@agent-cards/sdk 0.23.13 → 0.23.15

package/dist/client.js

@@ -15,6 +15,8 @@ import { CONVERGE_CAPABILITY } from './elavon-converge.js';
 import { SHIJI_STS_CAPABILITY, SHIJI_STS_PSP, isShijiStsServedCompanion, isShijiStsServedSubstitution } from './shiji-sts.js';
 import { AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { PADDLE_VGS_CAPABILITY, PADDLE_VGS_PSP, paddleVgsCardFactsOf } from './paddle-vgs.generated.js';
+import { PADDLE_TOKENEX_CAPABILITY, PADDLE_TOKENEX_PSP, isPaddleTokenexServedFacts, isPaddleTokenexServedSubstitution } from './paddle-tokenex.js';
+import { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_PSP } from './wix-payments.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
 import { BuyModule } from './buy.js';
@@ -32,6 +34,7 @@ import { PELECARD_CAPABILITY, PELECARD_PSP } from './pelecard.js';
 import { PRIMER_CAPABILITY, PRIMER_PSP, primerTokenAnswer } from './primer.js';
 import { PAYRAILS_CAPABILITY, isPayrailsPaymentUrl, payrailsAnswer } from './payrails.js';
 import { WSPAY_CAPABILITY, WSPAY_PSP } from './wspay.js';
+import { EbanxFollowUpError } from './ebanx.js';
 import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REPLY_WINDOW_MS, secureAcceptanceCheckoutProfile, secureAcceptanceCheckoutRefusal, secureAcceptanceFrameAnswer, } from './cybersource-secure-acceptance.js';
 /**
  * The modes this SDK can finish. Asked for on syncRegistry (the API serves
@@ -187,6 +190,11 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * Moneris on for. A gated recognizer never sits in BUILTIN_REGISTRY, so it is paused
  * only after a sync.
  *
+ * `redsys_hosted_payment_page`: Redsys's hosted payment page (the TPV Virtual redirect), whose
+ * card-free signed entry this build pauses for the cardholder's device and whose card page this build
+ * never lets the agent's browser post to (pre-claim.ts, redsys.ts). Served on the same terms as NMI's: only
+ * to a build that lists it, for a company Agentcard turned Redsys on for.
+ *
  * `paddle_vgs_cards`: the card request Paddle's checkout frame sends to its VGS card
  * vault (vault.paddle.com/cards) on a checkout that names VGS, only through a prepared
  * checkout: the frame aborts the request 10 seconds after Pay and sends it once more,
@@ -194,8 +202,40 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * device sends the card itself and the frame gets back the stored card's id alone.
  * Served on the same terms: only to a build that lists it, for a company Agentcard
  * turned Paddle on for.
+ *
+ * `paddle_tokenex_pay`: the /pay Paddle's checkout frame sends to its checkout service
+ * (checkout-service.paddle.com) on a checkout that names TokenEx. The frame encrypts the
+ * card in the page under the account's TokenEx key, so /pay carries the placeholder's two
+ * ciphertexts and facts; this build pauses it and writes over them the device's own, under
+ * the key payment-core pins (paddle-tokenex.ts). Served on the same terms: only to a build
+ * that lists it, for a company Agentcard turned Paddle on for.
+ *
+ * `lyra_krypton_payment`: the card payment Lyra's Krypton form (PayZen, Systempay,
+ * Sogecommerce) sends from its hidden checkout frame to ProcessPayment/2 on the brand's API
+ * host. This build pauses only the frame's card body under a form token that pays once; the
+ * cardholder's device sends the card through the checkout relay, and the frame gets Lyra's
+ * answer byte for byte with Lyra's payment id, so it runs any 3-D Secure step itself and its
+ * card-free follow-up passes untouched. Served on the same terms: only to a build that lists
+ * it, for a company Agentcard turned Lyra on for.
+ *
+ * `payfast_card_pay`: the card tab's pay on Payfast's hosted payment page (POST
+ * /eng/method/CreditCard/<uuid>/pay on payment.payfast.io, www.payfast.co.za or the sandbox),
+ * which this build pauses only as the card tab's own form body and answers with Payfast's own
+ * answer as the API recorded it: `[true]` once the payment is done, or the 3-D Secure step the
+ * card tab then runs in the agent's browser. The cardholder's device sends the card through the
+ * checkout relay. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Payfast on for.
