@agent-cards/sdk 0.23.5 → 0.23.6

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Pause a Worldpay eProtect registration whatever Worldpay key its page names. Worldpay rotates its production eProtect key daily (`26457000011` on 2026-10-08), and 0.23.3 refused every registration whose `publicKeyId` was not `26455500012`, the key it shipped, so an attached checkout at any eProtect merchant read `unsupported`. The SDK now takes any key id in Worldpay's digits; the cardholder's device encrypts the card under the key it reads from Worldpay's own `eProtect-api3.js` and writes that key's id into its copy, so no later rotation needs an SDK release. SmartPak Equine (paypageId `zhs8KzuRAryaq4cs` at `https://www.smartpakequine.com`) and Nordstrom (`fL33BPkRvbRqJ29S` at `https://www.nordstrom.com`) are reviewed eProtect merchants: a live checkout there passes `merchant: 'SmartPak Equine'` or `merchant: 'Nordstrom'` exactly, and `prepare()` refuses another name with `merchant_profile_mismatch` before any network call. eProtect stays dark for every org Agentcard has not enabled, and a payment also needs the matching API and Vault releases.
+
 - Stop the card your agent typed from reaching CyberSource through Secure Acceptance's Silent Order POST. A merchant that takes the card in its own form, such as Arrow Electronics, has its server sign the order fields, then posts them with the card fields (`card_number`, `card_expiry_date`, `card_cvn`) to a `/silent/` path on `secureacceptance.cybersource.com` (`testsecureacceptance.cybersource.com` in CyberSource's test environment, `secureacceptance.in.cybersource.com` in India); Arrow submits that form into a hidden iframe. No Agentcard payment takes that post over, and earlier releases let it through, so CyberSource received the dummy card. Both adapters now stop it for every company, whatever `syncRegistry()` served: a form the page submits as a page load, in the page or in a frame, gets the page that says Agentcard stopped the payment before the card reached CyberSource, and a fetch or an XHR fails. A `card_number` in the URL's query, as a form with method GET sends it, stops the request the same way. The controller reads `unsupported` with reason `unsupported_cybersource_secure_acceptance` and holds, like every `unsupported` reason: to pay another way on the same page, attach again. A post with no `card_number`, or an empty one, such as a payment with a stored `payment_token`, continues untouched, and so does Hosted Checkout, the same hosts without `/silent/`, where your agent types the card on CyberSource's own page. The SDK stops a post whose body it cannot read with a `blocked` event, `unreadable_cybersource_secure_acceptance_request`, and does not hold the checkout. TypeScript: the controller's `unsupported()` reasons gain `unsupported_cybersource_secure_acceptance`; code that switches exhaustively over them needs the new case.
 
 - Name CyberSource Secure Acceptance's Silent Order POST in a preflight inspection. A form, a frame or a document on a `/silent/` path of `secureacceptance.cybersource.com`, `testsecureacceptance.cybersource.com` or `secureacceptance.in.cybersource.com` now names `cybersource_secure_acceptance`, and the result stays `unknown`: `processor_variant_unverified` for a visible form, and `payment_signal_inactive` for a hidden one such as Arrow's. The catalog's `catalog_sha256` changes; `catalog_version` stays `2026-09-15.1`.

package/README.md

@@ -1938,7 +1938,8 @@ eProtect traffic exactly as it found it, as it does before a sync.
 
 The merchant's script gives up on the registration 10 to 15 seconds after Pay,
 and re-sends it to a failover host after 5, which is too soon for a prompt that
-waits on a person. An eProtect checkout is therefore always prepared:
+waits on a person (SmartPak Equine's card form sets neither, so its script
+waits). An eProtect checkout is therefore always prepared:
 
 ```ts
 const checkout = await attachToPlaywright(page, {
@@ -1955,8 +1956,10 @@ await page.getByRole('button', { name: 'Place order', exact: true }).click();
   registration is for, which is also the merchant Worldpay lets charge the card
   again. It is fixed before the page sends anything, so a registration naming
   another paypageId never spends the approval. The Worldpay iframe names it in
-  its URL (`/eProtect/payframe_<paypageId>_...`); a JS API merchant carries it
-  in its eProtect configuration.
