@agent-cards/sdk 0.23.19 → 0.23.20

package/dist/client.d.ts

@@ -257,6 +257,28 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * that the page then runs in the agent's browser. The cardholder's device sends the card through
  * the checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned PayMongo on for.
+ *
+ * `hipay_vault_token`: the token create HiPay's hosted fields send to HiPay's Secure Vault
+ * (secure2-vault.hipay-tpp.com, stage-secure2-vault for a test row), only through a prepared
+ * checkout: the merchant's page gives the frame 20 seconds after Pay. The cardholder's device
+ * sends the card to HiPay directly and the frame gets back HiPay's token. The number-only post
+ * the frame sends while the number is typed, and its /update once it holds a token, fail in the
+ * browser (pre-claim.ts hipayPreClaim). Served on the same terms: only to a build that lists it,
+ * for a company Agentcard turned HiPay on for.
+ *
+ * `twoc2p_secure_pay`: the Payment 2C2P's hosted payment page posts to its payment API
+ * (pgwv4.2c2p.com), carrying the card only as one field the page encrypts under 2C2P's static
+ * key. This build pauses it and writes over the placeholder's field the one the cardholder's
+ * device wrote under the key payment-core pins (twoc2p.ts), into that Payment alone; 3-D Secure
+ * then runs in the agent's browser. Served only to a build that lists it, and only for Agentcard's
+ * proof company, whatever the API's processor lists name: the field is the card under 2C2P's one
+ * static key, which any 2C2P merchant could charge.
+ *
+ * `quickpay_hosted_payment_page`: QuickPay's hosted payment window, whose card-free signed entry
+ * this build pauses for the cardholder's device and whose card post, fee lookup, wallet post, 3-D
+ * Secure step and card lookup this build never lets the agent's browser send (pre-claim.ts,
+ * quickpay.ts). Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a
+ * company Agentcard turned QuickPay on for.
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -1193,6 +1215,10 @@ export declare class CheckoutAuthError extends Error {
  * On Paytrail's hosts a payment's id reads `{transaction}`:
  * https://services.paytrail.com/payments/{transaction}/click-to-pay/loading-and-redirect, and on Payment
  * Highway's a card page's session reads `{session}`.
+ * On 2C2P's page hosts everything after the build's folder reads `{token}`:
+ * https://pgw-ui.2c2p.com/payment/4.1/{token}.
+ * On QuickPay's host the window's session reads `{session}`:
+ * https://payment.quickpay.net/{session}/3ds_auth.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1243,8 +1269,8 @@ export interface VaultClientOptions {
     /**
      * The voice module: how this product approves purchases by voice, named
      * once per business, with the Vault return link and the verifier address
-     * beside it. Leave it out for a client that approves no purchase by voice;
-     * `agentcard.voice.*` then throws `missing_approval_posture`. See `VoiceOptions`.
+     * beside it. Leave it out and the client approves on Agentcard's page
+     * (`approval: 'sheet'`). See `VoiceOptions`.
      */
     voice?: VoiceOptions;
     /**
@@ -1309,8 +1335,8 @@ export declare class VaultClient {
     /**
      * Approve purchases by voice inside your own product: connect a person once,
      * create the purchase, ask for the key word, read the result. Same
-     * credentials, same token as the checkout calls. Needs `voice: { approval }`
-     * at construction; without it every verb throws `missing_approval_posture`.
+     * credentials, same token as the checkout calls. Approves on Agentcard's
+     * page unless `voice: { approval: 'in_app' }` was named at construction.
