@agent-cards/sdk 0.23.4 → 0.23.6

package/dist/eprotect.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a9b6c689690a719af354b2f260064b8e276b8566f3b3482f4b1891f6c4db1caa
+// artifact-sha256: 9a686322a5e8f0667fa74e6e3f06d6adfa8a242ab79c18467054ded429f9a3af
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -10,6 +10,137 @@ function deepFreeze(value) {
     }
     return value;
 }
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
 // src/test-pans.js
 function immutableSet(values, name) {
     const set = new Set(values);
@@ -33,18 +164,19 @@ var EPROTECT_HOSTS = /* @__PURE__ */ Object.freeze({
     sandbox: "request.eprotect.vantivprelive.com"
 });
 var EPROTECT_SECONDARY_HOST = "secondary.eprotect.vantivcnp.com";
-var EPROTECT_KEYS = /* @__PURE__ */ Object.freeze({
-    production: /* @__PURE__ */ Object.freeze({
-        keyId: "26455500012",
-        exponent: "10001",
-        modulus: "b9c7095ff203475347a932a6e11bacbb61cfb66a877158683634e5fb1dbf9923401bd7f82c21b67ffd3c82bdc64797c5e2ba4b57c68b1aaccb7fbe847da7234a21df910dfcc0aebacbbd4d36b35c0c35f7ee27358610d2e2fb2aa87d359deda0b5f4d77e31ac5ab98741da5b6052cb657087da05ad496154b8954939ee6fd463301ff15ebca94f210f4627a255a95ca8833728c1ab80b6cc3a874e4d3dce5d40f66c043ba1b042717bb9cc5d89434fa489a51c2ba9a3843b310df58c9e8a54c36cdd5fd66e76651b6fc88850b60e0739abfcf7d0d0cb44beb7e768da3bcea7e743b8c2d57edef59643f54432ccf60c49d4f5f84410ecf9c5a7af19bc5e792801"
-    }),
-    sandbox: /* @__PURE__ */ Object.freeze({
-        keyId: "1",
-        exponent: "10001",
-        modulus: "bc637dd74ba76507dad5af1c7ad6f97dbef5298c3b9f74caea7301347db7b4a8c37f26491863100667246fd45071f3346bf62239f9b117d06fb67861b66ad0d158beeddd2f6f28be93d846f4c8f9ba1bd7e8f186f36cab0e432f22b3d732c221a9ff00a9bfacb88b24503e2695fd7237835d4936477b21289478906a49b164f52503c20eb29f11fcbda2af94deb9a0bfde5a4589276897436315c5d664d60bf10650164f509283aed39747ad5d6cb2bbe54e1b42306e5db37dfd42dcbfcc689e0ddfe3bc9cb22ae7018e5a4a1ff39813584ac7bd6d6d65ca763f0a672da454081ea20e8b1d403316d80b9353ba396bea8962b1a7d2f775c76612d857c1f7594f"
-    })
+var EPROTECT_KEY_SOURCES = /* @__PURE__ */ deepFreeze({
+    production: {
+        host: "request.eprotect.vantivcnp.com",
+        path: "/eProtect/eProtect-api3.js",
+        maskedSha256: "e4e55a14c10b25a497db7931124c62c6fb78d3b0c5c2afbc95303b398dd3f439"
+    },
+    sandbox: {
+        host: "request.eprotect.vantivprelive.com",
+        path: "/eProtect/eProtect-api3.js",
+        maskedSha256: "1fc0d21e51a36900bcfbbb6117a05a1eed7d004aa2decb85e12d4e19236dca15"
+    }
 });
+var EPROTECT_KEY_SCRIPT_MAX_BYTES = 65536;
 var EPROTECT_TEST_PANS = /* @__PURE__ */ immutableSet([
     "5112010000000003",
     "44570100000000009",
@@ -107,6 +239,98 @@ function eprotectPreparationUrl(environment) {
         throw new Error("unsupported_eprotect_environment");
     return `https://${EPROTECT_HOSTS[environment]}${EPROTECT_PATH}`;
 }
+function eprotectKeySourceUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_eprotect_environment");
+    const source = EPROTECT_KEY_SOURCES[environment];
+    return `https://${source.host}${source.path}`;
+}
+var KEY_LITERAL = 'modulus:"([0-9a-f]*)",exponent:"([0-9a-f]*)",keyId:"([0-9]*)"';
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var SESSION_KEYS = /* @__PURE__ */ new WeakSet();
+function scriptBytes(bytes, limit) {
+    if (!ArrayBuffer.isView(bytes) || Object.prototype.toString.call(bytes) !== "[object Uint8Array]")
+        return null;
+    const view = (
+    /** @type {Uint8Array} */
+    bytes);
+    if (view.length > limit)
+        return null;
+    const copy = new Uint8Array(view.length);
+    copy.set(view);
+    return copy;
+}
+function byteText(bytes) {
+    let text = "";
