@agent-cards/sdk 0.23.17 → 0.23.18

package/dist/client.js

@@ -233,9 +233,17 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * Wix's token. A second card request from the frame, which Wix's frame sends after a 401
  * or 403 under a fresh instance, is never answered from the same approval. Served on the
  * same terms: only to a build that lists it, for a company Agentcard turned Wix on for.
+ *
+ * `paymongo_checkout_pay`: the card attach PayMongo's hosted checkout sends to its own page
+ * URL (checkout.paymongo.com/<session>) as a Next.js Server Action. This build pauses only the
+ * page's own card attach and answers it with PayMongo's answer as the API recorded it, under the
+ * RSC type the page reads: a paid payment intent, or the step toward PayMongo's 3-D Secure page
+ * that the page then runs in the agent's browser. The cardholder's device sends the card through
+ * the checkout relay. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned PayMongo on for.
  */
 export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization', PADDLE_VGS_CAPABILITY, PADDLE_TOKENEX_CAPABILITY,
-    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY];
+    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY, 'paymongo_checkout_pay'];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -264,13 +272,18 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * and the API holds it to the payment Payfast itself reports. Wix's tokenize request
  * carries none either: the merchant's page charges Wix's token for its own order, so the
  * agent's pair, which the prepared checkout carries, is the total the cardholder approves.
+ * PayMongo's card attach carries none either: the merchant bound the total, always in
+ * Philippine pesos, to the checkout session when it created it, so the agent sends that
+ * total, above zero (PAYMONGO_PSP below), and the API holds it to the session PayMongo's
+ * own page shows.
  */
 const MONERIS_PSP = 'moneris';
 const PAYFAST_PSP = 'payfast';
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP];
+const PAYMONGO_PSP = 'paymongo';
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP, PAYMONGO_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix' };
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix', [PAYMONGO_PSP]: 'PayMongo' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -1000,10 +1013,27 @@ function parseErrorEnvelope(bodyText) {
     }
     return { code: null, details: {} };
 }
+/**
+ * A slash as the masks below read one: plain, or escaped once or more in either case (%2F, %2f, %252F). A path keeps
+ * an escape as it was written, and the id behind it is the same id, so every slash a mask names reads in any of these
+ * spellings. The slashes right before an id read as a run, and a doubled slash hides nothing either.
+ */
+const SLASH = '(?:/|%(?:25)*2f)';
+/** A hyphen inside an id: plain, or escaped once or more in either case (%2D, %252d). */
+const HYPHEN = '(?:-|%(?:25)*2d)';
+/**
+ * The masks that find a uuid by its shape take it in any case, with or without its hyphens, each hyphen in any
+ * spelling HYPHEN reads. The pattern reads a percent escape as one unit and keeps it, so the hex digits of an escaped
+ * separator before the id (%2F, %252F, %3D) never start a match and leave the id's last digits showing.
+ */
+const UUID_OR_ESCAPE = new RegExp(`%(?:25)*[0-9a-f]{2}|[0-9a-f]{8}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{4}${HYPHEN}?[0-9a-f]{12}`, 'gi');
+function maskUuids(path, label) {
+    return path.replace(UUID_OR_ESCAPE, (token) => (token.startsWith('%') ? token : label));
+}
 const CREDITGUARD_HOST = /(?:^|\.)creditguard\.co\.il\.?$/i;
+const CREDITGUARD_TXN = new RegExp(`(${SLASH}txn${SLASH}+)[^/]+`, 'gi');
 function maskCreditguardTxId(path) {
-    return path.replace(/(\/txn\/)[^/]+/gi, '$1{txId}')
-        .replace(/[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}/gi, '{txId}');
+    return maskUuids(path.replace(CREDITGUARD_TXN, '$1{txId}'), '{txId}');
 }
 /**
  * Hosts that put a per-payment secret in the PATH: Monri Components and
@@ -1012,8 +1042,8 @@ function maskCreditguardTxId(path) {
  * public token that secret confirms the payment and reads its status.
  */
 const PATH_SECRET_HOSTS = ['proxy.wspay.biz', 'proxy-test.wspay.biz', 'ipg.monri.com', 'ipgtest.monri.com'];
-/** The segment after a `payment` segment, in any case (the WSPay proxy is IIS) or after an escaped slash. */
-const PATH_SECRET = /(\/payment(?:\/|%2f))[^/]*/gi;
+/** The segment after a `payment` segment, in any case (the WSPay proxy is IIS) and any spelling of its slashes. */
+const PATH_SECRET = new RegExp(`(${SLASH}payment${SLASH}+)[^/]*`, 'gi');
 /**
  * Gravy (Gr4vy) gives every merchant hosts of its own under gr4vy.app, and Secure Fields sends the
  * card to /checkout/sessions/<session id>/fields with no auth header, so the session id is that
@@ -1023,10 +1053,9 @@ const PATH_SECRET = /(\/payment(?:\/|%2f))[^/]*/gi;
  * session ids.