      */
     readonly voice: VoiceModule;
     /**

package/dist/client.js

@@ -16,7 +16,9 @@ import { SHIJI_STS_CAPABILITY, SHIJI_STS_PSP, isShijiStsServedCompanion, isShiji
 import { AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { PADDLE_VGS_CAPABILITY, PADDLE_VGS_PSP, paddleVgsCardFactsOf } from './paddle-vgs.generated.js';
 import { PADDLE_TOKENEX_CAPABILITY, PADDLE_TOKENEX_PSP, isPaddleTokenexServedFacts, isPaddleTokenexServedSubstitution } from './paddle-tokenex.js';
+import { TWOC2P_CAPABILITY, TWOC2P_PSP } from './twoc2p.js';
 import { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_PSP } from './wix-payments.generated.js';
+import { HIPAY_CAPABILITY, HIPAY_PSP } from './hipay.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
 import { BuyModule } from './buy.js';
@@ -241,9 +243,31 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * that the page then runs in the agent's browser. The cardholder's device sends the card through
  * the checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned PayMongo on for.
+ *
+ * `hipay_vault_token`: the token create HiPay's hosted fields send to HiPay's Secure Vault
+ * (secure2-vault.hipay-tpp.com, stage-secure2-vault for a test row), only through a prepared
+ * checkout: the merchant's page gives the frame 20 seconds after Pay. The cardholder's device
+ * sends the card to HiPay directly and the frame gets back HiPay's token. The number-only post
+ * the frame sends while the number is typed, and its /update once it holds a token, fail in the
+ * browser (pre-claim.ts hipayPreClaim). Served on the same terms: only to a build that lists it,
+ * for a company Agentcard turned HiPay on for.
+ *
+ * `twoc2p_secure_pay`: the Payment 2C2P's hosted payment page posts to its payment API
+ * (pgwv4.2c2p.com), carrying the card only as one field the page encrypts under 2C2P's static
+ * key. This build pauses it and writes over the placeholder's field the one the cardholder's
+ * device wrote under the key payment-core pins (twoc2p.ts), into that Payment alone; 3-D Secure
+ * then runs in the agent's browser. Served only to a build that lists it, and only for Agentcard's
+ * proof company, whatever the API's processor lists name: the field is the card under 2C2P's one
+ * static key, which any 2C2P merchant could charge.
+ *
+ * `quickpay_hosted_payment_page`: QuickPay's hosted payment window, whose card-free signed entry
+ * this build pauses for the cardholder's device and whose card post, fee lookup, wallet post, 3-D
+ * Secure step and card lookup this build never lets the agent's browser send (pre-claim.ts,
+ * quickpay.ts). Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a
+ * company Agentcard turned QuickPay on for.
  */
 export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization', PADDLE_VGS_CAPABILITY, PADDLE_TOKENEX_CAPABILITY,
-    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY, 'paymongo_checkout_pay'];
+    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY, 'paymongo_checkout_pay', HIPAY_CAPABILITY, TWOC2P_CAPABILITY, 'quickpay_hosted_payment_page'];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -275,15 +299,20 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * PayMongo's card attach carries none either: the merchant bound the total, always in
  * Philippine pesos, to the checkout session when it created it, so the agent sends that
  * total, above zero (PAYMONGO_PSP below), and the API holds it to the session PayMongo's
- * own page shows.
+ * own page shows. 2C2P's Payment carries none either: the merchant bound the total to the
+ * payment token when it created it, so the agent sends the total 2C2P's page shows, above
+ * zero (TWOC2P_PSP), and the API holds it to the amount 2C2P's own PaymentOption answer names.
+ * HiPay's token create carries none either: the merchant's server charges
+ * HiPay's token for its own order, so the agent's pair, which the prepared checkout carries,
+ * is the total the cardholder approves, above zero as Moneris's is.
