@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/przelewy24.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Przelewy24's pay wall (secure.przelewy24.pl, where most Polish shops send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server registers the payment with Przelewy24 and sends the buyer's browser to the pay wall link
+ * Przelewy24 answered with, https://secure.przelewy24.pl/trnRequest/<token>, by a redirect, by setting the page's
+ * location, or in a window the page opens. That GET carries no card, no amount and no merchant, and it is the one
+ * request a build that declares Przelewy24's capability pauses (hosted-entry.ts): the cardholder's device repeats it
+ * over the end-to-end TLS relay, picks the pay wall's card method and fills the card form Przelewy24 returns to it
+ * (payment-core processors/przelewy24.js). Everything else the agent's browser sends the pay wall to pay follows
+ * that entry and leads to a card: the card method's post (/trnRequest/<token>/241), the card form's post
+ * (/card/p24form/<token>) and the Saferpay resolver the card form asks for its post's URL
+ * (/saferpay/cardPaymentEndpointResolver/<token>/<card type>). This SDK aborts every one of them, so a placeholder
+ * card never reaches Przelewy24.
+ *
+ * PRZELEWY24_HOSTS is payment-core's PRZELEWY24_HOSTS, and isPrzelewy24EntryUrl is payment-core's
+ * isPrzelewy24EntryUrl; przelewy24.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const PRZELEWY24_PSP = "przelewy24";
+/** The dark-launch capability the API serves Przelewy24's recognizer behind (payment-core definitions.js). */
+export declare const PRZELEWY24_CAPABILITY = "przelewy24_hosted_payment_page";
+/** The pay wall's two hosts: live, and Przelewy24's sandbox, which runs the same pay wall for a test account. */
+export declare const PRZELEWY24_HOSTS: readonly string[];
+/**
+ * Whether a URL is the pay wall link exactly as the merchant's redirect names it: https, one of the two pay wall
+ * hosts in lowercase, the default port, no credentials, /trnRequest/ and one token, and no query, fragment, trailing
+ * segment or other spelling. The card method's link, the card post and every other pay wall page share the host,
+ * and none of them is the entry.
+ */
+export declare function isPrzelewy24EntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on the pay wall's hosts is a step toward paying there: any POST (the card method's post, the
+ * card form's post, and any other form the pay wall posts), and the GET of the Saferpay resolver, which names the
+ * typed card's type and answers with the URL the card form posts the card to. The pay wall's own pages, scripts and
+ * images are GETs of no card and are not one.
+ */
+export declare function isPrzelewy24PayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a pay wall host and this build's registry
+ * serves Przelewy24's entry there. The card method's post and the other pay steps are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to the pay wall once
+ * Przelewy24 is armed.
+ */
+export declare function isArmedPrzelewy24Url(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/przelewy24.js

