@agent-cards/sdk 0.20.0 → 0.22.0

package/dist/wspay.js

@@ -0,0 +1,65 @@
+// WSPay Components (psp `wspay`), WSPay's build of Monri Components, on proxy.wspay.biz (live)
+// and proxy-test.wspay.biz (test). The card frame is an iframe on the WSPay host, and it sends
+// the card in one same-origin XHR: POST /v2/payment/{client_secret}/confirm. This module holds
+// what the SDK decides about that frame's requests. The rules themselves are payment-core's
+// (wspay.generated.ts): the API applies the same ones at create, and the cardholder's device
+// applies them again before it writes a card.
+//
+// The processor ships dark. The API serves the wspay recognizer only to a build that declares
+// the `wspay_confirm` capability (client.ts SUPPORTED_CAPABILITIES), and only for an org Agentcard
+// enabled for WSPay, so an SDK that has not synced, or that runs for any other org, never
+// recognizes a WSPay host and leaves its requests alone.
+//
+// The client_secret in the confirm URL is a per-payment secret: with the public authenticity
+// token it confirms the payment and reads its status. Nothing here puts it in an event, and
+// redactUrl (client.ts) masks it wherever a URL is reported.
+import { WSPAY_CONFIRM_HOSTS, wspayConfirmRefusal } from './wspay.generated.js';
+export const WSPAY_PSP = 'wspay';
+/** The dark-launch capability the API serves the wspay recognizer behind. */
+export const WSPAY_CAPABILITY = 'wspay_confirm';
+/** True when the URL's host is one of WSPay's two Components hosts. */
+export function isWspayHost(url) {
+    try {
+        return WSPAY_CONFIRM_HOSTS.includes(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
+ * card frame's confirm of a new card for a one-time payment, which pauses for approval;
+ * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
+ * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
+ * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
+ * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
+ * the cardholder.
+ */
+export function wspayRefusal(request) {
+    // No keep-on-file consent (the second argument): no approval asks for it yet.
+    const refusal = wspayConfirmRefusal({ url: request.url, method: 'POST', headers: request.headers ?? {}, body: request.body ?? '' }, undefined);
+    if (refusal === null)
+        return null;
+    return refusal === 'keep_on_file' ? 'wspay_keep_on_file_unsupported' : 'unsupported_wspay_payment_method';
+}
+/**
+ * Whether an approved answer handed to a WSPay confirm is WSPay's 3-D Secure step: HTTP 200 with
+ * status `action_required`, which is how the API stores it (payment-core sanitizeWspayResponse,
+ * with no payment_result). The card frame then runs the bank's challenge in the agent's browser,
+ * and nothing is charged until the cardholder completes it there. The adapters read it after the
+ * handoff to report `requires_user_action` with reason `3ds` (lifecycle.ts).
+ */
+export function isWspayChallenge(requestUrl, replay) {
+    if (replay.mode === 'cse' || replay.mode === 'hosted_form')
+        return false;
+    if (replay.status !== 200 || !isWspayHost(requestUrl))
+        return false;
+    try {
+        const answer = JSON.parse(replay.body);
+        return answer !== null && typeof answer === 'object' && !Array.isArray(answer)
+            && answer.status === 'action_required';
+    }
+    catch {
+        return false;
+    }
+}

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "a67f74c2466590d65338b8a909f4978fc4eebf2c71f20a8bda219cbb6989d010",
+  "catalog_sha256": "65cae3f96adbf90309d08e0a5b3c56160c05ab47b674277d520629a7d67d2d24",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs autopilot.test.mjs stripe-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node fiserv-browser.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",