@agent-cards/sdk 0.23.22 → 0.23.24

package/CHANGELOG.md

@@ -1,7 +1,41 @@
 # Changelog
 
+An unreleased change waits as a file of its own in `changes/` (`changes/README.md`), never under Unreleased here; the version cut moves it under the version a release publishes.
+
 ## Unreleased
 
+## 0.23.24
+
+- Continue Tap Payments' card form with the card the cardholder's device encrypts, for a company Agentcard turned Tap on for (dark launch). Merchants in Kuwait, Saudi Arabia, the UAE, Bahrain, Qatar and Oman take cards on Tap's hosted checkout at `checkout.tap.company`, whose card frame encrypts the card under the merchant's own key and sends it to `https://sdk.tap.company/v2/card/token`. This build declares `tap_card_sdk_token` on every sync, and the API serves Tap's recognizer only for a company Agentcard listed for it, so every other company's Tap payments go through untouched, as for an unsupported processor. The token request does not decide the charge: Tap's checkout charges the order the merchant holds, so `authorize()` refuses a Tap request without `amount` above zero and `currency` (`AmountRequiredError`). Send the total Tap's page shows. Before it creates anything, the API refuses a request that asks Tap to keep the card (`invalid_tap_payments_request`), a merchant Agentcard has not reviewed for the checkout page (`unsupported_checkout`), a live merchant's card form on a test-mode client or the reverse (`tap_payments_environment_mismatch`), and a request whose order names your currency at another total (`amount_mismatch`). After the approval the SDK writes the device's ciphertext over the one your agent's page wrote, in that request alone, moves no other byte, and continues the page's own request. 3-D Secure and the merchant's charge then run in the agent's browser, where a challenge needs a person at that browser. The SDK refuses a request that is not byte for byte the one the cardholder approved, or that names another merchant key. The API serves the device's ciphertext only in the 10 minutes after the approval and deletes it once that window passes. A Tap payment also needs the matching API and Vault releases.
+
+- Pause FastSpring's card payment for the cardholder's device. Every FastSpring store's checkout, a popup, an embedded checkout or a web storefront on the store's own host under `onfastspring.com`, posts the card as JSON to `/session/<id>/payment` (after `/popup-<name>` in a popup) under the session's `X-Session-Token`. The sync now also asks for `capabilities=fastspring_card_payment`, and the API serves FastSpring's recognizer only for a company Agentcard turned FastSpring on for. The SDK pauses only the checkout's own card body at that exact URL: a card FastSpring saved, a ticked "save payment details" or renewal box, a gift, a Brazilian or Argentine tax id and a CAPTCHA answer are refused at the pause, and a payment by another method with no card continues untouched. The cardholder's device writes the real card into the paused body and sends it through Agentcard's checkout relay to a store Agentcard reviewed, and the checkout gets FastSpring's answer. FastSpring's payment names no price, so pass `amount` and `currency`, above zero, the total the checkout shows: without them `authorize()` throws `AmountRequiredError` before anything is created. Matching API and Vault releases are required. FastSpring stays off for every company Agentcard has not turned it on for.
+
+- Pay an Openpay checkout, for a company Agentcard turned Openpay on for (dark launch). The merchant's page hands its card to Openpay's own `openpay.js`, which posts it to `https://api.openpay.mx/v1/<merchant id>/tokens` (`api.openpay.co` in Colombia, `api.openpay.pe` in Peru, `sandbox-api.openpay.<mx|co|pe>` in test) and gives up 40 seconds after Pay, too soon for an approval after Pay. So the SDK sends the card only through `prepare({ psp: 'openpay_bbva', environment: 'production' })` (`'sandbox'` for Openpay's sandbox hosts), before Pay; without one, the SDK refuses the request before it asks the API, and sends nothing. The sync now also asks for `capabilities=openpay_tokenizer`. The token URL names the merchant, so the SDK binds Pay's request to the approval by its host's environment and its shape, never by the URL `prepare()` names. Once the cardholder approves, Pay's request pauses, the cardholder's device sends the card to Openpay itself, and the page receives Openpay's token, rebuilt from its id, its masked number, its brand and its points flag, and nothing else. One approval sends one card request, and a request the cardholder's device has not sent 30 seconds after the pause fails before the card leaves, with `openpay_send_window_closed`. Openpay's request names no amount, so the cardholder approves the `amount` and `currency` you pass, above zero, and the API refuses a zero `amount` with `amount_required`, which `prepare()` names too. On Openpay's live hosts, Agentcard pays only a merchant account it has reviewed, at its reviewed page and under its reviewed name, merchant id and public key (Diario de Yucatán at `https://www.yucatan.com.mx`, today). `prepare()` at any other page fails with `unsupported_checkout`, and under another name with `merchant_profile_mismatch`, before anyone is asked; a token request for another merchant id or public key is refused with `unsupported_checkout` before the card leaves. The API holds the reviewed accounts, so an account Agentcard reviews later needs no new SDK. Openpay México and Openpay Colombia take a card issued abroad only as credit. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
+
+- `attachToCdp` and `attachToPlaywright` record the answers Paddle's checkout service gives its frame (`POST /transaction-checkout`, `PATCH /transaction-checkout/<id>/`, `POST .../customer`), read-only and cut to the checkout's terms, and send the newest eight with a Paddle TokenEx create as `paddle_checkout`. The API holds `amount` to the total they state for today, so an agent that reports a free trial's renewal as today's price is refused with `amount_mismatch`. A free trial's create sends `amount: 0` with its currency; the approval then shows the renewal those answers state. A /pay that pauses before the newest answer's text is read waits up to a second for it, and a /pay that leaves while an answer is still loading sends no answers, so the API never reads an older answer's terms in place of the newest. No customer, address or seller detail from those answers leaves the browser. A runtime that intercepts on its own can build the same capture with the exported `PaddleCheckoutWatch`: it reports each answer to the watch as `sent`, `answered`, `finished` and `read`, awaits `capture(pausedAt, payUrl)` when the /pay pauses, and passes the result to `authorize()` as `paddleCheckout`.
+
+## 0.23.23
+
+- Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.
+
+- `redactUrl` masks a host written with its port and no scheme, such as `checkout.payulatam.com:443/...`, the way it masks a bare host, for every processor. A URL parser reads that host as the scheme, so the string came back unmasked.
+
+- Keep a PayU Latam checkout's session key out of your events and error messages. PayU Latam's WebCheckout page sends the card to `/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>` on its own host (`checkout.payulatam.com`, `sandbox.checkout.payulatam.com`), and the key is the only credential the page's routes read: anyone who holds it can read the checkout's order, payer and merchant. `redactUrl`, every event and every error message now show it as `{key}` on every host under `payulatam.com`, on every route of the page and with any of its characters percent-escaped, as in `https://checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/co/credit_card/{key}`. The SDK does not pause a PayU Latam payment yet. No API or Vault release is needed.