+ *
+ * `wix_payments_tokenize`: the card request Wix Cashier's card frame sends to Wix's
+ * tokenizer (cashier-pci.wixapps.net), only through a prepared checkout: Wix's payment
+ * widget fails the payment 30 seconds after it asks the frame for a token. The
+ * cardholder's device sends the card through the checkout relay and the frame gets back
+ * Wix's token. A second card request from the frame, which Wix's frame sends after a 401
+ * or 403 under a fresh instance, is never answered from the same approval. Served on the
+ * same terms: only to a build that lists it, for a company Agentcard turned Wix on for.
  */
-export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization', PADDLE_VGS_CAPABILITY];
+export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization', PADDLE_VGS_CAPABILITY, PADDLE_TOKENEX_CAPABILITY,
+    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -218,13 +258,19 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * token later, so the agent's pair, above zero (MONERIS_PSP below), is the one
  * figure the approval shows. Paddle VGS's card request carries none either: Paddle
  * charges the stored card at /pay for what the checkout says, so the agent's pair,
- * which the prepared checkout carries, is the total the cardholder approves.
+ * which the prepared checkout carries, is the total the cardholder approves. Payfast's
+ * card pay carries none either: the merchant's entry bound the total to the payment,
+ * so the agent sends the total Payfast's page shows, above zero (PAYFAST_PSP below),
+ * and the API holds it to the payment Payfast itself reports. Wix's tokenize request
+ * carries none either: the merchant's page charges Wix's token for its own order, so the
+ * agent's pair, which the prepared checkout carries, is the total the cardholder approves.
  */
 const MONERIS_PSP = 'moneris';
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP];
+const PAYFAST_PSP = 'payfast';
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle' };
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -840,6 +886,14 @@ function refusalsOf(v) {
     }
     return out;
 }
+/**
+ * How often sendEbanxFollowUp reads a send back while the cardholder's device has it: every half second, whatever the
+ * client's own `pollIntervalMs`. One send is out at a time per approval, so this is 120 reads a minute, inside the
+ * API's 240 a minute per caller and authorization (routes/api/v2/checkout-follow-ups.ts).
+ */
+export const EBANX_FOLLOW_UP_READ_MS = 500;
+/** The longest sendEbanxFollowUp waits after reads the API refused as too many (429): 1, 2, 4, 8, then 15 seconds. */
+export const EBANX_FOLLOW_UP_BACKOFF_MAX_MS = 15_000;
 export class CheckoutApiError extends Error {
     status;
     path;
@@ -1012,18 +1066,81 @@ const ACI_CHECKOUT_ID = /[0-9a-f]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}/gi;
 function maskAciCheckout(path) {
     return path.replace(ACI_CHECKOUT, '$1{checkoutId}').replace(ACI_CHECKOUT_ID, '{checkoutId}');
 }
+/**
+ * Payfast's hosted payment page sends the card to /eng/method/CreditCard/<uuid>/pay on its own host
+ * with no auth header and no CSRF token (payment-core payfast.js): the payment's uuid is the
+ * request's only credential, and with it anyone can read that payment page, its amount and its
+ * merchant. Every route of the page carries the same uuid, so on every host Payfast owns (payfast.io and
+ * payfast.co.za and any name under them) any id of its shape, in any case or after an escaped slash,
+ * reads {uuid}.
+ */
+const PAYFAST_HOST = /(?:^|\.)payfast\.(?:io|co\.za)\.?$/i;
+const PAYFAST_UUID = /[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}/gi;
+function maskPayfastUuid(path) {
+    return path.replace(PAYFAST_UUID, '{uuid}');
+}
+/**
+ * Paddle's checkout frame pays a TokenEx checkout with its own /pay on checkout-service.paddle.com
+ * (sandbox-checkout-service in test), and the checkout id in that path is the checkout's only
+ * credential there, no cookies (payment-core paddle-tokenex.js): with it, and the card in the body,
+ * a payment reaches that checkout. On those hosts the segment between /checkout/ or
+ * /transaction-checkout/ and /pay, in any case or after an escaped slash, reads {checkout}.
