@agent-cards/sdk 0.23.23 → 0.23.24

package/dist/amazon-payment-services.js

@@ -0,0 +1,53 @@
+// Amazon Payment Services (formerly PayFort; psp `amazon_payment_services`), its custom merchant page: the merchant's own
+// card form posts top-level, as a document navigation, to /FortAPI/paymentPage on checkout.payfort.com (its sandbox,
+// sbcheckout.payfort.com), form encoded, with service_command=TOKENIZATION and the merchant's signed fields beside the
+// card. APS answers the post with a page whose script posts APS's fields to the form's return_url, or with a redirect
+// to that return_url carrying them in its query, and the merchant charges the token in those fields later, from its own
+// server. The rules are payment-core's (amazon-payment-services.generated.ts): the API applies them at create and at the
+// approve, and the cardholder's phone again before it sends the form through the checkout relay.
+//
+// The processor ships dark. The API serves the amazon_payment_services recognizer only to a build that declares the
+// `aps_custom_merchant_page` capability (client.ts SUPPORTED_CAPABILITIES), and only to an org Agentcard enabled for it,
+// so an SDK the API never served it leaves every APS form alone. This module holds the last check before an approval's
+// answer reaches the paused navigation.
+import { APS_CAPABILITY as CORE_CAPABILITY, APS_PAGE_CONTENT_TYPE, APS_PSP as CORE_PSP, apsAnswerOutcome } from './amazon-payment-services.generated.js';
+export const APS_PSP = CORE_PSP;
+export const APS_CAPABILITY = CORE_CAPABILITY;
+/**
+ * The answer the paused APS form navigation is fulfilled with, or null. The API stores APS's answer only once
+ * payment-core's judge reads it as a token for the paused form (apsAnswerOutcome), and this reads the stored answer
+ * again, against the paused request, before the agent's browser gets it:
+ *   page      status 200 under APS's HTML type alone, APS's page byte for byte, whose one form posts APS's fields to
+ *             the paused form's own return_url;
+ *   redirect  status 302 or 303 with one Location alone: the paused form's return_url, then APS's fields in the query.
+ * Anything else is null: a refusal, an unknown answer, another merchant's or another return page's answer, a card
+ * number anywhere in it, or a header beside the one each shape carries. A navigation reads no CORS header, so none is
+ * added. Autopilot never sends an APS form (payment-core autopilot.js), so the caller refuses an unattended answer.
+ */
+export function apsNavigationAnswer(request, response) {
+    try {
+        const headers = {};
+        for (const [name, value] of Object.entries(response.headers ?? {})) {
+            const lower = name.toLowerCase();
+            if (typeof value !== 'string' || Object.prototype.hasOwnProperty.call(headers, lower))
+                return null;
+            headers[lower] = value;
+        }
+        const names = Object.keys(headers);
+        // No card is in hand here: the judge reads the answer for any card number, with no card of its own to search for.
+        const verdict = apsAnswerOutcome({ status: response.status, headers, bodyText: response.body }, { url: request.url, body: request.body ?? '' }, undefined, undefined);
+        if (verdict.outcome !== 'token' || typeof verdict.body !== 'string')
+            return null;
+        if (verdict.shape === 'page') {
+            if (names.length !== 1 || headers['content-type'] !== APS_PAGE_CONTENT_TYPE)
+                return null;
+            return { status: 200, headers: { 'content-type': APS_PAGE_CONTENT_TYPE }, body: verdict.body };
+        }
+        if (names.length !== 1 || typeof verdict.location !== 'string' || response.body !== '')
+            return null;
+        return { status: response.status, headers: { location: verdict.location }, body: '' };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d1aac0b870ff4b5f9d63a43d1c2bb0eef03841846206282b5aeca4f540f0e73d
+// artifact-sha256: 30277fd34048f75e9f6b6252d783092c471aca03a64462bb4f458f9417b8cc82
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -4615,7 +4615,8 @@ function toastBodyVerdict(body) {
 // src/fastspring.js
 var FASTSPRING_PSP = "fastspring";
 var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
-    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" }),
+    Object.freeze({ environment: "production", store: "stardock", storefront: "/popup-store", merchant: "Stardock" })
 ]);
 var URL_LIMIT11 = 256;
 var BODY_LIMIT28 = 32768;

package/dist/cdp.js

@@ -20,6 +20,7 @@ import { isArmedPaytrailUrl } from './paytrail.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
 import { paddleTokenexTokenContinuation } from './paddle-tokenex.js';
 import { twoC2pContinuation, twoC2pRetire } from './twoc2p.js';
+import { tapPaymentsContinuation } from './tap-payments.js';
 import { isArmedEkashuUrl } from './ekashu.js';
 import { isArmedTransbankUrl, transbankMerchantReturn, transbankMerchantReturnAnswer } from './transbank.js';
 import { isArmedRedsysUrl } from './redsys.js';
@@ -39,6 +40,7 @@ import { replayTemplatedUrl, reviewedMerchantProfileUrlPatterns } from './mercha
 import { verifoneTemplatedUrl } from './verifone.js';
 import { MerchantHandoffWatch } from './merchant-handoff.js';
 import { MERCHANT_PAGE_WAIT_MS, MerchantTotalWatch } from './merchant-total-watch.js';
+import { PaddleCheckoutWatch } from './paddle-checkout-watch.js';
 import { hostedFormSubmittedPage } from './hosted-form.js';
 import { armSendWindow, failsAsNetworkError, preparedSendWindowMs, sendWindowProcessor } from './amadeus.js';
 import { HoldAnsweredError, HoldEndedError, HoldGate, HoldRefusedError, matchHoldOnlyRule } from './hold.js';
@@ -365,7 +367,7 @@ function cseAuthorizedDetail(replay, url, shijiCvv = null) {
  * processor takes cseContinuationBody (cse-body.ts cseBody), and `shijiCvv` and
  * `shijiCvvKeySequenceSha256` are null.
