/** * card-fields.ts, recognising a payment field on any page. * * Lives in security/ rather than in payments/ or browser/ because both need it * and neither owns it. The browser's snapshot must suppress a payment field's * value whether or not the payment capability is even configured, and the * payment capability must classify the same way the snapshot does or the two * disagree about what was protected. A shared rule in the layer they both * already depend on is the only arrangement where that cannot drift. * * It is also why `platform/browser/` still imports no product surface: this is * foundation, like link validation and the public-suffix list beside it. * * ── Why this is a classification and not a lookup ───────────────────────── * * There is no registry of merchants here and there must never be one. A rule * written against the standard `autocomplete` tokens works on every checkout * that wants browser autofill to function, which is every checkout that works * at all; the name and id patterns catch the rest. Neither needs to know which * site it is looking at. * * ── Erring toward yes ───────────────────────────────────────────────────── * * A false positive costs the model the contents of one form field, which it can * ask the owner about. A false negative hands it a card number. Those are not * comparable, so the patterns are broad and the tie goes to suppression. */ /** * Everything about one control the classification may look at. * * A plain record rather than a DOM element, because the function that walks a * page is serialized and evaluated inside the browser and can import nothing. * The in-page collector gathers these attributes; the judgement happens in * process, where it can be tested against real inputs instead of merely read. */ export interface FormControlDescriptor { readonly tag: string; readonly type: string; readonly autocomplete: string; readonly name: string; readonly id: string; readonly placeholder: string; readonly ariaLabel: string; readonly label: string; } /** Whether this control is a payment field whose value must never be reported. */ export declare function isCardFieldDescriptor(control: FormControlDescriptor): boolean; //# sourceMappingURL=card-fields.d.ts.map