@agent-cards/sdk 0.23.23 → 0.23.25

package/CHANGELOG.md

@@ -4,6 +4,22 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.25
+
+- Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.
+
+## 0.23.24
+
+- Continue Tap Payments' card form with the card the cardholder's device encrypts, for a company Agentcard turned Tap on for (dark launch). Merchants in Kuwait, Saudi Arabia, the UAE, Bahrain, Qatar and Oman take cards on Tap's hosted checkout at `checkout.tap.company`, whose card frame encrypts the card under the merchant's own key and sends it to `https://sdk.tap.company/v2/card/token`. This build declares `tap_card_sdk_token` on every sync, and the API serves Tap's recognizer only for a company Agentcard listed for it, so every other company's Tap payments go through untouched, as for an unsupported processor. The token request does not decide the charge: Tap's checkout charges the order the merchant holds, so `authorize()` refuses a Tap request without `amount` above zero and `currency` (`AmountRequiredError`). Send the total Tap's page shows. Before it creates anything, the API refuses a request that asks Tap to keep the card (`invalid_tap_payments_request`), a merchant Agentcard has not reviewed for the checkout page (`unsupported_checkout`), a live merchant's card form on a test-mode client or the reverse (`tap_payments_environment_mismatch`), and a request whose order names your currency at another total (`amount_mismatch`). After the approval the SDK writes the device's ciphertext over the one your agent's page wrote, in that request alone, moves no other byte, and continues the page's own request. 3-D Secure and the merchant's charge then run in the agent's browser, where a challenge needs a person at that browser. The SDK refuses a request that is not byte for byte the one the cardholder approved, or that names another merchant key. The API serves the device's ciphertext only in the 10 minutes after the approval and deletes it once that window passes. A Tap payment also needs the matching API and Vault releases.
+
+- Pause FastSpring's card payment for the cardholder's device. Every FastSpring store's checkout, a popup, an embedded checkout or a web storefront on the store's own host under `onfastspring.com`, posts the card as JSON to `/session/<id>/payment` (after `/popup-<name>` in a popup) under the session's `X-Session-Token`. The sync now also asks for `capabilities=fastspring_card_payment`, and the API serves FastSpring's recognizer only for a company Agentcard turned FastSpring on for. The SDK pauses only the checkout's own card body at that exact URL: a card FastSpring saved, a ticked "save payment details" or renewal box, a gift, a Brazilian or Argentine tax id and a CAPTCHA answer are refused at the pause, and a payment by another method with no card continues untouched. The cardholder's device writes the real card into the paused body and sends it through Agentcard's checkout relay to a store Agentcard reviewed, and the checkout gets FastSpring's answer. FastSpring's payment names no price, so pass `amount` and `currency`, above zero, the total the checkout shows: without them `authorize()` throws `AmountRequiredError` before anything is created. Matching API and Vault releases are required. FastSpring stays off for every company Agentcard has not turned it on for.
+
+- Pay an Openpay checkout, for a company Agentcard turned Openpay on for (dark launch). The merchant's page hands its card to Openpay's own `openpay.js`, which posts it to `https://api.openpay.mx/v1/<merchant id>/tokens` (`api.openpay.co` in Colombia, `api.openpay.pe` in Peru, `sandbox-api.openpay.<mx|co|pe>` in test) and gives up 40 seconds after Pay, too soon for an approval after Pay. So the SDK sends the card only through `prepare({ psp: 'openpay_bbva', environment: 'production' })` (`'sandbox'` for Openpay's sandbox hosts), before Pay; without one, the SDK refuses the request before it asks the API, and sends nothing. The sync now also asks for `capabilities=openpay_tokenizer`. The token URL names the merchant, so the SDK binds Pay's request to the approval by its host's environment and its shape, never by the URL `prepare()` names. Once the cardholder approves, Pay's request pauses, the cardholder's device sends the card to Openpay itself, and the page receives Openpay's token, rebuilt from its id, its masked number, its brand and its points flag, and nothing else. One approval sends one card request, and a request the cardholder's device has not sent 30 seconds after the pause fails before the card leaves, with `openpay_send_window_closed`. Openpay's request names no amount, so the cardholder approves the `amount` and `currency` you pass, above zero, and the API refuses a zero `amount` with `amount_required`, which `prepare()` names too. On Openpay's live hosts, Agentcard pays only a merchant account it has reviewed, at its reviewed page and under its reviewed name, merchant id and public key (Diario de Yucatán at `https://www.yucatan.com.mx`, today). `prepare()` at any other page fails with `unsupported_checkout`, and under another name with `merchant_profile_mismatch`, before anyone is asked; a token request for another merchant id or public key is refused with `unsupported_checkout` before the card leaves. The API holds the reviewed accounts, so an account Agentcard reviews later needs no new SDK. Openpay México and Openpay Colombia take a card issued abroad only as credit. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
+
+- `attachToCdp` and `attachToPlaywright` record the answers Paddle's checkout service gives its frame (`POST /transaction-checkout`, `PATCH /transaction-checkout/<id>/`, `POST .../customer`), read-only and cut to the checkout's terms, and send the newest eight with a Paddle TokenEx create as `paddle_checkout`. The API holds `amount` to the total they state for today, so an agent that reports a free trial's renewal as today's price is refused with `amount_mismatch`. A free trial's create sends `amount: 0` with its currency; the approval then shows the renewal those answers state. A /pay that pauses before the newest answer's text is read waits up to a second for it, and a /pay that leaves while an answer is still loading sends no answers, so the API never reads an older answer's terms in place of the newest. No customer, address or seller detail from those answers leaves the browser. A runtime that intercepts on its own can build the same capture with the exported `PaddleCheckoutWatch`: it reports each answer to the watch as `sent`, `answered`, `finished` and `read`, awaits `capture(pausedAt, payUrl)` when the /pay pauses, and passes the result to `authorize()` as `paddleCheckout`.
+
+- Recognize Amazon Payment Services' custom merchant page behind a dark launch. `syncRegistry()` now declares the `aps_custom_merchant_page` capability (`SUPPORTED_CAPABILITIES`), and the API serves the recognizer only to an org Agentcard has enabled, so no other org's APS checkout changes. For an enabled org, the merchant page's own card form, posted top-level to `https://checkout.payfort.com/FortAPI/paymentPage` (`sbcheckout.payfort.com` on APS's sandbox), pauses for the cardholder's approval, and the page navigates on with APS's own answer: APS's page, which posts APS's fields to the form's return page, or APS's redirect to that page. `authorize()` hands over only an answer payment-core's judge reads as a token for the form it paused, and throws `PaymentOutcomeUnknownError` with reason `aps_answer_unconfirmed` for any other. The form names no amount, so `authorize()` throws `AmountRequiredError` unless you pass `amount` and `currency`, above zero. A payment also needs the matching API, checkout relay and Vault releases.
+
 ## 0.23.23
 
 - Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.
@@ -24,6 +40,8 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 - Pause the card token request every Omise card form sends, for the cardholder's device. Omise.js's card frame (`https://cdn.omise.co/pay.html`), a merchant's own page calling Omise.js, and a checkout that bundles Omise's Node library all send the card as JSON to `https://vault.omise.co/tokens` under the merchant's public key. The sync now also asks for `capabilities=omise_card_token`, and the API serves Omise's recognizer only for a company Agentcard turned Omise on for. The SDK pauses only a card form's token request at that exact URL, a body the page posts as a `Blob` included; a wallet's tokenization and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Omise itself with the real card, and the page gets Omise's token. Omise's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a merchant Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Omise stays off for every company Agentcard has not turned it on for.
 
+- Send your agent's browser back to the Webpay shop once the cardholder's phone has paid, so the shop records the order. Webpay tells a shop about a payment only when the buyer's browser returns to the shop's return page with Webpay's token, and the shop then confirms the payment with Transbank. The phone pays in its own Webpay session, so a shop never heard of the payment while the paused Webpay link got the `submitted_on_device` page. Now `attachToCdp` and `attachToPlaywright` answer that link with a redirect to the shop's return page and the same token. Your browser lands on the shop's own page, in the shop's own session, and the shop shows its receipt or its decline there. The `submitted_on_device` event names the shop's host in `merchantReturn.host`, and no event names the token. Only a Webpay shop Agentcard has reviewed with its return page gets the redirect. Agentcard has reviewed none yet, so every Webpay checkout still gets the `submitted_on_device` page until one is reviewed. Matching API and Vault releases are required.
+
 ## 0.23.22
 
