@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/aci.d.ts

@@ -10,6 +10,20 @@ export type AciLeg = ({
     leg: 'refuse';
     code: string;
 } & AciAt);
+/** What one request on a JSON split card is, keyed by the URL its legs share. */
+export type JsonSplitLeg = {
+    leg: 'card' | 'absorb' | 'pass';
+    group: string;
+    psp: string;
+} | {
+    leg: 'refuse';
+    code: string;
+    group: string;
+    psp: string;
+    namesCard: boolean;
+};
+/** One request on a split card: ACI's, or a JSON split card's. */
+export type SplitLeg = AciLeg | JsonSplitLeg;
 /** The processor id, as the registry and the API name it. */
 export declare const ACI_PSP = "aci";
 /** The dark-launch capability the API serves the ACI recognizer behind (payment-core definitions.js). */
@@ -43,6 +57,10 @@ export declare const ACI_PAYMENT_UNAPPROVED = "aci_payment_unapproved";
 export declare const ACI_PAYMENT_REPEATED = "aci_payment_repeated";
 /** A card-number request on a checkout whose card-number request is running or was answered here. */
 export declare const ACI_CHECKOUT_REUSED = "aci_checkout_reused";
+/** A JSON split card's card request on a URL whose card request is running or was answered here. */
+export declare const SPLIT_CARD_REUSED = "split_card_reused";
+/** A request on a JSON split card's URL that is neither its card request nor a leg its definition names. */
+export declare const SPLIT_CARD_LEG_UNSUPPORTED = "split_card_leg_unsupported";
 /**
  * How many failed checkouts one attachment keeps. A failed checkout only makes its later CVC and
  * expiry requests fail at once instead of after ACI_SIBLING_WAIT_MS, so the oldest are dropped past
@@ -83,12 +101,20 @@ export declare const ACI_ENGINE_PROBE_MS = 5000;
  * Chromium allows.
  */
 export declare function playwrightReplacesNavigationBody(page: any, probeMs?: number): Promise<boolean>;
+/** A split card's key: an ACI checkout (host and checkout id), or the URL a JSON split card's legs share. */
+type LegAt = {
+    host: string;
+    checkoutId: string;
+} | {
+    group: string;
+};
 /**
- * One attachment's ACI state, keyed by checkout (host and checkout id). Every sibling and every
- * /payment submission is matched against a card-number request this attachment itself paused and
- * answered, never taken on the page's word. Inert (classify returns null) until the registry serves
- * ACI, which a client reaches only by syncing with the capability, so a build or an API that never
- * served it leaves every ACI request exactly as before.
+ * One attachment's split cards, keyed by ACI checkout (host and checkout id) or by a JSON split
+ * card's URL. Every sibling and every /payment submission is matched against a card-number request
+ * this attachment itself paused and answered, never taken on the page's word. Inert (classify returns
+ * null) until the registry serves ACI or a JSON split card, which a client reaches only by syncing
+ * with the processor's capability, so a build or an API that never served one leaves every request
+ * exactly as before.
  */
 export declare class AciGate {
     private readonly vault;
@@ -100,10 +126,22 @@ export declare class AciGate {
     private current;
     constructor(vault: {
         recognizesProcessor?: (psp: string) => boolean;
+        recognizerOf?: (url: string, method?: string) => unknown;
     } | undefined, siblingWaitMs?: number);
     private served;
-    /** What this request is, when the registry serves ACI and it is a POST to an ACI checkout; null leaves it to the other gates. */
-    classify(url: string, method: string, body: string | null | undefined): AciLeg | null;
+    /**
+     * What this request is: an ACI leg when the registry serves ACI and it is a POST to an ACI checkout, a JSON split
+     * card's leg when the registry serves a recognizer for it whose JSON definition names a `splitCard`; null leaves it
+     * to the other gates.
+     */
+    classify(url: string, method: string, body: string | null | undefined): SplitLeg | null;
+    /**
+     * A JSON split card's leg, judged as payment-core judges it: the processor's own refusal first, then the card
+     * request, then the leg its definition names by the body's members; any other body is refused, never forwarded.
