@agent-cards/sdk 0.23.23 → 0.23.25

package/dist/prepared-processor.d.ts

@@ -32,8 +32,13 @@
  * hipay: prepared only. The merchant's page gives HiPay's hosted fields 20 seconds after Pay, too soon for an
  * approval after Pay. Its environments are its two vault hosts: secure2-vault (production) and
  * stage-secure2-vault (sandbox).
+ *
+ * openpay_bbva: prepared only. openpay.js abandons its token create 40 seconds after Pay, too soon for an
+ * approval after Pay. Its environments are its API hosts: api.openpay.<mx|co|pe> (production) and
+ * sandbox-api.openpay.<mx|co|pe> (sandbox). The token URL names the merchant in its path, so no URL is
+ * prepared in advance: the claim binds the request by its host's environment and its shape, as ACI's.
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments' | 'paygent' | 'hipay';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments' | 'paygent' | 'hipay' | 'openpay_bbva';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -71,7 +76,8 @@ export declare function preparedApprovalAnswersRetry(psp: string): boolean;
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
  * sandbox-vault is test. So are Paygent's two token hosts: token is live, sandbox is test. So are
- * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test.
+ * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test. So are Openpay's API
+ * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**
@@ -83,8 +89,10 @@ export declare function validPreparationEnvironment(psp: string, environment: st
 export declare function aciPreparationUrl(environment: PreparationEnvironment): string;
 /**
  * A processor whose card request names an id the merchant mints only at Pay time (ACI's checkout
- * id), so no URL can be prepared in advance: whether the adapters can intercept it is asked of the
- * registry (VaultClient.recognizesProcessor), not of the prepared endpoint.
+ * id), or the merchant's own id (Openpay's token URL carries the merchant id in its path and the
+ * country in its host), so no URL can be prepared in advance: whether the adapters can intercept it
+ * is asked of the registry (VaultClient.recognizesProcessor), not of the prepared endpoint, which
+ * only names the preparation.
  */
 export declare function preparationBindsByShape(psp: string): boolean;
 /**

package/dist/prepared-processor.js

@@ -17,6 +17,7 @@ import { PADDLE_VGS_CARDS_URLS, isPreparedPaddleVgsRequest } from './paddle-vgs.
 import { WIX_PAYMENTS_TOKENIZE_URL, isPreparedWixPaymentsRequest } from './wix-payments.generated.js';
 import { paygentEnvironment, paygentPreparationUrl, paygentRequestRefusal } from './paygent.generated.js';
 import { HIPAY_TOKEN_URLS, hipayRequestRefusal, hipayTokenEnvironment, isPreparedHipayRequest } from './hipay.generated.js';
+import { OPENPAY_PREPARATION_URLS, isPreparedOpenpayRequest, openpayRequestRefusal, openpayTokenEnvironment } from './openpay.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -52,7 +53,8 @@ export function preparedApprovalAnswersRetry(psp) {
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
  * sandbox-vault is test. So are Paygent's two token hosts: token is live, sandbox is test. So are
- * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test.
+ * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test. So are Openpay's API
+ * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
@@ -61,7 +63,7 @@ export function validPreparationEnvironment(psp, environment) {
     if (psp === 'wix_payments')
         return environment === 'production';
     return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
-        'cybersource_secure_acceptance', 'paddle_vgs', 'paygent', 'hipay'].includes(psp) && ['production', 'sandbox'].includes(environment);
+        'cybersource_secure_acceptance', 'paddle_vgs', 'paygent', 'hipay', 'openpay_bbva'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -74,11 +76,13 @@ export function aciPreparationUrl(environment) {
 }
 /**
  * A processor whose card request names an id the merchant mints only at Pay time (ACI's checkout
- * id), so no URL can be prepared in advance: whether the adapters can intercept it is asked of the
- * registry (VaultClient.recognizesProcessor), not of the prepared endpoint.
+ * id), or the merchant's own id (Openpay's token URL carries the merchant id in its path and the
+ * country in its host), so no URL can be prepared in advance: whether the adapters can intercept it
+ * is asked of the registry (VaultClient.recognizesProcessor), not of the prepared endpoint, which
+ * only names the preparation.
  */
 export function preparationBindsByShape(psp) {
-    return psp === 'aci';
+    return psp === 'aci' || psp === 'openpay_bbva';
 }
 /**
  * The endpoint a CreditGuard preparation stands for, per environment, as the API advertises it: the
@@ -115,6 +119,11 @@ export function preparationEndpoint(psp, environment) {
     // HiPay: the token create on the environment's vault, the only URL the claim takes for it.
     if (psp === 'hipay')
         return HIPAY_TOKEN_URLS[environment];
+    // Openpay: the literal the API names (backend checkout-prepared-processor.ts), on the environment's Mexican host. It
+    // only names the preparation: its "prepared" is shorter than any merchant id, so no card request is ever sent to it,
+    // and the claim binds the real token URL by environment and shape (matchesPreparedRequest), as ACI's.
+    if (psp === 'openpay_bbva')
+        return OPENPAY_PREPARATION_URLS[environment];
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -286,6 +295,15 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     // bind with too.
     if (psp === 'hipay')
         return isPreparedHipayRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers ?? {});
+    // Openpay: a token URL on one of the environment's API hosts and payment-core's whole request rule (openpay.js's JSON
+    // Content-Type and Accept, one public key under Basic, every header named once, and the caller's token body member by
+    // member), the rule the API and the Vault bind with too. The token URL names the merchant in its path, so the claim
+    // never compares it with the prepared endpoint, which only names the preparation. The method as the page sent it, as
+    // the API reads it. Which merchant id and public key a live request may name is the API's to judge at the bind and the
+    // Vault's before it writes the card, against the reviewed pin each of them holds for the approved checkout origin, so a
+    // merchant a later release reviews needs no new build of this library.
+    if (psp === 'openpay_bbva')
+        return isPreparedOpenpayRequest(requestUrl, method, body ?? null, environment, headers ?? {});
     if (psp === 'creditguard')
         return matchesPreparedCreditguard(environment, requestUrl, body, headers, binding);
     // A Verifone request is judged only through the profile its preparation names (matchesPreparation).
@@ -453,6 +471,14 @@ export function preparedRequestRefusal(psp, environment, requestUrl, body, heade
             return 'checkout_changed';
         return hipayRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
     }
+    // An Openpay token create on one of the prepared environment's API hosts names what payment-core's request rule
+    // refused (openpay_headers_refused, openpay_body_unsupported); another environment's host, a group's or a customer's
+    // path, a query, or any other request is `checkout_changed`.
+    if (psp === 'openpay_bbva') {
+        if (openpayTokenEnvironment(requestUrl) !== environment)
+            return 'checkout_changed';
+        return openpayRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
+    }
     if (psp !== 'amadeus_checkout' || amadeusEnvironment(requestUrl) !== environment)
         return 'checkout_changed';
     const merchantHost = merchantHostOf(merchantOrigin);