 - Keep a FastSpring checkout's session id out of your events and error messages. FastSpring's checkout, on every store's own host under `onfastspring.com`, sends the card to `/session/<id>/payment` (after `/popup-<name>` in a popup), and anyone who holds that session id can read the session's own page, its order and the token its requests carry. `redactUrl`, every event and every error message now show it as `{session}` on every FastSpring store host, as in `https://daisydisk.onfastspring.com/session/{session}/payment`. The SDK does not pause a FastSpring payment yet. No API or Vault release is needed.

package/PREFLIGHT.md

@@ -217,6 +217,8 @@ Paddle (`paddle_vgs`) has no discovery rule in this table. Paddle's checkout fra
 
 Paygent (`paygent`) has no discovery rule in this table yet. Every Paygent card form loads Paygent's `PaygentToken.js`, so a rule would name every Paygent checkout while no Paygent payment has gone through, and a Paygent checkout stays `unknown`. The direct SDK pauses the token request to `token.paygent.co.jp/n/token/request` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Paygent row of the [README](./README.md) processor table for what the SDK covers.
 
+Openpay (`openpay_bbva`) has no discovery rule in this table yet. Openpay merchants load `openpay.js` on pages that take no card, some on every page, so the script on a page is no evidence that a payment can be approved, and an Openpay checkout stays `unknown`. The direct SDK pauses the token request `openpay.js` sends to `api.openpay.mx/v1/<merchant id>/tokens` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Openpay row of the [README](./README.md) processor table for what the SDK covers.
+
 The bundled direct SDK profile declares processor support for `one_time` purchases. The catalog carries each processor's request limitations and known exclusions. A detection rule does not cover every product or regional variant sold under the processor's name. For example, Moneris Hosted Tokenization and Moneris Checkout use different payment paths; the implemented adapter covers Hosted Tokenization.
 
 The catalog also carries reviewed hosted, regional, and versioned variants observed on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. A variant the implemented adapter does not admit, such as the Tranzila terminal-root page, the Authorize.Net hosted payment form, or a Worldpay hosted payment page, identifies its processor and returns `unknown` with `processor_variant_unverified`. A new fingerprint never declares payment support by itself.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -375,6 +375,11 @@ Eximbay's window in a new window gets the pause only under `attachToCdp`, and
 only once the SDK has armed that window: an entry posted into a window the page
 opens in the same moment can leave first, and the SDK then fails the window's
 next post, so the checkout reads `unsupported` with no card sent.
+Barion's Smart Gateway (`barion_hosted_payment_page`) is served the same way:
+this build pauses the gateway link `secure.barion.com/Pay?Id=<payment id>` for
+the cardholder's device and fails every post a page it watches makes to the
+gateway. A merchant's server often sends the buyer to that link with a
+redirect, and only `attachToCdp` pauses a redirect.
 Revolut Business's card field (`revolut_card_field`) is served on the same
 terms: this build pauses the frame's card payment on `merchant.revolut.com`,
 the cardholder's device sends it to Revolut itself, and the frame gets
@@ -424,6 +429,13 @@ page, the cardholder's device sends it to Omise itself with the real card, and
 the page gets Omise's token. The API pays only a merchant Agentcard reviewed
 for the page the request comes from. Omise's request names no price, so pass
 `amount` and `currency`, above zero: that is the amount the cardholder approves.
+FastSpring's checkout (`fastspring_card_payment`) is served on the same terms:
+this build pauses the card payment the checkout posts to
+`<store>.onfastspring.com/.../session/<id>/payment`, the cardholder's device
+writes the real card into it and sends it through Agentcard's checkout relay to
+a store Agentcard reviewed, and the checkout gets FastSpring's answer. The
+payment names no price, so pass `amount` and `currency`, above zero: the total
+the checkout shows, tax included, which the API holds to FastSpring's own figure.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["clover", "comgate", "cybersource_secure_acceptance", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["clover", "comgate", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/amadeus.d.ts