  */
-function cseContinuation(opts, url, body, replay, approved, preparation) {
+function cseContinuation(opts, url, body, replay, approved, preparation, headers) {
     const shiji = shijiStsTokenContinuation(url, body, replay.substitutions, approved, replay.kind === 'merchant_hosted' || replay.kind === 'verifone' ? undefined : replay.shijiStsCompanion);
     if (shiji)
         return { body: shiji.body, shijiCvv: shiji.cvv, shijiCvvKeySequenceSha256: shiji.cvvKeySequenceSha256 };
@@ -384,6 +386,13 @@ function cseContinuation(opts, url, body, replay, approved, preparation) {
         : null;
     if (twoc2p)
         return { body: twoc2p.body, shijiCvv: null, shijiCvvKeySequenceSha256: null };
+    // Tap writes one RSA ciphertext at the body root under the merchant's pinned key, which the generic Adyen swap refuses
+    // as no JWE, so it is dispatched by the token URL to substituteTapPayments (tap-payments.ts), only into the one request
+    // the approval was made for, and only while the request that continues names the merchant's publishable key the
+    // approved one named: the browser sends that request's own headers.
+    const tap = replay.kind === undefined ? tapPaymentsContinuation(url, body, headers, replay.substitutions, approved) : null;
+    if (tap)
+        return { body: tap.body, shijiCvv: null, shijiCvvKeySequenceSha256: null };
     return { body: cseContinuationBody(opts, body, replay, url, preparation), shijiCvv: null, shijiCvvKeySequenceSha256: null };
 }
 /**
@@ -1436,7 +1445,7 @@ function merchantAttempt(lifecycle, survives) {
     // known non-payment, so the prepared checkout ends failed with that reason, and a fresh attachment can
     // prepare again. Every other stop leaves the outcome unknown.
     const error = () => reason === 'amadeus_send_window_closed' || reason === 'secure_acceptance_send_window_closed'
-        || reason === 'wix_payments_send_window_closed' || reason === 'hipay_send_window_closed'
+        || reason === 'wix_payments_send_window_closed' || reason === 'hipay_send_window_closed' || reason === 'openpay_send_window_closed'
         ? new CheckoutPreparationError(lifecycle.getState().preparationId ?? null, reason)
         : new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, reason);
     const attempt = {
@@ -2016,6 +2025,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // The merchant's own total (merchant-total-watch.ts): its checkout responses, recorded
     // read-only from attach on, and the approval a hand-off answers, for the charge report.
     const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
+    // Paddle's own checkout answers (paddle-checkout-watch.ts), recorded read-only from attach on for a TokenEx /pay.
+    const paddleCheckout = new PaddleCheckoutWatch();
     // A reviewed card endpoint merchant's own record of the order (card-endpoint-facts.ts).
     const cardEndpointRecord = new CardEndpointFactsWatch();
     let handoffReplay = null;
@@ -2525,6 +2536,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 merchantTotal.sent(key, { method: params.request.method, url: params.request.url,
                     ...(typeof params.request.postData === 'string' ? { requestBody: params.request.postData } : {}),
                     ...(typeof params.loaderId === 'string' && params.loaderId ? { page: `${owner}:${params.loaderId}` } : {}) });
+                paddleCheckout.sent(key, { method: params.request.method, url: params.request.url });
                 cardEndpointRecord.sent(key, { method: params.request.method, url: params.request.url, resourceType: params.type ?? null, networkId: params.requestId });
             }
             if (matchesActive) {
@@ -2564,6 +2576,14 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((read) => merchantTotal.log.read(key, typeof read?.body === 'string'
                     ? (read.base64Encoded ? Buffer.from(read.body, 'base64').toString('utf8') : read.body) : null, completedAt), () => merchantTotal.log.read(key, null, completedAt));
             }
+            if (paddleCheckout.tracks(key)) {
+                // One of Paddle's checkout answers: stamped finished at once, so a /pay's pause waits for its text, then read
+                // and cut to the terms by the watch.