+
+- Pay a Midtrans Snap checkout, for Agentcard's own company only for now (dark launch). Midtrans' Snap popup posts the card as one JSON request to `https://api.midtrans.com/v2/token` (`https://api.sandbox.midtrans.com/v2/token` in test) under the business's publishable client key. This build declares `midtrans_card_token` on every sync, and the API serves the Midtrans entry only to a company Agentcard turned Midtrans on for, so every other company's Midtrans payments go through untouched. The token names no amount: the merchant's own server charges it afterwards, card free, and runs 3-D Secure there, so `authorize()` refuses a Midtrans token without `amount` above zero and `currency` (`AmountRequiredError`). The API refuses a saved-card reuse and any body that is not the card form's own token (`invalid_midtrans_request`), and holds the lane to Agentcard's own company until a reviewed change binds the client key to the merchant. The cardholder's device sends the card itself, with no relay. A Midtrans payment also needs the matching API and Vault releases.
+
+- Pay an SB Payment Service checkout, a Japanese store's card step that loads SBPS's one-time token script (`com_sbps_system_token.js`), for a company Agentcard turned SB Payment Service on for (dark launch). The script encrypts the card in the page and sends it as one JSONP `<script>` GET to `https://token.sps-system.com/token/generateToken` (`stbtoken.sps-system.com` in SBPS's test environment). The sync now also asks for `capabilities=sbps_token_jsonp`, and the API serves SBPS's recognizer only to an enabled company. There both adapters pause that GET, `authorize()` creates the authorization with its URL alone, the cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the paused script receives SBPS's one-time token in its own callback. Any other request on that path is aborted with an `unsupported_checkout` event, so the placeholder never reaches SBPS; the 3-D Secure info request and the scripts continue untouched. The request names no amount, so pass `amount` and `currency` above zero and the order total the page shows as `pageAmount`: `authorize()` refuses a request without them with `AmountRequiredError` or `PageAmountRequiredError`. A live payment needs a merchant Agentcard reviewed at its own checkout page, or the create answers `unsupported_checkout`. Every other company keeps today's path, where the request continues to SBPS untouched. No live payment has gone through this route yet. A payment also needs the matching API, relay and Vault releases.
+
+- Pause Paytrail's card method (the Visa and Mastercard method on the payment wall most Finnish webshops send the buyer to) for the cardholder's device. The sync now also asks for `capabilities=paytrail_hosted_payment_page`, and the API serves Paytrail's recognizer only for a company Agentcard turned Paytrail on for. The SDK pauses the merchant's signed entry to `https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect`, which carries no card and no amount, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Pass `amount` and `currency` (`eur`): the entry names no amount, so `authorize()` throws `AmountRequiredError` without them. Every other post of the card method your browser makes leads to or carries the card your agent typed: Paytrail's loading page's post, which opens Payment Highway's card page, and on `v1.api.paymenthighway.io` the card post, the Click to Pay posts and the 3-D Secure step, and so does the card page's lookup of the typed card's first digits. The SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required. Paytrail stays off for every company Agentcard has not turned it on for.
+
+- Keep a FastSpring checkout's session id out of your events and error messages however the URL spells the slashes around `/session/`. 0.23.22 showed the id after a slash escaped twice or more, as in `/session%252F<id>`, or doubled, as in `/session//<id>`. `redactUrl`, every event and every error message now show `{session}` in each of these spellings, as in `https://daisydisk.onfastspring.com/session%252F{session}/payment`. No API or Vault release is needed.
+
+- Pause the card token request Xendit's hosted invoice checkout sends, for the cardholder's device. Xendit's payment and donation links land on `https://checkout.xendit.co/web/<invoice id>`, where Pay Now has Xendit.js post the card as JSON to `https://api.xendit.co/v2/credit_card_tokens` under the business's publishable key. The sync now also asks for `capabilities=xendit_card_token`, and the API serves Xendit's recognizer only for a company Agentcard turned Xendit on for. The SDK pauses only the card form's single-use token request at that exact URL; a token that would keep the card on file, Xendit.js's code-only `storeCVN` post and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Xendit itself with the real card, and the page gets Xendit's token, then runs 3-D Secure and charges the token without the card. The token names the invoice's amount and currency, so `amount` and `currency` are optional: the API reads the token's and refuses a pair that disagrees with it. Matching API and Vault releases are required. Xendit stays off for every company Agentcard has not turned it on for.
+
+- Pause the card token request every Omise card form sends, for the cardholder's device. Omise.js's card frame (`https://cdn.omise.co/pay.html`), a merchant's own page calling Omise.js, and a checkout that bundles Omise's Node library all send the card as JSON to `https://vault.omise.co/tokens` under the merchant's public key. The sync now also asks for `capabilities=omise_card_token`, and the API serves Omise's recognizer only for a company Agentcard turned Omise on for. The SDK pauses only a card form's token request at that exact URL, a body the page posts as a `Blob` included; a wallet's tokenization and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Omise itself with the real card, and the page gets Omise's token. Omise's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a merchant Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Omise stays off for every company Agentcard has not turned it on for.
+
+- Send your agent's browser back to the Webpay shop once the cardholder's phone has paid, so the shop records the order. Webpay tells a shop about a payment only when the buyer's browser returns to the shop's return page with Webpay's token, and the shop then confirms the payment with Transbank. The phone pays in its own Webpay session, so a shop never heard of the payment while the paused Webpay link got the `submitted_on_device` page. Now `attachToCdp` and `attachToPlaywright` answer that link with a redirect to the shop's return page and the same token. Your browser lands on the shop's own page, in the shop's own session, and the shop shows its receipt or its decline there. The `submitted_on_device` event names the shop's host in `merchantReturn.host`, and no event names the token. Only a Webpay shop Agentcard has reviewed with its return page gets the redirect. Agentcard has reviewed none yet, so every Webpay checkout still gets the `submitted_on_device` page until one is reviewed. Matching API and Vault releases are required.
+
 ## 0.23.22
 
