@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/client.d.ts

@@ -242,6 +242,13 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Payfast on for.
  *
+ * `przelewy24_hosted_payment_page`: Przelewy24's pay wall, whose card-free link
+ * (secure.przelewy24.pl/trnRequest/<token>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose card method post, card form post and Saferpay resolver this build never lets the
+ * agent's browser send (pre-claim.ts, przelewy24.ts). Served on the same terms as NMI's and
+ * Redsys's: only to a build that lists it, for a company Agentcard turned Przelewy24 on for.
+ *
  * `wix_payments_tokenize`: the card request Wix Cashier's card frame sends to Wix's
  * tokenizer (cashier-pci.wixapps.net), only through a prepared checkout: Wix's payment
  * widget fails the payment 30 seconds after it asks the frame for a token. The
@@ -257,6 +264,115 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * that the page then runs in the agent's browser. The cardholder's device sends the card through
  * the checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned PayMongo on for.
+ *
+ * `gopay_card_form`: the card post GoPay's card frame sends to its own URL
+ * (secure.gopay.com/gp-card-comm/h/<token>) inside the GoPay gateway a shop opens. This build pauses
+ * only the frame's own card post and answers it with GoPay's answer as the API recorded it, the
+ * empty JSON object the frame reads; the gateway then reads the payment's end from GoPay and runs
+ * 3-D Secure in the agent's browser when the bank asks for it. The cardholder's device sends the card
+ * through the checkout relay. Served only to a build that lists it, and only for Agentcard's proof
+ * company until a reviewed change binds GoPay's payee and amount to the approval: the post names
+ * neither. The API takes it only at a shop Agentcard reviewed.
+ *
+ * `hipay_vault_token`: the token create HiPay's hosted fields send to HiPay's Secure Vault
+ * (secure2-vault.hipay-tpp.com, stage-secure2-vault for a test row), only through a prepared
+ * checkout: the merchant's page gives the frame 20 seconds after Pay. The cardholder's device
+ * sends the card to HiPay directly and the frame gets back HiPay's token. The number-only post
+ * the frame sends while the number is typed, and its /update once it holds a token, fail in the
+ * browser (pre-claim.ts hipayPreClaim). Served on the same terms: only to a build that lists it,
+ * for a company Agentcard turned HiPay on for.
+ *
+ * `twoc2p_secure_pay`: the Payment 2C2P's hosted payment page posts to its payment API
+ * (pgwv4.2c2p.com), carrying the card only as one field the page encrypts under 2C2P's static
+ * key. This build pauses it and writes over the placeholder's field the one the cardholder's
+ * device wrote under the key payment-core pins (twoc2p.ts), into that Payment alone; 3-D Secure
+ * then runs in the agent's browser. Served only to a build that lists it, and only for Agentcard's
+ * proof company, whatever the API's processor lists name: the field is the card under 2C2P's one
+ * static key, which any 2C2P merchant could charge.
+ *
+ * `quickpay_hosted_payment_page`: QuickPay's hosted payment window, whose card-free signed entry
+ * this build pauses for the cardholder's device and whose card post, fee lookup, wallet post, 3-D
+ * Secure step and card lookup this build never lets the agent's browser send (pre-claim.ts,
+ * quickpay.ts). Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a
+ * company Agentcard turned QuickPay on for.
+ *
+ * `revolut_card_field`: the card payment Revolut Business's card field or card popup sends from
+ * its frame to /api/public/orders/<order token>/payments on merchant.revolut.com, on a merchant's
+ * own page or Revolut's hosted checkout. This build pauses only the frame's card payment and
+ * answers it with Revolut's answer as the API recorded it: the payment Revolut created, which the
+ * frame then follows, through any 3-D Secure step, in the agent's browser. A payment by Apple Pay,
+ * Google Pay or Revolut Pay on the same URL carries no card and continues untouched. Revolut's
+ * host answers the Vault's origin, so the cardholder's device sends the card itself, with no relay.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned Revolut
+ * on for.
+ *
+ * `pay_nl_card_token`: the card token request a shop's card form sends to Pay. (pay.nl),
+ * Weeztix's sandboxed frame posting its FormData to payment.pay.nl/v1/Payment/getCardToken/json.