+    for (let at = 0; at < bytes.length; at += 8192)
+        text += String.fromCharCode.apply(null, bytes.subarray(at, at + 8192));
+    return text;
+}
+function occurrences(text, label) {
+    let count = 0;
+    for (let at = text.indexOf(label); at !== -1; at = text.indexOf(label, at + label.length))
+        count++;
+    return count;
+}
+function keyLiteralFacts(data) {
+    const text = byteText(data);
+    const literals = [...text.matchAll(new RegExp(KEY_LITERAL, "g"))];
+    if (literals.length !== 1 || occurrences(text, "modulus:") !== 1 || occurrences(text, "keyId:") !== 1)
+        return { literals: literals.length };
+    const [whole, modulus, exponent, keyId] = literals[0];
+    const start = literals[0].index;
+    const kept = `modulus:"",exponent:"${exponent}",keyId:""`;
+    const masked = new Uint8Array(data.length - whole.length + kept.length);
+    masked.set(data.subarray(0, start));
+    for (let i = 0; i < kept.length; i++)
+        masked[start + i] = kept.charCodeAt(i);
+    masked.set(data.subarray(start + whole.length), start + kept.length);
+    return { literals: 1, keyId, modulus, exponent, modulusSha256: sha256Hex(modulus), maskedSha256: sha256Hex(masked) };
+}
+function eprotectScriptFacts(bytes) {
+    const data = scriptBytes(bytes, Infinity);
+    return data ? keyLiteralFacts(data) : { literals: 0 };
+}
+function eprotectKeyScriptVerdict(environment, bytes, sources = EPROTECT_KEY_SOURCES) {
+    const source = (environment === "production" || environment === "sandbox") && sources && typeof sources === "object" ? sources[environment] : null;
+    const pinned = source && typeof source === "object" ? source.maskedSha256 : null;
+    if (!exact(SHA256_HEX, pinned))
+        return { ok: false, reason: "unsupported_eprotect_environment" };
+    const data = scriptBytes(bytes, EPROTECT_KEY_SCRIPT_MAX_BYTES);
+    if (!data || data.length === 0)
+        return { ok: false, reason: "eprotect_script_unreadable" };
+    const facts = keyLiteralFacts(data);
+    if (!("maskedSha256" in facts))
+        return { ok: false, reason: "eprotect_script_key_literal" };
+    const { keyId, modulus, exponent, modulusSha256, maskedSha256 } = facts;
+    if (!exact(/^[0-9]{1,32}$/, keyId) || !exact(/^[0-9a-f]{512}$/, modulus))
+        return { ok: false, reason: "eprotect_script_key_literal", maskedSha256 };
+    if (maskedSha256 !== pinned)
+        return { ok: false, reason: "eprotect_script_changed", maskedSha256 };
+    if (modulus[0] < "8" || exponent !== "10001")
+        return { ok: false, reason: "eprotect_key_weak", maskedSha256 };
+    return { ok: true, keyId, modulus, modulusSha256, maskedSha256 };
+}
+function readEprotectKeyScript(environment, bytes, sources = EPROTECT_KEY_SOURCES) {
+    const verdict = eprotectKeyScriptVerdict(environment, bytes, sources);
+    if (!verdict.ok) {
+        throw Object.assign(new Error("Refusing to pay: Worldpay's eProtect script is not the one Agentcard reviewed."), { reason: verdict.reason });
+    }
+    const key = Object.freeze({
+        environment,
+        keyId: verdict.keyId,
+        modulus: verdict.modulus,
+        exponent: "10001",
+        modulusSha256: verdict.modulusSha256
+    });
+    SESSION_KEYS.add(key);
+    return key;
+}
+function eprotectKeyReport(key) {
+    if (!SESSION_KEYS.has(key))
+        throw new Error("Refusing to pay: no Worldpay key was read for this eProtect session.");
+    return Object.freeze({ key_id: key.keyId, modulus_sha256: key.modulusSha256 });
+}
 var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function bytesToBase64(bytes) {
     let out = "";
@@ -141,6 +365,8 @@ var VALUE_RULES = {
     // true bypasses Worldpay's Mod10 check and hides the BIN: private-label cards only.