  */
 const MONERIS_PSP = 'moneris';
 const PAYFAST_PSP = 'payfast';
 const PAYMONGO_PSP = 'paymongo';
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP, PAYMONGO_PSP];
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP, PAYMONGO_PSP, HIPAY_PSP, TWOC2P_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix', [PAYMONGO_PSP]: 'PayMongo' };
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix', [PAYMONGO_PSP]: 'PayMongo', [HIPAY_PSP]: 'HiPay', [TWOC2P_PSP]: '2C2P' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -1268,6 +1297,68 @@ function maskPaytrailTransaction(path) {
 function maskPaymentHighwaySession(path) {
     return maskPaytrailId(path, '{session}');
 }
+/**
+ * 2C2P's hosted payment page names its payment token in its hash routes (pgw-ui.2c2p.com/payment/<build>/#/token/
+ * <token>, #/info/<token>, #/mobile/process/<token>), and the token is all a browser needs to open that payment's page
+ * (payment-core twoc2p.js). redactUrl drops a fragment, but a URL whose `#` was escaped carries the route in its path,
+ * and then in any spelling: escaped or doubled separators, escaped letters, parameters. Nothing past the build's folder
+ * on 2C2P's page hosts is worth a log line, so everything after `/payment/<build>/`, its separators in any spelling
+ * SLASH reads, reads {token}, and on any other path everything after its first separator. A string that is not a URL
+ * is cut the same way after a whole page-host authority it names (at the start, or after a space, a quote, a bracket,
+ * a colon such as a `see:` before it, a comma, a semicolon, an equals sign or `//`, and followed by a path, a port or
+ * the end), and only up to the end of that URL, so the message's own words,
+ * another site's path naming the host and a lookalike host stay; a text naming several such URLs has each one cut.
+ * Anchored matches and cuts in one pass: no input makes it backtrack.
+ */
+const TWOC2P_PAGE_HOST = /^(?:sandbox-)?pgw-ui\.2c2p\.com\.?$/i;
+const TWOC2P_PAGE_FOLDER = new RegExp(`^${SLASH}payment${SLASH}4\\.[0-9]{1,2}${SLASH}`, 'i');
+const TWOC2P_FIRST_SEPARATOR = new RegExp(`^${SLASH}`, 'i');
+const TWOC2P_PAGE_AUTHORITY = `(?:^|[\\s"'(<\\[:,;=]|//)(?:sandbox-)?pgw-ui\\.2c2p\\.com\\.?(?::[0-9]{1,5})?(?=${SLASH}|$)`;
+/** One page path, from its first separator: the build's folder stays and the rest reads {token}. */
+function maskTwoC2pPath(path) {
+    const kept = TWOC2P_PAGE_FOLDER.exec(path) ?? TWOC2P_FIRST_SEPARATOR.exec(path);
+    const end = kept ? kept[0].length : 0;
+    return path.length > end ? `${path.slice(0, end)}{token}` : path;
+}
+/**
+ * Text that is not a URL: every whole page-host authority it names, each URL cut only to its own end (the first
+ * space, quote or bracket), so the words between and after them stay. A text that starts with a slash is read the
+ * same way, so another site's protocol-relative URL that names the host keeps its own host and path.
+ */
+function maskTwoC2pToken(path) {
+    const authority = new RegExp(TWOC2P_PAGE_AUTHORITY, 'gi');
+    // A closing bracket or parenthesis ends the URL only when no path or token character follows it, so a URL
+    // a message wraps in [] or () keeps the words after it, and a bracket inside the path still cannot end the cut early.
+    const urlEnd = /[\s"'<>]|[\])](?![A-Za-z0-9+/=%\\])/g;
+    let out = '';
+    let done = 0;
+    for (let host = authority.exec(path); host !== null; host = authority.exec(path)) {
+        const start = host.index + host[0].length;
+        urlEnd.lastIndex = start;
+        const stop = urlEnd.exec(path);
+        const end = stop ? stop.index : path.length;
+        out += path.slice(done, start) + maskTwoC2pPath(path.slice(start, end));
+        done = end;
+        authority.lastIndex = end;
+    }
+    return out + path.slice(done);
+}
+/**
+ * QuickPay's window names its session as the first segment of its own path (/<32 hex>, then /3ds_auth or
+ * /poll-response), and that id is what carries a card post into the payment the merchant's signed entry
+ * opened; a payment link's id (/payments/<64 hex>) opens one the same way. On QuickPay's host a run of 32 hex
+ * digits or more after a slash, in any case or escaped, reads {session} whatever follows it: a URL parser drops a
+ * newline after the URL, so words after it can run on into the id. The entry, the host's root, carries none.
