@agent-cards/sdk 0.23.18 → 0.23.19

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7140b6eee18986c07c3393c1a950467cd13a86c32f47813ab57af11c7cd3fa02
+// artifact-sha256: 75a1d6551b8b0f5af53c9ce72e709e523f6911e0f96a1705fca0855b180d8532
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -502,6 +502,104 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["(token)"]
         }
     },
+    {
+        psp: "comgate",
+        // ComGate's payment gateway, where most Czech and Slovak e-shops send the buyer (ComGate's own WooCommerce,
+        // Shoptet, PrestaShop and Magento modules). The merchant's server creates the payment at ComGate, which keeps
+        // the amount, the currency and the merchant on its side, and sends the buyer's browser to the gateway URL
+        // ComGate answered with, https://payN.comgate.cz/init?id=<transaction id> (processors/comgate.js). The
+        // gateway is an app that takes the card in ComGate's own card frames (sec.comgate.cz), encrypts it there
+        // under the payment's own RSA key and posts the ciphertext to ComGate's API (payments.comgate.cz, or
+        // payments-gcp.comgate.cz behind pay3 and pay4). The paused request is therefore the entry, a GET Document
+        // navigation that carries no card and no body: the cardholder's device makes the gateway's own API calls
+        // for that payment over the end-to-end TLS relay, holds the payment ComGate returns to what the person
+        // approved, encrypts the card under the payment's key as the card frame does and posts it, and the runtime
+        // resolves the paused navigation with the hosted_form notice. Only the entry is matched, exactly
+        // (processors/comgate.js isComgateEntryUrl: the one `id` parameter, nothing else). The card post
+        // (/client/instructions/card-process), the BIN lookup (/bin-checker, /client/instructions/check-card) and
+        // the Web Checkout SDK's /checkout/provider calls carry a card or part of one, already encrypted in ComGate's
+        // frame, so no body rule can see it: this lane's SDK change aborts every call to those paths in the agent's
+        // browser, as it pauses the entry, and no dummy card ever reaches ComGate. ComGate has no test host for merchants: a test
+        // payment runs on these hosts and says so in the payment the API returns, so the hosts mark no environment.
+        // Dark: served only to a client that declares the capability, and gated off for every org the operator has
+        // not allowlisted. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "comgate_hosted_payment_page",
+        match: "pay[1-4]\\.comgate\\.cz/init(?![\\w/.%-])",
+        hosts: ["^pay1\\.comgate\\.cz$", "^pay2\\.comgate\\.cz$", "^pay3\\.comgate\\.cz$", "^pay4\\.comgate\\.cz$"],
+        // The entry has no body; `encoding` names none, and the card rides the JSON the device builds.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The paused request is the navigation itself, a GET with the payment's id in its one query parameter.
+        request: { method: "GET", cardIn: "processor_page", response: "document" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into ComGate's API from the device, not into the paused entry, which carries none. The
+            // device never posts a form of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/comgate.js checkComgateEntry), the reviewed merchants among them: the
+            // create runs them, and naming them here makes the cardholder's device run them again on the entry it is
+            // about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "comgate",
+            required: [],
+            // The members of ComGate's card-process body the device writes, each the card frame's own ciphertext:
+            // the number, the expiry and the security code (`secret` in ComGate's names).
+            card: { number: "number", expiry: "expiry", cvc: "secret" },
+            // The payment's id names one payment (checkComgateEntry's dedupe): the entry's only parameter.
+            dedupe: ["id"]
+        }
+    },
+    {
+        psp: "paytrail",
+        // Paytrail's card method, the one Visa and Mastercard form on the payment wall most Finnish webshops send
+        // the buyer to (WooCommerce, MyCashflow, Vilkas and the merchants' own pages render the same forms). The
+        // merchant's page, or Paytrail's own wall, posts a card-free ENTRY top-level to
+        // https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect: seven checkout-
+        // fields Paytrail signed for the merchant (its account, the transaction, a timestamp, a nonce and an HMAC).