+ */
+const PADDLE_CHECKOUT_HOST = /^(?:sandbox-)?checkout-service\.paddle\.com\.?$/i;
+const PADDLE_PAY = /(\/(?:checkout|transaction-checkout)(?:\/|%2f))[^/]*(\/pay)/gi;
+function maskPaddleCheckout(path) {
+    return path.replace(PADDLE_PAY, '$1{checkout}$2');
+}
+/**
+ * Lyra's Krypton frame sends its payment to ProcessPayment/2 on the brand's API host with the form
+ * token's session id as a `;jsessionid=` path parameter (payment-core lyra.js). With the form token the
+ * body carries, that id continues the payment on Lyra's side, so on Lyra's hosts it reads `{session}`,
+ * in any case: https://api.systempay.fr/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid={session}.
+ */
+const LYRA_HOST = /^(?:api\.payzen\.eu|api\.systempay\.fr|api-sogecommerce\.societegenerale\.eu|api\.lyra\.com)\.?$/i;
+const LYRA_SESSION = /;jsessionid=[^/;?#]*/gi;
+function maskLyraSession(path) {
+    return path.replace(LYRA_SESSION, ';jsessionid={session}');
+}
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
  * that send it, the text that names those hosts in a string that is not a URL, and the mask. The
  * guard in redact-url.test.mjs fails for a payment-core recognizer that no one has sorted into
  * this list or out of it.
  */
+/**
+ * Redsys's hosted payment page names its session in the path of every page and post after the entry
+ * (/sis/pagoTarjeta;jsessionid=<id>), and that id is what carries a card post into the session the
+ * merchant's signed entry opened. On Redsys's hosts the session id, in any case or escaped, reads
+ * {session}. The entry itself carries none.
+ */
+const REDSYS_HOST = /^sis(?:-t)?\.redsys\.es\.?$/i;
+const REDSYS_SESSION = /((?:;|%3b)jsessionid(?:=|%3d))[^/?#;]*/gi;
+function maskRedsysSession(path) {
+    return path.replace(REDSYS_SESSION, '$1{session}');
+}
+/**
+ * A PayPal order id opens PayPal's own checkout page for that order (/checkoutnow?token=<order id>) to
+ * anyone who holds it, and PayPal's card confirms carry it in the path:
+ * /v2/checkout/orders/<order id>/confirm-payment-source on www, api-m and cors.api. On PayPal's hosts the
+ * segment after /orders/, in any case or after an escaped slash, reads {order}.
+ */
+const PAYPAL_HOST = /(?:^|\.)paypal\.com\.?$/i;
+const PAYPAL_ORDER = /(\/orders(?:\/|%2f))[^/]*/gi;
+function maskPaypalOrder(path) {
+    return path.replace(PAYPAL_ORDER, '$1{order}');
+}
 const PATH_CREDENTIALS = [
     { host: CREDITGUARD_HOST, named: /creditguard\.co\.il/i, mask: maskCreditguardTxId },
     { host: GRAVY_HOST, named: /gr4vy\.app/i, mask: maskGravySession },
     { host: RAPYD_HOST, named: /rapyd\.net/i, mask: maskRapydToken },
     { host: STRIPE_API_HOST, named: /api\.stripe\.com/i, mask: maskStripeSession },
     { host: ACI_HOST, named: /oppwa\.com/i, mask: maskAciCheckout },
+    { host: PAYFAST_HOST, named: /payfast\.(?:io|co\.za)/i, mask: maskPayfastUuid },
+    { host: PADDLE_CHECKOUT_HOST, named: /checkout-service\.paddle\.com/i, mask: maskPaddleCheckout },
+    { host: REDSYS_HOST, named: /redsys\.es/i, mask: maskRedsysSession },
+    { host: LYRA_HOST, named: /(?:payzen\.eu|systempay\.fr|societegenerale\.eu|lyra\.com)/i, mask: maskLyraSession },
+    { host: PAYPAL_HOST, named: /paypal\.com/i, mask: maskPaypalOrder },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1039,6 +1156,13 @@ const PATH_CREDENTIALS = [
  * On Rapyd's hosts the hosted page's id reads `{token}`: https://api.rapyd.net/v1/checkout/{token}.
  * On api.stripe.com a Checkout Session id reads `{session}`:
  * https://api.stripe.com/v1/payment_pages/{session}/confirm.
+ * On Payfast's hosts the payment's uuid reads `{uuid}`:
+ * https://payment.payfast.io/eng/method/CreditCard/{uuid}/pay.
+ * On Redsys's hosts the session id after `;jsessionid=` reads `{session}`:
+ * https://sis.redsys.es/sis/pagoTarjeta;jsessionid={session}.
