature. Callers on the checkout path must treat a throw as "proceed
- * unsigned" — see `webBotAuthHeadersOrNone`.
- */
-export declare function buildWebBotAuthHeaders(params: BuildHeadersParams): WebBotAuthHeaders;
-/**
- * Header-or-nothing wrapper for the checkout path.
- *
- * Signing is an optional trust upgrade, never a precondition for buying
- * something. Unusable key material, a malformed URL, or any crypto failure
- * degrades to an unsigned request — which is exactly what we sent before this
- * module existed — rather than throwing into a live checkout.
- */
-export declare function webBotAuthHeadersOrNone(config: WebBotAuthConfig | null, targetUrl: string, nowSeconds: number): WebBotAuthHeaders | null;
-/**
- * Async version of buildWebBotAuthHeaders, supporting Turnkey or vault signFn signers.
- */
-export declare function buildWebBotAuthHeadersAsync(params: BuildHeadersParams): Promise<WebBotAuthHeaders>;
-export declare function webBotAuthHeadersOrNoneAsync(config: WebBotAuthConfig | null, targetUrl: string, nowSeconds: number): Promise<WebBotAuthHeaders | null>;
-/**
- * Resolve signing config from the environment. Returns `null` — meaning "send
- * unsigned" — unless a directory URL and a usable key are BOTH present.
- *
- * Default-off is deliberate. Until the operator directory is live and serving
- * this key, a signature resolves to nothing and fails verification, which is
- * worse than the honest unsigned request we sent before.
- */
-export declare function resolveWebBotAuthConfig(env: NodeJS.ProcessEnv, loadKey: () => WebBotAuthSigningKey | null): WebBotAuthConfig | null;

package/dist/checkout-engine/web-bot-auth.js

@@ -1,218 +0,0 @@
-/**
- * @purpose Web Bot Auth (RFC 9421) request signing for checkout navigations —
- * the client half of Trusted Agent Protocol verification.
- *
- * Cloudflare's TAP verifies an agent by checking an RFC 9421 HTTP message
- * signature on the request. Three headers carry it: `Signature-Input` names the
- * covered components and parameters, `Signature` carries the Ed25519 signature
- * over the derived base, and `Signature-Agent` gives the URL of the directory
- * that resolves `keyid` to a public key. The checkout browser previously sent
- * none of them, so a TAP-aware edge had nothing to verify and fell through to
- * ordinary bot management.
- *
- * TWO HALVES, BOTH REQUIRED. This module presents a `keyid`; the auth server
- * must publish that key at the `Signature-Agent` URL for anything to resolve.
- * Signing while the directory is absent is strictly worse than not signing,
- * because it advertises intent and then fails verification — which is why
- * signing stays OFF unless explicitly configured with a directory URL.
- *
- * KEY MATERIAL NEVER LEAVES THIS MODULE. The signing key is accepted as a
- * value, used once per request, and never logged, serialized, returned, or
- * attached to evidence. Callers get headers, never the key. This module takes
- * no logger for exactly that reason.
- */
-import { createPrivateKey, sign as cryptoSign } from 'node:crypto';
-/** Signature validity ceiling. A signature is a bearer-ish artifact for as long
- *  as it is valid, so the window stays short even if a caller asks for more. */
-export const WEB_BOT_AUTH_MAX_TTL_SECONDS = 300;
-/** Default validity. Long enough to survive a redirect chain and a slow TLS
- *  handshake, short enough that a captured signature is near-useless. */
-export const WEB_BOT_AUTH_DEFAULT_TTL_SECONDS = 60;
-/** Label for the single signature we emit. RFC 9421 allows several per request. */
-export const WEB_BOT_AUTH_SIGNATURE_LABEL = 'sig1';
-/** Tag fixed by the Web Bot Auth draft; verifiers select on it. */
-export const WEB_BOT_AUTH_TAG = 'web-bot-auth';
-/** Components covered by the signature, in the order they appear in the base. */
-export const WEB_BOT_AUTH_COVERED_COMPONENTS = ['@authority', 'signature-agent'];
-/** Serialize an RFC 8941 structured-field string (always double-quoted). */
-function sfString(value) {
-    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
-}
-/**
- * Build the RFC 9421 signature base.