 - Keep a FastSpring checkout's session id out of your events and error messages. FastSpring's checkout, on every store's own host under `onfastspring.com`, sends the card to `/session/<id>/payment` (after `/popup-<name>` in a popup), and anyone who holds that session id can read the session's own page, its order and the token its requests carry. `redactUrl`, every event and every error message now show it as `{session}` on every FastSpring store host, as in `https://daisydisk.onfastspring.com/session/{session}/payment`. The SDK does not pause a FastSpring payment yet. No API or Vault release is needed.

package/PREFLIGHT.md

@@ -217,6 +217,8 @@ Paddle (`paddle_vgs`) has no discovery rule in this table. Paddle's checkout fra
 
 Paygent (`paygent`) has no discovery rule in this table yet. Every Paygent card form loads Paygent's `PaygentToken.js`, so a rule would name every Paygent checkout while no Paygent payment has gone through, and a Paygent checkout stays `unknown`. The direct SDK pauses the token request to `token.paygent.co.jp/n/token/request` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Paygent row of the [README](./README.md) processor table for what the SDK covers.
 
+Openpay (`openpay_bbva`) has no discovery rule in this table yet. Openpay merchants load `openpay.js` on pages that take no card, some on every page, so the script on a page is no evidence that a payment can be approved, and an Openpay checkout stays `unknown`. The direct SDK pauses the token request `openpay.js` sends to `api.openpay.mx/v1/<merchant id>/tokens` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Openpay row of the [README](./README.md) processor table for what the SDK covers.
+
 The bundled direct SDK profile declares processor support for `one_time` purchases. The catalog carries each processor's request limitations and known exclusions. A detection rule does not cover every product or regional variant sold under the processor's name. For example, Moneris Hosted Tokenization and Moneris Checkout use different payment paths; the implemented adapter covers Hosted Tokenization.
 