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: cd9e71f205ba2b11824dd49d5dd2fb4ebd67f5bb0c38dfe974bbace93f7b018b
+// artifact-sha256: 12785bf93affbf72e1c0f5b4a8b3dedecab36a87d1bfa2c16405bffa841432c6
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -3569,11 +3569,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var BODY_LIMIT22 = 8192;
@@ -4623,7 +4623,8 @@ function toastBodyVerdict(body) {
 // src/fastspring.js
 var FASTSPRING_PSP = "fastspring";
 var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
-    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" }),
+    Object.freeze({ environment: "production", store: "stardock", storefront: "/popup-store", merchant: "Stardock" })
 ]);
 var URL_LIMIT11 = 256;
 var BODY_LIMIT28 = 32768;

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7d433d016a6cb47bb9d1cf22ab63bf41d3d67091d68a23e2d3c8885dbfa98b43
+// artifact-sha256: d0cb72d4119895f1fa8110ae4048be399964c6ab62814a11527cc163b8cb70cd
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -3344,11 +3344,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
@@ -3480,7 +3480,8 @@ var CARDCOM_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
 // src/fastspring.js
 var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
-    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" }),
+    Object.freeze({ environment: "production", store: "stardock", storefront: "/popup-store", merchant: "Stardock" })
 ]);
 var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
 var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);