     pciNonSensitive: (value) => value === "false",
     encryptedCvv: ciphertext,
+    // Worldpay's key id, digits only. Any key passes: Worldpay rotates its production key daily, and
+    // the device writes the key it read from Worldpay into its own copy (eprotectDeviceRequest).
     publicKeyId: (value) => exact(/^[0-9]{1,32}$/, value),
     firstEight: (value) => value === "true",
     requestType: (value) => value === "eProtect",
@@ -182,8 +408,6 @@ function parseRegistration(url, host) {
     }
     if (QUERY_ORDER.some((name) => !OPTIONAL.has(name) && !(name in values)))
         return null;
-    if (values.publicKeyId !== EPROTECT_KEYS[environment].keyId)
-        return null;
     if (values.targetServer !== (host === "secondary" ? "secondary" : "primary"))
         return null;
     return { environment, origin: parsed.origin, pairs, values };
@@ -214,12 +438,14 @@ function eprotectSecondaryAttempt(url) {
     return parsed ? { paypageId: parsed.values.paypageId, id: parsed.values.id } : null;
 }
 var CIPHERTEXT_KEYS = /* @__PURE__ */ new Set(["encryptedAccount", "encryptedCvv"]);
-function isEprotectDeviceRequest(templateUrl, deviceUrl) {
+function isEprotectDeviceRequest(templateUrl, deviceUrl, sessionKeyId) {
+    if (sessionKeyId !== void 0 && !exact(/^[0-9]{1,32}$/, sessionKeyId))
+        return false;
     const template = parseRegistration(templateUrl, "primary");
     const device = parseRegistration(deviceUrl, "primary");
     if (!template || !device || device.origin !== template.origin || device.pairs.length !== template.pairs.length)
         return false;
-    return device.pairs.every((pair, i) => pair.name === template.pairs[i].name && (CIPHERTEXT_KEYS.has(pair.name) ? pair.raw !== template.pairs[i].raw : pair.raw === template.pairs[i].raw));
+    return device.pairs.every((pair, i) => pair.name === template.pairs[i].name && (CIPHERTEXT_KEYS.has(pair.name) ? pair.raw !== template.pairs[i].raw : pair.name === "publicKeyId" && sessionKeyId !== void 0 ? pair.raw === sessionKeyId : pair.raw === template.pairs[i].raw));
 }
 function isPreparedEprotectRequest(url, method, body, environment, paypageId) {
     if (environment !== "production" && environment !== "sandbox")
@@ -229,7 +455,10 @@ function isPreparedEprotectRequest(url, method, body, environment, paypageId) {
     const facts = eprotectRequestFacts(url);
     return !!facts && facts.environment === environment && facts.paypageId === paypageId;
 }
-var EPROTECT_MERCHANT_PINS = /* @__PURE__ */ deepFreeze([]);
+var EPROTECT_MERCHANT_PINS = /* @__PURE__ */ deepFreeze([
+    { id: "smartpak_equine", merchant: "SmartPak Equine", origins: ["https://www.smartpakequine.com"], paypageIds: ["zhs8KzuRAryaq4cs"] },
+    { id: "nordstrom", merchant: "Nordstrom", origins: ["https://www.nordstrom.com"], paypageIds: ["fL33BPkRvbRqJ29S"] }
+]);
 function eprotectMerchantPin(paypageId, merchantOrigin, pins = EPROTECT_MERCHANT_PINS) {
     if (!exact(PAYPAGE_ID, paypageId) || typeof merchantOrigin !== "string" || !Array.isArray(pins))
         return null;
@@ -315,10 +544,13 @@ function eprotectCardRefusal(environment, cardNumber) {
         return "invalid_card_number";
     return EPROTECT_TEST_PANS.has(pan) || DOCUMENTED_TEST_PANS.has(pan) ? "live_host_refuses_documented_test_card" : null;
 }
-function eprotectDeviceRequest(templateUrl, card, random = defaultRandom) {
+function eprotectDeviceRequest(templateUrl, card, sessionKey, random = defaultRandom) {
     const parsed = parseRegistration(templateUrl, "primary");
     if (!parsed)
         throw new Error("Refusing to pay: unsupported eProtect card request.");
+    if (!SESSION_KEYS.has(sessionKey) || sessionKey.environment !== parsed.environment) {
+        throw new Error("Refusing to pay: no Worldpay key was read for this eProtect session.");
+    }