 The catalog also carries reviewed hosted, regional, and versioned variants observed on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. A variant the implemented adapter does not admit, such as the Tranzila terminal-root page, the Authorize.Net hosted payment form, or a Worldpay hosted payment page, identifies its processor and returns `unknown` with `processor_variant_unverified`. A new fingerprint never declares payment support by itself.

package/README.md

@@ -286,6 +286,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Elavon Converge (Hosted Payment Page) | dark: paused only for an org Agentcard enables for Converge, always with the cardholder's approval, never autopilot. One credit card sale in US dollars per payment page on `api.convergepay.com` or `www.convergepay.com` (`api.demo.convergepay.com` in Converge's demo environment); no amount needed. See [Pay an Elavon Converge payment page](#pay-an-elavon-converge-payment-page) |
 | Moneris Hosted Tokenization (Moneris's card frame; Raisin donation pages) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/HPPtoken/request.php` on `www3.moneris.com` or `gateway.moneris.com` (`esqa.moneris.com` for a test row) when it carries the card number, expiry and CVD, always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the profile id the frame names must be one pinned for the checkout page's origin (Jack.org's Raisin page today), or the create answers `unsupported_checkout`. A frame that leaves the expiry or CVD to the merchant's page, or a post to any other `request.php` URL, fails in the browser with a `blocked` event, `request_without_card`. The cardholder's device sends the card through the checkout relay, and the page gets Moneris's temporary token, which the merchant charges from its own server: pass `amount` and `currency`, the total the cardholder approves. Moneris Checkout (`/chkt/`, `/chktv2/`) is not supported |
 | GoDaddy Payments (Poynt's card frame on a GoDaddy Online Store checkout) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/v1/commerce/stores/<store id>/payment-tokens/generate-nonce` on `services.poynt.net`, always with the cardholder's approval. A live payment needs a store Agentcard reviewed: the store id must be one pinned for the checkout page's origin, or the create answers `unsupported_checkout`; a test key is refused, since Poynt has no test host. A form that asks Poynt to keep the card fails in the browser with a `blocked` event. The cardholder's device sends the card through the checkout relay, and the page gets Poynt's nonce, which the store's server charges: pass `amount` and `currency`, the total the cardholder approves. The store's pay button runs an invisible reCAPTCHA, so a person presses it |
+| SB Payment Service (SBPS's one-time token script; BOSS E・ZO FUKUOKA's ticket site) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the token script's JSONP GET to `/token/generateToken` on `token.sps-system.com` (`stbtoken.sps-system.com` for a test row), always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the merchant and service ids the request names must be ones pinned for the checkout page's origin, or the create answers `unsupported_checkout`. Any other request on that path fails in the browser with an `unsupported_checkout` event. The cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the page's script gets SBPS's one-time token in its own callback, which the store charges from its own server: pass `amount` and `currency` above zero, and the order total the page shows as `pageAmount` |
 | WSPay Components (WSPay's build of Monri Components) | dark launch: the card frame's confirm of a new card, after `vault.syncRegistry()`, with `amount` and `currency`, and only for an org Agentcard has enabled; for any other org the SDK leaves WSPay's requests alone. The cardholder's device sends the card to WSPay and the frame receives WSPay's answer. A confirm that asks WSPay to keep the card on file, as Valamar's does on every booking, is paid only as a hotel's EUR 1.00 card guarantee with a card the cardholder stored. Validated in local Chromium against a model of the card frame; no WSPay sandbox run or live merchant purchase yet. See [Pay a WSPay Components checkout](#pay-a-wspay-components-checkout) |
 | Shiji STS (MyCheck Wallet V3; Wyndham's booking pages) | dark launch, mode `cse` under a pinned key, and only for an org Agentcard has enabled. The card token a hotel booking mints guarantees the stay, so the cardholder approves with a card they stored, under a line that says the hotel can keep it on file. See [Shiji STS](#shiji-sts-mycheck-wallet-v3) |
