@agent-cards/sdk 0.23.24 → 0.23.26

package/dist/cdp.js

@@ -25,6 +25,7 @@ import { isArmedEkashuUrl } from './ekashu.js';
 import { isArmedTransbankUrl, transbankMerchantReturn, transbankMerchantReturnAnswer } from './transbank.js';
 import { isArmedRedsysUrl } from './redsys.js';
 import { isArmedPrzelewy24Url } from './przelewy24.js';
+import { isArmedBarionUrl } from './barion.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
 import { COMGATE_CARD_PATTERNS, isArmedComgateUrl, servesComgate } from './comgate.js';
 import { isArmedEximbayUrl } from './eximbay.js';
@@ -3980,6 +3981,9 @@ export async function attachToPlaywright(page, opts) {
             // the hosts: the card method's post, the card form's post and the Saferpay resolver reach the Przelewy24
             // gate and fail.
             || isArmedPrzelewy24Url(opts.vault, url.toString())
+            // Every request to Barion's gateway hosts once its entry is served (barion.ts), as attachToCdp arms the hosts:
+            // the gateway's email check, card posts and 3-D Secure post reach the Barion gate and fail.
+            || isArmedBarionUrl(opts.vault, url.toString())
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
             || isArmedEkashuUrl(opts.vault, url.toString())

package/dist/client.d.ts

@@ -499,6 +499,48 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `nexi_checkout_pay`: the card payment Nexi Checkout's card frame (checkout.dibspayment.eu/v1/, formerly Nets
+ * Easy) posts as JSON to its own pay endpoint, https://checkout.dibspayment.eu/api/v1/pay (the test host for a
+ * test row), under the merchant's checkout key and the payment's id. This build pauses only the card form's own
+ * body at that exact URL ("save my card", "remember me" and a card fee are refused at the pause, and the frame's
+ * card lookup while the number is typed continues untouched); the cardholder's device reads Nexi's own record of the
+ * payment and sends the card through the checkout relay, and the frame gets Nexi's answer as payment-core's judge
+ * rebuilt it: the payment done, or Nexi's 3-D Secure step, which the frame then runs in the agent's browser. The
+ * body names the payment's amount in minor units but not its currency, so the agent's pair, above zero, is the one
+ * the cardholder approves, and the API holds its amount to the body's. Served on the same terms: only to a build
+ * that lists it, for a company Agentcard turned Nexi Checkout on for.
+ *
+ * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
+ * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose email check, card posts and 3-D Secure post this build never lets the agent's browser
+ * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
+ * lists it, for a company Agentcard turned Barion on for.
+ *
+ * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
+ * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
+ * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the
+ * card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card,
+ * pays in installments, splits, converts or names a Paymob account, and a payment key that enrolls
+ * a subscription or names no amount are refused at the pause, and another method's payment with no
+ * card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the
+ * payment to Paymob itself with the real card, and the checkout gets Paymob's answer as payment-core's
+ * judge rebuilt it. The payment key names the amount and currency, so an agent pair is optional and
+ * the API holds one to the key's figure. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Paymob on for.
+ *
+ * `payu_latam_webcheckout_card`: the card submit PayU Latam's WebCheckout page posts to
+ * checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>
+ * (sandbox.checkout.payulatam.com on PayU's test platform). This build pauses only the card form's
+ * own submit at that exact URL (a ticked save-my-card box, a card PayU saved, installments and a
+ * test order on the live host are refused at the pause); the cardholder's device writes the real
+ * card into the paused body and sends it to PayU itself, and the page gets PayU's answer as
+ * payment-core's judge reads it. The page's BIN lookup (checkout/card_info/) carries the typed
+ * placeholder and continues, as the page needs its answer to fill the card's facts. The submit's
+ * copy of the order is the browser's, so the agent's pair, above zero, is the one the cardholder
+ * approves, which the API holds to the order PayU reads back. Served on the same terms: only to a
+ * build that lists it, for a company Agentcard turned PayU Latam on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];