+  its URL (`/eProtect/payframe_<paypageId>_...`, or the `paypageid` query of
+  `/eProtect/eProtect.html`, as at Nordstrom); a JS API merchant carries it in
+  its eProtect configuration (SmartPak Equine's page keeps it in a hidden
+  `PayPageId` input).
 - `cardId` is required, and the approval is locked to that card. Worldpay never
   receives an expiry: the merchant sends the one typed into its form with the
   registration. The agent types a placeholder number of the stored card's
@@ -1965,9 +1968,12 @@ await page.getByRole('button', { name: 'Place order', exact: true }).click();
   prepares.
 
 After Pay, the SDK pauses the registration and binds it to the preparation.
-The cardholder's device, still on the approval page, encrypts the approved card
-under Worldpay's key into that same query and sends it through Agentcard's
-encrypted relay. The SDK then answers the paused script as Worldpay would:
+Worldpay rotates its production key daily, so the SDK pauses a registration
+whatever Worldpay key id its page names. The cardholder's device, still on the
+approval page, reads Worldpay's key from Worldpay's own `eProtect-api3.js` on
+the connection that carries the card, encrypts the approved card under it into
+that same query, writes that key's id into `publicKeyId`, and sends it through
+Agentcard's encrypted relay. The SDK then answers the paused script as Worldpay would:
 the registration in the script's own callback, under Worldpay's script type,
 with only the fields the merchant needs (no first six or last four digits).
 The SDK reads the authorization every 500 ms for 15 seconds, so the answer
@@ -2001,8 +2007,16 @@ one the approval shows. The API refuses another name with
 `merchant_profile_mismatch` and a paypageId with no pin with
 `unsupported_checkout`, before any preparation exists; when this release pins
 the paypageId too, the SDK refuses another name first, before any network call.
-Agentcard has pinned no production merchant yet, so the API refuses every live
-eProtect checkout today; the pre-live host needs no pin. An approved answer that is not a
+This release pins two production merchants, and the API refuses every other
+live eProtect checkout; the pre-live host needs no pin:
+
+| `merchant` | `paypageId` | Merchant origin |
+| --- | --- | --- |
+| `SmartPak Equine` | `zhs8KzuRAryaq4cs` | `https://www.smartpakequine.com` |
+| `Nordstrom` | `fL33BPkRvbRqJ29S` | `https://www.nordstrom.com` |
+
+The merchant origin is the checkout page's own, the top page that frames
+Worldpay's iframe at Nordstrom. An approved answer that is not a
 registration for the paused request raises `PaymentOutcomeUnknownError` with
 reason `eprotect_registration_unconfirmed`: the device may have registered the
 card, so reconcile the merchant before trying again.

package/dist/eprotect.d.ts

@@ -18,8 +18,8 @@ export interface EprotectMerchantPin {
  * (merchant_profile_mismatch) before any preparation exists. When this build pins the paypageId
  * too, it refuses another name first, before any network call, as a Fiserv checkout must name its
  * key pin's merchant. A paypageId this build does not pin is the API's to judge (unsupported_checkout
- * with no pin); none is pinned on either side yet. The pre-live host takes only the guide's test
- * cards and needs no pin. `pins` is for tests.
+ * with no pin). This build pins SmartPak Equine and Nordstrom, under those exact names. The pre-live
+ * host takes only the guide's test cards and needs no pin. `pins` is for tests.
