@agent-cards/sdk 0.23.25 → 0.23.26

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d0cb72d4119895f1fa8110ae4048be399964c6ab62814a11527cc163b8cb70cd
+// artifact-sha256: e87510bfa2a9dbf91e4d234b93c0500d2ac2cc3c1bcdf0e21461346f24f5d25e
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -2743,8 +2743,8 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // by name. The endpoint answers no browser origin, so the card leaves the cardholder's device only through the
         // checkout relay, and only the frame's four session headers ride beside the card. test.checkout.dibspayment.eu is
         // Nexi's test environment: pinned (S7) to test rows, which send only Nexi's published test cards.
-        // Ships dark: served only to a client that declares `nexi_checkout_pay`, gated off for every org until an operator
-        // lists one (`nexi_checkout:<org>`), and autopilot never sends this request (autopilot.js
+        // Ships dark: served only to a client that declares `nexi_checkout_pay`, and only for the one company the API's gate
+        // names in its code (backend config.ts NEXI_CHECKOUT_PROOF_ORG), and autopilot never sends this request (autopilot.js
         // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
         capability: "nexi_checkout_pay",
         match: "(?:test\\.)?checkout\\.dibspayment\\.eu/api/v1/pay(?![\\w/.%-])",
@@ -3027,6 +3027,35 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: ["^accept$"],
         jsonCardFields: [["checkoutCreditCard", "number"]]
     },
+    {
+        psp: "pin_payments",
+        // Pin Payments (Australia and New Zealand, a Fat Zebra company). Both of Pin's browser libraries send the card
+        // to Pin's cards API, which answers with a card token the merchant's server charges afterwards: Hosted Fields
+        // from its control frame on cdn.pinpayments.com, Pin.js from the merchant's page. One JSON POST to exactly
+        // https://api.pinpayments.com/1/cards (test-api.pinpayments.com on Pin's test API): the merchant's publishable
+        // key, any billing address, and the card at the root as name, number, cvc, expiry_month and expiry_year,
+        // unencrypted. pin-payments.js holds the request rule the pause decision, the API's create and the device all
+        // read: exactly that URL, a JSON Content-Type, and the card fields' body with nothing the cards API does not
+        // document beside the card. The body names the merchant's Pin account, by its publishable key, but no amount, so a
+        // live request is taken only under a key a reviewed pin names. The cards API answers any origin, so the
+        // cardholder's device sends the card itself, with no relay. The hosted Payment Page (pay.pinpayments.com) and the
+        // JSONP form (/1/cards.json) are other requests, which `match` leaves out. test-api.pinpayments.com is Pin's test
+        // API: pinned (S7) to test rows, which send only Pin's test cards.
+        // Ships dark: served only to a client that declares `pin_payments_card_token`, gated off for every org until an
+        // operator lists one (`pin_payments:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` keeps the JSONP form and a card's own record (/1/cards/<token>)
+        // out of `match`; every consumer anchors it, and recognition.js takes only the exact URL (isPinPaymentsCardUrl).
+        capability: "pin_payments_card_token",
+        match: "(?:test-)?api\\.pinpayments\\.com/1/cards(?![\\w/.%-])",
+        hosts: ["^api\\.pinpayments\\.com$", "^test-api\\.pinpayments\\.com$"],
+        sandboxHosts: ["^test-api\\.pinpayments\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // Pin's own attribution header and the JSON Accept ride as the card fields sent them; origin, referer and
+        // cookies never do.
+        passthroughHeaders: ["^x-pin-origin$", "^accept$"],
+        jsonCardFields: [["number"]]
+    },
     // Every processor registered since this list froze, in id order (registry.js).
     ...REGISTERED_DEFINITIONS
 ]);
@@ -3274,32 +3303,6 @@ var ANSWER_LIMIT = 64 * 1024;
 var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
 var OPTIONAL_KEYS = /* @__PURE__ */ Object.freeze(["address_line1", "phone_numbers", "email_address", "name", "address_zip"]);
 var CARD_ORDER = /* @__PURE__ */ Object.freeze([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
-// src/tap-payments.js
-var pin7 = (fields) => Object.freeze({
-    ...fields,
-    origins: Object.freeze([...fields.origins]),
-    sessions: Object.freeze({ ...fields.sessions }),
-    key: Object.freeze({ ...fields.key })
-});
-var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin7({
-        id: "casefilegame",
-        merchant: "Casefilegame",
-        tapMerchantId: "67977048",
-        publishableKey: "pk_live_ydlRjrWcLXaVvpsSBQKOie86",
-        environment: "production",
-        origins: ["https://checkout.tap.company"],
-        // The WooCommerce plugin's redirect (Plugin-WooCommerce-All-in-one tap.php 567-586, read 2026-10-17)
-        // creates the src_all charge with save_card false and names no agreement, subscription or destinations.