package/dist/client.js

@@ -492,6 +492,48 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `nexi_checkout_pay`: the card payment Nexi Checkout's card frame (checkout.dibspayment.eu/v1/, formerly Nets
+ * Easy) posts as JSON to its own pay endpoint, https://checkout.dibspayment.eu/api/v1/pay (the test host for a
+ * test row), under the merchant's checkout key and the payment's id. This build pauses only the card form's own
+ * body at that exact URL ("save my card", "remember me" and a card fee are refused at the pause, and the frame's
+ * card lookup while the number is typed continues untouched); the cardholder's device reads Nexi's own record of the
+ * payment and sends the card through the checkout relay, and the frame gets Nexi's answer as payment-core's judge
+ * rebuilt it: the payment done, or Nexi's 3-D Secure step, which the frame then runs in the agent's browser. The
+ * body names the payment's amount in minor units but not its currency, so the agent's pair, above zero, is the one
+ * the cardholder approves, and the API holds its amount to the body's. Served on the same terms: only to a build
+ * that lists it, for a company Agentcard turned Nexi Checkout on for.
+ *
+ * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
+ * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose email check, card posts and 3-D Secure post this build never lets the agent's browser
+ * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
+ * lists it, for a company Agentcard turned Barion on for.
+ *
+ * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
+ * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
+ * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the
+ * card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card,
+ * pays in installments, splits, converts or names a Paymob account, and a payment key that enrolls
+ * a subscription or names no amount are refused at the pause, and another method's payment with no
+ * card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the
+ * payment to Paymob itself with the real card, and the checkout gets Paymob's answer as payment-core's
+ * judge rebuilt it. The payment key names the amount and currency, so an agent pair is optional and
+ * the API holds one to the key's figure. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Paymob on for.
+ *
+ * `payu_latam_webcheckout_card`: the card submit PayU Latam's WebCheckout page posts to
+ * checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>
+ * (sandbox.checkout.payulatam.com on PayU's test platform). This build pauses only the card form's
+ * own submit at that exact URL (a ticked save-my-card box, a card PayU saved, installments and a
+ * test order on the live host are refused at the pause); the cardholder's device writes the real
+ * card into the paused body and sends it to PayU itself, and the page gets PayU's answer as
+ * payment-core's judge reads it. The page's BIN lookup (checkout/card_info/) carries the typed
+ * placeholder and continues, as the page needs its answer to fill the card's facts. The submit's
+ * copy of the order is the browser's, so the agent's pair, above zero, is the one the cardholder
+ * approves, which the API holds to the order PayU reads back. Served on the same terms: only to a
+ * build that lists it, for a company Agentcard turned PayU Latam on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;
@@ -595,6 +637,8 @@ export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;
  * create route's refusal, not in this comment.
  */
 const REVOLUT_PSP = 'revolut';
+/** Nexi Checkout's card payment names the payment's amount in minor units but not its currency, as Revolut's does. */
+const NEXI_CHECKOUT_PSP = 'nexi_checkout';
 const AGENT_AMOUNT_PROCESSORS = AGENT_AMOUNT.processors;
 /** The ones a zero amount is refused for, like a missing one (authorize()). */
 const ABOVE_ZERO_PROCESSORS = AGENT_AMOUNT.aboveZero;
@@ -881,7 +925,7 @@ export class AmountRequiredError extends Error {
     constructor(psp) {
         const processor = PROCESSOR_NAMES[psp] ?? psp;
         // A Payrexx card request names the frame's total, but the merchant's page charges its own total after the token.
-        const lacks = psp === REVOLUT_PSP ? 'names its amount but not its currency'
+        const lacks = psp === REVOLUT_PSP || psp === NEXI_CHECKOUT_PSP ? 'names its amount but not its currency'
             : psp === PAYREXX_PSP ? "only mints a token the merchant's page charges later"
                 : psp === TAP_PAYMENTS_PSP ? 'does not decide the amount charged' : 'names no amount';
         // "An Omise payment request", "A Clover payment request": the article follows the name's first letter.

package/dist/hosted-entry.js

@@ -17,10 +17,12 @@
 import { PRZELEWY24_PSP, isPrzelewy24EntryUrl } from './przelewy24.js';
 import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
 import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
+import { BARION_PSP, isBarionEntryUrl } from './barion.js';
 const HOSTED_GET_ENTRIES = new Map([
     [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
     [COMGATE_PSP, isComgateEntryUrl],
     [TRANSBANK_PSP, isTransbankEntryUrl],
+    [BARION_PSP, isBarionEntryUrl],
 ]);
 /** Whether this processor's hosted page is entered with a GET this build reads exactly. */
 export function hasHostedGetEntry(psp) {

package/dist/pre-claim.d.ts

@@ -279,6 +279,7 @@ export declare function isArmedCreditguardCall(vault: {
     recognizesProcessor?(psp: string): boolean;
 } | undefined, url: string): boolean;
 export declare const przelewy24PreClaim: PreClaimGate;
+export declare const barionPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const transbankPreClaim: PreClaimGate;
 export declare const paytrailPreClaim: PreClaimGate;

package/dist/pre-claim.js

@@ -85,6 +85,7 @@ import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { isArmedTransbankUrl } from './transbank.js';
 import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
 import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
+import { isArmedBarionUrl, isBarionPayStep } from './barion.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
 import { isArmedComgateUrl } from './comgate.js';
 import { isArmedEximbayUrl, isEximbayEntry } from './eximbay.js';
@@ -1663,6 +1664,22 @@ export const przelewy24PreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// Barion's Smart Gateway (barion.ts). Once this build's registry serves Barion's entry (a capability the API serves
+// only to a company Agentcard turned Barion on for), every request to the gateway's two hosts pauses. The merchant's
+// entry, a GET of /Pay?Id=<payment id> exactly, is no step of this gate's: it defers, and the terminal arbiter pauses
+// it for the claim flow like any card request, so the cardholder's device pays it. Every step toward paying on the
+// gateway itself aborts as an unsupported checkout: every POST there (the email check, the card's two posts, the 3-D
+// Secure post, any form the gateway posts). So Barion never sees the card the agent typed. The agent's browser only
+// reaches the gateway when the entry was not paused (an attachment made too late, say), and then only the cardholder's
+// device can pay. The gateway's own pages, scripts, images and 3-D Secure frames are GETs this gate leaves to
+// continue. With Barion not served, the gate defers, and every request continues as before. Synchronous until it
+// must abort, like every gate. Exported for the gate registry's tests.
+export const barionPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isBarionPayStep(url, method) || !isArmedBarionUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -2482,7 +2499,7 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, paypalHostedFieldsPreClaim,
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.