 | Wix checkout (Wix Cashier's card frame; Wix Payments and classic Stripe on Wix) | dark launch: only in Agentcard's own account for now, after `vault.syncRegistry()`, and only through `prepare({ psp: 'wix_payments', environment: 'production' })` at a store Agentcard reviewed, with `amount` and `currency`. The frame's post to `cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens` pauses, the cardholder's device sends the card through the checkout relay, and the frame receives Wix's token. Wix has no test environment. The SDK refuses the frame's second card request after a 401 or 403 in the browser, and fails a request still unsent 20 seconds after the pause, before the card leaves (`wix_payments_send_window_closed`) |
@@ -300,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -331,7 +332,11 @@ same way: this build pauses the merchant's redirect to
 page or a frame of it, and with `attachToCdp` also in a window the page opened,
 for the cardholder's device, and fails every request but a GET your browser
 makes to Webpay, so the token is never spent in your browser and Webpay never
-sees the card your agent typed. `attachToPlaywright` covers the page it is
+sees the card your agent typed. Once the cardholder's phone has paid, the
+paused link goes to the shop's return page with Webpay's token, for a shop
+Agentcard has reviewed with its return page, so the shop records the order and
+shows its receipt in your browser; any other Webpay checkout gets the
+`submitted_on_device` page. `attachToPlaywright` covers the page it is
 attached to and that page's frames, and pauses the entry when one of them
 navigates to it directly or by script. Playwright's `page.route` never sees the
 hop of an HTTP redirect, so a merchant whose server answers its checkout with a
@@ -342,6 +347,11 @@ that opens Webpay in a popup needs that popup attached on its own, and a popup's
 first navigation needs the integration
 [Browser integration and merchant outcomes](#browser-integration-and-merchant-outcomes)
 describes.
+Paytrail's card method (`paytrail_hosted_payment_page`) is served the same
+way: this build pauses the merchant's signed Visa and Mastercard entry to
+`services.paytrail.com` for the cardholder's device, and fails the loading
+page's own post, every post your browser makes to Payment Highway's card page
+and the card page's lookup of the typed card's first digits.
 PayMongo's hosted checkout (`paymongo_checkout_pay`) is served on the same terms:
 this build pauses the checkout page's own card attach on `checkout.paymongo.com`,
 the cardholder's device sends it through the checkout relay, and the page gets
@@ -401,6 +411,26 @@ build pauses the card token request Clover's card frame sends to
 real card encrypted under Clover's key and sends it to Clover itself, and the
 frame gets Clover's token. Clover's request names no price, so pass `amount`
 and `currency`, above zero: that is the amount the cardholder approves.
+Xendit's hosted invoice checkout (`xendit_card_token`) is served on the same
+terms: this build pauses the card token request Xendit.js sends from
+`checkout.xendit.co` to `api.xendit.co/v2/credit_card_tokens`, the cardholder's
+device sends it to Xendit itself with the real card, and the page gets Xendit's
+token and runs 3-D Secure. The token names the invoice's amount, so `amount`
+and `currency` are optional; a pair you pass must match the token's.
+Omise's card token (`omise_card_token`) is served on the same terms: this
+build pauses the token request an Omise card form sends to
+`vault.omise.co/tokens`, from Omise.js's card frame or from a merchant's own
+page, the cardholder's device sends it to Omise itself with the real card, and
+the page gets Omise's token. The API pays only a merchant Agentcard reviewed
+for the page the request comes from. Omise's request names no price, so pass
+`amount` and `currency`, above zero: that is the amount the cardholder approves.
+FastSpring's checkout (`fastspring_card_payment`) is served on the same terms:
+this build pauses the card payment the checkout posts to
+`<store>.onfastspring.com/.../session/<id>/payment`, the cardholder's device
+writes the real card into it and sends it through Agentcard's checkout relay to
+a store Agentcard reviewed, and the checkout gets FastSpring's answer. The
+payment names no price, so pass `amount` and `currency`, above zero: the total
+the checkout shows, tax included, which the API holds to FastSpring's own figure.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure
@@ -1363,8 +1393,8 @@ await controller.prepare({ psp: 'aci', environment: 'production' }); // 'sandbox
 Type a placeholder card of the approved card's network (a Mastercard-range placeholder for an Agentcard-issued card), then click Pay once. The cardholder's device refuses a placeholder of another network before any card leaves it, and the authorization ends `declined` with reason `aci_brand_mismatch`. The SDK:
 
