@agent-cards/sdk 0.23.18 → 0.23.19

package/dist/client.d.ts

@@ -1187,8 +1187,20 @@ export declare class CheckoutAuthError extends Error {
  * On komoju.com a session id reads `{session}`: https://komoju.com/api/v1/sessions/{session}/pay.
  * On Przelewy24's hosts the transaction's token reads `{token}`:
  * https://secure.przelewy24.pl/trnRequest/{token}.
+ * On Revolut's card payment and hosted checkout hosts an order or payment token reads `{token}`:
+ * https://merchant.revolut.com/api/public/orders/{token}/payments.
+ * On SumUp's API host a checkout id reads `{checkout}`: https://api.sumup.com/v0.2/checkouts/{checkout}.
+ * On Paytrail's hosts a payment's id reads `{transaction}`:
+ * https://services.paytrail.com/payments/{transaction}/click-to-pay/loading-and-redirect, and on Payment
+ * Highway's a card page's session reads `{session}`.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
- * same segments masked.
+ * same segments masked for every processor whose host it names.
+ * A URL is read by its host only when the parser finds one. Text before a URL
+ * can read as a scheme: `see:https://api.stripe.com/...` parses as a URL with
+ * the scheme `see`, no host, and the whole Stripe URL as its path, so a parse
+ * with no host is read as a string that is not a URL. A path can carry a URL of
+ * its own, as `http:https://api.stripe.com/...` does once `https` reads as its
+ * host, so every processor whose host the path names masks the URL too.
  */
 export declare function redactUrl(raw: string): string;
 export interface VaultClientOptions {

package/dist/client.js

@@ -1,7 +1,7 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns as deriveCardUrlPatterns, LOOPBACK_URL_PATTERNS, findRecognizer, isRecognizerRequest, recognizerRequestMethod, recognizerRequiresPreparation, urlsOnProcessorHosts, } from './registry.js';
 import { armServedProfiles, classifyProfileRequest, declareSandboxMerchant, merchantProfileEnvironment, merchantProfileFor, merchantProfileUrlPatterns, } from './merchant-hosted.js';
 import { merchantAmountExchanges, merchantAmountFromResponses, merchantProfilePricedBySource, merchantTotalWire, MerchantTotalWait, } from './merchant-total.js';
-import { ACI_CAPABILITY, ACI_PSP, aciCardLegAnswer, redactAciCheckoutId } from './aci.js';
+import { ACI_CAPABILITY, ACI_PSP, aciCardLegAnswer } from './aci.js';
 import { EPROTECT_CAPABILITY, EPROTECT_PSP, eprotectCheckoutRefusal, eprotectScriptAnswer, isEprotectRegistration } from './eprotect.js';
 import { isMercadoTokenRequest, parseMercadoCheckoutContext, validateMercadoProcessorContext } from './mercado-checkout.generated.js';
 import { matchesPreparation, preparationMode, validPreparationEnvironment } from './prepared-processor.js';
@@ -1041,9 +1041,12 @@ function maskCreditguardTxId(path) {
  * /v2/payment/{client_secret}/confirm (and /show, /status), and with the page's
  * public token that secret confirms the payment and reads its status.
  */
-const PATH_SECRET_HOSTS = ['proxy.wspay.biz', 'proxy-test.wspay.biz', 'ipg.monri.com', 'ipgtest.monri.com'];
+const PATH_SECRET_HOST = /^(?:proxy(?:-test)?\.wspay\.biz|ipg(?:test)?\.monri\.com)\.?$/i;
 /** The segment after a `payment` segment, in any case (the WSPay proxy is IIS) and any spelling of its slashes. */
 const PATH_SECRET = new RegExp(`(${SLASH}payment${SLASH}+)[^/]*`, 'gi');
+function maskPathSecret(path) {
+    return path.replace(PATH_SECRET, '$1{client_secret}');
+}
 /**
  * Gravy (Gr4vy) gives every merchant hosts of its own under gr4vy.app, and Secure Fields sends the
  * card to /checkout/sessions/<session id>/fields with no auth header, so the session id is that
@@ -1084,10 +1087,11 @@ function maskStripeSession(path) {
     return path.replace(STRIPE_PAYMENT_PAGE, '$1{session}');
 }
 /**
- * redactAciCheckoutId (aci.ts) takes the checkout id out of the paths ACI's widget sends. This rule
- * takes any other copy of it out on ACI's hosts: a trailing dot on the host, an escaped or doubled
- * slash, another case, a string that is not a URL. The segment after /v1/checkouts/ and any id of
- * ACI's shape (<32 hex>.<cluster>-vm-tx<nn>) read {checkoutId}.
