@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/client.d.ts

@@ -242,6 +242,13 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Payfast on for.
  *
+ * `przelewy24_hosted_payment_page`: Przelewy24's pay wall, whose card-free link
+ * (secure.przelewy24.pl/trnRequest/<token>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose card method post, card form post and Saferpay resolver this build never lets the
+ * agent's browser send (pre-claim.ts, przelewy24.ts). Served on the same terms as NMI's and
+ * Redsys's: only to a build that lists it, for a company Agentcard turned Przelewy24 on for.
+ *
  * `wix_payments_tokenize`: the card request Wix Cashier's card frame sends to Wix's
  * tokenizer (cashier-pci.wixapps.net), only through a prepared checkout: Wix's payment
  * widget fails the payment 30 seconds after it asks the frame for a token. The
@@ -258,6 +265,31 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * the checkout relay. Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned PayMongo on for.
  *
+ * `gopay_card_form`: the card post GoPay's card frame sends to its own URL
+ * (secure.gopay.com/gp-card-comm/h/<token>) inside the GoPay gateway a shop opens. This build pauses
+ * only the frame's own card post and answers it with GoPay's answer as the API recorded it, the
+ * empty JSON object the frame reads; the gateway then reads the payment's end from GoPay and runs
+ * 3-D Secure in the agent's browser when the bank asks for it. The cardholder's device sends the card
+ * through the checkout relay. Served only to a build that lists it, and only for Agentcard's proof
+ * company until a reviewed change binds GoPay's payee and amount to the approval: the post names
+ * neither. The API takes it only at a shop Agentcard reviewed.
+ *
+ * `paygent_token`: the token request Paygent's own PaygentToken.js sends from a merchant's
+ * page (token.paygent.co.jp/n/token/request), only through a prepared checkout: the script
+ * abandons the request 35 seconds after the press that sends it, so the cardholder approves
+ * before the press. The cardholder's device sends the card itself and the page gets back
+ * Paygent's single-use token alone; the SDK refuses a second token request on the same approval.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned
+ * Paygent on for.
+ *
+ * `payrexx_card_frame`: the card request Payrexx Pay's card frame sends to its own URL
+ * (checkout.payrexx.com/?pspId=44&lang=<xx>) on a Payrexx merchant's page. This build pauses only
+ * the frame's own one-time card request and answers it with Payrexx's answer as the API recorded
+ * it: the token the merchant's page then charges, or the start of 3-D Secure, whose two later sends
+ * of the card this build hands to the cardholder's device under the same approval (payrexx.ts,
+ * pre-claim.ts payrexxPreClaim). The cardholder's device sends the card through the checkout relay.
+ * Served only to a build that lists it, for a company Agentcard turned Payrexx on for.
+ *
  * `hipay_vault_token`: the token create HiPay's hosted fields send to HiPay's Secure Vault
  * (secure2-vault.hipay-tpp.com, stage-secure2-vault for a test row), only through a prepared
  * checkout: the merchant's page gives the frame 20 seconds after Pay. The cardholder's device
@@ -279,6 +311,110 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * Secure step and card lookup this build never lets the agent's browser send (pre-claim.ts,
  * quickpay.ts). Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a
  * company Agentcard turned QuickPay on for.
+ *
+ * `revolut_card_field`: the card payment Revolut Business's card field or card popup sends from
+ * its frame to /api/public/orders/<order token>/payments on merchant.revolut.com, on a merchant's
+ * own page or Revolut's hosted checkout. This build pauses only the frame's card payment and
+ * answers it with Revolut's answer as the API recorded it: the payment Revolut created, which the
+ * frame then follows, through any 3-D Secure step, in the agent's browser. A payment by Apple Pay,
+ * Google Pay or Revolut Pay on the same URL carries no card and continues untouched. Revolut's
+ * host answers the Vault's origin, so the cardholder's device sends the card itself, with no relay.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned Revolut
+ * on for.
+ *
+ * `pay_nl_card_token`: the card token request a shop's card form sends to Pay. (pay.nl),
+ * Weeztix's sandboxed frame posting its FormData to payment.pay.nl/v1/Payment/getCardToken/json.