+                const completedAt = Date.now();
+                paddleCheckout.finished(key, completedAt);
+                cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((read) => paddleCheckout.read(key, typeof read?.body === 'string'
+                    ? (read.base64Encoded ? Buffer.from(read.body, 'base64').toString('utf8') : read.body) : null, completedAt), () => paddleCheckout.read(key, null, completedAt));
+            }
             if (payrails && payrailsAnswers.delete(requestKey(sessionId, params.requestId))
                 && !(Number(params.encodedDataLength) > PAYRAILS_INIT_BODY_LIMIT)) {
                 payrails.reading(cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((answer) => {
@@ -2578,6 +2598,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         }
         if (method === 'Network.responseReceived') {
             merchantTotal.log.answered(requestKey(sessionId, params.requestId), params.response?.status);
+            paddleCheckout.answered(requestKey(sessionId, params.requestId), params.response?.status);
             const recordKey = cardEndpointRecord.keyFor(requestKey(sessionId, params.requestId), params.requestId);
             if (recordKey)
                 cardEndpointRecord.answered(recordKey, params.response?.status);
@@ -2606,6 +2627,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 || (activeRequest && activeRequest.networkId === params.requestId && activeRequest.sourceSessionId === sessionId)))
                 holdGate.lost();
             merchantTotal.log.failed(requestKey(sessionId, params.requestId));
+            paddleCheckout.failed(requestKey(sessionId, params.requestId));
             const recordKey = cardEndpointRecord.keyFor(requestKey(sessionId, params.requestId), params.requestId);
             if (recordKey)
                 cardEndpointRecord.failed(recordKey);
@@ -3124,6 +3146,10 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // The merchant's own record of the order, as of the pause, for a profile that reads one.
             const cardRecord = cardEndpoint ? await cardEndpointFacts(cardEndpointRecord, cardEndpoint, request.url, pausedAt, attempt.signal) : null;
             attempt.assertLive();
+            // Paddle's own checkout answers as of the pause, once the texts of those that finished before it are read
+            // (a Billing /pay only; sent only with a Paddle TokenEx create, which a pause-only business makes itself).
+            const paddleAnswers = opts.pauseOnly ? undefined : await paddleCheckout.capture(pausedAt, request.url, attempt.signal);
+            attempt.assertLive();
             // Hold mode: nothing is created until the person's total releases the request (hold.ts).
             if (holdGate) {
                 if (holdGate.state !== 'watching') {
@@ -3179,6 +3205,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // What the merchant's own checkout said its total was, as this browser recorded it
                 // (read only for a reviewed profile priced by it): the page is the card request's.
                 merchantTotal: merchantTotal.capture(pausedAt, cardPage),
+                // Paddle's own checkout answers, as this browser recorded them (sent only with a Paddle TokenEx create).
+                paddleCheckout: paddleAnswers,
                 onAuthorizationCreated: (id) => {
                     lifecycle.approvalCreated(id);
                     if (holdSandbox && !holdRequestFailed) {
@@ -3299,7 +3327,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // companion cannot arrive first, and dropped if the continue fails.
                 // Both go only to the request the approval was created from, from the
                 // frame that sent it (cseContinuation refuses any other body).
-                const continuation = cseContinuation(opts, deliverRequest.url, deliverBody, replay, { url: request.url, body }, preparation);
+                const continuation = cseContinuation(opts, deliverRequest.url, deliverBody, replay, { url: request.url, body, headers: request.headers }, preparation, deliverRequest.headers);
                 const postData = Buffer.from(continuation.body).toString('base64');
                 if (continuation.shijiCvv !== null) {
                     shijiCompanions.bind({ url: request.url, method: request.method, body }, cdpShijiPage(sessionId, frameId), continuation.shijiCvv, continuation.shijiCvvKeySequenceSha256 ?? []);
@@ -3629,6 +3657,8 @@ export async function attachToPlaywright(page, opts) {
     // but sends no document request, so it keeps the page id, as CDP's loaderId does. Nor does
     // a document request that commits nothing: one that failed, or one answered 204 or 205.
     const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
+    // Paddle's own checkout answers, as attachToCdp records them (paddle-checkout-watch.ts).
+    const paddleCheckout = new PaddleCheckoutWatch();
     // A reviewed card endpoint merchant's own record of the order (card-endpoint-facts.ts).
     const cardEndpointRecord = new CardEndpointFactsWatch();
     let documentSerial = 1;
@@ -3690,6 +3720,10 @@ export async function attachToPlaywright(page, opts) {
                 ...(typeof body === 'string' ? { requestBody: body } : {}), page: `doc:${documentSerial}` });
         }
         catch { /* a request the page already dropped */ }
+        try {
+            paddleCheckout.sent(keyOf(request), { method: request.method(), url: request.url() });
+        }
+        catch { /* a request the page already dropped */ }
         try {
             cardEndpointRecord.sent(keyOf(request), { method: request.method(), url: request.url(),
                 resourceType: typeof request.resourceType === 'function' ? request.resourceType() : null });
@@ -3731,6 +3765,28 @@ export async function attachToPlaywright(page, opts) {
                 cardEndpointRecord.read(key, text, finishedAt);
             }).catch(() => cardEndpointRecord.failed(key));
         }
+        if (paddleCheckout.tracks(key)) {
+            // One of Paddle's checkout answers: stamped finished at once, so a /pay's pause waits for its text, then its
+            // status and its text, cut to the terms by the watch.