+ * ACI's checkout id is that checkout's only capability: once the card-number request carried the real
+ * card, anyone holding it can post /payment against that card for the rest of the checkout's 30
+ * minutes. On ACI's hosts, with a trailing dot, an escaped or doubled slash, in another case or in a
+ * string that is not a URL, the segment after /v1/checkouts/ and any id of ACI's shape
+ * (<32 hex>.<cluster>-vm-tx<nn>) read {checkoutId}.
  */
 const ACI_HOST = /^(?:eu-prod\.|eu-test\.|test\.)?oppwa\.com\.?$/i;
 const ACI_CHECKOUT = new RegExp(`(${SLASH}v1${SLASH}checkouts${SLASH}+)[^/]*`, 'gi');
@@ -1162,21 +1166,36 @@ function maskGopayToken(path) {
  * the merchant's publishable key, which is public (payment-core komoju.js): with the session id, anyone
  * can read that session's amount and buyer email and pay it. On komoju.com the segment after /sessions,
  * in any case and after any run of slashes, each written plain or escaped once or more, reads {session}:
- * https://komoju.com/api/v1/sessions/{session}/pay. Then any 25 letters and digits left that end a run read
- * {session} too, so an id after a dot segment, a backslash or an escape KOMOJU's frame never writes is
- * masked as well; no other path KOMOJU's card fields use holds such a run.
+ * https://komoju.com/api/v1/sessions/{session}/pay. Then every run of 25 or more letters and digits left
+ * reads {session}, so an id after a dot segment, a backslash or an escape KOMOJU's frame never writes is
+ * masked as well; a percent escape right before the run stays when 25 or more remain after it. No other
+ * path KOMOJU's card fields use holds such a run. The whole run reads {session}, never only its last 25
+ * characters, so a longer id of another processor in the same text is never cut in two before that
+ * processor's mask reads it.
  */
 const KOMOJU_HOST = /^komoju\.com\.?$/i;
 const KOMOJU_SESSION = new RegExp(`(${SLASH}sessions)(${SLASH}+)[^/]*`, 'gi');
-const KOMOJU_SESSION_ID = /[a-z0-9]{25}(?![a-z0-9])/gi;
+const KOMOJU_SESSION_ID = /(%(?:25)*[0-9a-f]{2})?[a-z0-9]{25,}/gi;
 function maskKomojuSession(path) {
-    return path.replace(KOMOJU_SESSION, '$1$2{session}').replace(KOMOJU_SESSION_ID, '{session}');
+    return path.replace(KOMOJU_SESSION, '$1$2{session}').replace(KOMOJU_SESSION_ID, (_run, escape) => `${escape ?? ''}{session}`);
+}
+/**
+ * SumUp's Payment Widget sends the card to https://api.sumup.com/v0.2/checkouts/<checkout id> with no cookie and
+ * no auth header (payment-core sumup.js), so the checkout id is that request's only credential: with it anyone can
+ * read the checkout's amount and merchant and pay it. On api.sumup.com the segment after /checkouts/, in any case
+ * and any spelling of the slashes before it, reads {checkout}, as does any other id shaped like SumUp's UUID
+ * checkout ids, in every spelling maskUuids reads.
