@agent-cards/sdk 0.23.22 → 0.23.24

package/dist/amazon-payment-services.js

@@ -0,0 +1,53 @@
+// Amazon Payment Services (formerly PayFort; psp `amazon_payment_services`), its custom merchant page: the merchant's own
+// card form posts top-level, as a document navigation, to /FortAPI/paymentPage on checkout.payfort.com (its sandbox,
+// sbcheckout.payfort.com), form encoded, with service_command=TOKENIZATION and the merchant's signed fields beside the
+// card. APS answers the post with a page whose script posts APS's fields to the form's return_url, or with a redirect
+// to that return_url carrying them in its query, and the merchant charges the token in those fields later, from its own
+// server. The rules are payment-core's (amazon-payment-services.generated.ts): the API applies them at create and at the
+// approve, and the cardholder's phone again before it sends the form through the checkout relay.
+//
+// The processor ships dark. The API serves the amazon_payment_services recognizer only to a build that declares the
+// `aps_custom_merchant_page` capability (client.ts SUPPORTED_CAPABILITIES), and only to an org Agentcard enabled for it,
+// so an SDK the API never served it leaves every APS form alone. This module holds the last check before an approval's
+// answer reaches the paused navigation.
+import { APS_CAPABILITY as CORE_CAPABILITY, APS_PAGE_CONTENT_TYPE, APS_PSP as CORE_PSP, apsAnswerOutcome } from './amazon-payment-services.generated.js';
+export const APS_PSP = CORE_PSP;
+export const APS_CAPABILITY = CORE_CAPABILITY;
+/**
+ * The answer the paused APS form navigation is fulfilled with, or null. The API stores APS's answer only once
+ * payment-core's judge reads it as a token for the paused form (apsAnswerOutcome), and this reads the stored answer
+ * again, against the paused request, before the agent's browser gets it:
+ *   page      status 200 under APS's HTML type alone, APS's page byte for byte, whose one form posts APS's fields to
+ *             the paused form's own return_url;
+ *   redirect  status 302 or 303 with one Location alone: the paused form's return_url, then APS's fields in the query.
+ * Anything else is null: a refusal, an unknown answer, another merchant's or another return page's answer, a card
+ * number anywhere in it, or a header beside the one each shape carries. A navigation reads no CORS header, so none is
+ * added. Autopilot never sends an APS form (payment-core autopilot.js), so the caller refuses an unattended answer.
+ */
+export function apsNavigationAnswer(request, response) {
+    try {
+        const headers = {};
+        for (const [name, value] of Object.entries(response.headers ?? {})) {
+            const lower = name.toLowerCase();
+            if (typeof value !== 'string' || Object.prototype.hasOwnProperty.call(headers, lower))
+                return null;
+            headers[lower] = value;
+        }
+        const names = Object.keys(headers);
+        // No card is in hand here: the judge reads the answer for any card number, with no card of its own to search for.
+        const verdict = apsAnswerOutcome({ status: response.status, headers, bodyText: response.body }, { url: request.url, body: request.body ?? '' }, undefined, undefined);
+        if (verdict.outcome !== 'token' || typeof verdict.body !== 'string')
+            return null;
+        if (verdict.shape === 'page') {
+            if (names.length !== 1 || headers['content-type'] !== APS_PAGE_CONTENT_TYPE)
+                return null;
+            return { status: 200, headers: { 'content-type': APS_PAGE_CONTENT_TYPE }, body: verdict.body };
+        }
+        if (names.length !== 1 || typeof verdict.location !== 'string' || response.body !== '')
+            return null;
+        return { status: response.status, headers: { location: verdict.location }, body: '' };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/capabilities.generated.d.ts

@@ -0,0 +1,2 @@
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export declare const DECLARED_CAPABILITIES: readonly string[];

package/dist/capabilities.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];