 - pauses the card-number request and binds it to the preparation. The cardholder's device sends it to ACI with the real number, CVC and expiry, and the page receives ACI's answer.
-- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than ACI takes, leaves them waiting for the card-number request.
-- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to the 4,096 characters ACI takes) through untouched.
+- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than 8,192 characters, leaves them waiting for the card-number request.
+- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to 8,192 characters) through untouched. IKEA US's page posts one of 5,953 characters, past the 4,096 ACI's API reference names, and ACI takes it.
 - lets the page's `/payment` submission continue once, only as the widget's own form post into its hidden iframe (a frame navigation) and only after its checkout's card-number request was answered (`aci_payment_continued`). In classic mode the placeholder expiry the page put there is removed (`stripped: true`). `paymentBrand` must be the brand of the placeholder you typed, `shopperResultUrl` must be on the prepared merchant origin, and `shopperResultTarget`, when the page sets one, must be `_top`, ACI's own default.
 
 The SDK removes that expiry only on a browser that sends the body it replaced on a navigation, which the SDK's tests show on Chromium. `attachToCdp` drives Chromium. `attachToPlaywright` reads the page's browser engine, or, for a persistent context, checks whether a CDP session opens, which only Chromium allows. On Firefox or WebKit it refuses a classic-mode `/payment` as `aci_expiry_unstrippable` rather than send the placeholder expiry. A SAQ-A-mode `/payment` has nothing to remove and continues on any engine.

package/dist/aci.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 624ca03645e28d72156188c850b3650fd0f5162b0366475e6a124657120f7f11
+// artifact-sha256: 82e5241b99296bfb616a3c740a6a1c6a29f563405ed4a6ded681e21fb24168ab
 // src/aci.js
 var ACI_HOSTS = Object.freeze(["eu-prod.oppwa.com", "oppwa.com", "eu-test.oppwa.com", "test.oppwa.com"]);
 var ACI_TEST_HOSTS = Object.freeze(["eu-test.oppwa.com", "test.oppwa.com"]);
@@ -23,8 +23,8 @@ var ACI_PASSED_FIELDS = Object.freeze(["card.holder"]);
 var ACI_SIBLING_KEYS = Object.freeze(["customParameters[SHOPPER_EndToEndIdentity]"]);
 var ACI_REMOVED_ON_CONTINUATION = Object.freeze(["card.expiryMonth", "card.expiryYear"]);
 var ACI_FINGERPRINT_FIELD = "customer.browserFingerprint.value";
-var FINGERPRINT_LENGTH = 4096;
-var LEG_BODY_LIMIT = 16384;
+var FINGERPRINT_LENGTH = 8192;
+var LEG_BODY_LIMIT = 32768;
 var END_TO_END = ACI_SIBLING_KEYS[0];
 var CHECKOUT_ID = /^[0-9A-F]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}$/i;
 var ENDPOINT_PATH = /^\/v1\/checkouts\/([^/]+?)(\/payment|\/registration)?$/;

package/dist/agent-amount.generated.d.ts

@@ -0,0 +1,7 @@
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export declare const AGENT_AMOUNT: {
+    processors: readonly string[];
+    aboveZero: readonly string[];
+    pageAmount: readonly string[];
+    names: Readonly<Record<string, string>>;
+};

package/dist/agent-amount.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/amadeus.d.ts

@@ -4,6 +4,8 @@ export declare const AMADEUS_SEND_WINDOW_MS = 20000;
 export declare const WIX_PAYMENTS_SEND_WINDOW_MS = 20000;
 /** How long after the pause a paused HiPay token create may still be sent, of the 20 seconds the merchant's page waits. */
 export declare const HIPAY_SEND_WINDOW_MS = 12000;
+/** How long after the pause a paused Openpay token create may still be sent, of the 40 seconds openpay.js waits. */
+export declare const OPENPAY_SEND_WINDOW_MS = 30000;
 /**
  * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
  * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
@@ -13,13 +15,14 @@ export declare const HIPAY_SEND_WINDOW_MS = 12000;
  */
 export declare function failsAsNetworkError(url: string): boolean;
 /** The processor a send window's events and stop cause name. */
-export type SendWindowProcessor = 'amadeus' | 'secure_acceptance' | 'wix_payments' | 'hipay';
+export type SendWindowProcessor = 'amadeus' | 'secure_acceptance' | 'wix_payments' | 'hipay' | 'openpay';
 /** Why a send window stopped its attempt: the API confirmed the card never left the device and never can. */
 export type SendWindowClosed = `${SendWindowProcessor}_send_window_closed`;
 /**
  * The send window for a request paused under a preparation for `psp`, or null when it has none: a
  * prepared Amadeus SDK add, a prepared CyberSource Secure Acceptance token create and a prepared Wix
- * tokenize request, each 20 seconds, and a prepared HiPay token create, 12 seconds.
+ * tokenize request, each 20 seconds, a prepared HiPay token create, 12 seconds, and a prepared Openpay token
+ * create, on exactly a token URL as openpay.js writes it, 30 seconds.
  */
 export declare function preparedSendWindowMs(psp: string | undefined, url: string): number | null;
 /** The processor a prepared request's send window names in its events, or null when it has none. */