     const refusal = eprotectCardRefusal(parsed.environment, card && card.number);
     if (refusal === "sandbox_host_requires_documented_test_card") {
         throw new Error("Refusing to pay: a sandbox or test host accepts only the processor's documented test cards, not a real card.");
@@ -329,13 +561,14 @@ function eprotectDeviceRequest(templateUrl, card, random = defaultRandom) {
     if (withCvv && (typeof card.cvc !== "string" || !/^[0-9]{3,4}$/.test(card.cvc))) {
         throw new Error("Could not fill the card fields for Worldpay eProtect. Nothing was sent.");
     }
-    const key = EPROTECT_KEYS[parsed.environment];
-    const fresh = { encryptedAccount: eprotectEncrypt(String(card.number), key, random) };
+    const fresh = { encryptedAccount: eprotectEncrypt(String(card.number), sessionKey, random) };
     if (withCvv)
-        fresh.encryptedCvv = eprotectEncrypt(card.cvc, key, random);
+        fresh.encryptedCvv = eprotectEncrypt(card.cvc, sessionKey, random);
+    if (parsed.values.publicKeyId !== sessionKey.keyId)
+        fresh.publicKeyId = sessionKey.keyId;
     const query = parsed.pairs.map(({ name, raw }) => `${name}=${name in fresh ? canonicalComponent(fresh[name]) : raw}`).join("&");
     const url = `${parsed.origin}${EPROTECT_PATH}?${query}`;
-    if (!isEprotectDeviceRequest(templateUrl, url))
+    if (!isEprotectDeviceRequest(templateUrl, url, sessionKey.keyId))
         throw new Error("Refusing to pay: unsupported eProtect card request.");
     return { url, method: "GET", headers: {}, body: "", where: Object.keys(fresh) };
 }
@@ -495,4 +728,4 @@ function eprotectRefusalCode(bodyText) {
         return null;
     return Object.entries(answer).every(([key, value]) => REFUSAL_FIELDS.has(key) && typeof value === "string") ? answer.response : null;
 }
-export { EPROTECT_HOSTS, EPROTECT_KEYS, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, sanitizeEprotectRegistration };
+export { EPROTECT_HOSTS, EPROTECT_KEY_SCRIPT_MAX_BYTES, EPROTECT_KEY_SOURCES, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectKeyReport, eprotectKeyScriptVerdict, eprotectKeySourceUrl, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectScriptFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, readEprotectKeyScript, sanitizeEprotectRegistration };

package/dist/eprotect.js

@@ -3,8 +3,9 @@
 // The vendor's browser script (eProtect-api2/3, litle-api2/3, and the Worldpay iframe, which runs
 // them in a Worldpay-origin frame) encrypts the card in the page and sends it as ONE JSONP
 // <script> GET to /eProtect/paypage; the answer is `<callback>({...})`. The rules that judge that
-// request (the query grammar, the pinned keys, the failover and give-up reports, the answer
-// allowlist) live in payment-core and reach this SDK as eprotect.generated.ts. This module holds
+// request (the query grammar, which takes any key id in Worldpay's digits because Worldpay rotates
+// its production key daily, the failover and give-up reports, the answer allowlist, the reviewed
+// merchants) live in payment-core and reach this SDK as eprotect.generated.ts. This module holds
 // only what an attachment decides from them:
 //   - which request on eProtect's hosts is the registration to pause for the vault;
 //   - which is the vendor's failover re-send of a registration the page already sent (aborted
@@ -28,8 +29,8 @@ const EPROTECT_HOSTNAMES = [EPROTECT_HOSTS.production, EPROTECT_HOSTS.sandbox, E
  * (merchant_profile_mismatch) before any preparation exists. When this build pins the paypageId
  * too, it refuses another name first, before any network call, as a Fiserv checkout must name its
  * key pin's merchant. A paypageId this build does not pin is the API's to judge (unsupported_checkout
- * with no pin); none is pinned on either side yet. The pre-live host takes only the guide's test
- * cards and needs no pin. `pins` is for tests.