+ */
+const SUMUP_API_HOST = /^api\.sumup\.com\.?$/i;
+const SUMUP_CHECKOUT = new RegExp(`(${SLASH}checkouts${SLASH}+)[^/]*`, 'gi');
+function maskSumupCheckout(path) {
+    return maskUuids(path.replace(SUMUP_CHECKOUT, '$1{checkout}'), '{checkout}');
 }
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
- * that send it, the text that names those hosts in a string that is not a URL, and the mask. The
- * guard in redact-url.test.mjs fails for a payment-core recognizer that no one has sorted into
- * this list or out of it.
+ * that send it, the text that names those hosts anywhere else (a string that is not a URL, or a
+ * path that carries a URL of its own), and the mask. The guard in redact-url.test.mjs fails for a
+ * payment-core recognizer that no one has sorted into this list or out of it.
  */
 /**
  * Redsys's hosted payment page names its session in the path of every page and post after the entry
@@ -1212,7 +1231,45 @@ const PRZELEWY24_TOKEN = new RegExp(`[0-9a-f]{10}${HYPHEN}[0-9a-f]{6}${HYPHEN}[0
 function maskPrzelewy24Token(path) {
     return path.replace(PRZELEWY24_TOKEN, '{token}');
 }
+/**
+ * Revolut's card field and card popup send the card payment to /api/public/orders/<order token>/payments on
+ * merchant.revolut.com (sandbox-merchant.revolut.com in test), and the frame polls /api/public/payments/<payment
+ * token> (payment-core revolut.js). Neither carries a header or cookie that binds it: the order token alone
+ * opens that order's checkout, its amount and its merchant, and pays it, and the payment token reads the payment.
+ * Revolut's hosted checkout page names the same order token in its own paths (/payment-link/<order token>), and the
+ * frame reads the order at merchant-mgmt.revolut.com/orders/token/<order token>. On those hosts every id of their
+ * uuid shape, in every spelling maskUuids reads, reads {token}.
+ */
+const REVOLUT_HOST = /^(?:sandbox-)?(?:merchant|checkout|merchant-mgmt)\.revolut\.com\.?$/i;
+function maskRevolutToken(path) {
+    return maskUuids(path, '{token}');
+}
+/**
+ * Paytrail names its payment in the path of every route of its card method
+ * (/payments/<transaction>/click-to-pay/loading-and-redirect, and its success and cancel routes), and the same id
+ * opens Paytrail's own payment wall for that payment (pay.paytrail.com/pay/<transaction>), its amount, its
+ * merchant and every method's form, to anyone who holds it (payment-core processors/paytrail.js). On every host
+ * Paytrail owns, any id of its shape, with or without its hyphens, in any case, after an escaped slash or with its
+ * hyphens escaped, reads {transaction}. Payment Highway, Paytrail's card platform, names its card page's session
+ * the same way (/form/<session>/pay_with_click_to_pay), and that path is what carries a card post into the payment,
+ * so on its hosts the same shape reads {session}. The pattern reads a percent escape as one unit and keeps it, so
+ * the hex digits of an escaped separator (%2F, %252F, %3D) never start an id and leave part of it showing.