+ */
+const QUICKPAY_HOST = /^payment\.quickpay\.net\.?$/i;
+const QUICKPAY_SESSION = /(\/|%2f)[0-9a-f]{32,}/gi;
+function maskQuickpaySession(path) {
+    return path.replace(QUICKPAY_SESSION, '$1{session}');
+}
+/**
+ * `mask` reads a text that names the processor's host; `pathMask`, where a processor has one, reads the path of a
+ * URL already parsed on that host, which `mask` reads otherwise.
+ */
 const PATH_CREDENTIALS = [
     { host: PATH_SECRET_HOST, named: /(?:wspay\.biz|monri\.com)/i, mask: maskPathSecret },
     { host: CREDITGUARD_HOST, named: /creditguard\.co\.il/i, mask: maskCreditguardTxId },
@@ -1288,6 +1379,8 @@ const PATH_CREDENTIALS = [
     { host: SUMUP_API_HOST, named: /api\.sumup\.com/i, mask: maskSumupCheckout },
     { host: PAYTRAIL_HOST, named: /paytrail\.com/i, mask: maskPaytrailTransaction },
     { host: PAYMENT_HIGHWAY_HOST, named: /(?:paymenthighway\.io|sph-test-solinor\.com)/i, mask: maskPaymentHighwaySession },
+    { host: TWOC2P_PAGE_HOST, named: /pgw-ui\.2c2p\.com/i, mask: maskTwoC2pToken, pathMask: maskTwoC2pPath },
+    { host: QUICKPAY_HOST, named: /quickpay\.net/i, mask: maskQuickpaySession },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1321,6 +1414,10 @@ const PATH_CREDENTIALS = [
  * On Paytrail's hosts a payment's id reads `{transaction}`:
  * https://services.paytrail.com/payments/{transaction}/click-to-pay/loading-and-redirect, and on Payment
  * Highway's a card page's session reads `{session}`.
+ * On 2C2P's page hosts everything after the build's folder reads `{token}`:
+ * https://pgw-ui.2c2p.com/payment/4.1/{token}.
+ * On QuickPay's host the window's session reads `{session}`:
+ * https://payment.quickpay.net/{session}/3ds_auth.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1345,7 +1442,7 @@ export function redactUrl(raw) {
     let path = url.pathname;
     for (const rule of PATH_CREDENTIALS)
         if (rule.host.test(url.hostname))
-            path = rule.mask(path);
+            path = (rule.pathMask ?? rule.mask)(path);
     return maskNamed(`${url.origin}${path}`, url.pathname);
 }
 /**
@@ -1429,6 +1526,16 @@ const PADDLE_VGS_PREPARATION_REFUSALS = [
  * `unsupported_checkout`, which PREPARATION_REFUSALS names for every checkout. Only for a Wix checkout.
  */
 const WIX_PAYMENTS_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'merchant_profile_mismatch'];
+/**
+ * The API's refusals of a HiPay preparation, before any preparation exists, that prepareCheckout surfaces by name:
+ * the company is not turned on for HiPay (`processor_unavailable`), the environment is not the caller's key mode's
+ * (`live_host_on_sandbox_row`, `sandbox_host_on_live_row`), a checkout's merchant is not the name the reviewed pin
+ * carries (`merchant_profile_mismatch`), and the price is zero (`amount_required`), since every create after it would be
+ * refused. An unreviewed origin answers `unsupported_checkout`, which PREPARATION_REFUSALS names for every checkout.
+ * Only for a HiPay checkout.