+ * On Lyra's API hosts the form token's session id reads `{session}`.
+ * On PayPal's hosts an order id reads `{order}`:
+ * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */
@@ -1127,17 +1251,26 @@ const SECURE_ACCEPTANCE_PREPARATION_REFUSALS = [
 const PADDLE_VGS_PREPARATION_REFUSALS = [
     'processor_unavailable', 'sandbox_host_on_live_row', 'live_host_on_sandbox_row', 'merchant_profile_mismatch', 'paddle_vgs_card_unsupported',
 ];
+/**
+ * The API's refusals of a Wix Payments preparation, before any preparation exists, that prepareCheckout
+ * surfaces by name: the lane is held to Agentcard's own account (`processor_unavailable`), a test client
+ * asked for it (`live_host_on_sandbox_row`: Wix has no test environment), and a checkout's merchant is not
+ * the name the reviewed store pin carries (`merchant_profile_mismatch`). An unreviewed store answers
+ * `unsupported_checkout`, which PREPARATION_REFUSALS names for every checkout. Only for a Wix checkout.
+ */
+const WIX_PAYMENTS_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'merchant_profile_mismatch'];
 /**
  * The reason the cardholder's device declines a bound prepared row with, per processor, when its own
  * send boundary passed before the card left it (the Vault's sendWindow, 12 seconds after it last saw
- * the checkout unbound): a prepared Amadeus SDK add and a prepared Secure Acceptance token create. It
- * names the same known non-payment the adapters' own send window closes on (amadeus.ts), which can
- * close later, so authorize() ends the attempt the way that window does, as a CheckoutPreparationError
- * with that reason, and never as the cardholder's "no".
+ * the checkout unbound): a prepared Amadeus SDK add, a prepared Secure Acceptance token create and a
+ * prepared Wix tokenize request. It names the same known non-payment the adapters' own send window
+ * closes on (amadeus.ts), which can close later, so authorize() ends the attempt the way that window
+ * does, as a CheckoutPreparationError with that reason, and never as the cardholder's "no".
  */
 const PREPARED_SEND_WINDOW_DECLINES = Object.freeze({
     amadeus_checkout: 'amadeus_send_window_closed',
     [SECURE_ACCEPTANCE_PSP]: 'secure_acceptance_send_window_closed',
+    [WIX_PAYMENTS_PSP]: 'wix_payments_send_window_closed',
 });
 /**
  * Refusals a CyberSource Flex preparation that tokenizes before Pay answers (4xx) before any
@@ -1341,7 +1474,7 @@ export class VaultClient {
         // wspay_confirm, shiji_sts_pinned_key, amadeus_checkout_actions.v1,
         // worldline_mycheckout_form, verifone_card_capture, ekashu_hosted_payment_page,
         // cybersource_sa_token_create, gravy_session_fields_put,
-        // moneris_hosted_tokenization) and
+        // moneris_hosted_tokenization, paddle_vgs_cards, redsys_hosted_payment_page) and
         // the caller's company is one Agentcard turned that processor on for, so this
         // build arms Fiserv's card capture, GMO's getToken, CyberSource Flex's card
         // fields, Juspay's card flow, Datatrans's Secure Fields card post, the
@@ -1720,7 +1853,10 @@ export class VaultClient {
                 ...(fiservPin ? { merchant_profile: fiservPin.id } : {}),
                 ...(verifone ? { merchant_profile: verifone.id } : {}),
                 ...(declaration ? { sandbox_declaration: { endpoint: declaration.endpoint, client_key: declaration.clientKey, environment: 'test' } } : {}),
-                ...(input.psp === 'creditguard' ? { payment_page_url: input.paymentPageUrl } : {}),
+                // CreditGuard: this build answers the hosted page's own 3-D Secure calls (pre-claim.ts), so the
+                // cardholder's device can run 3-D Secure before the submit; the API admits such a transaction
+                // only for a build that says so.