  */
 export declare function eprotectCheckoutRefusal(input: {
     environment: string;

package/dist/eprotect.generated.d.ts

@@ -4,22 +4,61 @@ declare var EPROTECT_HOSTS: Readonly<{
     sandbox: "request.eprotect.vantivprelive.com";
 }>;
 declare var EPROTECT_SECONDARY_HOST: string;
-declare var EPROTECT_KEYS: Readonly<{
-    production: Readonly<{
-        keyId: "26455500012";
-        exponent: "10001";
-        modulus: "b9c7095ff203475347a932a6e11bacbb61cfb66a877158683634e5fb1dbf9923401bd7f82c21b67ffd3c82bdc64797c5e2ba4b57c68b1aaccb7fbe847da7234a21df910dfcc0aebacbbd4d36b35c0c35f7ee27358610d2e2fb2aa87d359deda0b5f4d77e31ac5ab98741da5b6052cb657087da05ad496154b8954939ee6fd463301ff15ebca94f210f4627a255a95ca8833728c1ab80b6cc3a874e4d3dce5d40f66c043ba1b042717bb9cc5d89434fa489a51c2ba9a3843b310df58c9e8a54c36cdd5fd66e76651b6fc88850b60e0739abfcf7d0d0cb44beb7e768da3bcea7e743b8c2d57edef59643f54432ccf60c49d4f5f84410ecf9c5a7af19bc5e792801";
-    }>;
-    sandbox: Readonly<{
-        keyId: "1";
-        exponent: "10001";
-        modulus: "bc637dd74ba76507dad5af1c7ad6f97dbef5298c3b9f74caea7301347db7b4a8c37f26491863100667246fd45071f3346bf62239f9b117d06fb67861b66ad0d158beeddd2f6f28be93d846f4c8f9ba1bd7e8f186f36cab0e432f22b3d732c221a9ff00a9bfacb88b24503e2695fd7237835d4936477b21289478906a49b164f52503c20eb29f11fcbda2af94deb9a0bfde5a4589276897436315c5d664d60bf10650164f509283aed39747ad5d6cb2bbe54e1b42306e5db37dfd42dcbfcc689e0ddfe3bc9cb22ae7018e5a4a1ff39813584ac7bd6d6d65ca763f0a672da454081ea20e8b1d403316d80b9353ba396bea8962b1a7d2f775c76612d857c1f7594f";
-    }>;
-}>;
+declare var EPROTECT_KEY_SOURCES: any;
+declare var EPROTECT_KEY_SCRIPT_MAX_BYTES: number;
 declare var EPROTECT_TEST_PANS: Readonly<Set<unknown>>;
 declare var EPROTECT_REFUSAL_CODES: readonly string[];
 declare function eprotectEnvironment(hostname: any): "production" | "sandbox" | null;
 declare function eprotectPreparationUrl(environment: any): string;
+declare function eprotectKeySourceUrl(environment: any): string;
+declare function eprotectScriptFacts(bytes: any): {
+    literals: number;
+    keyId?: undefined;
+    modulus?: undefined;
+    exponent?: undefined;
+    modulusSha256?: undefined;
+    maskedSha256?: undefined;
+} | {
+    literals: number;
+    keyId: string;
+    modulus: string;
+    exponent: string;
+    modulusSha256: string;
+    maskedSha256: string;
+};
+declare function eprotectKeyScriptVerdict(environment: any, bytes: any, sources?: any): {
+    ok: boolean;
+    reason: string;
+    maskedSha256?: undefined;
+    keyId?: undefined;
+    modulus?: undefined;
+    modulusSha256?: undefined;
+} | {
+    ok: boolean;
+    reason: string;
+    maskedSha256: string | undefined;
+    keyId?: undefined;
+    modulus?: undefined;
+    modulusSha256?: undefined;
+} | {
+    ok: boolean;
+    keyId: string;
+    modulus: string;
+    modulusSha256: string;
+    maskedSha256: string;
+    reason?: undefined;
+};
+declare function readEprotectKeyScript(environment: any, bytes: any, sources?: any): Readonly<{
+    environment: any;
+    keyId: string | undefined;
+    modulus: string | undefined;
+    exponent: "10001";
+    modulusSha256: string | undefined;
+}>;
+declare function eprotectKeyReport(key: any): Readonly<{
+    key_id: any;
+    modulus_sha256: any;
+}>;
 declare function isEprotectTokenRequest(url: any, method: any): boolean;
 declare function isEprotectRequest(request: any): boolean;
 declare function eprotectRequestFacts(url: any): {
@@ -35,7 +74,7 @@ declare function eprotectSecondaryAttempt(url: any): {
     paypageId: any;
     id: any;
 } | null;
-declare function isEprotectDeviceRequest(templateUrl: any, deviceUrl: any): boolean;