package/dist/tap-payments.d.ts

@@ -0,0 +1,43 @@
+/** The PSP id the API and the recognizer name this lane, re-exported so the client dispatches by it. */
+export { TAP_PAYMENTS_PSP } from './tap-payments.generated.js';
+/** The dark-launch capability a build declares when it fills a Tap token request with the device's ciphertext. */
+export declare const TAP_PAYMENTS_CAPABILITY = "tap_card_sdk_token";
+/** A cse substitution as the API serves it (substitute.ts Substitutions): here the one ciphertext. */
+interface TapPaymentsServedSubstitution {
+    encoding: string;
+    at: string;
+    fields: Record<string, string>;
+    remove?: string[];
+}
+/**
+ * Whether an approved Tap authorization's served substitution is one this SDK can continue: JSON at the body root (`at`
+ * is ''), no sibling to remove, and exactly the one ciphertext, a non-empty string. substituteTapPayments checks its
+ * size and range against the pin for the request's publishable key; this is the shape gate the client runs first.
+ */
+export declare function isTapPaymentsServedSubstitution(sub: unknown): sub is TapPaymentsServedSubstitution;
+/** The paused request an approval was created from: the URL and body the API reviewed at create, and its headers. */
+export interface TapPaymentsApprovedRequest {
+    url: string;
+    body: string;
+    headers?: Record<string, string>;
+}
+/**
+ * The continuation of an approved Tap token request: the paused body with the device's ciphertext written over the
+ * placeholder's at encryptedData (payment-core substituteTapPayments, which runs the frame's request rule again on the
+ * headers of the request that continues, and refuses a ciphertext that does not have the size and range of one under
+ * the pin for its publishable key, or one already in the paused body).
+ *
+ * Only into `approved`, the paused request the approval was created from: `url` and `body` must equal it byte for byte.
+ * A ciphertext under the merchant's key would ask Tap for a token in any later request of the same shape; binding it
+ * to the one request keeps this lane from ever writing one checkout's card into another. `headers` are those of the
+ * request that continues, the paused one or the page's retry of it, and the browser sends them as they are: they
+ * must name the publishable key the approved request named, so a retry under another merchant's key never carries the
+ * card.
+ *
+ * Null when neither URL is Tap's token URL, so every other processor keeps its own swap. Throws for any other body,
+ * URL or key, and for a substitution the shape gate or the swap refuses, in each case before anything continues. The
+ * approval is not retired on a refusal: the runtime already read the ciphertext, so the API keeps the row and its hold.
+ */
+export declare function tapPaymentsContinuation(url: string, body: string, headers: Record<string, string> | undefined, sub: unknown, approved: TapPaymentsApprovedRequest): {
+    body: string;
+} | null;

package/dist/tap-payments.generated.d.ts

@@ -0,0 +1,59 @@
+declare var TAP_PAYMENTS_PSP: string;
+declare var TAP_PAYMENTS_CAPABILITY: string;
+declare var TAP_PAYMENTS_OPERATION: string;
+declare var TAP_PAYMENTS_SCHEME: string;
+declare var TAP_PAYMENTS_HOST: string;
+declare var TAP_PAYMENTS_TOKEN_URL: string;
+declare var TAP_PAYMENTS_FIELD: string;
+declare var TAP_PAYMENTS_PURPOSES: readonly string[];
+declare var TAP_PAYMENTS_REFUSAL_CODES: readonly string[];
+declare function tapPaymentsRefusalMessage(code: any): any;
+declare var TapPaymentsError: {
+    new (code: any): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+    };
+};
+declare function isTapPaymentsTokenUrl(url: any): boolean;
+declare function tapPaymentsKeyEnvironment(publishableKey: any): "production" | "sandbox" | null;
+declare var TAP_PAYMENTS_MERCHANT_PINS: readonly any[];
+declare function tapPaymentsMerchantPin(publishableKey: any, pins?: readonly any[]): any;
+declare function tapPaymentsMerchantRefusal(environment: any, publishableKey: any, merchantOrigin: any, pins?: readonly any[]): "tap_payments_merchant_unreviewed" | null;
+declare function isTapPaymentsCiphertext(value: any): boolean;
+declare function tapPaymentsBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function tapPaymentsOrderAmount(body: any): Readonly<{
+    amount: any;
+    currency: any;
+}> | null;
+declare function tapPaymentsRequestKey(request: any): any;
+declare function tapPaymentsRequestRefusal(request: any): any;
+declare function tapPaymentsPlaintext(card: any): string;
+declare function encryptTapPaymentsCard(card: any, publishableKey: any, facilities?: {}): Readonly<{
+    encryptedData: string;
+}>;
+declare function isTapPaymentsCiphertextUnderPin(value: any, merchantPin: any): boolean;
+declare function substituteTapPayments(request: any, substitution: any): string;
+declare function tapPaymentsSubstitutionsRefusal(template: any, substitution: any): {
+    code: string;
+    message: any;
+} | null;
+declare function tapPaymentsKeyUsable(authorization: any): boolean;
+declare function tapPaymentsRefusalCode(text: any): string | null;
+declare function tapPaymentsAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: any;
+} | {
+    outcome: string;
+    code: string;
+} | {
+    outcome: string;
+    code?: undefined;
+};
+export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsSubstitutionsRefusal };