@agent-cards/sdk 0.23.13 → 0.23.14

package/dist/prepared-processor.js

@@ -177,7 +177,11 @@ function freshCardBody(psp, body) {
  * preparation's, the submit is the /process URL of the page the preparation read, on that page's
  * own host and for its txId, and the request is the page's own new-card submit exactly as the
  * device will judge it, with ppDomain bound to the approved merchant page. A saved card, a wallet,
- * a refused flag, another transaction or another PPS host never spends consent.
+ * a refused flag, another transaction or another PPS host never spends consent. The encrypted
+ * variant (jwePayload) is the page's own submit when the transaction carries a key, so it binds
+ * too: the API's create reads the transaction and holds the body to it (a jwePayload only under a
+ * key, and only while the API admits the encrypted card), and the device seals the approved card
+ * under the key the API's own read hands it.
  */
 function matchesPreparedCreditguard(environment, requestUrl, body, headers, binding) {
     let hostname = '', merchantHost = '';
@@ -194,7 +198,7 @@ function matchesPreparedCreditguard(environment, requestUrl, body, headers, bind
     const txId = creditguardProcessTxId(requestUrl);
     if (page === null || txId === null || page !== requestUrl)
         return false;
-    return creditguardProcessRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? '' }, { merchantHost }) === null;
+    return creditguardProcessRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? '' }, { merchantHost, jwe: true }) === null;
 }
 /**
  * The approved merchant page's host, with its port if it has one: what the Amadeus SDK sends in its