+            const answeredAt = Date.now();
+            paddleCheckout.finished(key, answeredAt);
+            Promise.resolve().then(async () => {
+                const response = await request.response();
+                if (!response) {
+                    paddleCheckout.failed(key);
+                    return;
+                }
+                paddleCheckout.answered(key, response.status());
+                let text = null;
+                try {
+                    text = await response.text();
+                }
+                catch {
+                    text = null;
+                }
+                paddleCheckout.read(key, text, answeredAt);
+            }).catch(() => paddleCheckout.failed(key));
+        }
         if (!merchantTotal.log.tracks(key))
             return;
         const completedAt = Date.now();
@@ -3800,6 +3856,7 @@ export async function attachToPlaywright(page, opts) {
         if (request === documentRequest)
             documentRequest = null;
         merchantTotal.log.failed(keyOf(request));
+        paddleCheckout.failed(keyOf(request));
         cardEndpointRecord.failed(keyOf(request));
         if (activeRequest && activeRequest.request === request && activeRequest.attempt.lose()) {
             // The page's own script gave up on its request; the cardholder's
@@ -4292,6 +4349,9 @@ export async function attachToPlaywright(page, opts) {
                 // The merchant's own record of the order, as of the pause (see attachToCdp).
                 const cardRecord = cardEndpoint ? await cardEndpointFacts(cardEndpointRecord, cardEndpoint, request.url(), pausedAt, attempt.signal) : null;
                 assertRequestLive();
+                // Paddle's own checkout answers as of the pause, once their texts are read (see attachToCdp).
+                const paddleAnswers = await paddleCheckout.capture(pausedAt, request.url(), attempt.signal);
+                assertRequestLive();
                 const replay = await opts.vault.authorize({
                     user: opts.user,
                     merchant: opts.merchant,
@@ -4311,6 +4371,8 @@ export async function attachToPlaywright(page, opts) {
                     merchantSignal: attempt.signal,
                     // Same as the CDP path: the merchant's total as this browser recorded it.
                     merchantTotal: merchantTotal.capture(pausedAt, pausedPage),
+                    // And Paddle's own checkout answers, as this browser recorded them.
+                    paddleCheckout: paddleAnswers,
                     onAuthorizationCreated: (id) => lifecycle.approvalCreated(id),
                     onApprovalUrl: (url) => { if (!preparation && !attempt.signal.aborted) {
                         lifecycle.approvalUrl(url);
@@ -4381,7 +4443,7 @@ export async function attachToPlaywright(page, opts) {
                     // A Shiji STS getTokenId binds the device's cvv to its companion
                     // first, exactly as in attachToCdp: only for the request the
                     // approval was created from, and its frame.
-                    const continuation = cseContinuation(opts, deliverRequest.url(), deliverBody, replay, { url: request.url(), body }, preparation);
+                    const continuation = cseContinuation(opts, deliverRequest.url(), deliverBody, replay, { url: request.url(), body, headers: request.headers() }, preparation, deliverRequest.headers());
                     if (continuation.shijiCvv !== null) {
                         // The document the getTokenId paused in. One that cannot be read leaves the CVV nowhere to
                         // go, so the card is not tokenized either.

package/dist/client.d.ts

@@ -6,6 +6,7 @@ import { type PreparationMode, type PreparationProcessor } from './prepared-proc
 import { type VerifoneProfile, type VerifoneSubstitutions } from './verifone.js';
 import { type MerchantSessionCapture } from './merchant-session-probe.js';
 import { type PaddleTokenexServedFacts } from './paddle-tokenex.js';
+import type { PaddleCheckoutCapture } from './paddle-checkout-watch.js';
 import { VoiceModule, type VoiceOptions } from './voice.js';
 import { BuyModule } from './buy.js';
 import { RequestRegistry } from './requests.js';
@@ -462,6 +463,42 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * Served on the same terms, and the API holds the lane to Agentcard's own company
  * until a reviewed change binds the client key to the merchant.
  *
+ * `tap_card_sdk_token`: the token request Tap Payments' card frame sends to sdk.tap.company, carrying
+ * the card only as one ciphertext the frame writes under the merchant's own RSA key. This build pauses
+ * it and writes over the placeholder's ciphertext the one the cardholder's device wrote under the key
+ * payment-core pins for the request's publishable key (tap-payments.ts), into that request alone; 3-D
+ * Secure and the merchant's charge then run in the agent's browser. Served on the same terms: only to
+ * a build that lists it, for a company Agentcard turned Tap on for.
+ *
+ * `fastspring_card_payment`: the card payment FastSpring's checkout posts, on every store's own
+ * host, to <store>.onfastspring.com[/popup-<name>]/session/<id>/payment under the session's
+ * X-Session-Token. This build pauses only the checkout's own card body at that exact URL (a card
+ * FastSpring saved, a renewal, a gift, a tax id's second card send and a CAPTCHA answer are refused
+ * at the pause, and another method's payment with no card continues); the cardholder's device writes
+ * the real card into the paused body and sends it through the checkout relay, and the checkout gets
+ * FastSpring's answer as payment-core's judge rebuilt it. The request names no amount, so the agent's
+ * pair, above zero, is the total the checkout shows. Served on the same terms:
+ * only to a build that lists it, for a company Agentcard turned FastSpring on for.