+     */
+    private jsonLeg;
+    /** The code a card request this attachment cannot begin is refused with (begin answered false). */
+    reuseCode(url: string): string;
     /**
      * Playwright's route predicate sees only the URL. The card-number, CVC, expiry and holder
      * requests share the recognizer's URL; /payment and /registration do not, so they are routed
@@ -115,16 +153,13 @@ export declare class AciGate {
      * False, with nothing changed, for a checkout whose card-number request is still running or was
      * answered here: its group keeps its answer and its one /payment, so a second approval can never
      * reopen that checkout for another /payment. The pre-claim gate refuses such a request first
-     * (reused, aci_checkout_reused), before it claims a preparation; the adapters fail it here too.
-     * A refused begin leaves the running approval it found running. A checkout whose card-number
-     * request failed begins again.
+     * (reused, aci_checkout_reused or split_card_reused), before it claims a preparation; the adapters
+     * fail it here too (reuseCode). A refused begin leaves the running approval it found running. A
+     * checkout whose card-number request failed begins again.
      */
     begin(url: string, method: string, body: string | null | undefined, merchantOrigin: string | undefined): boolean;
     /** Whether this checkout's card-number request is running or was answered here: another one is refused. */
-    reused(leg: {
-        host: string;
-        checkoutId: string;
-    }): boolean;
+    reused(leg: LegAt): boolean;
     private live;
     /** Drops the oldest failed checkouts past ACI_FAILED_CHECKOUTS_KEPT; running and answered ones stay. */
     private prune;
@@ -139,20 +174,15 @@ export declare class AciGate {
      * until a card-number request begins. A refused request that names no card number, such as a
      * fingerprint longer than ACI takes, says nothing about the card-number request a later Pay sends,
      * so its siblings keep waiting for it. A running or answered card-number request keeps its siblings.
+     * A JSON split card's refused request names the card when it holds a card field its recognizer declares.
      */
-    refused(leg: {
-        host: string;
-        checkoutId: string;
-    }, body: string | null | undefined): void;
+    refused(leg: SplitLeg, body: string | null | undefined): void;
     /**
      * A sibling leg (the page's CVC or expiry request): the answer to hand it, once its checkout's
      * card-number request was answered, or null when that request failed, never began within
      * siblingWaitMs, or cannot be answered here. Never resolves to anything the page did not get.
      */
-    hold(leg: {
-        host: string;
-        checkoutId: string;
-    }): Promise<AciAnswer | null>;
+    hold(leg: LegAt): Promise<AciAnswer | null>;
     /**
      * The page's /payment submission: continue it with the body to send, or refuse it. It continues
      * only as a frame navigation (the widget's form posting into its hidden iframe; a script's fetch

package/dist/aci.js

@@ -25,7 +25,17 @@
 //     It continues only as a frame navigation, which is how the widget's form posts it into its
 //     hidden iframe, and a classic-mode body only on a browser shown to send the body the SDK
 //     replaced on a navigation (Chromium; see playwrightReplacesNavigationBody).
+//
+// A JSON split card is held by the same rules: a served recognizer whose JSON definition names a
+// `splitCard` (payment-core card-fields.js splitCardLeg), where each card field sends its own JSON
+// object to one URL, and that URL stands where ACI's checkout id stands. Its card request pauses;
+// its code and expiry requests are held and answered with that request's answer; a holder request
+// continues; a second card request on a URL whose first one is running or was answered is refused
+// (split_card_reused), except the page's retry while that approval is still open, which the
+// adapters bind to it; anything the processor's own gate refuses, or that is no leg, is refused. It
+// has no /payment submission.