+ * with no pin). This build pins SmartPak Equine and Nordstrom, under those exact names. The pre-live
+ * host takes only the guide's test cards and needs no pin. `pins` is for tests.
  */
 export function eprotectCheckoutRefusal(input, pins) {
     if (input.environment !== 'production')

package/dist/lifecycle.d.ts

@@ -226,11 +226,14 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
      * shiji-sts.ts reasons), a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * the cardholder's device can fill (processor_card_page: NMI's), a card
      * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
-     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts), or a card
+     * a merchant's page posts to CyberSource Secure Acceptance's Silent Order
+     * POST, which no Vault mode takes over either
+     * (unsupported_cybersource_secure_acceptance, cybersource-secure-acceptance.ts).
      */
-    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields'): void;
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | 'unsupported_cybersource_secure_acceptance'): void;
     /**
      * A card request that only a prepared checkout pays (an Adyen merchant
      * profile's, or a Fiserv card capture) arrived with no preparation on this

package/dist/lifecycle.js

@@ -202,9 +202,12 @@ export class CheckoutLifecycle {
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
      * shiji-sts.ts reasons), a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * the cardholder's device can fill (processor_card_page: NMI's), a card
      * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
-     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts), or a card
+     * a merchant's page posts to CyberSource Secure Acceptance's Silent Order
+     * POST, which no Vault mode takes over either
+     * (unsupported_cybersource_secure_acceptance, cybersource-secure-acceptance.ts).
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;

package/dist/pre-claim.d.ts

@@ -201,6 +201,7 @@ export declare const verifonePreClaim: PreClaimGate;
 export declare const fiservPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
+export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -16,7 +16,8 @@
 // card-saving bodies, WSPay's confirm URL, which also carries bodies with
 // no new card, Shiji STS's getTokenId and getCvvId, which also carry
 // requests the vault must never pay, and PayPal's legacy Hosted Fields
-// confirm, whose card no Vault mode takes over.
+// confirm and CyberSource Secure Acceptance's Silent Order POST, whose card
+// no Vault mode takes over.
 // The first three used to be
 // written inline in Fetch.requestPaused and again in the page.route handler, so
 // a decision could drift between the two adapters and a new family had to be
@@ -75,6 +76,7 @@ import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isP
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
+import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, } from './cybersource-secure-acceptance.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -169,14 +171,16 @@ function cardEndpointPausedBody(ctx) {
 }
 /**
  * Answer a paused card form navigation with the page that says Agentcard stopped it before
- * its card left. While an approval is outstanding, or once a payment for this checkout may
- * already exist, the page says a payment is in progress instead of that nothing was sent
- * (card-endpoint-page.ts refusedNavigationOutcome), and names that payment's authorization.
+ * its card left, naming where the card was going: a card endpoint profile's own merchant, or
+ * CyberSource for a Secure Acceptance post. While an approval is outstanding, or once a payment
+ * for this checkout may already exist, the page says a payment is in progress instead of that
+ * nothing was sent (card-endpoint-page.ts refusedNavigationOutcome), and names that payment's
+ * authorization.
  */
-async function stopNavigationBeforeSend(ctx, profile, reason) {
+async function stopNavigationBeforeSend(ctx, merchant, reason) {
     const state = ctx.lifecycle.getState();
     const outcome = refusedNavigationOutcome({ awaitingApproval: ctx.awaitingApproval(), status: state.status });
-    await ctx.effects.answer(cardEndpointStoppedPage({ outcome, reason, merchant: profile.merchant,
+    await ctx.effects.answer(cardEndpointStoppedPage({ outcome, reason, merchant,
         authorizationId: outcome === 'payment_in_progress' ? state.authorizationId : null }));
     return { kind: 'answer' };
 }
@@ -216,13 +220,13 @@ async function cardEndpointNavigationPreClaim(ctx, profile) {
     }
     if (navigation !== profile.navigation) {
         ctx.onEvent?.({ type: 'card_endpoint_refused', detail: { ...cardEndpointDetail(profile), reason: 'request_unsupported', refusal: `the card post navigates ${navigation === 'top' ? 'the page' : 'an iframe'}` } });