+declare function isEprotectDeviceRequest(templateUrl: any, deviceUrl: any, sessionKeyId: any): boolean;
 declare function isPreparedEprotectRequest(url: any, method: any, body: any, environment: any, paypageId: any): boolean;
 declare var EPROTECT_MERCHANT_PINS: any;
 declare function eprotectMerchantPin(paypageId: any, merchantOrigin: any, pins?: any): any;
@@ -43,7 +82,7 @@ declare function eprotectMerchantRefusal(environment: any, paypageId: any, merch
 declare function defaultRandom(bytes: any): void;
 declare function eprotectEncrypt(text: any, key: any, random?: typeof defaultRandom): string;
 declare function eprotectCardRefusal(environment: any, cardNumber: any): "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "invalid_card_number" | "live_host_refuses_documented_test_card" | null;
-declare function eprotectDeviceRequest(templateUrl: any, card: any, random?: typeof defaultRandom): {
+declare function eprotectDeviceRequest(templateUrl: any, card: any, sessionKey: any, random?: typeof defaultRandom): {
     url: string;
     method: string;
     headers: {};
@@ -74,4 +113,4 @@ declare function eprotectGiveUp(url: any): {
     code: any;
 } | null;
 declare function eprotectRefusalCode(bodyText: any): any;
-export { EPROTECT_HOSTS, EPROTECT_KEYS, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, sanitizeEprotectRegistration };
+export { EPROTECT_HOSTS, EPROTECT_KEY_SCRIPT_MAX_BYTES, EPROTECT_KEY_SOURCES, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectKeyReport, eprotectKeyScriptVerdict, eprotectKeySourceUrl, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectScriptFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, readEprotectKeyScript, sanitizeEprotectRegistration };

package/dist/eprotect.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a9b6c689690a719af354b2f260064b8e276b8566f3b3482f4b1891f6c4db1caa
+// artifact-sha256: 9a686322a5e8f0667fa74e6e3f06d6adfa8a242ab79c18467054ded429f9a3af
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -10,6 +10,137 @@ function deepFreeze(value) {
     }
     return value;
 }
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
 // src/test-pans.js
 function immutableSet(values, name) {
     const set = new Set(values);
@@ -33,18 +164,19 @@ var EPROTECT_HOSTS = /* @__PURE__ */ Object.freeze({
     sandbox: "request.eprotect.vantivprelive.com"
 });
 var EPROTECT_SECONDARY_HOST = "secondary.eprotect.vantivcnp.com";
-var EPROTECT_KEYS = /* @__PURE__ */ Object.freeze({
-    production: /* @__PURE__ */ Object.freeze({
-        keyId: "26455500012",
-        exponent: "10001",
-        modulus: "b9c7095ff203475347a932a6e11bacbb61cfb66a877158683634e5fb1dbf9923401bd7f82c21b67ffd3c82bdc64797c5e2ba4b57c68b1aaccb7fbe847da7234a21df910dfcc0aebacbbd4d36b35c0c35f7ee27358610d2e2fb2aa87d359deda0b5f4d77e31ac5ab98741da5b6052cb657087da05ad496154b8954939ee6fd463301ff15ebca94f210f4627a255a95ca8833728c1ab80b6cc3a874e4d3dce5d40f66c043ba1b042717bb9cc5d89434fa489a51c2ba9a3843b310df58c9e8a54c36cdd5fd66e76651b6fc88850b60e0739abfcf7d0d0cb44beb7e768da3bcea7e743b8c2d57edef59643f54432ccf60c49d4f5f84410ecf9c5a7af19bc5e792801"
-    }),
-    sandbox: /* @__PURE__ */ Object.freeze({
-        keyId: "1",
-        exponent: "10001",
-        modulus: "bc637dd74ba76507dad5af1c7ad6f97dbef5298c3b9f74caea7301347db7b4a8c37f26491863100667246fd45071f3346bf62239f9b117d06fb67861b66ad0d158beeddd2f6f28be93d846f4c8f9ba1bd7e8f186f36cab0e432f22b3d732c221a9ff00a9bfacb88b24503e2695fd7237835d4936477b21289478906a49b164f52503c20eb29f11fcbda2af94deb9a0bfde5a4589276897436315c5d664d60bf10650164f509283aed39747ad5d6cb2bbe54e1b42306e5db37dfd42dcbfcc689e0ddfe3bc9cb22ae7018e5a4a1ff39813584ac7bd6d6d65ca763f0a672da454081ea20e8b1d403316d80b9353ba396bea8962b1a7d2f775c76612d857c1f7594f"