+ * This build pauses only the form's own multipart body at that exact URL; the cardholder's
+ * device sends the card through the checkout relay, and the frame gets the token answer
+ * payment-core's judge rebuilt, with the CORS answer for the frame's own origin, null. The
+ * request names no amount, so the agent's pair, above zero, is the one the cardholder approves
+ * (PAY_NL_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Pay. on for.
+ *
+ * `paypal_card_fields`: PayPal Card Fields' confirm, the POST its v5 frame sends to
+ * www.paypal.com and its v6 frame to api-m.paypal.com. This build pauses it only in
+ * the frames' own shape, refuses one that asks PayPal to keep the card or forces
+ * 3-D Secure in the browser with a `blocked` event, and answers the frame with the
+ * order's id and status as the API recorded them. The device sends a v5 confirm
+ * through the checkout relay and a v6 one directly. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned PayPal Card Fields on
+ * for. Every other company keeps the checkout guard's refusal (paypal-card-forms.ts).
+ *
+ * `comgate_hosted_payment_page`: ComGate's payment gateway, whose card-free gateway link
+ * (payN.comgate.cz/init?id=<transaction id>, a plain GET) this build pauses for the
+ * cardholder's device by its exact link (hosted-entry.ts), in the page, in a frame of it or
+ * in a window it opened, and whose card hosts this build never lets the agent's browser post
+ * to (pre-claim.ts, comgate.ts). Served on the same terms as NMI's and Redsys's: only to a
+ * build that lists it, for a company Agentcard turned ComGate on for.
+ *
+ * `makecommerce_card_frame`: the card post MakeCommerce's card frame sends to its own card endpoint
+ * (cc.maksekeskus.ee/card-payment) under the shop's publishable key. This build pauses only the
+ * frame's own one-time card payment and answers it with MakeCommerce's answer as the API recorded
+ * it: the URL of MakeCommerce's 3-D Secure page, which the frame then opens in the agent's browser.
+ * The cardholder's device sends the card through the checkout relay. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned MakeCommerce on for.
+ *
+ * `poynt_collect_nonce`: GoDaddy Payments' card request, the POST Poynt Collect's
+ * card frame sends to a store's generate-nonce on services.poynt.net. This build
+ * pauses it only as the frame writes it, refuses a body that asks Poynt to keep the
+ * card in the browser with a `blocked` event, and answers the frame with the nonce as
+ * the API recorded it. The device sends the card through the checkout relay. Served
+ * on the same terms: only to a build that lists it, for a company Agentcard turned
+ * GoDaddy Payments on for.
+ *
+ * `tokenex_iframe_tokenize`: the card post TokenEx's hosted iframe v3 sends from its card-number frame
+ * to its own document URL on htp.tokenex.com (JetBlue's card form). This build pauses only the PCI frame's
+ * own card post with its CVV frame, refuses in the browser every other post on that path that carries a
+ * card (tokenex-iframe.ts), answers it with TokenEx's token as the API recorded it, rebuilt from
+ * payment-core's allow-list, and answers the same frame's byte-identical repeat from that answer while the
+ * approval is being handed off. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned the TokenEx iframe on for.
+ *
+ * `transbank_webpay_hosted_payment_page`: Transbank's Webpay Plus, whose card-free entry
+ * (webpay3g.transbank.cl/webpayserver/initTransaction?token_ws=<token>, the merchant's
+ * redirect, a plain GET) this build pauses for the cardholder's device by its exact link
+ * (hosted-entry.ts) in the page or a frame of it, and with attachToCdp also in a window the
+ * page opened, and whose hosts this build never lets the agent's browser post to (pre-claim.ts,
+ * transbank.ts), so the token is never spent there. attachToPlaywright covers the page it is
+ * attached to and that page's frames only, and pauses only a direct or scripted navigation to
+ * the entry: its page.route sees no HTTP redirect hop, so a merchant's redirect needs attachToCdp.
+ * Served on the same terms as NMI's and Redsys's: only to a build that lists it, for a company
+ * Agentcard turned Webpay on for.