+                ...(input.psp === 'creditguard' ? { payment_page_url: input.paymentPageUrl, three_d_secure: 'device' } : {}),
                 ...(eprotect ? { paypage_id: input.paypageId } : {}),
                 ...(secureAcceptance ? { secure_acceptance_profile_id: secureAcceptanceProfileId } : {}),
                 ...(flexContext ? { capture_context: flexContext.captureContext,
@@ -1816,6 +1952,7 @@ export class VaultClient {
                     || (input.psp === 'fiserv' && FISERV_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === EPROTECT_PSP && EPROTECT_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === PADDLE_VGS_PSP && PADDLE_VGS_PREPARATION_REFUSALS.includes(error.code))
+                    || (input.psp === WIX_PAYMENTS_PSP && WIX_PAYMENTS_PREPARATION_REFUSALS.includes(error.code))
                     || (!!flexContext && CYBERSOURCE_FLEX_PREPARATION_REFUSALS.includes(error.code))))
                     || (input.psp === 'fiserv' && error.status === 502 && error.code === 'cse_key_unavailable')))
                 throw fail(error.code);
@@ -2099,9 +2236,10 @@ export class VaultClient {
         // amount_required.
         if (!hasAmount && rec && AGENT_AMOUNT_PROCESSORS.includes(rec.psp))
             throw new AmountRequiredError(rec.psp);
-        // A Moneris token is charged later for whatever the merchant's server decides, so a zero pair
-        // would show the cardholder no price at all: it is refused like a missing one.
-        if (hasAmount && rec && rec.psp === MONERIS_PSP && Number(input.amount) <= 0)
+        // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay
+        // charges the total its payment already holds, so a zero pair would show the cardholder no price
+        // at all: it is refused like a missing one.
+        if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP) && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the
@@ -2420,10 +2558,14 @@ export class VaultClient {
                         // the page's reviewed getCvvId keys (no keys, no continuation);
                         // every other processor names a holder path, as before.
                         const shiji = rec?.psp === SHIJI_STS_PSP;
+                        // Paddle TokenEx carries the two ciphertexts at tokenex_card and the five facts beside them in
+                        // `paddle_tokenex_facts` (the expiry parts are numbers, so they cannot ride `fields`).
+                        const paddleTokenex = rec?.psp === PADDLE_TOKENEX_PSP;
                         const fieldsOk = shiji ? isShijiStsServedSubstitution(sub) && isShijiStsServedCompanion(s.shiji_sts_companion)
-                            : sub && typeof sub === 'object' && sub.encoding === 'json' && typeof sub.at === 'string' && sub.at
-                                && sub.fields && typeof sub.fields === 'object' && !Array.isArray(sub.fields)
-                                && Object.values(sub.fields).every((v) => typeof v === 'string' && v.length > 0);
+                            : paddleTokenex ? isPaddleTokenexServedSubstitution(sub) && isPaddleTokenexServedFacts(s.paddle_tokenex_facts)
+                                : sub && typeof sub === 'object' && sub.encoding === 'json' && typeof sub.at === 'string' && sub.at
+                                    && sub.fields && typeof sub.fields === 'object' && !Array.isArray(sub.fields)
+                                    && Object.values(sub.fields).every((v) => typeof v === 'string' && v.length > 0);
                         if (!fieldsOk)
                             throw new PaymentOutcomeUnknownError(authorizationId, 'cse_substitutions_malformed');
                         // A Fiserv approval carries exactly its envelope's four members at
@@ -2448,6 +2590,7 @@ export class VaultClient {
                                 ...(removeRaw ? { remove: [...removeRaw] } : {}),
                             },
                             ...(shiji ? { shijiStsCompanion: Object.freeze({ keySequenceSha256: Object.freeze([...s.shiji_sts_companion.key_sequence_sha256]) }) } : {}),
+                            ...(paddleTokenex ? { paddleTokenexFacts: Object.freeze({ ...s.paddle_tokenex_facts }) } : {}),
                             ...amountAuthority,
                             ...execution,
                         };
@@ -2641,6 +2784,9 @@ export class VaultClient {
                         chargedAmount: typeof s.charged_amount === 'number' ? s.charged_amount : null,
                         chargedCurrency: typeof s.charged_currency === 'string' ? s.charged_currency : null,
                         chargedKind: s.charged_kind === 'captured' || s.charged_kind === 'authorized' || s.charged_kind === 'none' ? s.charged_kind : null,
+                        // An EBANX token approval that covers the sends after it names until when (ebanx.ts EbanxFollowUps).