+ *
+ * `openpay_tokenizer`: the token create openpay.js sends from a merchant's own page to
+ * api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe; sandbox-api for a test
+ * row), only through a prepared checkout: openpay.js abandons the request 40 seconds after Pay, so
+ * the cardholder approves before Pay. The token URL names the merchant, so the claim binds the
+ * request by its host's environment and its shape, never by the prepared URL. The cardholder's
+ * device sends the card to Openpay itself and the page gets back Openpay's token alone, rebuilt by
+ * payment-core's judge. The request names no amount, so the agent's pair, above zero
+ * (agent-amount-processors.json), is the one the cardholder approves. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned Openpay on for.
+ *
+ * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
+ * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
+ * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's
+ * phone sends the form with the real card through the checkout relay, and the paused navigation
+ * gets APS's own answer, its page or its redirect to the form's return page, only as payment-core's
+ * judge reads it for that form (amazon-payment-services.ts apsNavigationAnswer). The form names no
+ * amount, so the agent's pair, above zero, is the one the cardholder approves.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
@@ -964,6 +1001,13 @@ export interface AuthorizeInput extends ExecutionMetadata {
      * one from its network events, or the payment is refused before any create.
      */
     merchantTotal?: MerchantTotalCapture;
+    /**
+     * For a Paddle TokenEx /pay: when it paused and the answers Paddle's checkout service gave the frame before it,
+     * as this browser recorded them (see paddle-checkout-watch.ts). The adapters pass it, and it rides the create only
+     * for that processor. The API holds `amount` to the total they state for today, and admits a free trial's $0.00
+     * only on them; without them a $0.00 Paddle create is refused as before.
+     */
+    paddleCheckout?: PaddleCheckoutCapture;
 }
 export declare class CardEncryptedError extends Error {
     psp: string;
@@ -1625,9 +1669,10 @@ export declare class VaultClient {
      * capability (syncRegistry does), so before a sync, or against an API that
      * withheld it, the adapters leave that processor's traffic exactly as they
      * found it. prepare() asks this for ACI, whose card-number request names a
-     * checkout id the merchant mints only at Pay time, and for a processor whose
-     * card request is a GET (Worldpay eProtect), since that request is recognized
-     * by a query the page has not written yet.
+     * checkout id the merchant mints only at Pay time, for Openpay, whose token
+     * URL names the merchant's own id, and for a processor whose card request is
+     * a GET (Worldpay eProtect), since that request is recognized by a query the
+     * page has not written yet.
      */
     recognizesProcessor(psp: string): boolean;
     /**

package/dist/client.js

@@ -18,8 +18,10 @@ import { AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { PADDLE_VGS_PSP, paddleVgsCardFactsOf } from './paddle-vgs.generated.js';
 import { PAYGENT_PSP, paygentAnswerOutcome } from './paygent.generated.js';
 import { PADDLE_TOKENEX_PSP, isPaddleTokenexServedFacts, isPaddleTokenexServedSubstitution } from './paddle-tokenex.js';
+import { TAP_PAYMENTS_PSP, isTapPaymentsServedSubstitution } from './tap-payments.js';
 import { WIX_PAYMENTS_PSP } from './wix-payments.generated.js';
 import { HIPAY_PSP } from './hipay.generated.js';
+import { OPENPAY_PSP, openpayAnswerOutcome } from './openpay.generated.js';
 import { TOAST_PSP, isToastCiphertext } from './toast.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
@@ -38,6 +40,7 @@ import { JUSPAY_PSP, juspayPageAnswer } from './juspay-gate.js';
 import { CARD_ENDPOINT_MODE, CARD_ENDPOINT_PSP, CardEndpointRefusedError, cardEndpointById, cardEndpointLive, cardEndpointSessionRefusal, } from './card-endpoint.js';
 import { merchantCardEndpointFactsRefusal as sharedFactsRefusal, readMerchantCardEndpointFacts as sharedReadFacts, } from './merchant-card-endpoints.generated.js';
 import { TOKENEX_IFRAME_PSP, tokenexIframePageAnswer, tokenexIframePlaceholderFits } from './tokenex-iframe.js';
+import { APS_PSP, apsNavigationAnswer } from './amazon-payment-services.js';
 import { PRIMER_PSP, primerTokenAnswer } from './primer.js';
 import { isPayrailsPaymentUrl, payrailsAnswer } from './payrails.js';
 import { EbanxFollowUpError } from './ebanx.js';
@@ -453,6 +456,42 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * Served on the same terms, and the API holds the lane to Agentcard's own company
  * until a reviewed change binds the client key to the merchant.
  *
+ * `tap_card_sdk_token`: the token request Tap Payments' card frame sends to sdk.tap.company, carrying
+ * the card only as one ciphertext the frame writes under the merchant's own RSA key. This build pauses
+ * it and writes over the placeholder's ciphertext the one the cardholder's device wrote under the key
+ * payment-core pins for the request's publishable key (tap-payments.ts), into that request alone; 3-D
+ * Secure and the merchant's charge then run in the agent's browser. Served on the same terms: only to
+ * a build that lists it, for a company Agentcard turned Tap on for.
