@agent-cards/sdk 0.23.18 → 0.23.20

package/dist/card-endpoint.d.ts

@@ -49,6 +49,11 @@ export interface CardEndpointProfile {
      */
     readonly facts?: {
         readonly reader: string;
+        /**
+         * Null when the record's answers come from the endpoint origin; else the origin they come from, another host of
+         * the endpoint's site (D-EDGE's payment hub, beside the card frame that posts the card).
+         */
+        readonly origin: string | null;
         readonly responses: readonly {
             readonly method: string;
             readonly path: string;
@@ -101,9 +106,11 @@ export declare const CARD_ENDPOINT_MODE: "card_endpoint";
  *   (`detail` says what, naming fields, never values).
  * - `facts_unavailable`: the merchant keeps its own record of the order (profile.facts),
  *   and this runtime read none for this checkout, or one it cannot place.
- * - `facts_refused`: the merchant's own record says the order renews on a schedule, or
- *   that its checkout is in test mode. A total or currency that differs from the agent's
- *   is an AmountMismatchError instead.
+ * - `facts_refused`: the merchant's own record says the order renews on a schedule, that
+ *   the merchant charges the card later (a hotel rate that only guarantees the booking, a
+ *   charge on a later date, part of the room left for the stay), or that its checkout is
+ *   in test mode. A total or currency that differs from the agent's is an
+ *   AmountMismatchError instead.
  *
  * `not_enabled`, `amount_required`, `approval_required` and `preparation_unsupported`
  * answer the same way for every request on the attachment, so the adapters stop asking;
@@ -138,7 +145,10 @@ export declare function cardEndpointResendFor(url: string, method: string): Card
  * CORS preflight to the same URL defers), so routing a URL is never a decision to pause it.
  */
 export declare function cardEndpointRouted(url: string): boolean;
-/** The origins of the profiles whose merchant keeps its own record of the order: the only responses card-endpoint-facts.ts records. */
+/**
+ * The origins the record of each profile whose merchant keeps one comes from (its facts.origin, else its
+ * endpoint): the only responses card-endpoint-facts.ts records.
+ */
 export declare function cardEndpointFactsOrigins(): readonly string[];
 /**
  * The checkout session a request on the endpoint of a profile with facts belongs to: the
@@ -148,6 +158,12 @@ export declare function cardEndpointFactsOrigins(): readonly string[];
  * request. card-endpoint-facts.ts counts what it keeps, and what a checkout lost, by it.
  * When the paths of two profiles on one origin both fit, the shorter session is the one:
  * every request on a card request's session then gets the card request's own.
+ *
+ * For a profile whose record comes from its own origin (D-EDGE's payment hub beside the card
+ * frame), a request on that origin belongs to the session its last path segment names, the
+ * session id every hub URL ends in, and the profile's card request to the session its bind
+ * value names, both written on that origin ('https://pay.secure-hotel-booking.com/<id>'): the
+ * card post and the hub's own calls are one checkout, as payment-core's role rules read them.
  */
 export declare function cardEndpointFactsSession(url: string): string | null;
 /** Whether this build's copy of the profile takes payments (enabled, nothing pending, a reviewed HAR, not recurring). */

package/dist/card-endpoint.js

@@ -46,7 +46,9 @@
 // that sends the typed card again outside the card request is aborted in every status
 // (cardEndpointResendFor). And the merchant's own record of the order, which its page
 // reads from the endpoint origin, is recorded read-only (card-endpoint-facts.ts) and sent
-// with the create, so the agent's amount is held to the merchant's total.
+// with the create, so the agent's amount is held to the merchant's total. D-EDGE's card
+// frame is read the same way from the payment hub around it, whose booking record says
+// what the card pays now and whether the hotel charges it later.
 //
 // The endpoint URL (it carries cart, booking and instance ids), the paused body, the
 // session and the answer are cardholder data even with no real card in them: no
@@ -121,9 +123,23 @@ const ROUTED_METHODS = [...new Set(PROFILES.flatMap((profile) => [profile.method
 export function cardEndpointRouted(url) {
     return ROUTED_METHODS.some((method) => cardEndpointFor(url, method) !== null || cardEndpointResendFor(url, method) !== null);
 }
-/** The origins of the profiles whose merchant keeps its own record of the order: the only responses card-endpoint-facts.ts records. */
+/**
+ * The origins the record of each profile whose merchant keeps one comes from (its facts.origin, else its
+ * endpoint): the only responses card-endpoint-facts.ts records.
+ */
 export function cardEndpointFactsOrigins() {
-    return [...new Set(PROFILES.filter((profile) => profile.facts).map((profile) => profile.endpoint))];
+    return [...new Set(PROFILES.filter((profile) => profile.facts).map((profile) => profile.facts.origin ?? profile.endpoint))];
+}
+/**
+ * The `:name` segment of a card path template a URL path gives, when the path has the template's
+ * shape (as many segments, every literal one equal); else null.
+ */
+function boundSegment(template, segments, name) {
+    const want = template.split('/');
+    if (want.length !== segments.length || !want.every((part, i) => (part.startsWith(':') ? segments[i] !== '' : part === segments[i])))
+        return null;
+    const at = want.indexOf(`:${name}`);
+    return at < 1 ? null : segments[at];
 }
 /**
  * The checkout session a request on the endpoint of a profile with facts belongs to: the
@@ -133,6 +149,12 @@ export function cardEndpointFactsOrigins() {
  * request. card-endpoint-facts.ts counts what it keeps, and what a checkout lost, by it.
  * When the paths of two profiles on one origin both fit, the shorter session is the one:
  * every request on a card request's session then gets the card request's own.
+ *
+ * For a profile whose record comes from its own origin (D-EDGE's payment hub beside the card
+ * frame), a request on that origin belongs to the session its last path segment names, the
+ * session id every hub URL ends in, and the profile's card request to the session its bind
+ * value names, both written on that origin ('https://pay.secure-hotel-booking.com/<id>'): the
+ * card post and the hub's own calls are one checkout, as payment-core's role rules read them.
  */
 export function cardEndpointFactsSession(url) {
     let parsed;
@@ -143,9 +165,21 @@ export function cardEndpointFactsSession(url) {
         return null;
     }
     const segments = parsed.pathname.split('/');
+    for (const profile of PROFILES) {
+        const origin = profile.facts?.origin;
+        if (!origin)
+            continue;
+        if (parsed.origin === origin) {
+            const last = segments[segments.length - 1];
+            return last ? `${origin}/${last}` : null;
+        }
+        const bound = parsed.origin === profile.endpoint ? boundSegment(profile.path, segments, profile.facts.bind) : null;
+        if (bound)
+            return `${origin}/${bound}`;
+    }
     let shortest = null;
     for (const profile of PROFILES) {
-        if (!profile.facts || profile.endpoint !== parsed.origin)
+        if (!profile.facts || profile.facts.origin || profile.endpoint !== parsed.origin)
             continue;
         const template = profile.path.split('/');
         const at = template.indexOf(`:${profile.facts.bind}`);