+ * This build pauses only the form's own multipart body at that exact URL; the cardholder's
+ * device sends the card through the checkout relay, and the frame gets the token answer
+ * payment-core's judge rebuilt, with the CORS answer for the frame's own origin, null. The
+ * request names no amount, so the agent's pair, above zero, is the one the cardholder approves
+ * (PAY_NL_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pay. on for.
+ *
+ * `paypal_card_fields`: PayPal Card Fields' confirm, the POST its v5 frame sends to
+ * www.paypal.com and its v6 frame to api-m.paypal.com. This build pauses it only in
+ * the frames' own shape, refuses one that asks PayPal to keep the card or forces
+ * 3-D Secure in the browser with a `blocked` event, and answers the frame with the
+ * order's id and status as the API recorded them. The device sends a v5 confirm
+ * through the checkout relay and a v6 one directly. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned PayPal Card Fields on
+ * for. Every other company keeps the checkout guard's refusal (paypal-card-forms.ts).
+ *
+ * `comgate_hosted_payment_page`: ComGate's payment gateway, whose card-free gateway link
+ * (payN.comgate.cz/init?id=<transaction id>, a plain GET) this build pauses for the
+ * cardholder's device by its exact link (hosted-entry.ts), in the page, in a frame of it or
+ * in a window it opened, and whose card hosts this build never lets the agent's browser post
+ * to (pre-claim.ts, comgate.ts). Served on the same terms as NMI's and Redsys's: only to a
+ * build that lists it, for a company Agentcard turned ComGate on for.
+ *
+ * `makecommerce_card_frame`: the card post MakeCommerce's card frame sends to its own card endpoint
+ * (cc.maksekeskus.ee/card-payment) under the shop's publishable key. This build pauses only the
+ * frame's own one-time card payment and answers it with MakeCommerce's answer as the API recorded
+ * it: the URL of MakeCommerce's 3-D Secure page, which the frame then opens in the agent's browser.
+ * The cardholder's device sends the card through the checkout relay. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned MakeCommerce on for.
+ *
+ * `poynt_collect_nonce`: GoDaddy Payments' card request, the POST Poynt Collect's
+ * card frame sends to a store's generate-nonce on services.poynt.net. This build
+ * pauses it only as the frame writes it, refuses a body that asks Poynt to keep the
+ * card in the browser with a `blocked` event, and answers the frame with the nonce as
+ * the API recorded it. The device sends the card through the checkout relay. Served
+ * on the same terms: only to a build that lists it, for a company Agentcard turned
+ * GoDaddy Payments on for.
+ *
+ * `tokenex_iframe_tokenize`: the card post TokenEx's hosted iframe v3 sends from its card-number frame
+ * to its own document URL on htp.tokenex.com (JetBlue's card form). This build pauses only the PCI frame's
+ * own card post with its CVV frame, refuses in the browser every other post on that path that carries a
+ * card (tokenex-iframe.ts), answers it with TokenEx's token as the API recorded it, rebuilt from
+ * payment-core's allow-list, and answers the same frame's byte-identical repeat from that answer while the
+ * approval is being handed off. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned the TokenEx iframe on for.
+ *
+ * `transbank_webpay_hosted_payment_page`: Transbank's Webpay Plus, whose card-free entry
+ * (webpay3g.transbank.cl/webpayserver/initTransaction?token_ws=<token>, the merchant's
+ * redirect, a plain GET) this build pauses for the cardholder's device by its exact link
+ * (hosted-entry.ts) in the page or a frame of it, and with attachToCdp also in a window the
+ * page opened, and whose hosts this build never lets the agent's browser post to (pre-claim.ts,
+ * transbank.ts), so the token is never spent there. attachToPlaywright covers the page it is
+ * attached to and that page's frames only, and pauses only a direct or scripted navigation to
+ * the entry: its page.route sees no HTTP redirect hop, so a merchant's redirect needs attachToCdp.
+ * Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a company
+ * Agentcard turned Webpay on for.