+ *
+ * `fastspring_card_payment`: the card payment FastSpring's checkout posts, on every store's own
+ * host, to <store>.onfastspring.com[/popup-<name>]/session/<id>/payment under the session's
+ * X-Session-Token. This build pauses only the checkout's own card body at that exact URL (a card
+ * FastSpring saved, a renewal, a gift, a tax id's second card send and a CAPTCHA answer are refused
+ * at the pause, and another method's payment with no card continues); the cardholder's device writes
+ * the real card into the paused body and sends it through the checkout relay, and the checkout gets
+ * FastSpring's answer as payment-core's judge rebuilt it. The request names no amount, so the agent's
+ * pair, above zero, is the total the checkout shows. Served on the same terms:
+ * only to a build that lists it, for a company Agentcard turned FastSpring on for.
+ *
+ * `openpay_tokenizer`: the token create openpay.js sends from a merchant's own page to
+ * api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe; sandbox-api for a test
+ * row), only through a prepared checkout: openpay.js abandons the request 40 seconds after Pay, so
+ * the cardholder approves before Pay. The token URL names the merchant, so the claim binds the
+ * request by its host's environment and its shape, never by the prepared URL. The cardholder's
+ * device sends the card to Openpay itself and the page gets back Openpay's token alone, rebuilt by
+ * payment-core's judge. The request names no amount, so the agent's pair, above zero
+ * (agent-amount-processors.json), is the one the cardholder approves. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned Openpay on for.
+ *
+ * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
+ * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
+ * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's
+ * phone sends the form with the real card through the checkout relay, and the paused navigation
+ * gets APS's own answer, its page or its redirect to the form's return page, only as payment-core's
+ * judge reads it for that form (amazon-payment-services.ts apsNavigationAnswer). The form names no
+ * amount, so the agent's pair, above zero, is the one the cardholder approves.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;
@@ -843,7 +882,8 @@ export class AmountRequiredError extends Error {
         const processor = PROCESSOR_NAMES[psp] ?? psp;
         // A Payrexx card request names the frame's total, but the merchant's page charges its own total after the token.
         const lacks = psp === REVOLUT_PSP ? 'names its amount but not its currency'
-            : psp === PAYREXX_PSP ? "only mints a token the merchant's page charges later" : 'names no amount';
+            : psp === PAYREXX_PSP ? "only mints a token the merchant's page charges later"
+                : psp === TAP_PAYMENTS_PSP ? 'does not decide the amount charged' : 'names no amount';
         // "An Omise payment request", "A Clover payment request": the article follows the name's first letter.
         const article = /^[AEIOU]/.test(processor) ? 'An' : 'A';
         super(`${article} ${processor} payment request ${lacks}, so pass amount and currency: that is the amount the cardholder approves. Nothing was created and nothing was charged.`);
@@ -1844,19 +1884,33 @@ const PAYGENT_PREPARATION_REFUSALS = [
  */
 const HIPAY_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'sandbox_host_on_live_row', 'merchant_profile_mismatch',
     'amount_required'];
+/**
+ * The API's refusals of an Openpay preparation, before any preparation exists, that prepareCheckout passes on by
+ * name: the company is not turned on for Openpay (`processor_unavailable`), the environment is not the caller's key
+ * mode's (`live_host_on_sandbox_row`, `sandbox_host_on_live_row`), a live checkout's merchant is not the name the
+ * reviewed pin for its origin carries (`merchant_profile_mismatch`), and the price is zero (`amount_required`), since
+ * the token create names no amount. An origin no reviewed pin lists answers `unsupported_checkout`, which
+ * PREPARATION_REFUSALS names for every checkout. The API holds the pins, not this build, so a merchant a later release
+ * reviews needs no new SDK. Only for an Openpay checkout.
+ */
+const OPENPAY_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'sandbox_host_on_live_row',
+    'merchant_profile_mismatch', 'amount_required'];
 /**
  * The reason the cardholder's device declines a bound prepared row with, per processor, when its own
  * send boundary passed before the card left it (the Vault's sendWindow, 12 seconds after it last saw
  * the checkout unbound): a prepared Amadeus SDK add, a prepared Secure Acceptance token create and a
  * prepared Wix tokenize request. It names the same known non-payment the adapters' own send window
  * closes on (amadeus.ts), which can close later, so authorize() ends the attempt the way that window
- * does, as a CheckoutPreparationError with that reason, and never as the cardholder's "no".
+ * does, as a CheckoutPreparationError with that reason, and never as the cardholder's "no". A prepared
+ * HiPay token create too, and a prepared Openpay token create, whose device sends the card at most 25
+ * seconds after it last saw the checkout unbound, inside the adapters' 30.
  */
 const PREPARED_SEND_WINDOW_DECLINES = Object.freeze({
     amadeus_checkout: 'amadeus_send_window_closed',
     [SECURE_ACCEPTANCE_PSP]: 'secure_acceptance_send_window_closed',
     [WIX_PAYMENTS_PSP]: 'wix_payments_send_window_closed',
     [HIPAY_PSP]: 'hipay_send_window_closed',
+    [OPENPAY_PSP]: 'openpay_send_window_closed',
 });
 /**
  * Refusals a CyberSource Flex preparation that tokenizes before Pay answers (4xx) before any
@@ -2180,9 +2234,10 @@ export class VaultClient {
      * capability (syncRegistry does), so before a sync, or against an API that
      * withheld it, the adapters leave that processor's traffic exactly as they
      * found it. prepare() asks this for ACI, whose card-number request names a
-     * checkout id the merchant mints only at Pay time, and for a processor whose
-     * card request is a GET (Worldpay eProtect), since that request is recognized
-     * by a query the page has not written yet.