+ */
+const PAYTRAIL_HOST = /(?:^|\.)paytrail\.com\.?$/i;
+const PAYMENT_HIGHWAY_HOST = /(?:^|\.)(?:paymenthighway\.io|sph-test-solinor\.com)\.?$/i;
+const PAYTRAIL_ID_HYPHEN = '(?:-|%(?:25)*2d)?';
+const PAYTRAIL_ID = new RegExp(`%(?:25)*[0-9a-f]{2}|[0-9a-f]{8}${PAYTRAIL_ID_HYPHEN}[0-9a-f]{4}${PAYTRAIL_ID_HYPHEN}[0-9a-f]{4}${PAYTRAIL_ID_HYPHEN}[0-9a-f]{4}${PAYTRAIL_ID_HYPHEN}[0-9a-f]{12}`, 'gi');
+function maskPaytrailId(path, label) {
+    return path.replace(PAYTRAIL_ID, (token) => (token.startsWith('%') ? token : label));
+}
+function maskPaytrailTransaction(path) {
+    return maskPaytrailId(path, '{transaction}');
+}
+function maskPaymentHighwaySession(path) {
+    return maskPaytrailId(path, '{session}');
+}
 const PATH_CREDENTIALS = [
+    { host: PATH_SECRET_HOST, named: /(?:wspay\.biz|monri\.com)/i, mask: maskPathSecret },
     { host: CREDITGUARD_HOST, named: /creditguard\.co\.il/i, mask: maskCreditguardTxId },
     { host: GRAVY_HOST, named: /gr4vy\.app/i, mask: maskGravySession },
     { host: RAPYD_HOST, named: /rapyd\.net/i, mask: maskRapydToken },
@@ -1227,6 +1284,10 @@ const PATH_CREDENTIALS = [
     { host: GOPAY_CARD_FORM_HOST, named: /secure(?:\.sandbox)?\.gopay\.com/i, mask: maskGopayToken },
     { host: KOMOJU_HOST, named: /komoju\.com/i, mask: maskKomojuSession },
     { host: PRZELEWY24_HOST, named: /przelewy24\.pl/i, mask: maskPrzelewy24Token },
+    { host: REVOLUT_HOST, named: /(?:merchant|checkout|merchant-mgmt)\.revolut\.com/i, mask: maskRevolutToken },
+    { host: SUMUP_API_HOST, named: /api\.sumup\.com/i, mask: maskSumupCheckout },
+    { host: PAYTRAIL_HOST, named: /paytrail\.com/i, mask: maskPaytrailTransaction },
+    { host: PAYMENT_HIGHWAY_HOST, named: /(?:paymenthighway\.io|sph-test-solinor\.com)/i, mask: maskPaymentHighwaySession },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1254,30 +1315,48 @@ const PATH_CREDENTIALS = [
  * On komoju.com a session id reads `{session}`: https://komoju.com/api/v1/sessions/{session}/pay.
  * On Przelewy24's hosts the transaction's token reads `{token}`:
  * https://secure.przelewy24.pl/trnRequest/{token}.
+ * On Revolut's card payment and hosted checkout hosts an order or payment token reads `{token}`:
+ * https://merchant.revolut.com/api/public/orders/{token}/payments.
+ * On SumUp's API host a checkout id reads `{checkout}`: https://api.sumup.com/v0.2/checkouts/{checkout}.
+ * On Paytrail's hosts a payment's id reads `{transaction}`:
+ * https://services.paytrail.com/payments/{transaction}/click-to-pay/loading-and-redirect, and on Payment
+ * Highway's a card page's session reads `{session}`.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
- * same segments masked.
+ * same segments masked for every processor whose host it names.
+ * A URL is read by its host only when the parser finds one. Text before a URL
+ * can read as a scheme: `see:https://api.stripe.com/...` parses as a URL with
+ * the scheme `see`, no host, and the whole Stripe URL as its path, so a parse
+ * with no host is read as a string that is not a URL. A path can carry a URL of
+ * its own, as `http:https://api.stripe.com/...` does once `https` reads as its
+ * host, so every processor whose host the path names masks the URL too.
  */
 export function redactUrl(raw) {
-    // An ACI checkout id is that checkout's only capability; it never rides on an event.
-    const aci = redactAciCheckoutId(raw);
-    if (aci !== null)
-        return aci;
+    let url;
     try {
-        const u = new URL(raw);
-        // A trailing dot names the same host, so it cannot let the secret through.