@@ -0,0 +1,88 @@
+/**
+ * Przelewy24's pay wall (secure.przelewy24.pl, where most Polish shops send a buyer who pays by card), as this SDK
+ * reads it.
+ *
+ * The merchant's server registers the payment with Przelewy24 and sends the buyer's browser to the pay wall link
+ * Przelewy24 answered with, https://secure.przelewy24.pl/trnRequest/<token>, by a redirect, by setting the page's
+ * location, or in a window the page opens. That GET carries no card, no amount and no merchant, and it is the one
+ * request a build that declares Przelewy24's capability pauses (hosted-entry.ts): the cardholder's device repeats it
+ * over the end-to-end TLS relay, picks the pay wall's card method and fills the card form Przelewy24 returns to it
+ * (payment-core processors/przelewy24.js). Everything else the agent's browser sends the pay wall to pay follows
+ * that entry and leads to a card: the card method's post (/trnRequest/<token>/241), the card form's post
+ * (/card/p24form/<token>) and the Saferpay resolver the card form asks for its post's URL
+ * (/saferpay/cardPaymentEndpointResolver/<token>/<card type>). This SDK aborts every one of them, so a placeholder
+ * card never reaches Przelewy24.
+ *
+ * PRZELEWY24_HOSTS is payment-core's PRZELEWY24_HOSTS, and isPrzelewy24EntryUrl is payment-core's
+ * isPrzelewy24EntryUrl; przelewy24.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export const PRZELEWY24_PSP = 'przelewy24';
+/** The dark-launch capability the API serves Przelewy24's recognizer behind (payment-core definitions.js). */
+export const PRZELEWY24_CAPABILITY = 'przelewy24_hosted_payment_page';
+/** The pay wall's two hosts: live, and Przelewy24's sandbox, which runs the same pay wall for a test account. */
+export const PRZELEWY24_HOSTS = Object.freeze(['secure.przelewy24.pl', 'sandbox.przelewy24.pl']);
+const ENTRY_PATH = '/trnRequest/';
+// The token transaction/register returns: four groups of uppercase hexadecimal, 10, 6, 6 and 10 long.
+const TOKEN = /^[0-9A-F]{10}-[0-9A-F]{6}-[0-9A-F]{6}-[0-9A-F]{10}$/;
+// A token of that shape, for asking whether this build's registry serves the entry on a host.
+const PROBE_TOKEN = '0000000000-000000-000000-0000000000';
+/**
+ * Whether a URL is the pay wall link exactly as the merchant's redirect names it: https, one of the two pay wall
+ * hosts in lowercase, the default port, no credentials, /trnRequest/ and one token, and no query, fragment, trailing
+ * segment or other spelling. The card method's link, the card post and every other pay wall page share the host,
+ * and none of them is the entry.
+ */
+export function isPrzelewy24EntryUrl(raw) {
+    if (typeof raw !== 'string')
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || !PRZELEWY24_HOSTS.includes(url.hostname) || url.port || url.username || url.password
+        || url.href !== raw || /[?#]/.test(raw) || !url.pathname.startsWith(ENTRY_PATH))
+        return false;
+    return TOKEN.test(url.pathname.slice(ENTRY_PATH.length));
+}
+/** The pay wall host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function przelewy24Host(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return PRZELEWY24_HOSTS.includes(host) ? host : null;
+}
+/**
+ * Whether a request on the pay wall's hosts is a step toward paying there: any POST (the card method's post, the
+ * card form's post, and any other form the pay wall posts), and the GET of the Saferpay resolver, which names the
+ * typed card's type and answers with the URL the card form posts the card to. The pay wall's own pages, scripts and
+ * images are GETs of no card and are not one.
+ */
+export function isPrzelewy24PayStep(url, method) {
+    if (przelewy24Host(url) === null)
+        return false;
+    const verb = String(method).toUpperCase();
+    if (verb === 'POST')
+        return true;
+    return verb === 'GET' && /^\/saferpay\//i.test(new URL(url).pathname);
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a pay wall host and this build's registry
+ * serves Przelewy24's entry there. The card method's post and the other pay steps are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to the pay wall once
+ * Przelewy24 is armed.
+ */
+export function isArmedPrzelewy24Url(vault, url) {
+    const host = przelewy24Host(url);
+    return host !== null && vault.isCardRequest(`https://${host}${ENTRY_PATH}${PROBE_TOKEN}`, 'GET');
+}

package/dist/quickpay.d.ts

@@ -0,0 +1,44 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export declare const QUICKPAY_PSP = "quickpay";
+export declare const QUICKPAY_HOSTS: readonly string[];
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export declare function isQuickpayHost(url: string): boolean;
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isQuickpayEntry(url: string, method: string): boolean;
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export declare function isQuickpayCardLookup(url: string, method: string): boolean;
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export declare function quickpayEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export declare function isArmedQuickpayUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/quickpay.js

@@ -0,0 +1,65 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export const QUICKPAY_PSP = 'quickpay';
+export const QUICKPAY_HOSTS = Object.freeze(['payment.quickpay.net']);
+const QUICKPAY_ENTRY_URL = 'https://payment.quickpay.net/';
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export function isQuickpayHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && QUICKPAY_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isQuickpayEntry(url, method) {
+    return String(method).toUpperCase() === 'POST' && url === QUICKPAY_ENTRY_URL;
+}
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export function isQuickpayCardLookup(url, method) {
+    if (String(method).toUpperCase() !== 'GET' || !isQuickpayHost(url))
+        return false;
+    const parsed = new URL(url);
+    return /(?:^|\/)payment-methods\/?$/i.test(parsed.pathname) || parsed.searchParams.has('bin');
+}
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export function quickpayEntryUrl(url) {
+    return isQuickpayHost(url) ? QUICKPAY_ENTRY_URL : null;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export function isArmedQuickpayUrl(vault, url) {
+    const entry = quickpayEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}

package/dist/registry.d.ts

@@ -225,11 +225,12 @@ export declare function recognizerRequestMethod(rec: Pick<Recognizer, 'request'>
 /**
  * Whether `method` is this recognizer's card request method for `url`. A PUT
  * recognizer (Gravy) carries the card in its body as a POST one does, so its PUT
- * pauses like a POST, and neither pauses in the other's method. A GET carries
- * the card in its URL, so a GET recognizer is a card request only for a
- * processor whose exact query this build checks (Worldpay eProtect, through
- * payment-core's grammar); any other GET recognizer is nothing this build can
- * complete and is never paused.
+ * pauses like a POST, and neither pauses in the other's method. A GET is a card
+ * request only for a processor whose exact URL this build checks: Worldpay
+ * eProtect's registration, whose query carries the card (payment-core's
+ * grammar), and a hosted page entered with a plain GET, whose link carries no
+ * card and which the cardholder's device takes over (hosted-entry.ts). Any other
+ * GET recognizer is nothing this build can complete and is never paused.
  */
 export declare function isRecognizerRequest(rec: Recognizer, url: string, method: string): boolean;
 /**