+     * checkout id the merchant mints only at Pay time, for Openpay, whose token
+     * URL names the merchant's own id, and for a processor whose card request is
+     * a GET (Worldpay eProtect), since that request is recognized by a query the
+     * page has not written yet.
      */
     recognizesProcessor(psp) {
         return this.registry.some((rec) => rec.psp === psp);
@@ -2425,7 +2480,8 @@ export class VaultClient {
         const secureAcceptanceProfileId = secureAcceptance ? secureAcceptanceCheckoutProfile({ environment: input.environment,
             profileId: input.secureAcceptanceProfileId, merchantOrigin: input.merchantOrigin }) : null;
         // A live Paygent checkout's merchant is the API's to judge against the reviewed pins it holds, before anyone is
-        // asked to approve (PAYGENT_PREPARATION_REFUSALS); test mode needs no pin.
+        // asked to approve (PAYGENT_PREPARATION_REFUSALS); test mode needs no pin. So is a live Openpay checkout's
+        // origin and merchant (OPENPAY_PREPARATION_REFUSALS); Openpay's sandbox needs no pin either.
         const timeoutMs = input.timeoutMs ?? 15 * 60_000;
         if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647)
             throw fail('timeout_invalid');
@@ -2547,6 +2603,7 @@ export class VaultClient {
                     || (input.psp === WIX_PAYMENTS_PSP && WIX_PAYMENTS_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === PAYGENT_PSP && PAYGENT_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === HIPAY_PSP && HIPAY_PREPARATION_REFUSALS.includes(error.code))
+                    || (input.psp === OPENPAY_PSP && OPENPAY_PREPARATION_REFUSALS.includes(error.code))
                     || (!!flexContext && CYBERSOURCE_FLEX_PREPARATION_REFUSALS.includes(error.code))))
                     || (input.psp === 'fiserv' && error.status === 502 && error.code === 'cse_key_unavailable')))
                 throw fail(error.code);
@@ -2845,7 +2902,8 @@ export class VaultClient {
         // like a missing one.
         // A ComGate payment charges the total ComGate already holds for it, the same way, and a Webpay transaction the
         // total the merchant's server bound to it, and a Payrexx page charges its own
-        // total after the frame's token.
+        // total after the frame's token. The charge that follows a Tap token charges the order the merchant's session
+        // holds, the same way.
         // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay, a
         // PayMongo attach or a MakeCommerce card post charges the total its payment, checkout session or
         // transaction already holds, so a zero pair would show the cardholder no price at all: it is refused
@@ -2854,6 +2912,7 @@ export class VaultClient {
         // A Toast payment method is charged by the page's own confirm for whatever its intent says, the same way.
         // An Omise token is charged later for whatever the merchant's server decides, as a Clover one is.
         // An SB Payment Service token is charged later the same way.
+        // An Openpay token is charged later for whatever the merchant's server decides, as a HiPay one is.
         if (hasAmount && rec && ABOVE_ZERO_PROCESSORS.includes(rec.psp) && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
@@ -2920,6 +2979,12 @@ export class VaultClient {
             // Only the profile's id: the API takes the leg, the key and its environment from the
             // profile Agentcard reviewed, never from the caller.
             ...(verifoneProfile ? { verifone: { profile: verifoneProfile.id } } : {}),
+            // Paddle TokenEx only: Paddle's checkout answers this browser recorded before the /pay paused, which the API
+            // holds `amount` to (paddle-checkout-watch.ts). Any other processor's create would be refused with them.
+            ...(rec?.psp === PADDLE_TOKENEX_PSP && input.paddleCheckout?.answers.length ? { paddle_checkout: {
+                    paused_at: input.paddleCheckout.pausedAt,
+                    answers: input.paddleCheckout.answers.map((answer) => ({ method: answer.method, url: answer.url, status: answer.status, completed_at: answer.completedAt, body: answer.body })),
+                } } : {}),
             // A prepared checkout already carries the page origin as merchant_origin.
             ...(preparation
                 ? { preparation_id: preparation.id, checkout_key: preparation.checkoutKey, merchant_origin: preparation.merchantOrigin, form_guidance: 'filled' }
@@ -3003,10 +3068,14 @@ export class VaultClient {
         // A prepared HiPay token create too, for 20 seconds: HiPay's hosted fields give it 20 seconds from Pay, so
         // an answer the cardholder's device records late in that span still reaches the frame before it gives up,
         // and the API names 500 ms as such a row's poll interval.