 import { ACI_CARD_FIELD, aciBrandOfCardLeg as brandOfCardLeg, aciEndpoint, classifyAciRequest, prepareAciContinuation, sanitizeAciResponse, } from './aci.generated.js';
+import { cardRequestRefusal, carriesCardFields, splitCardLeg } from './card-fields.generated.js';
 const classifyLeg = classifyAciRequest;
 const judgePayment = prepareAciContinuation;
 /** The processor id, as the registry and the API name it. */
@@ -45,6 +55,10 @@ export const ACI_PAYMENT_UNAPPROVED = 'aci_payment_unapproved';
 export const ACI_PAYMENT_REPEATED = 'aci_payment_repeated';
 /** A card-number request on a checkout whose card-number request is running or was answered here. */
 export const ACI_CHECKOUT_REUSED = 'aci_checkout_reused';
+/** A JSON split card's card request on a URL whose card request is running or was answered here. */
+export const SPLIT_CARD_REUSED = 'split_card_reused';
+/** A request on a JSON split card's URL that is neither its card request nor a leg its definition names. */
+export const SPLIT_CARD_LEG_UNSUPPORTED = 'split_card_leg_unsupported';
 /**
  * How many failed checkouts one attachment keeps. A failed checkout only makes its later CVC and
  * expiry requests fail at once instead of after ACI_SIBLING_WAIT_MS, so the oldest are dropped past
@@ -147,7 +161,8 @@ export async function playwrightReplacesNavigationBody(page, probeMs = ACI_ENGIN
         clearTimeout(timer);
     }
 }
-const groupKey = (leg) => `${leg.host}/${leg.checkoutId}`;
+const groupKey = (leg) => ('group' in leg ? leg.group : `${leg.host}/${leg.checkoutId}`);
+const upper = (method) => (typeof method === 'string' ? method.toUpperCase() : method);
 /** Whether a form body has a card.number key, whatever else it carries and however it broke the rules. */
 function namesCardNumber(body) {
     if (typeof body !== 'string')
@@ -162,12 +177,33 @@ function namesCardNumber(body) {
         }
     });
 }
+/** Whether a JSON body names a card field its recognizer declares, whatever that member holds and however the body broke the rules. */
+function namesJsonCardField(rec, body) {
+    let root;
+    try {
+        root = typeof body === 'string' ? JSON.parse(body) : undefined;
+    }
+    catch {
+        return false;
+    }
+    const paths = Array.isArray(rec.jsonCardFields) ? rec.jsonCardFields : [];
+    return paths.some((path) => {
+        let node = root;
+        return Array.isArray(path) && path.length > 0 && path.every((step) => {
+            if (!node || typeof node !== 'object' || !Object.prototype.hasOwnProperty.call(node, step))
+                return false;
+            node = node[step];
+            return true;
+        });
+    });
+}
 /**
- * One attachment's ACI state, keyed by checkout (host and checkout id). Every sibling and every
- * /payment submission is matched against a card-number request this attachment itself paused and
- * answered, never taken on the page's word. Inert (classify returns null) until the registry serves
- * ACI, which a client reaches only by syncing with the capability, so a build or an API that never
- * served it leaves every ACI request exactly as before.
+ * One attachment's split cards, keyed by ACI checkout (host and checkout id) or by a JSON split
+ * card's URL. Every sibling and every /payment submission is matched against a card-number request
+ * this attachment itself paused and answered, never taken on the page's word. Inert (classify returns
+ * null) until the registry serves ACI or a JSON split card, which a client reaches only by syncing
+ * with the processor's capability, so a build or an API that never served one leaves every request
+ * exactly as before.
  */
 export class AciGate {
     vault;
@@ -184,11 +220,36 @@ export class AciGate {
     served() {
         return typeof this.vault?.recognizesProcessor === 'function' && this.vault.recognizesProcessor(ACI_PSP) === true;
     }
-    /** What this request is, when the registry serves ACI and it is a POST to an ACI checkout; null leaves it to the other gates. */
+    /**
+     * What this request is: an ACI leg when the registry serves ACI and it is a POST to an ACI checkout, a JSON split
+     * card's leg when the registry serves a recognizer for it whose JSON definition names a `splitCard`; null leaves it
+     * to the other gates.
+     */
     classify(url, method, body) {
-        if (!this.served())
+        return (this.served() ? classifyLeg({ url, method: upper(method), body }) : null) ?? this.jsonLeg(url, method, body);
+    }
+    /**
+     * A JSON split card's leg, judged as payment-core judges it: the processor's own refusal first, then the card
+     * request, then the leg its definition names by the body's members; any other body is refused, never forwarded.