+ *
+ * `sumup_checkout_process`: the card request SumUp's Payment Widget sends from its hidden form frame
+ * on gateway.sumup.com, a PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>. This build pauses
+ * that PUT as it pauses Gravy's, so only the CDP and Playwright adapters see it (the form frame is
+ * cross-origin to the page), and answers the frame with SumUp's own answer as the API recorded it: the
+ * paid checkout, or the 3-D Secure step the widget then runs in the agent's browser. The cardholder's
+ * device sends the card itself, and the API holds the payment to a merchant Agentcard reviewed, at the
+ * amount SumUp holds for the checkout. Served on the same terms: only to a build that lists it, for a
+ * company Agentcard turned SumUp on for.
+ *
+ * `clover_card_token`: the card token request Clover's card frame (the hidden frame of
+ * checkout.clover.com that Clover's iframe mounts on a merchant's page) sends to
+ * token.clover.com/v1/tokens (token-sandbox.dev.clover.com for a test row), with the number
+ * encrypted under Clover's key. This build pauses only the frame's own body at that exact URL; the
+ * cardholder's device builds the request again with the real card under the key payment-core pins
+ * and sends it to Clover itself, and the frame gets the token answer payment-core's judge rebuilt.
+ * The request names no amount, so the agent's pair, above zero, is the one the cardholder approves
+ * (CLOVER_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Clover on for.
+ *
+ * `eximbay_hosted_payment_page`: Eximbay's payment window, whose card-free signed entry
+ * (a form post to /Gateway/BasicProcessor.krp on secureapi.eximbay.com, or its test host) this
+ * build pauses for the cardholder's device, in the page or in a window it opened once attachToCdp
+ * has armed that window (eximbay.ts names the entry that can leave first), and whose
+ * step, amount query, card lookup and card post this build never lets the agent's browser send
+ * (pre-claim.ts, eximbay.ts). Served on the same terms as NMI's and Redsys's: only to a build
+ * that lists it, for a company Agentcard turned Eximbay on for.
+ *
+ * `toast_pinned_key`: the card request Toast's payments frame sends to
+ * payments.toasttab.com/v1/payment-methods on a Toast online-ordering checkout, with
+ * the card sealed in card.cardData under one key every Toast restaurant shares. The
+ * cardholder's device seals the real card under that key, which payment-core pins, and
+ * this build writes it over the agent's placeholder and nothing else before it
+ * continues the request. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Toast on for.
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -358,8 +494,9 @@ export interface TokenReplay extends ExecutionMetadata {
     amountAuthority?: AmountAuthority;
     /**
      * An EBANX token approval that covers the sends EBANX's page makes after it (its 3-D Secure calls and the hosted
-     * page's confirm), for a company Agentcard turned that on for: until when (ISO 8601) the adapters may ask the
-     * cardholder's device to send them (sendEbanxFollowUp). Absent on every other approval.
+     * page's confirm), for a company Agentcard turned that on for, or a Payrexx card request whose answer started 3-D
+     * Secure, which covers the card frame's two 3-D Secure sends: until when (ISO 8601) the adapters may ask the
+     * cardholder's device to send them (sendEbanxFollowUp, sendPayrexxFollowUp). Absent on every other approval.
      */
     followUpsUntil?: string;
 }
@@ -838,7 +975,10 @@ export interface PlaceholderCard {
 /**
  * The placeholder number for a network (lowercase, as GET /api/v2/vault_cards names it) on a
  * processor's page: the processor's own number for that network when `overrides` names one, else
- * the network's default, else undefined for a network with no placeholder.
+ * the network's default, else undefined for a network with no placeholder. On a TokenEx iframe
+ * (`tokenex_iframe`) the number must also be one TokenEx's frame reads as that network, since the frame
+ * names the brand to the page from the typed digits and the cardholder's device refuses a mismatch: the
+ * frame's table takes Visa, Mastercard and American Express, so every other network gets undefined.
  */
 export declare function placeholderNumber(brand: string, psp?: string, overrides?: Readonly<Record<string, Readonly<Record<string, string>>>>): string | undefined;
 /**
@@ -861,7 +1001,9 @@ export declare class PreparationRequiredError extends Error {
  * when the merchant's server created the payment), so the `amount` and
  * `currency` you pass are what the cardholder approves, and for WSPay the
  * figure the API compares with WSPay's answer when that answer names one (a
- * 3-D Secure step names none). Thrown locally before any create or
+ * 3-D Secure step names none). A Revolut card payment names the order's
+ * amount but not its currency, so it takes the same pair, above zero.