@@ -4,6 +4,8 @@ export declare const AMADEUS_SEND_WINDOW_MS = 20000;
 export declare const WIX_PAYMENTS_SEND_WINDOW_MS = 20000;
 /** How long after the pause a paused HiPay token create may still be sent, of the 20 seconds the merchant's page waits. */
 export declare const HIPAY_SEND_WINDOW_MS = 12000;
+/** How long after the pause a paused Openpay token create may still be sent, of the 40 seconds openpay.js waits. */
+export declare const OPENPAY_SEND_WINDOW_MS = 30000;
 /**
  * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
  * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
@@ -13,13 +15,14 @@ export declare const HIPAY_SEND_WINDOW_MS = 12000;
  */
 export declare function failsAsNetworkError(url: string): boolean;
 /** The processor a send window's events and stop cause name. */
-export type SendWindowProcessor = 'amadeus' | 'secure_acceptance' | 'wix_payments' | 'hipay';
+export type SendWindowProcessor = 'amadeus' | 'secure_acceptance' | 'wix_payments' | 'hipay' | 'openpay';
 /** Why a send window stopped its attempt: the API confirmed the card never left the device and never can. */
 export type SendWindowClosed = `${SendWindowProcessor}_send_window_closed`;
 /**
  * The send window for a request paused under a preparation for `psp`, or null when it has none: a
  * prepared Amadeus SDK add, a prepared CyberSource Secure Acceptance token create and a prepared Wix
- * tokenize request, each 20 seconds, and a prepared HiPay token create, 12 seconds.
+ * tokenize request, each 20 seconds, a prepared HiPay token create, 12 seconds, and a prepared Openpay token
+ * create, on exactly a token URL as openpay.js writes it, 30 seconds.
  */
 export declare function preparedSendWindowMs(psp: string | undefined, url: string): number | null;
 /** The processor a prepared request's send window names in its events, or null when it has none. */

package/dist/amadeus.js

@@ -24,6 +24,12 @@
 // the frame unused (the frame's next Pay would send /update, which the SDK refuses), so a paused token create gets a
 // 12 second window: HiPay answers a create in about a second, so a card sent inside it reaches the page in time.
 //
+// openpay.js abandons its token create 40 seconds after Pay ("Timeout after 40000 milliseconds"), and the merchant's
+// server charges only a token the page read in time. A token Openpay mints after that point is one no charge ever
+// names, so a paused token create gets a 30 second window, of the 40 the page waits, as the 30 second pages above
+// get 20: the cardholder's device sends by 25 seconds after it last saw the checkout unbound (the Vault's own
+// window), and Openpay's answer, about a second, then reaches the page with the rest of those 40 seconds to spare.
+//
 // So when the window closes and no answer is being handed to the page yet, the adapter asks for that
 // cancel. Confirmed: nothing was sent and nothing can be, so the attempt stops, the page's request
 // fails (a Secure Acceptance frame gets the stopped page), and the checkout reads failed. Not
@@ -36,19 +42,23 @@
 // Data Collection Page's store has no client timeout and gets no window. The window's events name the
 // processor: `amadeus_send_window_closed` and `amadeus_send_window_unconfirmed`,
 // `secure_acceptance_send_window_closed` and `secure_acceptance_send_window_unconfirmed`,