+                        ...(rec?.psp === 'ebanx' && typeof s.follow_ups?.until === 'string' && Number.isFinite(Date.parse(s.follow_ups.until))
+                            ? { followUpsUntil: s.follow_ups.until } : {}),
                         ...amountAuthority,
                         ...execution,
                     };
@@ -2838,6 +2984,79 @@ export class VaultClient {
         }
         return { setupIntentId: confirmed };
     }
+    /**
+     * Send one request an approved EBANX token request covers (ebanx.ts says which: EBANX's 3-D Secure calls and the
+     * hosted page's confirm, bound to that approval) from the cardholder's device, and resolve with EBANX's answer for
+     * the paused request: POST /v2/checkout/authorizations/:id/follow_ups with the request as the page sent it, the
+     * agent's placeholder card in it, then the send read back every half second until the device answered
+     * (EBANX_FOLLOW_UP_READ_MS, whatever `pollIntervalMs` says, so the reads stay inside the API's per-approval budget).
+     * A read the API refuses as too many (429) waits longer each time, doubling from a second up to
+     * EBANX_FOLLOW_UP_BACKOFF_MAX_MS, inside the same deadline, and the next answered read goes back to the half second.
+     * No prompt: the cardholder approved the token request, and the Vault page that sent it sends these while it stays
+     * open. Rejects with an EbanxFollowUpError naming why there is no answer and whether the card may have reached
+     * EBANX: the API refused the send (nothing sent), no device started it in time, the device refused it or withheld
+     * an answer that carried the card, or `options.until` (the approval's window, plus the API's own clocks) passed.
+     */
+    async sendEbanxFollowUp(authorizationId, request, options = {}) {
+        if (!/^cauth_[A-Za-z0-9_-]{1,128}$/.test(authorizationId))
+            throw new Error('Invalid authorization ID.');
+        const base = `/v2/checkout/authorizations/${authorizationId}/follow_ups`;
+        // The API's own clocks: a minute for a device to start a send and a minute for its answer.
+        const deadline = Math.min(Date.now() + 3 * 60_000, (options.until ?? Number.POSITIVE_INFINITY) + 2 * 60_000);
+        const signal = options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(Math.max(1, deadline - Date.now()))]) : AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+        let created;
+        try {
+            created = await this.post(base, { request: { url: request.url, method: 'POST', headers: pickHeaders(request.headers, []), body: request.body } }, AbortSignal.any([signal, AbortSignal.timeout(15_000)]));
+        }
+        catch (error) {
+            // A refusal (a 4xx answer) stored no send, so nothing left. Any other failure (a 5xx, a timeout, a dropped
+            // connection, an unreadable 201) may have come after the API stored the send, which the device then sends:
+            // the card may reach EBANX, and for a confirm that is a payment whose outcome is unknown.
+            const refused = error instanceof CheckoutApiError && error.status >= 400 && error.status < 500;
+            const reason = error instanceof CheckoutApiError
+                ? (typeof error.details.reason === 'string' && /^[a-z_]{1,64}$/.test(error.details.reason) ? error.details.reason : error.code ?? `http_${error.status}`)
+                : 'follow_up_unavailable';
+            throw new EbanxFollowUpError(reason, !refused, authorizationId);
+        }
+        const id = created?.id;
+        if (typeof id !== 'string' || !/^cfu_[0-9a-f]{24}$/.test(id) || created.authorization !== authorizationId) {
+            throw new EbanxFollowUpError('follow_up_unrecognized', true, authorizationId);
+        }
+        // Reads the API refused in a row as too many (429): each waits twice as long as the last before the next read.