-        let path = PATH_SECRET_HOSTS.includes(u.hostname.replace(/\.$/, '')) ? u.pathname.replace(PATH_SECRET, '$1{client_secret}') : u.pathname;
-        for (const rule of PATH_CREDENTIALS)
-            if (rule.host.test(u.hostname))
-                path = rule.mask(path);
-        return `${u.origin}${path}`;
+        url = new URL(raw);
     }
     catch {
-        let bare = raw.split(/[?#]/)[0].replace(PATH_SECRET, '$1{client_secret}');
-        for (const rule of PATH_CREDENTIALS)
-            if (rule.named.test(bare))
-                bare = rule.mask(bare);
-        return bare;
+        url = null;
     }
+    if (!url?.hostname) {
+        const text = raw.split(/[?#]/)[0];
+        return maskNamed(maskPathSecret(text), text);
+    }
+    let path = url.pathname;
+    for (const rule of PATH_CREDENTIALS)
+        if (rule.host.test(url.hostname))
+            path = rule.mask(path);
+    return maskNamed(`${url.origin}${path}`, url.pathname);
+}
+/**
+ * `text` with the mask of every processor whose host `names` names. `names` is read before any mask
+ * runs, so a mask that rewrites another processor's host cannot keep that processor's mask from running.
+ */
+function maskNamed(text, names) {
+    for (const rule of PATH_CREDENTIALS)
+        if (rule.named.test(names))
+            text = rule.mask(text);
+    return text;
 }
 /**
  * Refusals a preparation create answers before any preparation exists, surfaced

package/dist/datatrans.d.ts

@@ -69,8 +69,8 @@ export interface DatatransRepeatAnswer {
  * The approved Datatrans answers one attachment handed to a card post, per frame. `frame` is the
  * adapter's identity for the request's frame (the CDP frameId, the Playwright Frame); a request
  * whose frame is unknown is never remembered and never answered. Only an answer payment-core reads
- * as approved ({transactionId, cardInfo}) is kept: an error answer leaves the next post a new
- * question, so the page can try again.
+ * as approved (the token, with cardInfo when Datatrans sends one) is kept: an error answer leaves
+ * the next post a new question, so the page can try again.
  */
 export declare class DatatransRepeats {
     private readonly windowMs;

package/dist/datatrans.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 9c00d227ed43d3b5346dba02fe0431f4cc4762fc7d2d9333eeeb34233b0c9844
+// artifact-sha256: 829167e03a7ffe9fc109ababe9755f1263a840fd5294ebec970e08d41aa9741b
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";
@@ -346,7 +346,7 @@ function injectDatatransCard(body, card, policy = DATATRANS_REGISTRATION_POLICY)
 var TRANSACTION_ID = /^[0-9]{18}$/;
 var CARD_WORD = /^[A-Za-z][A-Za-z _-]{0,31}$/;
 var COUNTRY = /^[A-Z]{2}$/;
-var CARD_INFO_KEYS = ["brand", "type", "usage", "country", "issuer", "coBrand"];
+var CARD_INFO_KEYS = ["brand", "type", "usage", "country", "issuer", "coBrand", "accountType", "binLength"];
 var UNFOLLOWED_KEYS = ["tds2EnrollmentResult", "redirect", "dcc", "mcp"];
 var ERROR_CODES = [
     [/^Invalid merchantId$/, "invalid_merchant_id"],
@@ -368,10 +368,11 @@ function readAnswer(body) {
     }
 }
 var optionalText = (value, pattern) => value === null || exact(pattern, value);
+var optionalBinLength = (value) => value === null || Number.isInteger(value) && value >= 1 && value <= 19;
 function rebuildCardInfo(info) {
-    if (!record(info) || !Object.keys(info).every((key) => CARD_INFO_KEYS.includes(key)) || !exact(CARD_WORD, info.brand))
+    if (!record(info) || !Object.keys(info).every((key) => CARD_INFO_KEYS.includes(key)))
         return null;
-    if (owns(info, "type") && !optionalText(info.type, CARD_WORD) || owns(info, "usage") && !optionalText(info.usage, CARD_WORD) || owns(info, "country") && !optionalText(info.country, COUNTRY) || owns(info, "issuer") && info.issuer !== null && !plain(info.issuer, 128) || owns(info, "coBrand") && info.coBrand !== null && !plain(info.coBrand, 64))