  */
 const GRAVY_HOST = /(?:^|\.)gr4vy\.app\.?$/i;
-const GRAVY_SESSION = /(\/checkout\/sessions(?:\/|%2f))[^/]*/gi;
-const GRAVY_SESSION_ID = /[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}/gi;
+const GRAVY_SESSION = new RegExp(`(${SLASH}checkout${SLASH}sessions${SLASH}+)[^/]*`, 'gi');
 function maskGravySession(path) {
-    return path.replace(GRAVY_SESSION, '$1{session}').replace(GRAVY_SESSION_ID, '{session}');
+    return maskUuids(path.replace(GRAVY_SESSION, '$1{session}'), '{session}');
 }
 /**
  * Rapyd's hosted pages send the card to api.rapyd.net (sandboxapi.rapyd.net in test) with no auth
@@ -1037,7 +1066,7 @@ function maskGravySession(path) {
  * after an escaped slash, read {token}.
  */
 const RAPYD_HOST = /(?:^|\.)rapyd\.net\.?$/i;
-const RAPYD_CARD_PAGE = /(\/hosted\/collect\/card(?:\/|%2f))[^/]*/gi;
+const RAPYD_CARD_PAGE = new RegExp(`(${SLASH}hosted${SLASH}collect${SLASH}card${SLASH}+)[^/]*`, 'gi');
 const RAPYD_PAGE_ID = /(?:checkout|hp_[a-z]+)_[a-z0-9]+/gi;
 function maskRapydToken(path) {
     return path.replace(RAPYD_CARD_PAGE, '$1{token}').replace(RAPYD_PAGE_ID, '{token}');
@@ -1050,7 +1079,7 @@ function maskRapydToken(path) {
  * SetupIntent id stays: confirming one also needs its client_secret, which rides in the body.
  */
 const STRIPE_API_HOST = /^api\.stripe\.com\.?$/i;
-const STRIPE_PAYMENT_PAGE = /(\/payment_pages(?:\/|%2f))[^/]*/gi;
+const STRIPE_PAYMENT_PAGE = new RegExp(`(${SLASH}payment_pages${SLASH}+)[^/]*`, 'gi');
 function maskStripeSession(path) {
     return path.replace(STRIPE_PAYMENT_PAGE, '$1{session}');
 }
@@ -1061,7 +1090,7 @@ function maskStripeSession(path) {
  * ACI's shape (<32 hex>.<cluster>-vm-tx<nn>) read {checkoutId}.
  */
 const ACI_HOST = /^(?:eu-prod\.|eu-test\.|test\.)?oppwa\.com\.?$/i;
-const ACI_CHECKOUT = /(\/v1\/checkouts(?:\/|%2f))[^/]*/gi;
+const ACI_CHECKOUT = new RegExp(`(${SLASH}v1${SLASH}checkouts${SLASH}+)[^/]*`, 'gi');
 const ACI_CHECKOUT_ID = /[0-9a-f]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}/gi;
 function maskAciCheckout(path) {
     return path.replace(ACI_CHECKOUT, '$1{checkoutId}').replace(ACI_CHECKOUT_ID, '{checkoutId}');
@@ -1071,34 +1100,35 @@ function maskAciCheckout(path) {
  * with no auth header and no CSRF token (payment-core payfast.js): the payment's uuid is the
  * request's only credential, and with it anyone can read that payment page, its amount and its
  * merchant. Every route of the page carries the same uuid, so on every host Payfast owns (payfast.io and
- * payfast.co.za and any name under them) any id of its shape, in any case or after an escaped slash,
- * reads {uuid}.
+ * payfast.co.za and any name under them) any id of its shape, in every spelling maskUuids reads, reads {uuid}.
  */
 const PAYFAST_HOST = /(?:^|\.)payfast\.(?:io|co\.za)\.?$/i;
-const PAYFAST_UUID = /[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}/gi;
 function maskPayfastUuid(path) {
-    return path.replace(PAYFAST_UUID, '{uuid}');
+    return maskUuids(path, '{uuid}');
 }
 /**
  * Paddle's checkout frame pays a TokenEx checkout with its own /pay on checkout-service.paddle.com
  * (sandbox-checkout-service in test), and the checkout id in that path is the checkout's only
  * credential there, no cookies (payment-core paddle-tokenex.js): with it, and the card in the body,
  * a payment reaches that checkout. On those hosts the segment between /checkout/ or
- * /transaction-checkout/ and /pay, in any case or after an escaped slash, reads {checkout}.