+ */
+const HIPAY_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'sandbox_host_on_live_row', 'merchant_profile_mismatch',
+    'amount_required'];
 /**
  * The reason the cardholder's device declines a bound prepared row with, per processor, when its own
  * send boundary passed before the card left it (the Vault's sendWindow, 12 seconds after it last saw
@@ -1441,6 +1548,7 @@ const PREPARED_SEND_WINDOW_DECLINES = Object.freeze({
     amadeus_checkout: 'amadeus_send_window_closed',
     [SECURE_ACCEPTANCE_PSP]: 'secure_acceptance_send_window_closed',
     [WIX_PAYMENTS_PSP]: 'wix_payments_send_window_closed',
+    [HIPAY_PSP]: 'hipay_send_window_closed',
 });
 /**
  * Refusals a CyberSource Flex preparation that tokenizes before Pay answers (4xx) before any
@@ -1529,8 +1637,8 @@ export class VaultClient {
     /**
      * Approve purchases by voice inside your own product: connect a person once,
      * create the purchase, ask for the key word, read the result. Same
-     * credentials, same token as the checkout calls. Needs `voice: { approval }`
-     * at construction; without it every verb throws `missing_approval_posture`.
+     * credentials, same token as the checkout calls. Approves on Agentcard's
+     * page unless `voice: { approval: 'in_app' }` was named at construction.
      */
     voice;
     /**
@@ -1644,7 +1752,9 @@ export class VaultClient {
         // wspay_confirm, shiji_sts_pinned_key, amadeus_checkout_actions.v1,
         // worldline_mycheckout_form, verifone_card_capture, ekashu_hosted_payment_page,
         // cybersource_sa_token_create, gravy_session_fields_put,
-        // moneris_hosted_tokenization, paddle_vgs_cards, redsys_hosted_payment_page) and
+        // moneris_hosted_tokenization, paddle_vgs_cards, paddle_tokenex_pay,
+        // redsys_hosted_payment_page, lyra_krypton_payment, payfast_card_pay,
+        // quickpay_hosted_payment_page) and
         // the caller's company is one Agentcard turned that processor on for, so this
         // build arms Fiserv's card capture, GMO's getToken, CyberSource Flex's card
         // fields, Juspay's card flow, Datatrans's Secure Fields card post, the
@@ -2123,6 +2233,7 @@ export class VaultClient {
                     || (input.psp === EPROTECT_PSP && EPROTECT_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === PADDLE_VGS_PSP && PADDLE_VGS_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === WIX_PAYMENTS_PSP && WIX_PAYMENTS_PREPARATION_REFUSALS.includes(error.code))
+                    || (input.psp === HIPAY_PSP && HIPAY_PREPARATION_REFUSALS.includes(error.code))
                     || (!!flexContext && CYBERSOURCE_FLEX_PREPARATION_REFUSALS.includes(error.code))))
                     || (input.psp === 'fiserv' && error.status === 502 && error.code === 'cse_key_unavailable')))
                 throw fail(error.code);
@@ -2406,10 +2517,11 @@ export class VaultClient {
         // amount_required.
         if (!hasAmount && rec && AGENT_AMOUNT_PROCESSORS.includes(rec.psp))
             throw new AmountRequiredError(rec.psp);
-        // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay or a
-        // PayMongo attach charges the total its payment or checkout session already holds, so a zero pair
-        // would show the cardholder no price at all: it is refused like a missing one.
-        if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP || rec.psp === PAYMONGO_PSP) && Number(input.amount) <= 0)
+        // A Moneris or a HiPay token is charged later for whatever the merchant's server decides, and a Payfast pay, a
+        // PayMongo attach or a 2C2P Payment charges the total its payment, checkout session or payment token
+        // already holds, so a zero pair would show the cardholder no price at all: it is refused like a missing one.
+        if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP || rec.psp === PAYMONGO_PSP || rec.psp === HIPAY_PSP || rec.psp === TWOC2P_PSP)
+            && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the
@@ -2555,8 +2667,11 @@ export class VaultClient {
         // and the API names 500 ms as such a row's poll interval.