-        sessions: { saveCard: false, agreement: false, subscription: false, destinations: false },
-        key: {
-            spki: "MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAzja2vB+Iyafj2Mm3pFg65z7Yvj9ZeoFLdMBgWFyyjF020r5HSPKVhuZ39uJkjs0U/kWgEpKDzHZAKdtGv36dS33NjMAzYpgFkD8j+9/YWqpvAGRj5nv1b/q7NaiZk3b1wm7aXHJOx5L6rPQf2qDQxhcSNHocU+Uy8wGmGxRRu6QRKN3khaz4o4jJDzqxns4h/ShzHjdZeWIVfpCAyVoED0IESBYrvGEhJeyKnga5XdHdBU2yP8P1huO4RbSKcZv00ZgxVHAQQ9CqArW3TE8SyLLnJPkSpSHHBnIPSQS1z3ld1mImy/zqTd4ltkV6XHpYqVvoPmys2EuZX3pMvCcPGwIBEQ==",
-            sha256: "6eb4e89a1e05a06a39d631f6fb450c052a9cad9935edc1921e84e80207470552",
-            // The shared parser takes exponent 17 only under a pin that names it (rsa-pkcs1v15.js).
-            exponent: 17
-        }
-    })
-]);
 // src/conekta.js
 var LETTERS = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
 var PAGE_NAME = new RegExp(`^[${LETTERS} .'-]{1,64}$`);
@@ -3431,9 +3434,9 @@ var PAGE_NAME2 = new RegExp(`^[${LETTERS2} .'-]{1,64}$`);
 var HAS_LETTER2 = new RegExp(`[${LETTERS2}]`);
 var ADDRESS_VALUE2 = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
 var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
-var pin8 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
+var pin7 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
 var OPENPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin8({
+    pin7({
         id: "diario_de_yucatan",
         merchant: "Diario de Yucatán",
         origins: ["https://www.yucatan.com.mx"],
@@ -3447,15 +3450,15 @@ var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var NONCE_URL = new RegExp(`^https://services\\.poynt\\.net/v1/commerce/stores/(${UUID})/payment-tokens/generate-nonce$`);
 var STORE_ID = new RegExp(`^${UUID}$`);
 var APPLICATION_ID = new RegExp(`^urn:aid:${UUID}$`);
-var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
+var pin8 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
 var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin9({
+    pin8({
         id: "yearning_for_learning",
         merchant: "Yearning for Learning Publishing & Coaching",
         origins: ["https://ff305485-ba6c-423a-87b0-cebe3f83ffe9.mysimplestore.com"],
         storeIds: ["71ac12ed-e61f-4318-95db-db0e7c649d6f"]
     }),
-    pin9({
+    pin8({
         id: "timber_ridge_bookkeeping",
         merchant: "Timber Ridge Bookkeeping",
         origins: ["https://d7d64ac3-0352-4e53-af9a-f6d8e7b5fb71.mysimplestore.com"],
@@ -3486,11 +3489,11 @@ var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
 var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
 var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
 // src/omise.js
-var pin10 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
+var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
 var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin10({ id: "taejai", merchant: "Taejai", origins: ["https://taejai.com"], keys: ["pkey_53q6mm66esjr563ob0h"] }),
-    pin10({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
-    pin10({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
+    pin9({ id: "taejai", merchant: "Taejai", origins: ["https://taejai.com"], keys: ["pkey_53q6mm66esjr563ob0h"] }),
+    pin9({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
+    pin9({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
 ]);
 // src/payu-latam.js
 var PAYU_LATAM_HOSTS = /* @__PURE__ */ Object.freeze({
@@ -3645,6 +3648,33 @@ var RECORD_MEMBERS = /* @__PURE__ */ Object.freeze({
         "EXTRA4"
     ]
 });
+// src/pin-payments.js
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["name", "number", "cvc", "expiry_month", "expiry_year"]);
+var ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
+    "address_line1",
+    "address_line2",
+    "address_city",
+    "address_postcode",
+    "address_state",
+    "address_country"
+]);
+var KEY = "publishable_api_key";
+var METHOD = "_method";