package/dist/registry.js

@@ -12,6 +12,8 @@ import { isEprotectTokenRequest } from './eprotect.generated.js';
 import { EPROTECT_PSP } from './eprotect.js';
 import { isSecureAcceptanceTokenRequest } from './cybersource-secure-acceptance.generated.js';
 import { SECURE_ACCEPTANCE_PSP } from './cybersource-secure-acceptance.js';
+import { hasHostedGetEntry, isHostedGetEntry } from './hosted-entry.js';
+import { TOKENEX_IFRAME_PSP, isTokenexIframeUrl } from './tokenex-iframe.generated.js';
 export { BUILTIN_REGISTRY };
 /** True for a plain-http loopback address (`127.0.0.1` or `localhost`, any port); the only http a sandbox recogniser admits. */
 export function isLoopbackUrl(parsed) {
@@ -123,6 +125,15 @@ export function findRecognizer(url, registry = BUILTIN_REGISTRY, opts = {}) {
         // doubled slash. Any other spelling stays the stop's (pre-claim.ts).
         if (r.psp === SECURE_ACCEPTANCE_PSP)
             return isSecureAcceptanceTokenRequest(url, 'POST') === true;
+        // A hosted page entered with a plain GET (hosted-entry.ts, ComGate's gateway link) is recognized as the
+        // server recognizes it, by its exact link, query included: the match reads only the host and the path.
+        if (hasHostedGetEntry(r.psp))
+            return isHostedGetEntry(r.psp, url);
+        // The TokenEx iframe's card post goes to the frame's own document URL, query included, and the server
+        // recognizes only that exact URL with the PCI card frame's query (payment-core tokenexIframeTarget): the match
+        // reads only the host and the path. Any other query on that path is the TokenEx gate's (pre-claim.ts).
+        if (r.psp === TOKENEX_IFRAME_PSP)
+            return isTokenexIframeUrl(url);
         return true;
     }) ?? null);
 }
@@ -140,17 +151,19 @@ export function recognizerRequestMethod(rec) {
 /**
  * Whether `method` is this recognizer's card request method for `url`. A PUT
  * recognizer (Gravy) carries the card in its body as a POST one does, so its PUT
- * pauses like a POST, and neither pauses in the other's method. A GET carries
- * the card in its URL, so a GET recognizer is a card request only for a
- * processor whose exact query this build checks (Worldpay eProtect, through
- * payment-core's grammar); any other GET recognizer is nothing this build can
- * complete and is never paused.
+ * pauses like a POST, and neither pauses in the other's method. A GET is a card
+ * request only for a processor whose exact URL this build checks: Worldpay
+ * eProtect's registration, whose query carries the card (payment-core's
+ * grammar), and a hosted page entered with a plain GET, whose link carries no
+ * card and which the cardholder's device takes over (hosted-entry.ts). Any other
+ * GET recognizer is nothing this build can complete and is never paused.
  */
 export function isRecognizerRequest(rec, url, method) {
     const expected = recognizerRequestMethod(rec);
     if (typeof method !== 'string' || method.toUpperCase() !== expected)
         return false;
-    return expected !== 'GET' || (rec.psp === EPROTECT_PSP && isEprotectTokenRequest(url, 'GET'));
+    return expected !== 'GET' || (rec.psp === EPROTECT_PSP && isEprotectTokenRequest(url, 'GET'))
+        || (rec.mode === 'hosted_form' && isHostedGetEntry(rec.psp, url));
 }
 /**
  * True when this processor cannot be taken over on an ordinary authorization:
@@ -223,7 +236,14 @@ function cardHostPatterns(rec) {
         // normalization resolveRecognizerForUrl does with url.hostname. Do not
         // "fix" this by wildcarding the letters: `*???.??????.???*` matches most of
         // the web and would pause every request on the page.
-        return rec.hosts.filter((h) => typeof h === 'string').flatMap((h) => regexSourceToGlobs(h)).map((g) => wrap(g).toLowerCase());
+        //
+        // PayPal is armed by path, not host: www.paypal.com serves PayPal's whole site and its buttons' own
+        // traffic, so arming the host would pause and re-check every PayPal request on every page for nothing.
+        // Its frames send the confirm under one lower-case prefix, the spelling payment-core's
+        // paypalConfirmOrderId takes; the checkout guard (paypal-card-forms.ts) arms the same confirm for
+        // every company.
+        const path = rec?.psp === 'paypal' ? '/v2/checkout/orders/' : '';
+        return rec.hosts.filter((h) => typeof h === 'string').flatMap((h) => regexSourceToGlobs(h)).map((g) => wrap(`${g}${path}`).toLowerCase());
     }
     // No hosts[] — a registry pinned before the field existed, or hand-built.
     // Fall back to widening `match`, which is the predicate isCardRequest

package/dist/shiji-sts.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 98a535f4ba13e1ee4744fb725ae47c91fd9ca650dcb37fcd9eadd92b85bf6ce1
+// artifact-sha256: 9e15c873e3e3002651f0d5bcde91507c344bf33bfacec748aabfd56c6e7529f1
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);