+ * Thrown locally before any create or
  * prompt, and terminal: the same request without an amount fails the same
  * way. The API answers 400 amount_required for the same case. A page total
  * (`pageAmount`) does not count.
@@ -1131,12 +1273,12 @@ export interface PresetRefusal {
 /** A decline reason only the company presets stamp (see PresetRefusedError). */
 export declare const PRESET_REFUSAL_REASONS: ReadonlySet<string>;
 /**
- * How often sendEbanxFollowUp reads a send back while the cardholder's device has it: every half second, whatever the
- * client's own `pollIntervalMs`. One send is out at a time per approval, so this is 120 reads a minute, inside the
- * API's 240 a minute per caller and authorization (routes/api/v2/checkout-follow-ups.ts).
+ * How often sendEbanxFollowUp and sendPayrexxFollowUp read a send back while the cardholder's device has it: every
+ * half second, whatever the client's own `pollIntervalMs`. One send is out at a time per approval, so this is 120
+ * reads a minute, inside the API's 240 a minute per caller and authorization (routes/api/v2/checkout-follow-ups.ts).
  */
 export declare const EBANX_FOLLOW_UP_READ_MS = 500;
-/** The longest sendEbanxFollowUp waits after reads the API refused as too many (429): 1, 2, 4, 8, then 15 seconds. */
+/** The longest a follow-up send waits after reads the API refused as too many (429): 1, 2, 4, 8, then 15 seconds. */
 export declare const EBANX_FOLLOW_UP_BACKOFF_MAX_MS = 15000;
 export declare class CheckoutApiError extends Error {
     status: number;
@@ -1219,6 +1361,8 @@ export declare class CheckoutAuthError extends Error {
  * https://pgw-ui.2c2p.com/payment/4.1/{token}.
  * On QuickPay's host the window's session reads `{session}`:
  * https://payment.quickpay.net/{session}/3ds_auth.
+ * On FastSpring's store hosts the session id reads `{session}`:
+ * https://daisydisk.onfastspring.com/session/{session}/payment.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1482,7 +1626,9 @@ export declare class VaultClient {
      * The facts hold only while the cardholder pays with that card. `psp` names the processor
      * whose card form the agent types into (the recognizer's name, `worldline_mycheckout`): a
      * processor that needs its own number for the card's network gets it, and every other gets the
-     * network's default. Throws PlaceholderCardError when there is no such card, its network has no
+     * network's default. On a TokenEx iframe (`tokenex_iframe`, JetBlue) the number is one TokenEx's frame
+     * reads as the card's own network, Visa, Mastercard or American Express, and any other network has no
+     * placeholder there. Throws PlaceholderCardError when there is no such card, its network has no
      * placeholder, or it carries no expiry.
      */
     placeholderCard(input: {
@@ -1607,6 +1753,28 @@ export declare class VaultClient {
         headers: Record<string, string>;
         body: string;
     }>;
+    /**
+     * Send one of Payrexx's 3-D Secure sends an approved Payrexx card request covers (payrexx.ts says which: the card
+     * frame's authentication after the ACS method and its post-authentication after the bank's challenge, bound to that
+     * approval) from the cardholder's device, and resolve with Payrexx's answer for the paused request, exactly as
+     * sendEbanxFollowUp does for EBANX: the same create, reads and clocks, and no prompt. Rejects with a
+     * PayrexxFollowUpError naming why there is no answer and whether the card may have reached Payrexx.
+     */
+    sendPayrexxFollowUp(authorizationId: string, request: {
+        url: string;
+        method: 'POST';
+        headers: Record<string, string>;
+        body: string;
+    }, options?: {
+        signal?: AbortSignal;
+        until?: number;
+    }): Promise<{
+        status: number;
+        headers: Record<string, string>;
+        body: string;
+    }>;
+    /** The send behind sendEbanxFollowUp and sendPayrexxFollowUp; `fail` builds the processor's error for a send with no answer. */
+    private sendFollowUp;
     /**
      * Create a merchant-session probe, the phase-0 read of the deterministic merchant total:
      * `user` is the org's connected user, who opens the returned Vault link and reads the