@agent-cards/sdk 0.23.13 → 0.23.15

package/dist/redsys.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Redsys's hosted payment page (the TPV Virtual redirect most Spanish banks give their merchants), as
+ * this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://sis.redsys.es/sis/realizarPago
+ * (or /sis/realizarPago/utf-8), and Redsys answers with its own card page under a session of its own.
+ * That entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats
+ * it over the end-to-end TLS relay and fills the card into the page Redsys returns to it (payment-core
+ * processors/redsys.js). Everything else the agent's browser posts to Redsys carries a card the agent
+ * typed, or leads to a page that asks for one: the card page's own post (/sis/pagoTarjeta;jsessionid=...),
+ * the older page's 3-D Secure card lookup (/sis/services/rest/rest3DS/consultaTarjeta3DSPantalla), InSite's
+ * card post (/sis/services/rest/NC/generaIdOper). This SDK aborts every one of them, so a placeholder card
+ * never reaches Redsys.
+ *
+ * The entry host is payment-core's REDSYS_HOSTS; redsys.test.mjs pins the two lists together. The
+ * abort rule also covers Redsys's test platform, sis-t.redsys.es, on any port: it answers on 25443, which
+ * no recognizer takes, so Agentcard pays nothing there, and an entry posted to it opens a page that asks
+ * the agent for a card.
+ */
+export declare const REDSYS_PSP = "redsys";
+export declare const REDSYS_ENTRY_HOSTS: readonly string[];
+export declare const REDSYS_HOSTS: readonly string[];
+/** Whether this URL is on one of Redsys's hosts (https, no credentials, any port). */
+export declare function isRedsysHost(url: string): boolean;
+/**
+ * The only request on Redsys's hosts that is the merchant's entry: a POST to one of the two entry paths on
+ * the live host, written exactly as a form action writes it, with no port, query or fragment
+ * (payment-core isRedsysEntryUrl). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isRedsysEntry(url: string, method: string): boolean;
+/** The entry URL the registry recognizes when this build is armed for Redsys, for any URL on a Redsys host. */
+export declare function redsysEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of Redsys's hosts and
+ * this build's registry serves Redsys's entry. The card page's post and the other card requests are not
+ * the entry, so the registry's card-request test does not name them; the CDP adapter still pauses them
+ * through the recognizer's host patterns, and attachToPlaywright's route predicate asks this, so both
+ * adapters show the gates every request to a Redsys host once Redsys is armed.
+ */
+export declare function isArmedRedsysUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/redsys.js

@@ -0,0 +1,68 @@
+/**
+ * Redsys's hosted payment page (the TPV Virtual redirect most Spanish banks give their merchants), as
+ * this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://sis.redsys.es/sis/realizarPago
+ * (or /sis/realizarPago/utf-8), and Redsys answers with its own card page under a session of its own.
+ * That entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats
+ * it over the end-to-end TLS relay and fills the card into the page Redsys returns to it (payment-core
+ * processors/redsys.js). Everything else the agent's browser posts to Redsys carries a card the agent
+ * typed, or leads to a page that asks for one: the card page's own post (/sis/pagoTarjeta;jsessionid=...),
+ * the older page's 3-D Secure card lookup (/sis/services/rest/rest3DS/consultaTarjeta3DSPantalla), InSite's
+ * card post (/sis/services/rest/NC/generaIdOper). This SDK aborts every one of them, so a placeholder card
+ * never reaches Redsys.
+ *
+ * The entry host is payment-core's REDSYS_HOSTS; redsys.test.mjs pins the two lists together. The
+ * abort rule also covers Redsys's test platform, sis-t.redsys.es, on any port: it answers on 25443, which
+ * no recognizer takes, so Agentcard pays nothing there, and an entry posted to it opens a page that asks
+ * the agent for a card.
+ */
+export const REDSYS_PSP = 'redsys';
+export const REDSYS_ENTRY_HOSTS = Object.freeze(['sis.redsys.es']);
+export const REDSYS_HOSTS = Object.freeze(['sis.redsys.es', 'sis-t.redsys.es']);
+const REDSYS_ENTRY_PATHS = Object.freeze(['/sis/realizarPago', '/sis/realizarPago/utf-8']);
+const REDSYS_ENTRY_URL = 'https://sis.redsys.es/sis/realizarPago';
+/** Whether this URL is on one of Redsys's hosts (https, no credentials, any port). */
+export function isRedsysHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password && REDSYS_HOSTS.includes(parsed.hostname.toLowerCase());
+}
+/**
+ * The only request on Redsys's hosts that is the merchant's entry: a POST to one of the two entry paths on
+ * the live host, written exactly as a form action writes it, with no port, query or fragment
+ * (payment-core isRedsysEntryUrl). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isRedsysEntry(url, method) {
+    if (String(method).toUpperCase() !== 'POST' || typeof url !== 'string')
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && REDSYS_ENTRY_HOSTS.includes(parsed.hostname) && REDSYS_ENTRY_PATHS.includes(parsed.pathname)
+        && !parsed.port && !parsed.username && !parsed.password && parsed.href === url && !/[?#]/.test(url);
+}
+/** The entry URL the registry recognizes when this build is armed for Redsys, for any URL on a Redsys host. */
+export function redsysEntryUrl(url) {
+    return isRedsysHost(url) ? REDSYS_ENTRY_URL : null;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of Redsys's hosts and
+ * this build's registry serves Redsys's entry. The card page's post and the other card requests are not
+ * the entry, so the registry's card-request test does not name them; the CDP adapter still pauses them
+ * through the recognizer's host patterns, and attachToPlaywright's route predicate asks this, so both
+ * adapters show the gates every request to a Redsys host once Redsys is armed.
+ */
+export function isArmedRedsysUrl(vault, url) {
+    const entry = redsysEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}