+var DOCUMENTED = /* @__PURE__ */ new Set([KEY, METHOD, ...CARD_KEYS, ...ADDRESS_KEYS]);
+var TOKEN_FACTS = /* @__PURE__ */ Object.freeze([
+    "token",
+    "scheme",
+    "display_number",
+    "issuing_country",
+    "expiry_month",
+    "expiry_year",
+    "name",
+    ...ADDRESS_KEYS,
+    "network_type",
+    "network_format",
+    "customer_token",
+    "primary"
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -3787,7 +3817,7 @@ var REQUIRED = Object.freeze([
     "ekashu_failure_url",
     "ekashu_callback_success_url"
 ]);
-var CARD_KEYS = Object.freeze([
+var CARD_KEYS2 = Object.freeze([
     "ekashu_card_number",
     "ekashu_expires_end_month",
     "ekashu_expires_end_year",
@@ -4107,13 +4137,13 @@ var DECLINE_CODES = Object.freeze([
 ]);
 var FRICTIONLESS_STATUSES = Object.freeze([0, 5, 7]);
 // src/sbps.js
-var pin11 = (fields) => /* @__PURE__ */ Object.freeze({
+var pin10 = (fields) => /* @__PURE__ */ Object.freeze({
     ...fields,
     origins: Object.freeze([...fields.origins]),
     accounts: Object.freeze(fields.accounts.map((account) => Object.freeze({ ...account })))
 });
 var SBPS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    /* @__PURE__ */ pin11({
+    /* @__PURE__ */ pin10({
         id: "boss_ezo_fukuoka",
         merchant: `BOSS E${ /* @__PURE__ */String.fromCharCode(12539)}ZO FUKUOKA`,
         origins: ["https://ticket.e-zofukuoka.com"],
@@ -4205,7 +4235,7 @@ var replayPolicy = Object.freeze({ contentTypeFor, HEADER_NEVER_FORWARD });
 var STRIPE_CHECKOUT_OPERATION = "stripe.device_checkout_confirm.v1";
 var STRIPE_CHECKOUT_CONTEXT_HEADER = "x-agentcard-stripe-checkout-context";
 var SESSION = /^cs_(?:test|live)_[A-Za-z0-9]{1,200}(?![\s\S])/;
-var KEY = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
+var KEY2 = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
 var SYNTHETIC = /^pm_agentcard_checkout_[A-Za-z0-9_-]{16,80}(?![\s\S])/;
 var STRIPE_CHECKOUT_VALIDATION_CODES = Object.freeze({
     unclassified: "unclassified",
@@ -4248,7 +4278,7 @@ function validateStripeCheckoutIdentity(value) {
         reject("mode_binding");
     const environment = value.environment ?? "test", livemode = environment === "production";
     const mode = livemode ? "live" : "test";
-    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
+    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY2.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
         reject("mode_binding");
     return Object.freeze({ environment, livemode });
 }
@@ -4452,7 +4482,7 @@ function keyFor(request, values, expected) {
         headerKey = match[1];
     }
     const key = values.get("key") || headerKey;
-    if (!KEY.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
+    if (!KEY2.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
         reject("publishable_key");
     return key;
 }

package/dist/tap-payments.generated.d.ts

@@ -18,9 +18,9 @@ declare var TapPaymentsError: {
 };
 declare function isTapPaymentsTokenUrl(url: any): boolean;
 declare function tapPaymentsKeyEnvironment(publishableKey: any): "production" | "sandbox" | null;
-declare var TAP_PAYMENTS_MERCHANT_PINS: readonly any[];
-declare function tapPaymentsMerchantPin(publishableKey: any, pins?: readonly any[]): any;
-declare function tapPaymentsMerchantRefusal(environment: any, publishableKey: any, merchantOrigin: any, pins?: readonly any[]): "tap_payments_merchant_unreviewed" | null;
+declare var TAP_PAYMENTS_MERCHANT_PINS: readonly never[];
+declare function tapPaymentsMerchantPin(publishableKey: any, pins?: readonly never[]): null;
+declare function tapPaymentsMerchantRefusal(environment: any, publishableKey: any, merchantOrigin: any, pins?: readonly never[]): "tap_payments_merchant_unreviewed" | null;
 declare function isTapPaymentsCiphertext(value: any): boolean;
 declare function tapPaymentsBodyVerdict(body: any): Readonly<{
     verdict: "refuse";