+ *
+ * `sumup_checkout_process`: the card request SumUp's Payment Widget sends from its hidden form frame
+ * on gateway.sumup.com, a PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>. This build pauses
+ * that PUT as it pauses Gravy's, so only the CDP and Playwright adapters see it (the form frame is
+ * cross-origin to the page), and answers the frame with SumUp's own answer as the API recorded it: the
+ * paid checkout, or the 3-D Secure step the widget then runs in the agent's browser. The cardholder's
+ * device sends the card itself, and the API holds the payment to a merchant Agentcard reviewed, at the
+ * amount SumUp holds for the checkout. Served on the same terms: only to a build that lists it, for a
+ * company Agentcard turned SumUp on for.
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -816,7 +932,10 @@ export interface PlaceholderCard {
 /**
  * The placeholder number for a network (lowercase, as GET /api/v2/vault_cards names it) on a
  * processor's page: the processor's own number for that network when `overrides` names one, else
- * the network's default, else undefined for a network with no placeholder.
+ * the network's default, else undefined for a network with no placeholder. On a TokenEx iframe
+ * (`tokenex_iframe`) the number must also be one TokenEx's frame reads as that network, since the frame
+ * names the brand to the page from the typed digits and the cardholder's device refuses a mismatch: the
+ * frame's table takes Visa, Mastercard and American Express, so every other network gets undefined.
  */
 export declare function placeholderNumber(brand: string, psp?: string, overrides?: Readonly<Record<string, Readonly<Record<string, string>>>>): string | undefined;
 /**
@@ -839,7 +958,9 @@ export declare class PreparationRequiredError extends Error {
  * when the merchant's server created the payment), so the `amount` and
  * `currency` you pass are what the cardholder approves, and for WSPay the
  * figure the API compares with WSPay's answer when that answer names one (a
- * 3-D Secure step names none). Thrown locally before any create or
+ * 3-D Secure step names none). A Revolut card payment names the order's
+ * amount but not its currency, so it takes the same pair, above zero.
+ * Thrown locally before any create or
  * prompt, and terminal: the same request without an amount fails the same
  * way. The API answers 400 amount_required for the same case. A page total
  * (`pageAmount`) does not count.
@@ -1193,6 +1314,10 @@ export declare class CheckoutAuthError extends Error {
  * On Paytrail's hosts a payment's id reads `{transaction}`:
  * https://services.paytrail.com/payments/{transaction}/click-to-pay/loading-and-redirect, and on Payment
  * Highway's a card page's session reads `{session}`.
+ * On 2C2P's page hosts everything after the build's folder reads `{token}`:
+ * https://pgw-ui.2c2p.com/payment/4.1/{token}.
+ * On QuickPay's host the window's session reads `{session}`:
+ * https://payment.quickpay.net/{session}/3ds_auth.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1243,8 +1368,8 @@ export interface VaultClientOptions {
     /**
      * The voice module: how this product approves purchases by voice, named
      * once per business, with the Vault return link and the verifier address
-     * beside it. Leave it out for a client that approves no purchase by voice;
-     * `agentcard.voice.*` then throws `missing_approval_posture`. See `VoiceOptions`.
+     * beside it. Leave it out and the client approves on Agentcard's page
+     * (`approval: 'sheet'`). See `VoiceOptions`.
      */
     voice?: VoiceOptions;
     /**
@@ -1309,8 +1434,8 @@ export declare class VaultClient {
     /**
      * Approve purchases by voice inside your own product: connect a person once,
      * create the purchase, ask for the key word, read the result. Same
-     * credentials, same token as the checkout calls. Needs `voice: { approval }`
-     * at construction; without it every verb throws `missing_approval_posture`.
+     * credentials, same token as the checkout calls. Approves on Agentcard's
+     * page unless `voice: { approval: 'in_app' }` was named at construction.
      */
     readonly voice: VoiceModule;
     /**
@@ -1456,7 +1581,9 @@ export declare class VaultClient {
      * The facts hold only while the cardholder pays with that card. `psp` names the processor
      * whose card form the agent types into (the recognizer's name, `worldline_mycheckout`): a
      * processor that needs its own number for the card's network gets it, and every other gets the
-     * network's default. Throws PlaceholderCardError when there is no such card, its network has no
+     * network's default. On a TokenEx iframe (`tokenex_iframe`, JetBlue) the number is one TokenEx's frame
+     * reads as the card's own network, Visa, Mastercard or American Express, and any other network has no
+     * placeholder there. Throws PlaceholderCardError when there is no such card, its network has no
      * placeholder, or it carries no expiry.
      */
     placeholderCard(input: {