package/dist/amadeus.js

@@ -24,6 +24,12 @@
 // the frame unused (the frame's next Pay would send /update, which the SDK refuses), so a paused token create gets a
 // 12 second window: HiPay answers a create in about a second, so a card sent inside it reaches the page in time.
 //
+// openpay.js abandons its token create 40 seconds after Pay ("Timeout after 40000 milliseconds"), and the merchant's
+// server charges only a token the page read in time. A token Openpay mints after that point is one no charge ever
+// names, so a paused token create gets a 30 second window, of the 40 the page waits, as the 30 second pages above
+// get 20: the cardholder's device sends by 25 seconds after it last saw the checkout unbound (the Vault's own
+// window), and Openpay's answer, about a second, then reaches the page with the rest of those 40 seconds to spare.
+//
 // So when the window closes and no answer is being handed to the page yet, the adapter asks for that
 // cancel. Confirmed: nothing was sent and nothing can be, so the attempt stops, the page's request
 // fails (a Secure Acceptance frame gets the stopped page), and the checkout reads failed. Not
@@ -36,19 +42,23 @@
 // Data Collection Page's store has no client timeout and gets no window. The window's events name the
 // processor: `amadeus_send_window_closed` and `amadeus_send_window_unconfirmed`,
 // `secure_acceptance_send_window_closed` and `secure_acceptance_send_window_unconfirmed`,
-// `wix_payments_send_window_closed` and `wix_payments_send_window_unconfirmed`, or
-// `hipay_send_window_closed` and `hipay_send_window_unconfirmed`.
+// `wix_payments_send_window_closed` and `wix_payments_send_window_unconfirmed`,
+// `hipay_send_window_closed` and `hipay_send_window_unconfirmed`, or
+// `openpay_send_window_closed` and `openpay_send_window_unconfirmed`.
 import { amadeusCardUrl } from './amadeus-checkout.generated.js';
 import { isSecureAcceptanceTokenRequest } from './cybersource-secure-acceptance.generated.js';
 import { SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_SEND_WINDOW_MS } from './cybersource-secure-acceptance.js';
 import { WIX_PAYMENTS_PSP, isWixPaymentsTokenizeUrl } from './wix-payments.generated.js';
 import { HIPAY_PSP, isHipayTokenUrl } from './hipay.generated.js';
+import { OPENPAY_PSP, isOpenpayTokenUrl } from './openpay.generated.js';
 /** How long after the pause a paused Amadeus SDK add may still be sent. */
 export const AMADEUS_SEND_WINDOW_MS = 20_000;
 /** How long after the pause a paused Wix tokenize request may still be sent, of the 30 seconds Wix's widget waits. */
 export const WIX_PAYMENTS_SEND_WINDOW_MS = 20_000;
 /** How long after the pause a paused HiPay token create may still be sent, of the 20 seconds the merchant's page waits. */
 export const HIPAY_SEND_WINDOW_MS = 12_000;
+/** How long after the pause a paused Openpay token create may still be sent, of the 40 seconds openpay.js waits. */
+export const OPENPAY_SEND_WINDOW_MS = 30_000;
 /**
  * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
  * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
@@ -62,7 +72,8 @@ export function failsAsNetworkError(url) {
 /**
  * The send window for a request paused under a preparation for `psp`, or null when it has none: a
  * prepared Amadeus SDK add, a prepared CyberSource Secure Acceptance token create and a prepared Wix
- * tokenize request, each 20 seconds, and a prepared HiPay token create, 12 seconds.
+ * tokenize request, each 20 seconds, a prepared HiPay token create, 12 seconds, and a prepared Openpay token
+ * create, on exactly a token URL as openpay.js writes it, 30 seconds.
  */
 export function preparedSendWindowMs(psp, url) {
     if (psp === 'amadeus_checkout')
@@ -81,6 +92,8 @@ export function preparedSendWindowMs(psp, url) {
         return isWixPaymentsTokenizeUrl(url) ? WIX_PAYMENTS_SEND_WINDOW_MS : null;
     if (psp === HIPAY_PSP)
         return isHipayTokenUrl(url) ? HIPAY_SEND_WINDOW_MS : null;
+    if (psp === OPENPAY_PSP)
+        return isOpenpayTokenUrl(url) ? OPENPAY_SEND_WINDOW_MS : null;
     return null;
 }
 /** The processor a prepared request's send window names in its events, or null when it has none. */
@@ -89,6 +102,8 @@ export function sendWindowProcessor(psp) {
         return 'wix_payments';
     if (psp === HIPAY_PSP)
         return 'hipay';
+    if (psp === OPENPAY_PSP)
+        return 'openpay';
     return psp === 'amadeus_checkout' ? 'amadeus' : psp === SECURE_ACCEPTANCE_PSP ? 'secure_acceptance' : null;
 }
 /** The send window for a prepared Amadeus SDK add, or null: preparedSendWindowMs for Amadeus alone. */

package/dist/amazon-payment-services.d.ts

@@ -0,0 +1,25 @@
+export declare const APS_PSP: string;
+export declare const APS_CAPABILITY: string;
+/**
+ * The answer the paused APS form navigation is fulfilled with, or null. The API stores APS's answer only once
+ * payment-core's judge reads it as a token for the paused form (apsAnswerOutcome), and this reads the stored answer
+ * again, against the paused request, before the agent's browser gets it:
+ *   page      status 200 under APS's HTML type alone, APS's page byte for byte, whose one form posts APS's fields to
+ *             the paused form's own return_url;
+ *   redirect  status 302 or 303 with one Location alone: the paused form's return_url, then APS's fields in the query.
+ * Anything else is null: a refusal, an unknown answer, another merchant's or another return page's answer, a card
+ * number anywhere in it, or a header beside the one each shape carries. A navigation reads no CORS header, so none is
+ * added. Autopilot never sends an APS form (payment-core autopilot.js), so the caller refuses an unattended answer.
+ */
+export declare function apsNavigationAnswer(request: {
+    url: string;
+    body?: string | null;
+}, response: {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}): {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+} | null;