-    })
+var EPROTECT_KEY_SOURCES = /* @__PURE__ */ deepFreeze({
+    production: {
+        host: "request.eprotect.vantivcnp.com",
+        path: "/eProtect/eProtect-api3.js",
+        maskedSha256: "e4e55a14c10b25a497db7931124c62c6fb78d3b0c5c2afbc95303b398dd3f439"
+    },
+    sandbox: {
+        host: "request.eprotect.vantivprelive.com",
+        path: "/eProtect/eProtect-api3.js",
+        maskedSha256: "1fc0d21e51a36900bcfbbb6117a05a1eed7d004aa2decb85e12d4e19236dca15"
+    }
 });
+var EPROTECT_KEY_SCRIPT_MAX_BYTES = 65536;
 var EPROTECT_TEST_PANS = /* @__PURE__ */ immutableSet([
     "5112010000000003",
     "44570100000000009",
@@ -107,6 +239,98 @@ function eprotectPreparationUrl(environment) {
         throw new Error("unsupported_eprotect_environment");
     return `https://${EPROTECT_HOSTS[environment]}${EPROTECT_PATH}`;
 }
+function eprotectKeySourceUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_eprotect_environment");
+    const source = EPROTECT_KEY_SOURCES[environment];
+    return `https://${source.host}${source.path}`;
+}
+var KEY_LITERAL = 'modulus:"([0-9a-f]*)",exponent:"([0-9a-f]*)",keyId:"([0-9]*)"';
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var SESSION_KEYS = /* @__PURE__ */ new WeakSet();
+function scriptBytes(bytes, limit) {
+    if (!ArrayBuffer.isView(bytes) || Object.prototype.toString.call(bytes) !== "[object Uint8Array]")
+        return null;
+    const view = (
+    /** @type {Uint8Array} */
+    bytes);
+    if (view.length > limit)
+        return null;
+    const copy = new Uint8Array(view.length);
+    copy.set(view);
+    return copy;
+}
+function byteText(bytes) {
+    let text = "";
+    for (let at = 0; at < bytes.length; at += 8192)
+        text += String.fromCharCode.apply(null, bytes.subarray(at, at + 8192));
+    return text;
+}
+function occurrences(text, label) {
+    let count = 0;
+    for (let at = text.indexOf(label); at !== -1; at = text.indexOf(label, at + label.length))
+        count++;
+    return count;
+}
+function keyLiteralFacts(data) {
+    const text = byteText(data);
+    const literals = [...text.matchAll(new RegExp(KEY_LITERAL, "g"))];
+    if (literals.length !== 1 || occurrences(text, "modulus:") !== 1 || occurrences(text, "keyId:") !== 1)
+        return { literals: literals.length };
+    const [whole, modulus, exponent, keyId] = literals[0];
+    const start = literals[0].index;
+    const kept = `modulus:"",exponent:"${exponent}",keyId:""`;
+    const masked = new Uint8Array(data.length - whole.length + kept.length);
+    masked.set(data.subarray(0, start));
+    for (let i = 0; i < kept.length; i++)
+        masked[start + i] = kept.charCodeAt(i);
+    masked.set(data.subarray(start + whole.length), start + kept.length);
+    return { literals: 1, keyId, modulus, exponent, modulusSha256: sha256Hex(modulus), maskedSha256: sha256Hex(masked) };
+}
+function eprotectScriptFacts(bytes) {
+    const data = scriptBytes(bytes, Infinity);
+    return data ? keyLiteralFacts(data) : { literals: 0 };
+}
+function eprotectKeyScriptVerdict(environment, bytes, sources = EPROTECT_KEY_SOURCES) {
+    const source = (environment === "production" || environment === "sandbox") && sources && typeof sources === "object" ? sources[environment] : null;
+    const pinned = source && typeof source === "object" ? source.maskedSha256 : null;
+    if (!exact(SHA256_HEX, pinned))
+        return { ok: false, reason: "unsupported_eprotect_environment" };
+    const data = scriptBytes(bytes, EPROTECT_KEY_SCRIPT_MAX_BYTES);
+    if (!data || data.length === 0)
+        return { ok: false, reason: "eprotect_script_unreadable" };
+    const facts = keyLiteralFacts(data);