+        // Paytrail answers with a loading page that re-posts them to .../initialize-payment, which sends the
+        // browser to Payment Highway's card page (v1.api.paymenthighway.io, Paytrail's card platform) under a
+        // session of its own, so a card post made away from that session has no payment to pay
+        // (processors/paytrail.js). The paused request is therefore the entry, a Document navigation that carries
+        // no card: the cardholder's device repeats it over the end-to-end TLS relay, follows it to the card page,
+        // posts the card there in that same session, and the runtime resolves the paused navigation with the
+        // hosted_form notice. Only the entry path is matched, exactly (processors/paytrail.js isPaytrailEntryUrl:
+        // a query would reach Paytrail's server beside the signed body). The card page and its card, wallet and
+        // card-number lookups live on Payment Highway's host, which no recognizer takes; the SDK's pause, a later
+        // change, refuses them in the agent's browser, so no dummy card reaches Payment Highway. The entry names no amount: Paytrail
+        // holds it, so the cardholder approves the agent's amount and the device holds it to the amount the card
+        // page names. Paytrail's public test merchant shares this host, so the host marks no environment. Dark:
+        // served only to a client that declares the capability, and gated off for every org the operator has not
+        // allowlisted.
+        capability: "paytrail_hosted_payment_page",
+        match: "services\\.paytrail\\.com/payments/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/click-to-pay/loading-and-redirect",
+        hosts: ["^services\\.paytrail\\.com$"],
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into Payment Highway's card page, which the device reaches from the entry, never into the
+            // paused entry, which must carry none (processors/paytrail.js checkPaytrailEntry). The device never posts
+            // a form of its own: the Vault's form-action policy leaves this host out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/paytrail.js checkPaytrailEntry), the reviewed merchants among them:
+            // the create runs them, and naming them here makes the cardholder's device run them again on the entry
+            // it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "paytrail",
+            required: [
+                "checkout-transaction-id",
+                "checkout-account",
+                "checkout-method",
+                "checkout-algorithm",
+                "checkout-timestamp",
+                "checkout-nonce",
+                "signature"
+            ],
+            // The card page's own card members, which the device writes into the page's JSON card post (never into
+            // the entry).
+            card: { number: "pan", month: "expiry_month", year: "expiry_year", cvc: "cvc" },
+            // The merchant's account and the transaction name one payment.
+            dedupe: ["checkout-account", "checkout-transaction-id"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1970,6 +2068,71 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^payment\\.pay\\.nl$"],
         encoding: "multipart",
         passthroughHeaders: []
+    },
+    {
+        psp: "revolut",
+        // Revolut Business's online checkout (Revolut Merchant, UK and EEA): the card field and card popup
+        // RevolutCheckout.js mounts as frames from merchant.revolut.com, for an order the merchant's server made,
+        // on the merchant's own page (the WooCommerce plugin among them) or Revolut's hosted checkout page. The
+        // frame's pay posts the card as one JSON body to its own origin's /api/public/orders/<order token>/payments,
+        // the token a lowercase uuid. PAN@ payment_method.number, the expiry as numbers @ .expiry_month and
+        // .expiry_year (four digits), the code @ .cvv, beside the order's amount in minor units. Unencrypted.
+        // revolut.js holds the rule the pause decision, the API's create and the device all read: exactly this
+        // URL, the frame's own headers, and its card payment body byte for byte, with a payment that keeps the
+        // card on file (save_for CUSTOMER or MERCHANT) refused by its own code. A payment with another method
+        // (Apple Pay, Google Pay, Revolut Pay, open banking) carries no card on the same URL and continues
+        // untouched (passWithoutCard). merchant.revolut.com answers the Vault's origin, so the cardholder's device
+        // sends the request itself. 3-D Secure follows the answer in the agent's page, card free. The environment
+        // is pinned (S7): sandbox-merchant.revolut.com only on test rows and only with test cards (revolut.js
+        // REVOLUT_TEST_CARDS), merchant.revolut.com only on live rows.
+        // Ships dark: served only to a client that declares `revolut_card_field`, gated off for every org until an
+        // operator lists one (`revolut:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // order the payment names is bound to what the cardholder approves (backend config.ts REVOLUT_ORDER_BOUND_TO_APPROVAL).
+        // Autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "revolut_card_field",
+        match: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments",
+        hosts: ["^merchant\\.revolut\\.com$", "^sandbox-merchant\\.revolut\\.com$"],
+        sandboxHosts: ["^sandbox-merchant\\.revolut\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's own headers: the API version Revolut reads the body by, its device id and the widget's
+        // version (the four the preflight allows, with the content type), and the JSON Accept. Origin, Referer
+        // and cookies never ride (the frame's own fetch carries Revolut's cookies only because it is same origin).