package/dist/amazon-payment-services.generated.d.ts

@@ -0,0 +1,76 @@
+declare var APS_PSP: string;
+declare var APS_CAPABILITY: string;
+declare var APS_OPERATION: string;
+declare var APS_HOSTS: Readonly<{
+    "checkout.payfort.com": "production";
+    "sbcheckout.payfort.com": "sandbox";
+}>;
+declare var APS_TOKENIZATION_PATH: string;
+declare var APS_SIGNED_FIELDS: readonly string[];
+declare var APS_CARD_FIELDS: readonly string[];
+declare var APS_OPTIONAL_FIELDS: readonly string[];
+declare var APS_REFUSAL_CODES: readonly string[];
+declare function apsTokenizationUrl(url: any): Readonly<{
+    host: string;
+    environment: any;
+}> | null;
+declare var isApsTokenizationUrl: (url: any) => boolean;
+declare var apsEnvironment: (url: any) => any;
+declare function apsBodyRefusal(body: any): "aps_body_unsupported" | "aps_saved_card_refused" | "aps_recurring_refused" | "aps_service_command_refused" | "aps_return_url_refused" | null;
+declare function apsBodyVerdict(body: any, url: any): {
+    verdict: string;
+    code: string;
+} | {
+    verdict: string;
+    code?: undefined;
+};
+declare function apsRefusalMessage(code: any): any;
+declare function apsRequestRefusal(request: any, options: any): "aps_url_refused" | "aps_body_unsupported" | "aps_saved_card_refused" | "aps_recurring_refused" | "aps_service_command_refused" | "aps_return_url_refused" | "aps_headers_refused" | null;
+declare function apsKeepsCardOnFile(body: any): boolean | null;
+declare function apsRequestFacts(request: any): Readonly<{
+    environment: any;
+    merchantIdentifier: any;
+    accessCodeSha256: string;
+    merchantReference: any;
+    returnUrl: any;
+    keepsCardOnFile: boolean;
+}> | null;
+declare var APS_MERCHANTS: any;
+declare var APS_MERCHANT_REFUSALS: readonly string[];
+declare function apsMerchantRefusal(facts: any, merchantOrigin: any, entries?: any): "aps_request_unreadable" | "aps_unsupported_environment" | "aps_merchant_unreviewed" | "aps_merchant_pending" | "aps_access_code_unreviewed" | "aps_return_url_unreviewed" | "aps_merchant_client_signed" | "aps_merchant_observe" | null;
+declare function apsMerchantPin(facts: any, merchantOrigin: any, entries?: any): any;
+declare var APS_TEST_PANS: Readonly<Set<unknown>>;
+declare function apsCardRefusal(environment: any, card: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | "invalid_expiry" | "invalid_security_code" | null;
+declare function isApsDeviceRequest(templateBody: any, deviceBody: any, environment: any): boolean;
+declare function apsDeviceRequest(request: any, card: any, options: any): {
+    url: any;
+    method: string;
+    headers: {
+        "content-type": string;
+        origin: string;
+    };
+    body: string;
+    where: string[];
+};
+declare var APS_TOKEN_RESPONSE_CODES: readonly string[];
+declare var APS_KEPT_CARD_CODES: readonly string[];
+declare var APS_REFUSAL_MESSAGES: readonly string[];
+declare var APS_ANSWER_REASONS: readonly string[];
+declare var APS_PAGE_CONTENT_TYPE: string;
+declare function apsScannedTexts(reply: any, template: any): any[] | null;
+declare function apsAnswerOutcome(reply: any, template: any, card: any, options: any): {
+    outcome: string;
+    reason: any;
+} | {
+    location?: any;
+    outcome: string;
+    shape: string | undefined;
+    body: any;
+    code?: undefined;
+} | {
+    outcome: string;
+    code: any;
+};
+declare function apsRefusalCode(bodyText: any): any;
+declare var isApsRefusalCode: (code: any) => boolean;
+export { APS_ANSWER_REASONS, APS_CAPABILITY, APS_CARD_FIELDS, APS_HOSTS, APS_KEPT_CARD_CODES, APS_MERCHANTS, APS_MERCHANT_REFUSALS, APS_OPERATION, APS_OPTIONAL_FIELDS, APS_PAGE_CONTENT_TYPE, APS_PSP, APS_REFUSAL_CODES, APS_REFUSAL_MESSAGES, APS_SIGNED_FIELDS, APS_TEST_PANS, APS_TOKENIZATION_PATH, APS_TOKEN_RESPONSE_CODES, apsAnswerOutcome, apsBodyRefusal, apsBodyVerdict, apsCardRefusal, apsDeviceRequest, apsEnvironment, apsKeepsCardOnFile, apsMerchantPin, apsMerchantRefusal, apsRefusalCode, apsRefusalMessage, apsRequestFacts, apsRequestRefusal, apsScannedTexts, apsTokenizationUrl, isApsDeviceRequest, isApsRefusalCode, isApsTokenizationUrl };