+    if (owns(info, "brand") && !optionalText(info.brand, CARD_WORD) || owns(info, "type") && !optionalText(info.type, CARD_WORD) || owns(info, "usage") && !optionalText(info.usage, CARD_WORD) || owns(info, "country") && !optionalText(info.country, COUNTRY) || owns(info, "issuer") && info.issuer !== null && !plain(info.issuer, 128) || owns(info, "coBrand") && info.coBrand !== null && !plain(info.coBrand, 64) || owns(info, "accountType") && !optionalText(info.accountType, CARD_WORD) || owns(info, "binLength") && !optionalBinLength(info.binLength))
         return null;
     const safe = {};
     for (const key of CARD_INFO_KEYS)
@@ -380,10 +381,14 @@ function rebuildCardInfo(info) {
     return safe;
 }
 function rebuildSuccess(value) {
-    if (Object.keys(value).length !== 2 || !exact(TRANSACTION_ID, value.transactionId))
-        return null;
+    if (!Object.keys(value).every((key) => key === "transactionId" || key === "cardInfo"))
+        return { reason: "datatrans_unexpected_key" };
+    if (!exact(TRANSACTION_ID, value.transactionId))
+        return { reason: "datatrans_unexpected_token" };
+    if (!owns(value, "cardInfo") || value.cardInfo === null)
+        return { answer: { transactionId: value.transactionId } };
     const cardInfo = rebuildCardInfo(value.cardInfo);
-    return cardInfo ? { transactionId: value.transactionId, cardInfo } : null;
+    return cardInfo ? { answer: { transactionId: value.transactionId, cardInfo } } : { reason: "datatrans_unexpected_card_info" };
 }
 function rebuildError(value) {
     return Object.keys(value).length === 1 && plain(value.error, 256) && value.error.trim() !== "" ? { error: value.error } : null;
@@ -407,15 +412,15 @@ function datatransResponseOutcome(status, body, card) {
     if (owns(value, "error")) {
         const error = rebuildError(value);
         if (!error)
-            return { outcome: "unknown", reason: "datatrans_unexpected_response" };
+            return { outcome: "unknown", reason: "datatrans_unexpected_error" };
         const code = datatransErrorCode(error.error);
         return code === "too_many_requests" ? { outcome: "unknown", reason: "datatrans_repeat_request" } : { outcome: "refused", code };
     }
     if (UNFOLLOWED_KEYS.some((key) => owns(value, key)))
         return { outcome: "unknown", reason: "datatrans_unsupported_flow" };
-    const safe = rebuildSuccess(value);
+    const { answer: safe, reason } = rebuildSuccess(value);
     if (!safe)
-        return { outcome: "unknown", reason: "datatrans_unexpected_response" };
+        return { outcome: "unknown", reason };
     if (card && digits(card.number, 12, 19) && safe.transactionId.includes(card.number)) {
         return { outcome: "unknown", reason: "datatrans_token_mismatch" };
     }
@@ -432,7 +437,7 @@ function sanitizeDatatransTokenResponse(body) {
         return JSON.stringify(rebuildError(value) ?? fail());
     if (UNFOLLOWED_KEYS.some((key) => owns(value, key)))
         return fail();
-    return JSON.stringify(rebuildSuccess(value) ?? fail());
+    return JSON.stringify(rebuildSuccess(value).answer ?? fail());
 }
 function datatransFacts(status, body) {
     const verdict = datatransResponseOutcome(status, body);

package/dist/datatrans.js

@@ -112,8 +112,8 @@ function sameKey(a, b) {
  * The approved Datatrans answers one attachment handed to a card post, per frame. `frame` is the
  * adapter's identity for the request's frame (the CDP frameId, the Playwright Frame); a request
  * whose frame is unknown is never remembered and never answered. Only an answer payment-core reads
- * as approved ({transactionId, cardInfo}) is kept: an error answer leaves the next post a new
- * question, so the page can try again.
+ * as approved (the token, with cardInfo when Datatrans sends one) is kept: an error answer leaves
+ * the next post a new question, so the page can try again.