         // A prepared Paddle VGS card request too, for 20 seconds: Paddle's frame aborts it 10 seconds after
         // Pay and sends it once more, and the API names 500 ms as such a row's poll interval.
+        // A prepared HiPay token create too, for 20 seconds: HiPay's hosted fields give it 20 seconds from Pay, so
+        // an answer the cardholder's device records late in that span still reaches the frame before it gives up,
+        // and the API names 500 ms as such a row's poll interval.
         const preparedFastPollUntil = preparation?.psp === 'mercado_pago' ? Date.now() + 10_000
-            : preparation?.psp === PADDLE_VGS_PSP ? Date.now() + 20_000
+            : preparation?.psp === PADDLE_VGS_PSP || preparation?.psp === HIPAY_PSP ? Date.now() + 20_000
                 : preparation?.psp === EPROTECT_PSP ? Date.now() + 15_000
                     : preparation?.psp === SECURE_ACCEPTANCE_PSP ? Date.now() + SECURE_ACCEPTANCE_FAST_POLL_MS : 0;
         // A preparation that tokenized before Pay: the cardholder's device already holds CyberSource's

package/dist/hipay.generated.d.ts

@@ -0,0 +1,56 @@
+declare var HIPAY_PSP: string;
+declare var HIPAY_CAPABILITY: string;
+declare var HIPAY_OPERATION: string;
+declare var HIPAY_VAULT_HOSTS: Readonly<{
+    "secure2-vault.hipay-tpp.com": "production";
+    "stage-secure2-vault.hipay-tpp.com": "sandbox";
+}>;
+declare var HIPAY_TOKEN_URLS: Readonly<{
+    production: "https://secure2-vault.hipay-tpp.com/rest/v2/token";
+    sandbox: "https://stage-secure2-vault.hipay-tpp.com/rest/v2/token";
+}>;
+declare var HIPAY_UPDATE_PATH: string;
+declare var HIPAY_REFUSAL_CODES: readonly string[];
+declare function hipayTokenEnvironment(url: any): "production" | "sandbox" | null;
+declare function isHipayTokenUrl(url: any): boolean;
+declare function hipayBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function hipayNumberOnlyRequest(url: any, method: any, body: any): boolean;
+declare function hipayUsernameEnvironment(username: any): "production" | "sandbox" | null;
+declare function hipayUsername(headers: any): string | null;
+declare function hipayRequestRefusal(request: any): any;
+declare function isPreparedHipayRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare function hipayPinOriginUsable(origin: any): boolean;
+declare var HIPAY_MERCHANT_PINS: readonly never[];
+declare function hipayOriginPin(merchantOrigin: any, pins?: readonly never[]): null;
+declare function hipayPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly never[]): "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayMerchantPin(merchantOrigin: any, username: any, pins?: readonly never[]): null;
+declare function hipayMerchantRefusal(environment: any, merchantOrigin: any, username: any, pins?: readonly never[]): "hipay_headers_refused" | "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayRefusalMessage(code: any): any;
+declare function injectHipayCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isHipayDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function hipayRefusalCode(text: any): string | null;
+declare function hipayAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { HIPAY_CAPABILITY, HIPAY_MERCHANT_PINS, HIPAY_OPERATION, HIPAY_PSP, HIPAY_REFUSAL_CODES, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayAnswerOutcome, hipayBodyVerdict, hipayMerchantPin, hipayMerchantRefusal, hipayNumberOnlyRequest, hipayOriginPin, hipayPinOriginUsable, hipayPreparationRefusal, hipayRefusalCode, hipayRefusalMessage, hipayRequestRefusal, hipayTokenEnvironment, hipayUsername, hipayUsernameEnvironment, injectHipayCard, isHipayDeviceRequest, isHipayTokenUrl, isPreparedHipayRequest };