-        return stopNavigationBeforeSend(ctx, profile, 'request_unsupported');
+        return stopNavigationBeforeSend(ctx, profile.merchant, 'request_unsupported');
     }
     if (!cardEndpointLive(profile)) {
         ctx.preparationGate.invalidate('unsupported_checkout');
         ctx.lifecycle.unsupported('merchant_card_endpoint_not_enabled');
         ctx.onEvent?.({ type: 'unsupported_checkout', detail: { ...cardEndpointDetail(profile), reason: 'merchant_card_endpoint_not_enabled' } });
-        return stopNavigationBeforeSend(ctx, profile, 'not_enabled');
+        return stopNavigationBeforeSend(ctx, profile.merchant, 'not_enabled');
     }
     return { kind: 'pause', stripeStep: null, cardEndpoint: profile, navigation };
 }
@@ -1530,6 +1534,68 @@ async function paypalHostedFieldsUnreadable(ctx) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// CyberSource Secure Acceptance's Silent Order POST (cybersource-secure-acceptance.ts). The merchant's
+// page posts the card the agent typed, beside the fields its server signed, to a /silent/ path on
+// CyberSource's Secure Acceptance hosts, which no Vault mode takes over, so every company's adapters
+// hand each request there to this gate, whether a fetch, an XHR or a form navigation sent it:
+//   - a card_number that holds a value, in the body or in the URL's query, stops the request as an
+//     unsupported checkout, reason `unsupported_cybersource_secure_acceptance`, with no claim, create or
+//     prompt, so CyberSource never receives the card. A form navigation of the page or of a frame (Arrow
+//     submits its form into a hidden iframe) is answered with the stopped page, as a card endpoint's form
+//     is, since an aborted page load renders nothing and invites another click on Pay; any other request
+//     fails. The attachment then reads `unsupported` and holds: the page's next post would carry the
+//     card again;
+//   - a body the adapter could not read stops that request alone, the same way, with a `blocked` event,
+//     `unreadable_cybersource_secure_acceptance_request`, and does not hold the attachment: nothing
+//     proves it carries no card;
+//   - any other request (a payment with a stored payment_token and no card, a GET, a CORS preflight)
+//     defers, and the arbiter continues it untouched.
+// A request the synced registry recognizes as a card request defers too, so the arbiter pauses it for
+// that recognizer; no build serves one today. A path outside /silent/ is not this gate's. Synchronous
+// until it must stop a request, like every gate. Exported for the gate registry's tests.
+export const cybersourceSecureAcceptancePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isCybersourceSecureAcceptanceUrl(url) || ctx.vault.isCardRequest(url, method))
+        return undefined;
+    // A reader that throws (Playwright's postData() can) reads as a body the adapter could not read.
+    const { body, contentType } = cardEndpointPausedBody(ctx);
+    const carried = cybersourceSecureAcceptanceRequest(url, method, body, contentType);
+    if (carried === 'no_card')
+        return undefined;
+    return carried === 'card' ? cybersourceSecureAcceptanceUnsupported(ctx) : cybersourceSecureAcceptanceUnreadable(ctx);
+};
+async function cybersourceSecureAcceptanceUnsupported(ctx) {
+    const { url, method } = ctx.request;
+    ctx.preparationGate.invalidate('unsupported_checkout');
+    ctx.lifecycle.unsupported(CYBERSOURCE_SECURE_ACCEPTANCE_REASON);
+    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { url: eventUrl(ctx.vault, url), method, reason: CYBERSOURCE_SECURE_ACCEPTANCE_REASON } });
+    return cybersourceSecureAcceptanceStop(ctx);
+}
+async function cybersourceSecureAcceptanceUnreadable(ctx) {
+    ctx.onEvent?.({ type: 'blocked', detail: 'unreadable_cybersource_secure_acceptance_request' });
+    return cybersourceSecureAcceptanceStop(ctx);
+}
+/**
+ * Stop a Secure Acceptance post: a form navigation gets the stopped page, and if the page cannot be
+ * answered, or the request is not a navigation, it fails. Either way the card never leaves.
+ */
+async function cybersourceSecureAcceptanceStop(ctx) {
+    let navigation = false;
+    try {
+        navigation = ctx.request.navigation === true;
+    }
+    catch {
+        navigation = false;
+    }
+    if (navigation) {
+        try {
+            return await stopNavigationBeforeSend(ctx, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, 'request_unsupported');
+        }
+        catch { /* the page could not be answered: fail the request below */ }
+    }
+    await ctx.effects.abort().catch(() => { });
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1563,7 +1629,8 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim,
+    cybersourceSecureAcceptancePreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card