+        let limited = 0;
+        for (;;) {
+            let read = null;
+            try {
+                read = await this.get(`${base}/${id}`, AbortSignal.any([signal, AbortSignal.timeout(15_000)]));
+                limited = 0;
+            }
+            catch (error) {
+                if (signal.aborted)
+                    throw new EbanxFollowUpError('answer_late', true, authorizationId);
+                if (error instanceof CheckoutApiError && error.status === 429)
+                    limited += 1;
+            }
+            if (read?.status === 'answered') {
+                const r = read.response;
+                if (!r || !Number.isInteger(r.status) || r.status < 200 || r.status > 599 || typeof r.body !== 'string' || !r.headers || typeof r.headers !== 'object') {
+                    throw new EbanxFollowUpError('follow_up_unrecognized', true, authorizationId);
+                }
+                const headers = {};
+                for (const [name, value] of Object.entries(r.headers))
+                    if (name.toLowerCase() === 'content-type' && typeof value === 'string')
+                        headers['content-type'] = value;
+                return { status: r.status, headers: headers['content-type'] ? headers : { 'content-type': 'application/json' }, body: r.body };
+            }
+            if (read?.status === 'failed' || read?.status === 'expired') {
+                const reason = typeof read.failure_reason === 'string' && /^[a-z_]{1,64}$/.test(read.failure_reason) ? read.failure_reason : read.status;
+                throw new EbanxFollowUpError(reason, read.card_sent !== false, authorizationId);
+            }
+            if (signal.aborted || Date.now() >= deadline)
+                throw new EbanxFollowUpError('answer_late', true, authorizationId);
+            const wait = limited === 0 ? EBANX_FOLLOW_UP_READ_MS : Math.min(EBANX_FOLLOW_UP_BACKOFF_MAX_MS, 1000 * 2 ** (limited - 1));
+            await interruptibleSleep(Math.max(1, Math.min(wait, deadline - Date.now())), signal);
+        }
+    }
     /**
      * Create a merchant-session probe, the phase-0 read of the deterministic merchant total:
      * `user` is the org's connected user, who opens the returned Vault link and reads the

package/dist/creditguard.generated.d.ts

@@ -51,11 +51,13 @@ declare function parseCreditguardTransaction(body: any, txId: any): {
     dccActive: boolean;
     recaptcha: boolean;
     jwePublicKey: string;
+    jwePublicKeyJson: any;
     personalIdAlwaysEnabled: boolean;
     inputs: any;
 } | null;
-declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "transaction_unreadable" | "three_d_secure" | "form_inputs" | "card_field_hidden" | "jwe_public_key_malformed" | null;
+declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "three_d_secure" | "transaction_unreadable" | "form_inputs" | "card_field_hidden" | "jwe_public_key_malformed" | null;
 declare function creditguardSendWindowRefusal(timing: any): "timing_unknown" | "page_expired" | "recaptcha_expired" | null;
+declare function creditguardBodyTransactionRefusal(body: any, txn: any): "jwe_mismatch" | null;
 declare var CREDITGUARD_REFUSAL_CODES: readonly string[];
 declare function creditguardResponseOutcome(status: any, body: any, options: any): {
     outcome: string;
@@ -76,4 +78,100 @@ declare function creditguardFacts(status: any, body: any): {
     errorCode: any;
     refusalCode: any;
 };
-export { CREDITGUARD_JWE_HEADER, CREDITGUARD_OPERATION, CREDITGUARD_PAGE_WINDOW_MS, CREDITGUARD_PPS_HOSTS, CREDITGUARD_RECAPTCHA_WINDOW_MS, CREDITGUARD_REFUSAL_CODES, CREDITGUARD_SANDBOX_HOST, classifyCreditguardRequest, creditguardBodyRefusal, creditguardFacts, creditguardNuveiRefusal, creditguardPageProcessUrl, creditguardPpDomainHost, creditguardPreparationEnvironment, creditguardProcessRefusal, creditguardProcessTxId, creditguardRefusalMessage, creditguardReplayRefusal, creditguardResponseOutcome, creditguardSendWindowRefusal, creditguardTransactionReadUrl, creditguardTransactionRefusal, encryptCreditguardJwe, injectCreditguardCard, injectCreditguardJweCard, isCreditguardJweCompact, isCreditguardPpsDocument, isCreditguardProcessRequest, isCreditguardProcessUrl, parseCreditguardJwePublicKey, parseCreditguardTransaction, readCreditguardJson, sanitizeCreditguardResponse };
+declare var CREDITGUARD_COMPANION_PATHS: Readonly<{
+    card_details: "/card/details";
+    ddc_init: "/cc/ddc/init";