+    if (!("maskedSha256" in facts))
+        return { ok: false, reason: "eprotect_script_key_literal" };
+    const { keyId, modulus, exponent, modulusSha256, maskedSha256 } = facts;
+    if (!exact(/^[0-9]{1,32}$/, keyId) || !exact(/^[0-9a-f]{512}$/, modulus))
+        return { ok: false, reason: "eprotect_script_key_literal", maskedSha256 };
+    if (maskedSha256 !== pinned)
+        return { ok: false, reason: "eprotect_script_changed", maskedSha256 };
+    if (modulus[0] < "8" || exponent !== "10001")
+        return { ok: false, reason: "eprotect_key_weak", maskedSha256 };
+    return { ok: true, keyId, modulus, modulusSha256, maskedSha256 };
+}
+function readEprotectKeyScript(environment, bytes, sources = EPROTECT_KEY_SOURCES) {
+    const verdict = eprotectKeyScriptVerdict(environment, bytes, sources);
+    if (!verdict.ok) {
+        throw Object.assign(new Error("Refusing to pay: Worldpay's eProtect script is not the one Agentcard reviewed."), { reason: verdict.reason });
+    }
+    const key = Object.freeze({
+        environment,
+        keyId: verdict.keyId,
+        modulus: verdict.modulus,
+        exponent: "10001",
+        modulusSha256: verdict.modulusSha256
+    });
+    SESSION_KEYS.add(key);
+    return key;
+}
+function eprotectKeyReport(key) {
+    if (!SESSION_KEYS.has(key))
+        throw new Error("Refusing to pay: no Worldpay key was read for this eProtect session.");
+    return Object.freeze({ key_id: key.keyId, modulus_sha256: key.modulusSha256 });
+}
 var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function bytesToBase64(bytes) {
     let out = "";
@@ -141,6 +365,8 @@ var VALUE_RULES = {
     // true bypasses Worldpay's Mod10 check and hides the BIN: private-label cards only.
     pciNonSensitive: (value) => value === "false",
     encryptedCvv: ciphertext,
+    // Worldpay's key id, digits only. Any key passes: Worldpay rotates its production key daily, and
+    // the device writes the key it read from Worldpay into its own copy (eprotectDeviceRequest).
     publicKeyId: (value) => exact(/^[0-9]{1,32}$/, value),
     firstEight: (value) => value === "true",
     requestType: (value) => value === "eProtect",
@@ -182,8 +408,6 @@ function parseRegistration(url, host) {
     }
     if (QUERY_ORDER.some((name) => !OPTIONAL.has(name) && !(name in values)))
         return null;
-    if (values.publicKeyId !== EPROTECT_KEYS[environment].keyId)
-        return null;
     if (values.targetServer !== (host === "secondary" ? "secondary" : "primary"))
         return null;
     return { environment, origin: parsed.origin, pairs, values };
@@ -214,12 +438,14 @@ function eprotectSecondaryAttempt(url) {
     return parsed ? { paypageId: parsed.values.paypageId, id: parsed.values.id } : null;
 }
 var CIPHERTEXT_KEYS = /* @__PURE__ */ new Set(["encryptedAccount", "encryptedCvv"]);
-function isEprotectDeviceRequest(templateUrl, deviceUrl) {
+function isEprotectDeviceRequest(templateUrl, deviceUrl, sessionKeyId) {
+    if (sessionKeyId !== void 0 && !exact(/^[0-9]{1,32}$/, sessionKeyId))
+        return false;
     const template = parseRegistration(templateUrl, "primary");
     const device = parseRegistration(deviceUrl, "primary");
     if (!template || !device || device.origin !== template.origin || device.pairs.length !== template.pairs.length)
         return false;
-    return device.pairs.every((pair, i) => pair.name === template.pairs[i].name && (CIPHERTEXT_KEYS.has(pair.name) ? pair.raw !== template.pairs[i].raw : pair.raw === template.pairs[i].raw));
+    return device.pairs.every((pair, i) => pair.name === template.pairs[i].name && (CIPHERTEXT_KEYS.has(pair.name) ? pair.raw !== template.pairs[i].raw : pair.name === "publicKeyId" && sessionKeyId !== void 0 ? pair.raw === sessionKeyId : pair.raw === template.pairs[i].raw));