- *
- * The base is what actually gets signed, so its exact bytes are the contract
- * with every verifier — one wrong space or a reordered parameter and the
- * signature fails against a correct key. It is exported and pinned by a
- * deterministic test vector for that reason.
- */
-export function buildSignatureBase(params) {
-    return [
-        `"@authority": ${params.authority}`,
-        `"signature-agent": ${sfString(params.directoryUrl)}`,
-        `"@signature-params": ${buildSignatureParams(params)}`,
-    ].join('\n');
-}
-/**
- * The `@signature-params` value, which appears twice: as the final line of the
- * signature base, and verbatim as the `Signature-Input` header value. Building
- * it once is what keeps those two identical — a verifier rederives the base
- * from the header it received, so any divergence fails every signature.
- */
-export function buildSignatureParams(params) {
-    return (`(${WEB_BOT_AUTH_COVERED_COMPONENTS.map(sfString).join(' ')})` +
-        `;created=${params.created}` +
-        `;expires=${params.expires}` +
-        `;keyid=${sfString(params.keyId)}` +
-        `;alg="ed25519"` +
-        `;tag=${sfString(WEB_BOT_AUTH_TAG)}`);
-}
-/**
- * Produce the three Web Bot Auth headers for one request authority.
- *
- * Throws on unusable key material rather than emitting an unverifiable
- * signature. Callers on the checkout path must treat a throw as "proceed
- * unsigned" — see `webBotAuthHeadersOrNone`.
- */
-export function buildWebBotAuthHeaders(params) {
-    const { authority, config, nowSeconds } = params;
-    const ttl = Math.min(Math.max(1, Math.floor(config.ttlSeconds ?? WEB_BOT_AUTH_DEFAULT_TTL_SECONDS)), WEB_BOT_AUTH_MAX_TTL_SECONDS);
-    const created = Math.floor(nowSeconds);
-    const expires = created + ttl;
-    const baseParams = {
-        authority,
-        directoryUrl: config.directoryUrl,
-        keyId: config.key.keyId,
-        created,
-        expires,
-    };
-    const base = buildSignatureBase(baseParams);
-    const signatureParams = buildSignatureParams(baseParams);
-    // privateJwk is optional on the key so a vault-held signer can supply signFn
-    // instead. Only the async builder can await such a signer, so refuse here with
-    // the same explicit message rather than handing undefined to createPrivateKey
-    // and surfacing an opaque node:crypto error.
-    if (!config.key.privateJwk) {
-        throw new Error(config.key.signFn
-            ? 'WebBotAuthSigningKey with signFn requires buildWebBotAuthHeadersAsync'
-            : 'WebBotAuthSigningKey requires either privateJwk or signFn');
-    }
-    const privateKey = createPrivateKey({
-        key: config.key.privateJwk,
-        format: 'jwk',
-    });
-    // Ed25519 takes no separate digest algorithm; null is the required argument.
-    const signature = cryptoSign(null, Buffer.from(base, 'utf8'), privateKey);
-    return {
-        'Signature-Input': `${WEB_BOT_AUTH_SIGNATURE_LABEL}=${signatureParams}`,
-        Signature: `${WEB_BOT_AUTH_SIGNATURE_LABEL}=:${signature.toString('base64')}:`,
-        'Signature-Agent': sfString(config.directoryUrl),
-    };
-}
-/**
- * Header-or-nothing wrapper for the checkout path.