+ * /transaction-checkout/ and /pay, in any case and any spelling of the slashes around it, reads {checkout}.
+ * The segment ends at the first slash in any spelling, so a long run of them cannot make the pattern try
+ * every way of splitting the run between the segment and the slashes.
  */
 const PADDLE_CHECKOUT_HOST = /^(?:sandbox-)?checkout-service\.paddle\.com\.?$/i;
-const PADDLE_PAY = /(\/(?:checkout|transaction-checkout)(?:\/|%2f))[^/]*(\/pay)/gi;
+const PADDLE_PAY = new RegExp(`(${SLASH}(?:checkout|transaction-checkout)${SLASH}+)(?:[^/%]|%(?!(?:25)*2f))+(${SLASH}+pay)`, 'gi');
 function maskPaddleCheckout(path) {
     return path.replace(PADDLE_PAY, '$1{checkout}$2');
 }
 /**
  * Lyra's Krypton frame sends its payment to ProcessPayment/2 on the brand's API host with the form
  * token's session id as a `;jsessionid=` path parameter (payment-core lyra.js). With the form token the
- * body carries, that id continues the payment on Lyra's side, so on Lyra's hosts it reads `{session}`,
- * in any case: https://api.systempay.fr/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid={session}.
+ * body carries, that id continues the payment on Lyra's side, so on Lyra's hosts it reads `{session}`, in any
+ * case and with its `;` or `=` escaped once or more:
+ * https://api.systempay.fr/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid={session}.
  */
 const LYRA_HOST = /^(?:api\.payzen\.eu|api\.systempay\.fr|api-sogecommerce\.societegenerale\.eu|api\.lyra\.com)\.?$/i;
-const LYRA_SESSION = /;jsessionid=[^/;?#]*/gi;
+const LYRA_SESSION = /(?:;|%(?:25)*3b)jsessionid(?:=|%(?:25)*3d)[^/;?#]*/gi;
 function maskLyraSession(path) {
     return path.replace(LYRA_SESSION, ';jsessionid={session}');
 }
@@ -1123,10 +1153,25 @@ function maskPaymongoSession(path) {
  * case or after an escaped slash, reads {token}: https://secure.gopay.com/gp-card-comm/h/{token}.
  */
 const GOPAY_CARD_FORM_HOST = /^secure(?:\.sandbox)?\.gopay\.com\.?$/i;
-const GOPAY_CARD_FORM_TOKEN = /(\/h(?:\/|%2f))[^/?#]*/gi;
+const GOPAY_CARD_FORM_TOKEN = new RegExp(`(${SLASH}h${SLASH}+)[^/?#]*`, 'gi');
 function maskGopayToken(path) {
     return path.replace(GOPAY_CARD_FORM_TOKEN, '$1{token}');
 }
+/**
+ * KOMOJU's Hosted Fields frame pays a session with POST /api/v1/sessions/<id>/pay on komoju.com under
+ * the merchant's publishable key, which is public (payment-core komoju.js): with the session id, anyone
+ * can read that session's amount and buyer email and pay it. On komoju.com the segment after /sessions,
+ * in any case and after any run of slashes, each written plain or escaped once or more, reads {session}:
+ * https://komoju.com/api/v1/sessions/{session}/pay. Then any 25 letters and digits left that end a run read
+ * {session} too, so an id after a dot segment, a backslash or an escape KOMOJU's frame never writes is
+ * masked as well; no other path KOMOJU's card fields use holds such a run.
+ */
+const KOMOJU_HOST = /^komoju\.com\.?$/i;
+const KOMOJU_SESSION = new RegExp(`(${SLASH}sessions)(${SLASH}+)[^/]*`, 'gi');
+const KOMOJU_SESSION_ID = /[a-z0-9]{25}(?![a-z0-9])/gi;
+function maskKomojuSession(path) {
+    return path.replace(KOMOJU_SESSION, '$1$2{session}').replace(KOMOJU_SESSION_ID, '{session}');
+}
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
  * that send it, the text that names those hosts in a string that is not a URL, and the mask. The
@@ -1136,11 +1181,11 @@ function maskGopayToken(path) {
 /**
  * Redsys's hosted payment page names its session in the path of every page and post after the entry
  * (/sis/pagoTarjeta;jsessionid=<id>), and that id is what carries a card post into the session the
- * merchant's signed entry opened. On Redsys's hosts the session id, in any case or escaped, reads
- * {session}. The entry itself carries none.