+        passthroughHeaders: ["^revolut-api-version$", "^revolut-device-id$", "^revolut-client-version$", "^accept$"],
+        jsonCardFields: [["payment_method", "number"]],
+        passWithoutCard: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments"
+    },
+    {
+        psp: "sumup",
+        // SumUp's online payments (UK, EEA, US, Latin America): the Payment Widget
+        // (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) that SumUp's WooCommerce plugin, its Payment Links, Online
+        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page serves every
+        // merchant from one origin). Each card field is a frame on gateway.sumup.com, and a
+        // hidden form frame there sends the card in one PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>:
+        // JSON {"payment_type":"card","device_information":..,"card":{"name","number","expiry_month":"MM",
+        // "expiry_year":"YY" or "YYYY","cvv"},"installments":1,..}, unencrypted, with X-Sumup-Correlation-Id naming
+        // the same checkout. sumup.js holds the request rule the pause decision, the API's create and the device all
+        // read: exactly that URL, a JSON Content-Type, the correlation id, and the widget's body byte for byte, with
+        // a body that carries a recurring mandate, which keeps the card at SumUp, refused. The body names no
+        // amount and no merchant: the checkout the merchant's server created holds both, so a live request is taken
+        // only for a checkout origin a reviewed pin lists. The request carries no cookie and no Authorization
+        // header (the checkout id is its credential), and the API answers any browser origin's preflight with
+        // credentials omitted. The answer is the checkout: PAID, FAILED, or PENDING with a 3-D Secure step the
+        // widget then runs in the page. SumUp's sandbox merchants share the live host, so no sandbox host is
+        // marked and the lane takes production rows only.
+        // Ships dark: served only to a client that declares `sumup_checkout_process`, gated off for every org until
+        // an operator lists one (`sumup:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match`
+        // unanchored, so the checkout's apple-pay-session sibling is never matched.
+        capability: "sumup_checkout_process",
+        match: "api\\.sumup\\.com/v0\\.2/checkouts/[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}(?![\\w/.%-])",
+        hosts: ["^api\\.sumup\\.com$"],
+        encoding: "json",
+        // The widget's correlation and session ids ride as it sent them, each held to its own shape (sumup.js);
+        // origin, referer and cookies never do (the widget sends no cookie).
+        passthroughHeaders: ["^x-sumup-correlation-id$", "^x-sumup-widget-session-id$"],
+        jsonCardFields: [["card", "number"]],
+        request: { method: "PUT", cardIn: "body", response: "json" }
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2447,6 +2610,18 @@ var AUTH_FIELDS = Object.freeze([
     "[auth]threeDSCompInd"
 ]);
 var QUICKPAY_REFUSALS = Object.freeze(["quickpay_card_page", "quickpay_3ds_challenge", "quickpay_cancelled"]);
+// src/processors/comgate.js
+var COMGATE_GATEWAY_HOSTS = Object.freeze({
+    "pay1.comgate.cz": "payments.comgate.cz",
+    "pay2.comgate.cz": "payments.comgate.cz",
+    "pay3.comgate.cz": "payments-gcp.comgate.cz",
+    "pay4.comgate.cz": "payments-gcp.comgate.cz"
+});
+var COMGATE_MERCHANTS = Object.freeze([]);
+var MAX_LOAD = 1024 * 1024;
+var MAX_ANSWER = 64 * 1024;
+var HEADER_NAMES = Object.freeze(["content-type", "x-cg-origin", "origin"]);
+var COMGATE_REFUSALS = Object.freeze(["comgate_3ds_challenge", "comgate_declined"]);
 // src/processors/przelewy24.js
 var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
 var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
@@ -2478,6 +2653,27 @@ var MAX_PAGE5 = 64 * 1024;
 var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
 var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
 var TRANSBANK_REFUSALS = Object.freeze(["transbank_3ds_challenge", "transbank_aborted", "transbank_error"]);
+// src/processors/paytrail.js
+var PAYTRAIL_HOSTS = Object.freeze(["services.paytrail.com"]);
+var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
+    "checkout-transaction-id",
+    "checkout-account",
+    "checkout-method",
+    "checkout-algorithm",
+    "checkout-timestamp",
+    "checkout-nonce",
+    "signature"
+]);
+var PAYTRAIL_MERCHANTS = Object.freeze([]);
+var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var UUID = new RegExp(`^${UUID_SOURCE}$`);
+var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
+var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
+var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
+var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`);
+var MAX_PAGE6 = 256 * 1024;
+var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
+var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.18",
+  "version": "0.23.19",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",