@@ -33,18 +33,19 @@ declare function tapPaymentsOrderAmount(body: any): Readonly<{
     currency: any;
 }> | null;
 declare function tapPaymentsRequestKey(request: any): any;
-declare function tapPaymentsRequestRefusal(request: any): any;
+declare function tapPaymentsRequestRefusal(request: any, pins?: readonly never[]): any;
 declare function tapPaymentsPlaintext(card: any): string;
-declare function encryptTapPaymentsCard(card: any, publishableKey: any, facilities?: {}): Readonly<{
+declare function encryptTapPaymentsCard(card: any, publishableKey: any, facilities?: {}, pins?: readonly never[]): Readonly<{
     encryptedData: string;
 }>;
 declare function isTapPaymentsCiphertextUnderPin(value: any, merchantPin: any): boolean;
-declare function substituteTapPayments(request: any, substitution: any): string;
-declare function tapPaymentsSubstitutionsRefusal(template: any, substitution: any): {
+declare function substituteTapPayments(request: any, substitution: any, pins?: readonly never[]): string;
+declare function tapPaymentsSubstitutionsRefusal(template: any, substitution: any, pins?: readonly never[]): {
     code: string;
     message: any;
 } | null;
-declare function tapPaymentsKeyUsable(authorization: any): boolean;
+declare function tapPaymentsKeyUsable(authorization: any, pins?: readonly never[]): boolean;
+declare function tapPaymentsRowUsable(authorization: any, pins?: readonly never[]): boolean;
 declare function tapPaymentsRefusalCode(text: any): string | null;
 declare function tapPaymentsAnswerOutcome(status: any, text: any, card: any): {
     outcome: string;
@@ -56,4 +57,4 @@ declare function tapPaymentsAnswerOutcome(status: any, text: any, card: any): {
     outcome: string;
     code?: undefined;
 };
-export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsSubstitutionsRefusal };
+export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsRowUsable, tapPaymentsSubstitutionsRefusal };

package/dist/tap-payments.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 25bf499d00df8220a58e6f28f22522db1f7a4048dcdbd95ad321614df5b68b6d
+// artifact-sha256: 06fe191e76a7d298c2cb35a4b370760894dc5a48bd8d1c920db8510b73f2e62b
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -152,13 +152,13 @@ var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
-    const pin2 = key && typeof key === "object" ? key.sha256 : void 0;
+    const pin = key && typeof key === "object" ? key.sha256 : void 0;
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
-    if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
+    if (typeof pin !== "string" || !SHA256_HEX.test(pin))
         throw refuse("key");
     let binary;
     try {
@@ -170,7 +170,7 @@ function parseRsaPublicKey(key) {
     if (btoa(binary) !== spki)
         throw refuse("key");
     const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-    if (sha256Hex(der) !== pin2)
+    if (sha256Hex(der) !== pin)
         throw refuse("key");
     const outer = readElement(der, 0, 48);
     if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
@@ -570,31 +570,7 @@ function tapPaymentsKeyEnvironment(publishableKey) {
         return null;
     return match[1] === "live" ? "production" : "sandbox";
 }
-var pin = (fields) => Object.freeze({
-    ...fields,
-    origins: Object.freeze([...fields.origins]),
-    sessions: Object.freeze({ ...fields.sessions }),
-    key: Object.freeze({ ...fields.key })
-});
-var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin({
-        id: "casefilegame",
-        merchant: "Casefilegame",
-        tapMerchantId: "67977048",
-        publishableKey: "pk_live_ydlRjrWcLXaVvpsSBQKOie86",
-        environment: "production",
-        origins: ["https://checkout.tap.company"],
-        // The WooCommerce plugin's redirect (Plugin-WooCommerce-All-in-one tap.php 567-586, read 2026-10-17)
-        // creates the src_all charge with save_card false and names no agreement, subscription or destinations.
