@agent-cards/sdk 0.23.2 → 0.23.4

package/dist/client.js

@@ -1787,9 +1787,10 @@ export class VaultClient {
         // with that method, so a caller handing in another one would get it
         // silently rewritten and the cardholder's device would replay something the
         // caller never asked for. A direct caller deserves to be told, not surprised.
-        const method = (input.request.method ?? 'POST').toUpperCase();
-        // A card endpoint has no recognizer: its card request is a POST, as every recognizer's is but eProtect's.
-        const cardMethod = rec ? recognizerRequestMethod(rec) : 'POST';
+        // A card endpoint has no recognizer: its card request is its profile's own method (a POST, or
+        // Target Optical's PUT), which admitCardEndpoint already held the request to.
+        const method = (input.request.method ?? cardEndpoint?.method ?? 'POST').toUpperCase();
+        const cardMethod = rec ? recognizerRequestMethod(rec) : cardEndpoint ? cardEndpoint.method : 'POST';
         if (method !== cardMethod) {
             throw new Error(cardMethod === 'GET'
                 ? `a ${rec?.psp} card registration is a GET; got ${method} for ${redactUrl(input.request.url)}.`
@@ -1854,7 +1855,7 @@ export class VaultClient {
             ...(input.cardId ? { cardId: input.cardId } : {}),
             execution_mode: 'user_approval',
             checkout_origin: cardEndpoint.session.page_origin,
-            request: { url: cardEndpoint.session.url, method: 'POST', headers: {}, body: '' },
+            request: { url: cardEndpoint.session.url, method: cardEndpoint.method, headers: {}, body: '' },
             merchant_card_endpoint: { profile: cardEndpoint.profile, session: cardEndpoint.session, ...(cardEndpoint.facts ? { facts: cardEndpoint.facts } : {}) },
         } : {
             user: input.user,
@@ -2707,8 +2708,10 @@ export class VaultClient {
 /**
  * A card endpoint request, checked whole before any network call: a profile in this
  * build's table; no other checkout context, Autopilot or preparation (the cardholder
- * approves every such payment); the agent's amount, the only authority here; a
- * session the API and the device would take (payment-core
+ * approves every such payment); the agent's amount, the only authority here; the
+ * session's own URL with the profile's own method (a request that names none takes
+ * the profile's, a POST or Target Optical's PUT); a session the API and the device
+ * would take (payment-core
  * merchantCardEndpointSessionRefusal: the profile's URL, headers, cookies, Referer and
  * body, paused on its checkout page); for a merchant that keeps its own record of the
  * order, that record, held to the agent's amount and currency, and refused for an order
@@ -2731,7 +2734,7 @@ function admitCardEndpoint(input) {
     if (input.amount == null || typeof input.currency !== 'string' || !input.currency)
         throw new CardEndpointRefusedError(profile.id, 'amount_required');
     const session = named.session;
-    if (!isRecord(session) || (input.request.method ?? 'POST').toUpperCase() !== 'POST' || input.request.url !== session.url) {
+    if (!isRecord(session) || (input.request.method ?? profile.method).toUpperCase() !== profile.method || input.request.url !== session.url) {
         throw new CardEndpointRefusedError(profile.id, 'request_unsupported', 'the request is not the session\'s card request');
     }
     const refusal = cardEndpointSessionRefusal(profile, session);
@@ -2740,7 +2743,7 @@ function admitCardEndpoint(input) {
     const facts = admitCardEndpointFacts(profile, session, named.facts, input);
     if (!cardEndpointLive(profile))
         throw new CardEndpointRefusedError(profile.id, 'not_enabled');
-    return { profile: profile.id, session, ...(facts ? { facts } : {}) };
+    return { profile: profile.id, method: profile.method, session, ...(facts ? { facts } : {}) };
 }
 /**
  * The merchant's own record of the order, for a profile whose merchant keeps one

package/dist/lifecycle.d.ts

@@ -225,10 +225,12 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * unsupported_primer_request), a Payrails request its gate refuses
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
-     * shiji-sts.ts reasons), or a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's).
+     * shiji-sts.ts reasons), a post to a processor's own card page that only
+     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
      */
-    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page'): void;
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields'): void;
     /**
      * A card request that only a prepared checkout pays (an Adyen merchant
      * profile's, or a Fiserv card capture) arrived with no preparation on this

package/dist/lifecycle.js

@@ -201,8 +201,10 @@ export class CheckoutLifecycle {
      * unsupported_primer_request), a Payrails request its gate refuses
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
-     * shiji-sts.ts reasons), or a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's).
+     * shiji-sts.ts reasons), a post to a processor's own card page that only
+     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;