+ * merchant's signed entry opened. On Redsys's hosts the session id, in any case or escaped once or more,
+ * reads {session}. The entry itself carries none.
  */
 const REDSYS_HOST = /^sis(?:-t)?\.redsys\.es\.?$/i;
-const REDSYS_SESSION = /((?:;|%3b)jsessionid(?:=|%3d))[^/?#;]*/gi;
+const REDSYS_SESSION = /((?:;|%(?:25)*3b)jsessionid(?:=|%(?:25)*3d))[^/?#;]*/gi;
 function maskRedsysSession(path) {
     return path.replace(REDSYS_SESSION, '$1{session}');
 }
@@ -1151,10 +1196,22 @@ function maskRedsysSession(path) {
  * segment after /orders/, in any case or after an escaped slash, reads {order}.
  */
 const PAYPAL_HOST = /(?:^|\.)paypal\.com\.?$/i;
-const PAYPAL_ORDER = /(\/orders(?:\/|%2f))[^/]*/gi;
+const PAYPAL_ORDER = new RegExp(`(${SLASH}orders${SLASH}+)[^/]*`, 'gi');
 function maskPaypalOrder(path) {
     return path.replace(PAYPAL_ORDER, '$1{order}');
 }
+/**
+ * Przelewy24's pay wall names its transaction by one token in the path of every page and post
+ * (/trnRequest/<token>, its method links, /card/p24form/<token>, /trnResult/<token>), and that token
+ * is all a browser needs to open the transaction's pay wall (payment-core processors/przelewy24.js).
+ * On Przelewy24's hosts a token-shaped segment, in any case, after an escaped slash or with its hyphens
+ * escaped, reads {token}.
+ */
+const PRZELEWY24_HOST = /(?:^|\.)przelewy24\.pl\.?$/i;
+const PRZELEWY24_TOKEN = new RegExp(`[0-9a-f]{10}${HYPHEN}[0-9a-f]{6}${HYPHEN}[0-9a-f]{6}${HYPHEN}[0-9a-f]{10}`, 'gi');
+function maskPrzelewy24Token(path) {
+    return path.replace(PRZELEWY24_TOKEN, '{token}');
+}
 const PATH_CREDENTIALS = [
     { host: CREDITGUARD_HOST, named: /creditguard\.co\.il/i, mask: maskCreditguardTxId },
     { host: GRAVY_HOST, named: /gr4vy\.app/i, mask: maskGravySession },
@@ -1168,6 +1225,8 @@ const PATH_CREDENTIALS = [
     { host: PAYPAL_HOST, named: /paypal\.com/i, mask: maskPaypalOrder },
     { host: PAYMONGO_CHECKOUT_HOST, named: /checkout\.paymongo\.com/i, mask: maskPaymongoSession },
     { host: GOPAY_CARD_FORM_HOST, named: /secure(?:\.sandbox)?\.gopay\.com/i, mask: maskGopayToken },
+    { host: KOMOJU_HOST, named: /komoju\.com/i, mask: maskKomojuSession },
+    { host: PRZELEWY24_HOST, named: /przelewy24\.pl/i, mask: maskPrzelewy24Token },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1192,6 +1251,9 @@ const PATH_CREDENTIALS = [
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
  * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
  * On GoPay's card frame hosts the card form's token reads `{token}`: https://secure.gopay.com/gp-card-comm/h/{token}.
+ * On komoju.com a session id reads `{session}`: https://komoju.com/api/v1/sessions/{session}/pay.
+ * On Przelewy24's hosts the transaction's token reads `{token}`:
+ * https://secure.przelewy24.pl/trnRequest/{token}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */
@@ -2265,10 +2327,10 @@ export class VaultClient {
         // amount_required.
         if (!hasAmount && rec && AGENT_AMOUNT_PROCESSORS.includes(rec.psp))
             throw new AmountRequiredError(rec.psp);
-        // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay
-        // charges the total its payment already holds, so a zero pair would show the cardholder no price
-        // at all: it is refused like a missing one.
-        if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP) && Number(input.amount) <= 0)
+        // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay or a
+        // PayMongo attach charges the total its payment or checkout session already holds, so a zero pair
+        // would show the cardholder no price at all: it is refused like a missing one.
+        if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP || rec.psp === PAYMONGO_PSP) && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the