+     */
+    jsonLeg(url, method, body) {
+        const rec = typeof this.vault?.recognizerOf === 'function' ? this.vault.recognizerOf(url, upper(method)) : null;
+        if (!rec || rec.encoding !== 'json' || !rec.splitCard || typeof rec.splitCard !== 'object' || typeof rec.psp !== 'string')
             return null;
-        return classifyLeg({ url, method: typeof method === 'string' ? method.toUpperCase() : method, body });
+        const at = { group: url, psp: rec.psp };
+        const refusal = cardRequestRefusal(rec, url, body);
+        if (typeof refusal === 'string')
+            return { leg: 'refuse', code: refusal, namesCard: namesJsonCardField(rec, body), ...at };
+        if (carriesCardFields(rec, body))
+            return { leg: 'card', ...at };
+        const leg = splitCardLeg(rec, body);
+        if (leg === 'absorb' || leg === 'pass')
+            return { leg, ...at };
+        return { leg: 'refuse', code: SPLIT_CARD_LEG_UNSUPPORTED, namesCard: namesJsonCardField(rec, body), ...at };
+    }
+    /** The code a card request this attachment cannot begin is refused with (begin answered false). */
+    reuseCode(url) {
+        return aciEndpoint(url) !== null ? ACI_CHECKOUT_REUSED : SPLIT_CARD_REUSED;
     }
     /**
      * Playwright's route predicate sees only the URL. The card-number, CVC, expiry and holder
@@ -203,12 +264,12 @@ export class AciGate {
      * False, with nothing changed, for a checkout whose card-number request is still running or was
      * answered here: its group keeps its answer and its one /payment, so a second approval can never
      * reopen that checkout for another /payment. The pre-claim gate refuses such a request first
-     * (reused, aci_checkout_reused), before it claims a preparation; the adapters fail it here too.
-     * A refused begin leaves the running approval it found running. A checkout whose card-number
-     * request failed begins again.
+     * (reused, aci_checkout_reused or split_card_reused), before it claims a preparation; the adapters
+     * fail it here too (reuseCode). A refused begin leaves the running approval it found running. A
+     * checkout whose card-number request failed begins again.
      */
     begin(url, method, body, merchantOrigin) {
-        const leg = classifyLeg({ url, method: typeof method === 'string' ? method.toUpperCase() : method, body });
+        const leg = classifyLeg({ url, method: upper(method), body }) ?? this.jsonLeg(url, method, body);
         if (leg?.leg !== 'card') {
             this.current = null;
             return true;
@@ -252,7 +313,9 @@ export class AciGate {
     /** The card-number request's answer reached the page; its siblings get the same answer. */
     answered(url, answer, authorizationId) {
         const endpoint = aciEndpoint(url);
-        if (!endpoint || endpoint.kind !== 'leg' || this.current !== groupKey(endpoint))
+        // A JSON split card's legs share its URL; an ACI URL counts only as a checkout's leg URL.
+        const key = endpoint === null ? url : endpoint.kind === 'leg' ? groupKey(endpoint) : null;
+        if (key === null || this.current !== key)
             return;
         const group = this.groups.get(this.current);
         if (!group || group.state !== 'running')
@@ -284,9 +347,10 @@ export class AciGate {
      * until a card-number request begins. A refused request that names no card number, such as a
      * fingerprint longer than ACI takes, says nothing about the card-number request a later Pay sends,
      * so its siblings keep waiting for it. A running or answered card-number request keeps its siblings.
+     * A JSON split card's refused request names the card when it holds a card field its recognizer declares.
      */
     refused(leg, body) {
-        if (!namesCardNumber(body))
+        if (!('group' in leg ? leg.leg === 'refuse' && leg.namesCard : namesCardNumber(body)))
             return;
         const key = groupKey(leg);
         const known = this.groups.get(key);

package/dist/adyen-merchant-hosted.generated.d.ts

@@ -1,8 +1,8 @@
 declare var MERCHANT_EXCHANGES_MAX: number;
 declare var MERCHANT_PROFILE_RECOGNIZERS: any;
 declare function declaredEndpointRefusal(endpoint: any): string | null;
-declare function isAdyenWebJweCompact(s: any): boolean;
 declare function sha256Hex(input: any): string;
+declare function isAdyenWebJweCompact(s: any): boolean;
 declare function merchantAmountFromResponses(profile: any, input: any): {
     ok: boolean;
     code: any;
@@ -240,7 +240,7 @@ declare function merchantTotalFromResponses(profileId: any, input: any): {
         bodyAmount: string;
     };
 };
-declare function merchantProfileUrlRelation(profileId: any, rawUrl: any): "sibling" | "endpoint" | "then" | "other" | null;
+declare function merchantProfileUrlRelation(profileId: any, rawUrl: any): "other" | "sibling" | "endpoint" | "then" | null;
 declare function carriesAdyenCardCiphertext(body: any): any;
 declare function classifyMerchantBody(profileId: any, body: any): Readonly<{
     verdict: "pass";