  */
 export class DatatransRepeats {
     windowMs;

package/dist/pelecard.generated.d.ts

@@ -1,6 +1,7 @@
 declare var PELECARD_TRANSACTION_HOSTS: readonly string[];
 declare var PELECARD_TRANSACTION_PATH: string;
 declare var PELECARD_REFUSAL_REASONS: readonly string[];
+declare var PELECARD_SUCCESS_CODES: readonly string[];
 declare function isPelecardTransactionUrl(url: any, method?: string): boolean;
 declare function pelecardBodyRefusal(body: any): "unsupported" | "keep_on_file" | null;
 declare function isPelecardNewCardBody(body: any): boolean;
@@ -29,4 +30,4 @@ declare function pelecardFacts(status: any, body: any): {
     outcome: string;
     refusalCode: any;
 };
-export { PELECARD_REFUSAL_REASONS, PELECARD_TRANSACTION_HOSTS, PELECARD_TRANSACTION_PATH, classifyPelecardRequest, injectPelecardCard, isPelecardNewCardBody, isPelecardTransactionRequest, isPelecardTransactionUrl, pelecardBodyRefusal, pelecardFacts, pelecardKeepOnFileRequested, pelecardRefusalMessage, pelecardResponseOutcome, pelecardTransactionRefusal, sanitizePelecardResponse };
+export { PELECARD_REFUSAL_REASONS, PELECARD_SUCCESS_CODES, PELECARD_TRANSACTION_HOSTS, PELECARD_TRANSACTION_PATH, classifyPelecardRequest, injectPelecardCard, isPelecardNewCardBody, isPelecardTransactionRequest, isPelecardTransactionUrl, pelecardBodyRefusal, pelecardFacts, pelecardKeepOnFileRequested, pelecardRefusalMessage, pelecardResponseOutcome, pelecardTransactionRefusal, sanitizePelecardResponse };

package/dist/pelecard.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7b1296f83822ae81c64835c270ff9048fddb6efe0d7cdbe37ba42b8a81ac03d0
+// artifact-sha256: 30904474bf2bd6c0b0aac97deda8fe133514a241e7060e782118af5fba813fe4
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -14,6 +14,7 @@ function roundTrips(parsed, body) {
 var PELECARD_TRANSACTION_HOSTS = /* @__PURE__ */ Object.freeze(["gateway21.pelecard.biz", "gateway20.pelecard.biz"]);
 var PELECARD_TRANSACTION_PATH = "/PaymentGW/Transaction";
 var PELECARD_REFUSAL_REASONS = /* @__PURE__ */ Object.freeze(["unsupported", "keep_on_file"]);
+var PELECARD_SUCCESS_CODES = /* @__PURE__ */ Object.freeze(["000", "302"]);
 var UNSUPPORTED_REFUSAL = "Refusing to pay: unsupported Pelecard card payment request.";
 var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Pelecard payment would keep the card on file without your consent. Nothing was sent.";
 var TEST_CARD_REFUSAL = "Refusing to pay: a Pelecard checkout takes only a documented test card, because the merchant can have Pelecard keep the card without asking you. Nothing was sent.";
@@ -214,6 +215,9 @@ function landingUrl(value) {
         return null;
     }
 }
+function inPageDebit(value) {
+    return absent(value.UrlKashCash) && value.StatusDescription !== "Gama Completion Required" && (value.DisplayIshurPopUp === void 0 || value.DisplayIshurPopUp === null || value.DisplayIshurPopUp === false);
+}
 function pelecardResponseOutcome(status, body) {
     if (Number.isInteger(status) && status >= 400 && status < 500)
         return clientErrorOutcome(status, body);
@@ -225,7 +229,7 @@ function pelecardResponseOutcome(status, body) {
     const code = value.StatusCode;
     if (!exact(/^[0-9]{3}$/, code))
         return { outcome: "unknown", reason: "pelecard_unexpected_response" };
-    if (code !== "000") {