-// `wix_payments_send_window_closed` and `wix_payments_send_window_unconfirmed`, or
-// `hipay_send_window_closed` and `hipay_send_window_unconfirmed`.
+// `wix_payments_send_window_closed` and `wix_payments_send_window_unconfirmed`,
+// `hipay_send_window_closed` and `hipay_send_window_unconfirmed`, or
+// `openpay_send_window_closed` and `openpay_send_window_unconfirmed`.
 import { amadeusCardUrl } from './amadeus-checkout.generated.js';
 import { isSecureAcceptanceTokenRequest } from './cybersource-secure-acceptance.generated.js';
 import { SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_SEND_WINDOW_MS } from './cybersource-secure-acceptance.js';
 import { WIX_PAYMENTS_PSP, isWixPaymentsTokenizeUrl } from './wix-payments.generated.js';
 import { HIPAY_PSP, isHipayTokenUrl } from './hipay.generated.js';
+import { OPENPAY_PSP, isOpenpayTokenUrl } from './openpay.generated.js';
 /** How long after the pause a paused Amadeus SDK add may still be sent. */
 export const AMADEUS_SEND_WINDOW_MS = 20_000;
 /** How long after the pause a paused Wix tokenize request may still be sent, of the 30 seconds Wix's widget waits. */
 export const WIX_PAYMENTS_SEND_WINDOW_MS = 20_000;
 /** How long after the pause a paused HiPay token create may still be sent, of the 20 seconds the merchant's page waits. */
 export const HIPAY_SEND_WINDOW_MS = 12_000;
+/** How long after the pause a paused Openpay token create may still be sent, of the 40 seconds openpay.js waits. */
+export const OPENPAY_SEND_WINDOW_MS = 30_000;
 /**
  * True when a request the adapters refuse must fail as a network error (ERR_FAILED) rather than as
  * the cancellation (ERR_ABORTED) they use elsewhere. An XMLHttpRequest reports a cancellation only
@@ -62,7 +72,8 @@ export function failsAsNetworkError(url) {
 /**
  * The send window for a request paused under a preparation for `psp`, or null when it has none: a
  * prepared Amadeus SDK add, a prepared CyberSource Secure Acceptance token create and a prepared Wix
- * tokenize request, each 20 seconds, and a prepared HiPay token create, 12 seconds.
+ * tokenize request, each 20 seconds, a prepared HiPay token create, 12 seconds, and a prepared Openpay token
+ * create, on exactly a token URL as openpay.js writes it, 30 seconds.
  */
 export function preparedSendWindowMs(psp, url) {
     if (psp === 'amadeus_checkout')
@@ -81,6 +92,8 @@ export function preparedSendWindowMs(psp, url) {
         return isWixPaymentsTokenizeUrl(url) ? WIX_PAYMENTS_SEND_WINDOW_MS : null;
     if (psp === HIPAY_PSP)
         return isHipayTokenUrl(url) ? HIPAY_SEND_WINDOW_MS : null;
+    if (psp === OPENPAY_PSP)
+        return isOpenpayTokenUrl(url) ? OPENPAY_SEND_WINDOW_MS : null;
     return null;
 }
 /** The processor a prepared request's send window names in its events, or null when it has none. */
@@ -89,6 +102,8 @@ export function sendWindowProcessor(psp) {
         return 'wix_payments';
     if (psp === HIPAY_PSP)
         return 'hipay';
+    if (psp === OPENPAY_PSP)
+        return 'openpay';
     return psp === 'amadeus_checkout' ? 'amadeus' : psp === SECURE_ACCEPTANCE_PSP ? 'secure_acceptance' : null;
 }
 /** The send window for a prepared Amadeus SDK add, or null: preparedSendWindowMs for Amadeus alone. */