+    threeds_init: "/cg3ds/process/init";
+    threeds_outcome: "/cg3ds/process/outcome";
+}>;
+declare var CREDITGUARD_DEVICE_STEPS: readonly string[];
+declare var CREDITGUARD_CARDINAL_HOSTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare var CREDITGUARD_CARDINAL_COLLECT_URLS: Readonly<{
+    production: "https://client.cardinaltrusted.com/centinelapi/V2/Cruise/Collect";
+    sandbox: "https://cas.client.cardinaltrusted.com/centinelapi/V2/Cruise/Collect";
+}>;
+declare function creditguardCompanionStep(url: any): {
+    step: string;
+    txId: string;
+} | null;
+declare function creditguardDeviceStepUrl(processUrl: any, step: any): string | null;
+declare function creditguardCompanionCall(url: any, method: any, body: any): {
+    step: null;
+    txId: null;
+    refusal: string;
+} | {
+    refusal: string | null;
+    step: string;
+    txId: string;
+} | null;
+declare function creditguardCompanionAnswer(step: any): {
+    status: number;
+    headers: {
+        "content-type": string;
+    };
+    body: any;
+} | null;
+declare function creditguardDeviceDdcRequest(processUrl: any, card: any, options?: {}): Promise<{
+    url: string;
+    method: string;
+    headers: {
+        "content-type": "application/json";
+        accept: "application/json";
+    };
+    body: string;
+}>;
+declare function creditguardDeviceThreeDSInitRequest(processUrl: any, card: any, options?: {}): {
+    url: string;
+    method: string;
+    headers: {
+        "content-type": "application/json";
+        accept: "application/json";
+    };
+    body: string;
+};
+declare function creditguardDeviceThreeDSOutcomeRequest(processUrl: any): {
+    url: string;
+    method: string;
+    headers: {
+        "content-type": "application/json";
+        accept: "application/json";
+    };
+    body: string;
+};
+declare function creditguardDeviceStepRefusal(request: any, processUrl: any): "headers" | "malformed_body" | "wallet" | "unexpected_field" | "gift_card" | "dcc" | "txid_mismatch" | "card_fields" | "not_companion_request" | null;
+declare function creditguardCardinalUrl(url: any, purpose: any, environment: any): string | null;
+declare function isCreditguardCardinalOrigin(origin: any): boolean;
+declare function creditguardCardinalMessage(data: any): {
+    sessionId: any;
+} | null;
+declare function creditguardDdcAnswer(status: any, body: any, environment: any): {
+    collectUrl: any;
+    ddcJwt: any;
+} | null;
+declare function creditguardThreeDSInitAnswer(status: any, body: any, environment: any): {
+    outcome: string;
+    reason: string;
+    stepUpUrl?: undefined;
+    stepUpJwt?: undefined;
+} | {
+    outcome: string;
+    reason?: undefined;
+    stepUpUrl?: undefined;
+    stepUpJwt?: undefined;
+} | {
+    outcome: string;
+    stepUpUrl: string;
+    stepUpJwt: any;
+    reason?: undefined;
+};
+declare function creditguardThreeDSOutcomeAnswer(status: any, body: any): {
+    outcome: string;
+    reason: string;
+} | {
+    outcome: string;
+    reason?: undefined;
+};
+export { CREDITGUARD_CARDINAL_COLLECT_URLS, CREDITGUARD_CARDINAL_HOSTS, CREDITGUARD_COMPANION_PATHS, CREDITGUARD_DEVICE_STEPS, CREDITGUARD_JWE_HEADER, CREDITGUARD_OPERATION, CREDITGUARD_PAGE_WINDOW_MS, CREDITGUARD_PPS_HOSTS, CREDITGUARD_RECAPTCHA_WINDOW_MS, CREDITGUARD_REFUSAL_CODES, CREDITGUARD_SANDBOX_HOST, classifyCreditguardRequest, creditguardBodyRefusal, creditguardBodyTransactionRefusal, creditguardCardinalMessage, creditguardCardinalUrl, creditguardCompanionAnswer, creditguardCompanionCall, creditguardCompanionStep, creditguardDdcAnswer, creditguardDeviceDdcRequest, creditguardDeviceStepRefusal, creditguardDeviceStepUrl, creditguardDeviceThreeDSInitRequest, creditguardDeviceThreeDSOutcomeRequest, creditguardFacts, creditguardNuveiRefusal, creditguardPageProcessUrl, creditguardPpDomainHost, creditguardPreparationEnvironment, creditguardProcessRefusal, creditguardProcessTxId, creditguardRefusalMessage, creditguardReplayRefusal, creditguardResponseOutcome, creditguardSendWindowRefusal, creditguardThreeDSInitAnswer, creditguardThreeDSOutcomeAnswer, creditguardTransactionReadUrl, creditguardTransactionRefusal, encryptCreditguardJwe, injectCreditguardCard, injectCreditguardJweCard, isCreditguardCardinalOrigin, isCreditguardJweCompact, isCreditguardPpsDocument, isCreditguardProcessRequest, isCreditguardProcessUrl, parseCreditguardJwePublicKey, parseCreditguardTransaction, readCreditguardJson, sanitizeCreditguardResponse };