@agent-cards/sdk 0.23.4 → 0.23.6

package/dist/preflight-catalog.json

@@ -2172,6 +2172,33 @@
       "hostname_pattern": "^assets\\.braintreegateway\\.com$",
       "pathname_pattern": "^\\/web\\/[0-9]+\\.[0-9]+\\.[0-9]+-payments-sdk(?:-[a-z]+)?\\/html\\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\\.min)?\\.html$"
     },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://secureacceptance.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^secureacceptance\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
     {
       "id": "fiserv-commercehub-payment-fields",
       "psp": "fiserv",
@@ -3432,6 +3459,60 @@
       "hostname_pattern": "^testflex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post-test",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://testsecureacceptance.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^testsecureacceptance\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post-in",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://secureacceptance.in.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^secureacceptance\\.in\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
     {
       "id": "worldpay-eprotect-js-api-prelive",
       "psp": "worldpay_eprotect",

package/dist/preflight-schemas.json

@@ -469,6 +469,7 @@
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
                 "paypal-hosted-fields-payments-sdk",
+                "cybersource-secure-acceptance-silent-order-post",
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
                 "fiserv-secure-data-capture-frame",
@@ -523,6 +524,8 @@
                 "gmo-link-hosted-page-test",
                 "cybersource-flex-microform-script-test",
                 "cybersource-flex-microform-field-test",
+                "cybersource-secure-acceptance-silent-order-post-test",
+                "cybersource-secure-acceptance-silent-order-post-in",
                 "worldpay-eprotect-js-api-prelive",
                 "worldpay-eprotect-iframe-client-prelive",
                 "worldpay-eprotect-payframe-prelive",
@@ -1100,6 +1103,7 @@
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
                       "paypal-hosted-fields-payments-sdk",
+                      "cybersource-secure-acceptance-silent-order-post",
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",
                       "fiserv-secure-data-capture-frame",
@@ -1154,6 +1158,8 @@
                       "gmo-link-hosted-page-test",
                       "cybersource-flex-microform-script-test",
                       "cybersource-flex-microform-field-test",
+                      "cybersource-secure-acceptance-silent-order-post-test",
+                      "cybersource-secure-acceptance-silent-order-post-in",
                       "worldpay-eprotect-js-api-prelive",
                       "worldpay-eprotect-iframe-client-prelive",
                       "worldpay-eprotect-payframe-prelive",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 9d383b5155c791fc68947784fe3e2c16d03d3056572fb353f98305358fe75bc9
+// source-sha256: fc24e6cb50ab112c3a15983c461185a9189bd0cf8c5e1ceb73e8432e6eebc37f
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -79,6 +79,23 @@ RULES.push({ id: 'paypal-hosted-fields-payments-sdk', psp: 'paypal', kinds: ['fr
         paypalHostedFieldsSource('https://www.paypal.com/sdk/js?components=hosted-fields'),
         { kind: 'saved_observation', reference: 'planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames', reviewed_on: '2026-10-07' }],
     variant_unverified: 'PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.' });
+// CyberSource Secure Acceptance's Silent Order POST (the Secure Acceptance Checkout API), reviewed 2026-10-08 from
+// CyberSource's endpoint table and Arrow Electronics' public bundles (no card was sent). The merchant's own page
+// posts the card fields, unsigned, beside the fields its server signed, to a /silent/ path on CyberSource's Secure
+// Acceptance hosts: production, test (testsecureacceptance) and production in India (secureacceptance.in), below.
+// Arrow submits that form into a hidden iframe; a merchant can also post it as the page's own form. No Vault mode
+// takes that post over, and the checkout SDK stops it (checkout/src/cybersource-secure-acceptance.ts). So the form,
+// and a frame or document on a /silent/ path, name cybersource_secure_acceptance and the result stays unknown
+// through `variant_unverified`. Hosted Checkout, the same hosts without /silent/, takes the card on CyberSource's
+// own page and is not named here.
+const secureAcceptanceSources = [
+    { kind: 'official_documentation', reference: 'https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html', reviewed_on: '2026-10-08' },
+    { kind: 'saved_observation', reference: 'arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form', reviewed_on: '2026-10-08' },
+];
+RULES.push({ id: 'cybersource-secure-acceptance-silent-order-post', psp: 'cybersource_secure_acceptance', kinds: ['form', 'document', 'frame', 'iframe'],
+    hostname: /^secureacceptance\.cybersource\.com$/, pathname: /^\/silent\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\/?$/,
+    origin: 'https://secureacceptance.cybersource.com', path_pattern: '/silent/*', sources: secureAcceptanceSources,
+    variant_unverified: 'CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource\'s Secure Acceptance hosts; no Vault mode takes that request over.' });
 // Fiserv Commerce Hub, read 2026-09-23 from Home Depot's OrangePay frame and Fiserv's
 // docs: payment-fields.js renders one Secure Data Capture iframe per card field, and
 // the Checkout JS SDK is Commerce Hub's other browser entry. Fiserv ships dark (its
@@ -310,6 +327,9 @@ for (const [baseId, suffix, hostname, origin] of [
     ['gmo-link-hosted-page', 'test', /^pt01\.mul-pay\.jp$/, 'https://pt01.mul-pay.jp'],
     ['cybersource-flex-microform-script', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
     ['cybersource-flex-microform-field', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
+    // Secure Acceptance's test host and its production host in India serve the same /silent/ paths.
+    ['cybersource-secure-acceptance-silent-order-post', 'test', /^testsecureacceptance\.cybersource\.com$/, 'https://testsecureacceptance.cybersource.com'],
+    ['cybersource-secure-acceptance-silent-order-post', 'in', /^secureacceptance\.in\.cybersource\.com$/, 'https://secureacceptance.in.cybersource.com'],
     ['worldpay-eprotect-js-api', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],
     ['worldpay-eprotect-iframe-client', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],
     ['worldpay-eprotect-payframe', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "e570ccbce59b77166e6faef140042c068130bfe2cc4355c054e52ea2aed756e2",
+  "catalog_sha256": "a1bfa3f9da2942711afca14cfc7158a49274869c66e685abc0d36839d2e96454",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.4",
+  "version": "0.23.6",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",