package/dist/amazon-payment-services.d.ts

@@ -0,0 +1,25 @@
+export declare const APS_PSP: string;
+export declare const APS_CAPABILITY: string;
+/**
+ * The answer the paused APS form navigation is fulfilled with, or null. The API stores APS's answer only once
+ * payment-core's judge reads it as a token for the paused form (apsAnswerOutcome), and this reads the stored answer
+ * again, against the paused request, before the agent's browser gets it:
+ *   page      status 200 under APS's HTML type alone, APS's page byte for byte, whose one form posts APS's fields to
+ *             the paused form's own return_url;
+ *   redirect  status 302 or 303 with one Location alone: the paused form's return_url, then APS's fields in the query.
+ * Anything else is null: a refusal, an unknown answer, another merchant's or another return page's answer, a card
+ * number anywhere in it, or a header beside the one each shape carries. A navigation reads no CORS header, so none is
+ * added. Autopilot never sends an APS form (payment-core autopilot.js), so the caller refuses an unattended answer.
+ */
+export declare function apsNavigationAnswer(request: {
+    url: string;
+    body?: string | null;
+}, response: {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}): {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+} | null;

package/dist/amazon-payment-services.generated.d.ts

@@ -0,0 +1,76 @@
+declare var APS_PSP: string;
+declare var APS_CAPABILITY: string;
+declare var APS_OPERATION: string;
+declare var APS_HOSTS: Readonly<{
+    "checkout.payfort.com": "production";
+    "sbcheckout.payfort.com": "sandbox";
+}>;
+declare var APS_TOKENIZATION_PATH: string;
+declare var APS_SIGNED_FIELDS: readonly string[];
+declare var APS_CARD_FIELDS: readonly string[];
+declare var APS_OPTIONAL_FIELDS: readonly string[];
+declare var APS_REFUSAL_CODES: readonly string[];
+declare function apsTokenizationUrl(url: any): Readonly<{
+    host: string;
+    environment: any;
+}> | null;
+declare var isApsTokenizationUrl: (url: any) => boolean;
+declare var apsEnvironment: (url: any) => any;
+declare function apsBodyRefusal(body: any): "aps_body_unsupported" | "aps_saved_card_refused" | "aps_recurring_refused" | "aps_service_command_refused" | "aps_return_url_refused" | null;
+declare function apsBodyVerdict(body: any, url: any): {
+    verdict: string;
+    code: string;
+} | {
+    verdict: string;
+    code?: undefined;
+};
+declare function apsRefusalMessage(code: any): any;
+declare function apsRequestRefusal(request: any, options: any): "aps_url_refused" | "aps_body_unsupported" | "aps_saved_card_refused" | "aps_recurring_refused" | "aps_service_command_refused" | "aps_return_url_refused" | "aps_headers_refused" | null;
+declare function apsKeepsCardOnFile(body: any): boolean | null;
+declare function apsRequestFacts(request: any): Readonly<{
+    environment: any;
+    merchantIdentifier: any;
+    accessCodeSha256: string;
+    merchantReference: any;
+    returnUrl: any;
+    keepsCardOnFile: boolean;
+}> | null;
+declare var APS_MERCHANTS: any;
+declare var APS_MERCHANT_REFUSALS: readonly string[];
+declare function apsMerchantRefusal(facts: any, merchantOrigin: any, entries?: any): "aps_request_unreadable" | "aps_unsupported_environment" | "aps_merchant_unreviewed" | "aps_merchant_pending" | "aps_access_code_unreviewed" | "aps_return_url_unreviewed" | "aps_merchant_client_signed" | "aps_merchant_observe" | null;
+declare function apsMerchantPin(facts: any, merchantOrigin: any, entries?: any): any;
+declare var APS_TEST_PANS: Readonly<Set<unknown>>;
+declare function apsCardRefusal(environment: any, card: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | "invalid_expiry" | "invalid_security_code" | null;
+declare function isApsDeviceRequest(templateBody: any, deviceBody: any, environment: any): boolean;
+declare function apsDeviceRequest(request: any, card: any, options: any): {
+    url: any;
+    method: string;
+    headers: {
+        "content-type": string;
+        origin: string;
+    };
+    body: string;
+    where: string[];
+};
+declare var APS_TOKEN_RESPONSE_CODES: readonly string[];
+declare var APS_KEPT_CARD_CODES: readonly string[];
+declare var APS_REFUSAL_MESSAGES: readonly string[];
+declare var APS_ANSWER_REASONS: readonly string[];
+declare var APS_PAGE_CONTENT_TYPE: string;
+declare function apsScannedTexts(reply: any, template: any): any[] | null;
+declare function apsAnswerOutcome(reply: any, template: any, card: any, options: any): {
+    outcome: string;
+    reason: any;
+} | {
+    location?: any;
+    outcome: string;
+    shape: string | undefined;
+    body: any;
+    code?: undefined;
+} | {
+    outcome: string;
+    code: any;
+};
+declare function apsRefusalCode(bodyText: any): any;
+declare var isApsRefusalCode: (code: any) => boolean;
+export { APS_ANSWER_REASONS, APS_CAPABILITY, APS_CARD_FIELDS, APS_HOSTS, APS_KEPT_CARD_CODES, APS_MERCHANTS, APS_MERCHANT_REFUSALS, APS_OPERATION, APS_OPTIONAL_FIELDS, APS_PAGE_CONTENT_TYPE, APS_PSP, APS_REFUSAL_CODES, APS_REFUSAL_MESSAGES, APS_SIGNED_FIELDS, APS_TEST_PANS, APS_TOKENIZATION_PATH, APS_TOKEN_RESPONSE_CODES, apsAnswerOutcome, apsBodyRefusal, apsBodyVerdict, apsCardRefusal, apsDeviceRequest, apsEnvironment, apsKeepsCardOnFile, apsMerchantPin, apsMerchantRefusal, apsRefusalCode, apsRefusalMessage, apsRequestFacts, apsRequestRefusal, apsScannedTexts, apsTokenizationUrl, isApsDeviceRequest, isApsRefusalCode, isApsTokenizationUrl };