@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/transbank.js

@@ -0,0 +1,73 @@
+/**
+ * Transbank's Webpay Plus (webpay3g.transbank.cl, the card payment form most Chilean shops send a buyer to), as this
+ * SDK reads it.
+ *
+ * The merchant's server creates the transaction at Transbank and sends the buyer's browser to Webpay with a GET,
+ * https://webpay3g.transbank.cl/webpayserver/initTransaction?token_ws=<64 lowercase hex>, the way the official
+ * WooCommerce plugin redirects. That GET carries no card and nothing but Transbank's token, and it is the one request
+ * a build that declares Webpay's capability pauses for Webpay (hosted-entry.ts): the cardholder's device repeats it
+ * over the end-to-end TLS relay and sends Webpay's card steps inside the session it opens (payment-core
+ * processors/transbank.js). Everything else the agent's browser sends Webpay spends the token or carries a card the
+ * agent typed: the token's one submit (/webpayserver/init_transaction.cgi), the card lookup and card check under
+ * /webpayserver/wswebpay/services/, and the card post (/webpayserver/bp_control.cgi). Once Webpay is served this SDK
+ * aborts every one of them (pre-claim.ts transbankPreClaim), so the token is never spent in the agent's browser and
+ * no placeholder card reaches Webpay. Only the link exactly as the merchant's redirect writes it is the entry; any
+ * other spelling would be handed on to Webpay's own route, which these rules never see.
+ *
+ * TRANSBANK_HOSTS is payment-core's TRANSBANK_HOSTS, and isTransbankEntryUrl is payment-core's rule of the same name;
+ * transbank.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export const TRANSBANK_PSP = 'transbank_webpay';
+/** The dark-launch capability the API serves Webpay's recognizer behind (payment-core definitions.js). */
+export const TRANSBANK_CAPABILITY = 'transbank_webpay_hosted_payment_page';
+/** Webpay's live host and Transbank's integration host, each a host of its own entry. */
+export const TRANSBANK_HOSTS = Object.freeze(['webpay3g.transbank.cl', 'webpay3gint.transbank.cl']);
+const TRANSBANK_ENTRY_PATH = '/webpayserver/initTransaction';
+// A Webpay token as Transbank's REST reference defines it: 64 lowercase hex characters.
+const TOKEN_QUERY = /^\?token_ws=[0-9a-f]{64}$/;
+// An entry in the shape the merchant's redirect writes it: the registry reads Webpay as served when it takes this as a GET entry.
+const TRANSBANK_SAMPLE_ENTRY = `https://webpay3g.transbank.cl${TRANSBANK_ENTRY_PATH}?token_ws=${'0'.repeat(64)}`;
+/**
+ * Whether a URL is Webpay's entry exactly as the merchant's redirect writes it: https, one of Transbank's two hosts in
+ * lower case, no port, credentials or fragment, the path /webpayserver/initTransaction, and a query of the one
+ * `token_ws` parameter holding 64 lowercase hex characters. A string that parses to another spelling is not it.
+ */
+export function isTransbankEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256 || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password)
+        return false;
+    return TRANSBANK_HOSTS.includes(url.hostname) && url.pathname === TRANSBANK_ENTRY_PATH && TOKEN_QUERY.test(url.search);
+}
+/** Whether this URL is on one of Webpay's two hosts (https, no credentials, any port, a trailing dot or not). */
+export function isTransbankHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && TRANSBANK_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/** Whether this build's registry serves Webpay's entry: a company Agentcard turned Webpay on for, on a build that declares it. */
+export function servesTransbank(vault) {
+    return typeof vault?.isCardRequest === 'function' && vault.isCardRequest(TRANSBANK_SAMPLE_ENTRY, 'GET');
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of Webpay's hosts and this build's
+ * registry serves Webpay. attachToCdp pauses every request there through the recognizer's host patterns;
+ * attachToPlaywright's route predicate asks this, so both adapters show the Webpay gate every request to a Webpay host
+ * once Webpay is served.
+ */
+export function isArmedTransbankUrl(vault, url) {
+    return isTransbankHost(url) && servesTransbank(vault);
+}

package/dist/twoc2p.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 59df0cccc4cd5b4a98c801bfd901db5f264282e8209a07909898c35fc76a3c0b
+// artifact-sha256: 3c735198962459f0b06c7fbbdfa58de91ab1f76adeec6fa17b4e1a8d33e4b8c3
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "47dd1bc5a749224f66980b42b758f9a19d9ac849e3a8d5230075226a4870fde5",
+  "catalog_sha256": "7f65e0f07138296b0cbff7dd1ed4331842b6dd45e2950f08273fcc772c7f63f6",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.20",
+  "version": "0.23.22",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,8 +30,8 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs twoc2p.test.mjs redact-url.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node paypal-card-forms-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs && node ebanx-browser.test.mjs && node hold-browser.test.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",