-        sessions: { saveCard: false, agreement: false, subscription: false, destinations: false },
-        key: {
-            spki: "MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAzja2vB+Iyafj2Mm3pFg65z7Yvj9ZeoFLdMBgWFyyjF020r5HSPKVhuZ39uJkjs0U/kWgEpKDzHZAKdtGv36dS33NjMAzYpgFkD8j+9/YWqpvAGRj5nv1b/q7NaiZk3b1wm7aXHJOx5L6rPQf2qDQxhcSNHocU+Uy8wGmGxRRu6QRKN3khaz4o4jJDzqxns4h/ShzHjdZeWIVfpCAyVoED0IESBYrvGEhJeyKnga5XdHdBU2yP8P1huO4RbSKcZv00ZgxVHAQQ9CqArW3TE8SyLLnJPkSpSHHBnIPSQS1z3ld1mImy/zqTd4ltkV6XHpYqVvoPmys2EuZX3pMvCcPGwIBEQ==",
-            sha256: "6eb4e89a1e05a06a39d631f6fb450c052a9cad9935edc1921e84e80207470552",
-            // The shared parser takes exponent 17 only under a pin that names it (rsa-pkcs1v15.js).
-            exponent: 17
-        }
-    })
-]);
+var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([]);
 var SESSION_REVIEW = /* @__PURE__ */ Object.freeze(["saveCard", "agreement", "subscription", "destinations"]);
 var keepsNoCard = (entry) => record(entry.sessions) && SESSION_REVIEW.every((key) => entry.sessions[key] === false);
 function tapPaymentsMerchantPin(publishableKey, pins = TAP_PAYMENTS_MERCHANT_PINS) {
@@ -605,7 +581,7 @@ function tapPaymentsMerchantPin(publishableKey, pins = TAP_PAYMENTS_MERCHANT_PIN
 }
 function tapPaymentsMerchantRefusal(environment, publishableKey, merchantOrigin, pins = TAP_PAYMENTS_MERCHANT_PINS) {
     const found = tapPaymentsMerchantPin(publishableKey, pins);
-    if (!found || found.environment !== environment || typeof merchantOrigin !== "string" || !found.origins.includes(merchantOrigin)) {
+    if (!found || found.environment !== environment || typeof merchantOrigin !== "string" || !Array.isArray(found.origins) || !found.origins.includes(merchantOrigin)) {
         return "tap_payments_merchant_unreviewed";
     }
     return null;
@@ -770,7 +746,7 @@ function namesPinnedMerchant(body, merchantPin) {
     const id = body.merchant.id;
     return (typeof id === "number" && Number.isSafeInteger(id) ? String(id) : id) === merchantPin.tapMerchantId;
 }
-function tapPaymentsRequestRefusal(request) {
+function tapPaymentsRequestRefusal(request, pins = TAP_PAYMENTS_MERCHANT_PINS) {
     if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
         return "tap_payments_url_refused";
     if (!isTapPaymentsTokenUrl(request.url))
@@ -783,7 +759,7 @@ function tapPaymentsRequestRefusal(request) {
     const verdict = tapPaymentsBodyVerdict(request.body);
     if (verdict.verdict !== "card")
         return verdict.code;
-    const merchantPin = tapPaymentsMerchantPin(publishableKey);
+    const merchantPin = tapPaymentsMerchantPin(publishableKey, pins);
     return merchantPin && namesPinnedMerchant(JSON.parse(request.body), merchantPin) ? null : "tap_payments_merchant_unreviewed";
 }
 var NAME_LIMIT = 24;
@@ -818,8 +794,8 @@ function base64(bytes) {
         binary += String.fromCharCode(bytes[i]);
     return btoa(binary);
 }
-function encryptTapPaymentsCard(card, publishableKey, facilities = {}) {
-    const merchantPin = tapPaymentsMerchantPin(publishableKey);
+function encryptTapPaymentsCard(card, publishableKey, facilities = {}, pins = TAP_PAYMENTS_MERCHANT_PINS) {
+    const merchantPin = tapPaymentsMerchantPin(publishableKey, pins);
     if (!merchantPin)
         throw new TapPaymentsError("tap_payments_merchant_unreviewed");
     const message = new TextEncoder().encode(tapPaymentsPlaintext(card));
@@ -859,14 +835,14 @@ function substitutionOf(substitution) {
     const keys = Object.keys(substitution);
     return keys.length === 1 && keys[0] === TAP_PAYMENTS_FIELD && typeof substitution.encryptedData === "string" ? substitution.encryptedData : null;
 }
-function substituteTapPayments(request, substitution) {
-    const refusal = tapPaymentsRequestRefusal(request);
+function substituteTapPayments(request, substitution, pins = TAP_PAYMENTS_MERCHANT_PINS) {
+    const refusal = tapPaymentsRequestRefusal(request, pins);
     if (refusal)