- *
- * Signing is an optional trust upgrade, never a precondition for buying
- * something. Unusable key material, a malformed URL, or any crypto failure
- * degrades to an unsigned request — which is exactly what we sent before this
- * module existed — rather than throwing into a live checkout.
- */
-export function webBotAuthHeadersOrNone(config, targetUrl, nowSeconds) {
-    if (!config)
-        return null;
-    try {
-        const authority = new URL(targetUrl).host;
-        if (!authority)
-            return null;
-        return buildWebBotAuthHeaders({ authority, config, nowSeconds });
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Async version of buildWebBotAuthHeaders, supporting Turnkey or vault signFn signers.
- */
-export async function buildWebBotAuthHeadersAsync(params) {
-    const { authority, config, nowSeconds } = params;
-    const ttl = Math.min(Math.max(1, Math.floor(config.ttlSeconds ?? WEB_BOT_AUTH_DEFAULT_TTL_SECONDS)), WEB_BOT_AUTH_MAX_TTL_SECONDS);
-    const created = Math.floor(nowSeconds);
-    const expires = created + ttl;
-    const baseParams = {
-        authority,
-        directoryUrl: config.directoryUrl,
-        keyId: config.key.keyId,
-        created,
-        expires,
-    };
-    const base = buildSignatureBase(baseParams);
-    const signatureParams = buildSignatureParams(baseParams);
-    let signature;
-    if (config.key.signFn) {
-        signature = await config.key.signFn(Buffer.from(base, 'utf8'));
-    }
-    else if (config.key.privateJwk) {
-        const privateKey = createPrivateKey({
-            key: config.key.privateJwk,
-            format: 'jwk',
-        });
-        signature = cryptoSign(null, Buffer.from(base, 'utf8'), privateKey);
-    }
-    else {
-        throw new Error('WebBotAuthSigningKey requires either privateJwk or signFn');
-    }
-    return {
-        'Signature-Input': `${WEB_BOT_AUTH_SIGNATURE_LABEL}=${signatureParams}`,
-        Signature: `${WEB_BOT_AUTH_SIGNATURE_LABEL}=:${Buffer.from(signature).toString('base64')}:`,
-        'Signature-Agent': sfString(config.directoryUrl),
-    };
-}
-export async function webBotAuthHeadersOrNoneAsync(config, targetUrl, nowSeconds) {
-    if (!config)
-        return null;
-    try {
-        const authority = new URL(targetUrl).host;
-        if (!authority)
-            return null;
-        return await buildWebBotAuthHeadersAsync({ authority, config, nowSeconds });
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Resolve signing config from the environment. Returns `null` — meaning "send
- * unsigned" — unless a directory URL and a usable key are BOTH present.
- *
- * Default-off is deliberate. Until the operator directory is live and serving
- * this key, a signature resolves to nothing and fails verification, which is
- * worse than the honest unsigned request we sent before.
- */
-export function resolveWebBotAuthConfig(env, loadKey) {
-    const directoryUrl = env.VISA_WEB_BOT_AUTH_DIRECTORY_URL?.trim();
-    if (!directoryUrl)
-        return null;
-    let parsed;
-    try {
-        parsed = new URL(directoryUrl);
-    }
-    catch {
-        return null;
-    }
-    // A directory fetched over plain http could be swapped in flight, which would
-    // let an observer substitute the key set our identity is judged against.
-    if (parsed.protocol !== 'https:')
-        return null;
-    let key = null;
-    try {
-        key = loadKey();
-    }
-    catch {
-        return null;
-    }
-    if (!key?.keyId || (!key.signFn && (key.privateJwk?.crv !== 'Ed25519' || !key.privateJwk.d)))
-        return null;
-    const rawTtl = Number(env.VISA_WEB_BOT_AUTH_TTL_SECONDS);
-    const ttlSeconds = Number.isFinite(rawTtl) && rawTtl > 0 ? rawTtl : undefined;
-    return { directoryUrl: parsed.toString(), key, ttlSeconds };
-}