+        // A prepared Openpay token create too, for 40 seconds: openpay.js gives it 40 seconds from Pay, so the token
+        // reaches the page within half a second of the device's answer, and the API names 500 ms as such a row's poll
+        // interval.
         const preparedFastPollUntil = preparation?.psp === 'mercado_pago' ? Date.now() + 10_000
             : preparation?.psp === PADDLE_VGS_PSP || preparation?.psp === HIPAY_PSP ? Date.now() + 20_000
-                : preparation?.psp === EPROTECT_PSP ? Date.now() + 15_000
-                    : preparation?.psp === SECURE_ACCEPTANCE_PSP ? Date.now() + SECURE_ACCEPTANCE_FAST_POLL_MS : 0;
+                : preparation?.psp === OPENPAY_PSP ? Date.now() + 40_000
+                    : preparation?.psp === EPROTECT_PSP ? Date.now() + 15_000
+                        : preparation?.psp === SECURE_ACCEPTANCE_PSP ? Date.now() + SECURE_ACCEPTANCE_FAST_POLL_MS : 0;
         // A preparation that tokenized before Pay: the cardholder's device already holds CyberSource's
         // token and approves as soon as this bind reaches it, while the page may give createToken only
         // seconds (Alaska Airlines' flight checkout gives it three). Poll every 100 ms for 10 seconds,
@@ -3179,11 +3248,14 @@ export class VaultClient {
                         // Paddle TokenEx carries the two ciphertexts at tokenex_card and the five facts beside them in
                         // `paddle_tokenex_facts` (the expiry parts are numbers, so they cannot ride `fields`).
                         const paddleTokenex = rec?.psp === PADDLE_TOKENEX_PSP;
+                        // Tap carries its one ciphertext at the body root too (`at` is ''), and nothing to remove (tap-payments.ts).
+                        const tap = rec?.psp === TAP_PAYMENTS_PSP;
                         const fieldsOk = shiji ? isShijiStsServedSubstitution(sub) && isShijiStsServedCompanion(s.shiji_sts_companion)
                             : paddleTokenex ? isPaddleTokenexServedSubstitution(sub) && isPaddleTokenexServedFacts(s.paddle_tokenex_facts)
-                                : sub && typeof sub === 'object' && sub.encoding === 'json' && typeof sub.at === 'string' && sub.at
-                                    && sub.fields && typeof sub.fields === 'object' && !Array.isArray(sub.fields)
-                                    && Object.values(sub.fields).every((v) => typeof v === 'string' && v.length > 0);
+                                : tap ? isTapPaymentsServedSubstitution(sub)
+                                    : sub && typeof sub === 'object' && sub.encoding === 'json' && typeof sub.at === 'string' && sub.at
+                                        && sub.fields && typeof sub.fields === 'object' && !Array.isArray(sub.fields)
+                                        && Object.values(sub.fields).every((v) => typeof v === 'string' && v.length > 0);
                         if (!fieldsOk)
                             throw new PaymentOutcomeUnknownError(authorizationId, 'cse_substitutions_malformed');
                         // A Fiserv approval carries exactly its envelope's four members at
@@ -3388,6 +3460,19 @@ export class VaultClient {
                         response.headers = { 'content-type': 'application/json' };
                         response.body = judged.body;
                     }
+                    if (rec?.psp === OPENPAY_PSP) {
+                        // Openpay's answer enters the page only as payment-core rebuilds an approved token from its id, masked number,
+                        // brand and points flag (openpay.js openpayAnswerOutcome: HTTP 200 or 201 and a token in shape), under its
+                        // approved status and a JSON content type. openpay.js hands any 2xx to the page's success callback, so
+                        // anything else, an error object Openpay answers inside a 2xx included, is never handed over as an approval;
+                        // the card may have left the device, so the outcome is unknown rather than declined.
+                        const judged = openpayAnswerOutcome(response.status, response.body, null);
+                        if (judged.outcome !== 'approved' || typeof judged.body !== 'string')
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'openpay_token_unconfirmed');
+                        response.status = response.status === 201 ? 201 : 200;
+                        response.headers = { 'content-type': 'application/json' };
+                        response.body = judged.body;
+                    }
                     if (rec?.psp === PRIMER_PSP) {
                         // Primer's answer enters the page only as one single-use card token rebuilt from
                         // payment-core's allow-list, under a JSON content type (primer.ts primerTokenAnswer).
@@ -3412,6 +3497,21 @@ export class VaultClient {
                         response.headers = answer.headers;
                         response.body = answer.body;
                     }
+                    if (rec?.psp === APS_PSP) {
+                        // Amazon Payment Services: the paused top-level navigation is answered with APS's own page under its HTML
+                        // type, or with APS's redirect to the paused form's return page, and only with a token payment-core's judge
+                        // reads for that form (amazon-payment-services.ts apsNavigationAnswer). Anything else is not an answer to
+                        // hand the browser: the card has already reached APS. No autopilot run sends an APS form (payment-core, the
+                        // authority and the API refuse it), so an approval the API reports as unattended is not handed over either.
+                        if (execution.executionMode === 'autopilot')
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_submission_mode_invalid');
+                        const answer = apsNavigationAnswer(input.request, response);
+                        if (!answer)
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'aps_answer_unconfirmed');
+                        response.status = answer.status;
+                        response.headers = answer.headers;
+                        response.body = answer.body;
+                    }
                     let processorContext;
                     if (mercadoContext) {
                         try {