         throw new SubstitutionError(tapPaymentsRefusalMessage(refusal));
     const value = substitutionOf(substitution);
     if (value === null)
         throw new SubstitutionError("the substitution must carry exactly encryptedData");
-    const merchantPin = tapPaymentsMerchantPin(tapPaymentsRequestKey(request));
+    const merchantPin = tapPaymentsMerchantPin(tapPaymentsRequestKey(request), pins);
     if (!isTapPaymentsCiphertextUnderPin(value, merchantPin)) {
         throw new SubstitutionError("substitution for encryptedData does not have the size and range of the merchant's pinned key");
     }
@@ -894,14 +870,14 @@ function swappedBody(body, value) {
     }
     return out;
 }
-function tapPaymentsSubstitutionsRefusal(template, substitution) {
+function tapPaymentsSubstitutionsRefusal(template, substitution, pins = TAP_PAYMENTS_MERCHANT_PINS) {
     const refuseWith = (message) => ({ code: "invalid_substitutions", message });
-    if (tapPaymentsRequestRefusal(template) !== null)
+    if (tapPaymentsRequestRefusal(template, pins) !== null)
         return refuseWith("This authorization is not the card request of a reviewed Tap merchant.");
     const value = substitutionOf(substitution);
     if (value === null)
         return refuseWith("substitutions must carry exactly this field: encryptedData.");
-    if (!isTapPaymentsCiphertextUnderPin(value, tapPaymentsMerchantPin(tapPaymentsRequestKey(template)))) {
+    if (!isTapPaymentsCiphertextUnderPin(value, tapPaymentsMerchantPin(tapPaymentsRequestKey(template), pins))) {
         return refuseWith("substitutions.encryptedData does not have the size and range of the merchant's pinned key.");
     }
     if (value === JSON.parse(template.body).encryptedData)
@@ -910,7 +886,7 @@ function tapPaymentsSubstitutionsRefusal(template, substitution) {
         return refuseWith("substitutions.encryptedData cannot be written at encryptedData alone in the paused request.");
     return null;
 }
-function tapPaymentsKeyUsable(authorization) {
+function tapPaymentsKeyUsable(authorization, pins = TAP_PAYMENTS_MERCHANT_PINS) {
     if (!record(authorization) || !record(authorization.cse))
         return false;
     const cse = authorization.cse;
@@ -920,7 +896,7 @@ function tapPaymentsKeyUsable(authorization) {
         return false;
     if (!isTapPaymentsTokenUrl(authorization.url))
         return false;
-    const merchantPin = tapPaymentsMerchantPin(cse.publishable_key);
+    const merchantPin = tapPaymentsMerchantPin(cse.publishable_key, pins);
     if (!merchantPin || cse.environment !== merchantPin.environment || authorization.sandbox !== (merchantPin.environment === "sandbox"))
         return false;
     try {
@@ -930,6 +906,15 @@ function tapPaymentsKeyUsable(authorization) {
         return false;
     }
 }
+function tapPaymentsRowUsable(authorization, pins = TAP_PAYMENTS_MERCHANT_PINS) {
+    if (!tapPaymentsKeyUsable(authorization, pins))
+        return false;
+    const cse = authorization.cse;
+    if (tapPaymentsMerchantRefusal(cse.environment, cse.publishable_key, authorization.checkout_origin, pins) !== null)
+        return false;
+    const paused = { url: authorization.url, method: "POST", headers: authorization.headers, body: authorization.postData };
+    return tapPaymentsRequestRefusal(paused, pins) === null && tapPaymentsRequestKey(paused) === cse.publishable_key;
+}
 var ANSWER_LIMIT = 65536;
 var TOKEN_ID = /^tok_[A-Za-z0-9]{8,64}$/;
 var REFUSAL_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
@@ -987,4 +972,4 @@ function tapPaymentsAnswerOutcome(status, text, card) {
     }
     return { outcome: "approved" };
 }
-export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsSubstitutionsRefusal };
+export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsRowUsable, tapPaymentsSubstitutionsRefusal };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.25",
+  "version": "0.23.26",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",