+    if (!PELECARD_SUCCESS_CODES.includes(code)) {
         return absent(value.ApprovalNo) ? { outcome: "refused", code } : { outcome: "unknown", reason: "pelecard_unconfirmed" };
     }
     if (!REDIRECT_KEYS.every((key) => typeof value[key] === "string") || owns(value, "ParamX") && value.ParamX !== null && typeof value.ParamX !== "string") {
@@ -233,6 +237,9 @@ function pelecardResponseOutcome(status, body) {
     }
     if (value.DisplayIshurPopUp === true || !absent(value.UrlOpenFinance))
         return { outcome: "unknown", reason: "pelecard_unconfirmed" };
+    if (code === "302" && value.LandingURL === "") {
+        return inPageDebit(value) ? { outcome: "approved" } : { outcome: "unknown", reason: "pelecard_unconfirmed" };
+    }
     const landing = landingUrl(value.LandingURL);
     if (!landing)
         return { outcome: "unknown", reason: "pelecard_unconfirmed" };
@@ -246,7 +253,7 @@ function clientErrorOutcome(status, body) {
     if (!value || !owns(value, "StatusCode") && !owns(value, "ApprovalNo"))
         return { outcome: "refused", code: `http_${status}` };
     const code = value.StatusCode;
-    return exact(/^[0-9]{3}$/, code) && code !== "000" && absent(value.ApprovalNo) ? { outcome: "refused", code } : { outcome: "unknown", reason: "pelecard_unconfirmed" };
+    return exact(/^[0-9]{3}$/, code) && !PELECARD_SUCCESS_CODES.includes(code) && absent(value.ApprovalNo) ? { outcome: "refused", code } : { outcome: "unknown", reason: "pelecard_unconfirmed" };
 }
 function sanitizePelecardResponse(body) {
     const fail = () => {
@@ -260,7 +267,7 @@ function sanitizePelecardResponse(body) {
     const safe = {
         LandingURL: value.LandingURL,
         Target: value.Target,
-        StatusCode: "000",
+        StatusCode: value.StatusCode,
         StatusDescription: markupSafe(value.StatusDescription, 256) && !panLike(value.StatusDescription) ? value.StatusDescription : "",
         ApprovalNo: value.ApprovalNo,
         Token: "",
@@ -271,6 +278,8 @@ function sanitizePelecardResponse(body) {
     safe.UserKey = value.UserKey;
     safe.UseEndOfProcess = value.UseEndOfProcess;
     safe.FeedbackDataTransferMethod = value.FeedbackDataTransferMethod;
+    if (value.LandingURL === "")
+        safe.UrlOpenFinance = "";
     return JSON.stringify(safe);
 }
 function pelecardFacts(status, body) {
@@ -280,4 +289,4 @@ function pelecardFacts(status, body) {
         refusalCode: verdict.outcome === "refused" && /^[0-9]{3}$/.test(verdict.code) ? verdict.code : null
     };
 }
-export { PELECARD_REFUSAL_REASONS, PELECARD_TRANSACTION_HOSTS, PELECARD_TRANSACTION_PATH, classifyPelecardRequest, injectPelecardCard, isPelecardNewCardBody, isPelecardTransactionRequest, isPelecardTransactionUrl, pelecardBodyRefusal, pelecardFacts, pelecardKeepOnFileRequested, pelecardRefusalMessage, pelecardResponseOutcome, pelecardTransactionRefusal, sanitizePelecardResponse };
+export { PELECARD_REFUSAL_REASONS, PELECARD_SUCCESS_CODES, PELECARD_TRANSACTION_HOSTS, PELECARD_TRANSACTION_PATH, classifyPelecardRequest, injectPelecardCard, isPelecardNewCardBody, isPelecardTransactionRequest, isPelecardTransactionUrl, pelecardBodyRefusal, pelecardFacts, pelecardKeepOnFileRequested, pelecardRefusalMessage, pelecardResponseOutcome, pelecardTransactionRefusal, sanitizePelecardResponse };