 }
 function isPreparedEprotectRequest(url, method, body, environment, paypageId) {
     if (environment !== "production" && environment !== "sandbox")
@@ -229,7 +455,10 @@ function isPreparedEprotectRequest(url, method, body, environment, paypageId) {
     const facts = eprotectRequestFacts(url);
     return !!facts && facts.environment === environment && facts.paypageId === paypageId;
 }
-var EPROTECT_MERCHANT_PINS = /* @__PURE__ */ deepFreeze([]);
+var EPROTECT_MERCHANT_PINS = /* @__PURE__ */ deepFreeze([
+    { id: "smartpak_equine", merchant: "SmartPak Equine", origins: ["https://www.smartpakequine.com"], paypageIds: ["zhs8KzuRAryaq4cs"] },
+    { id: "nordstrom", merchant: "Nordstrom", origins: ["https://www.nordstrom.com"], paypageIds: ["fL33BPkRvbRqJ29S"] }
+]);
 function eprotectMerchantPin(paypageId, merchantOrigin, pins = EPROTECT_MERCHANT_PINS) {
     if (!exact(PAYPAGE_ID, paypageId) || typeof merchantOrigin !== "string" || !Array.isArray(pins))
         return null;
@@ -315,10 +544,13 @@ function eprotectCardRefusal(environment, cardNumber) {
         return "invalid_card_number";
     return EPROTECT_TEST_PANS.has(pan) || DOCUMENTED_TEST_PANS.has(pan) ? "live_host_refuses_documented_test_card" : null;
 }
-function eprotectDeviceRequest(templateUrl, card, random = defaultRandom) {
+function eprotectDeviceRequest(templateUrl, card, sessionKey, random = defaultRandom) {
     const parsed = parseRegistration(templateUrl, "primary");
     if (!parsed)
         throw new Error("Refusing to pay: unsupported eProtect card request.");
+    if (!SESSION_KEYS.has(sessionKey) || sessionKey.environment !== parsed.environment) {
+        throw new Error("Refusing to pay: no Worldpay key was read for this eProtect session.");
+    }
     const refusal = eprotectCardRefusal(parsed.environment, card && card.number);
     if (refusal === "sandbox_host_requires_documented_test_card") {
         throw new Error("Refusing to pay: a sandbox or test host accepts only the processor's documented test cards, not a real card.");
@@ -329,13 +561,14 @@ function eprotectDeviceRequest(templateUrl, card, random = defaultRandom) {
     if (withCvv && (typeof card.cvc !== "string" || !/^[0-9]{3,4}$/.test(card.cvc))) {
         throw new Error("Could not fill the card fields for Worldpay eProtect. Nothing was sent.");
     }
-    const key = EPROTECT_KEYS[parsed.environment];
-    const fresh = { encryptedAccount: eprotectEncrypt(String(card.number), key, random) };
+    const fresh = { encryptedAccount: eprotectEncrypt(String(card.number), sessionKey, random) };
     if (withCvv)
-        fresh.encryptedCvv = eprotectEncrypt(card.cvc, key, random);
+        fresh.encryptedCvv = eprotectEncrypt(card.cvc, sessionKey, random);
+    if (parsed.values.publicKeyId !== sessionKey.keyId)
+        fresh.publicKeyId = sessionKey.keyId;
     const query = parsed.pairs.map(({ name, raw }) => `${name}=${name in fresh ? canonicalComponent(fresh[name]) : raw}`).join("&");
     const url = `${parsed.origin}${EPROTECT_PATH}?${query}`;
-    if (!isEprotectDeviceRequest(templateUrl, url))
+    if (!isEprotectDeviceRequest(templateUrl, url, sessionKey.keyId))
         throw new Error("Refusing to pay: unsupported eProtect card request.");
     return { url, method: "GET", headers: {}, body: "", where: Object.keys(fresh) };
 }
@@ -495,4 +728,4 @@ function eprotectRefusalCode(bodyText) {
         return null;
     return Object.entries(answer).every(([key, value]) => REFUSAL_FIELDS.has(key) && typeof value === "string") ? answer.response : null;
 }
-export { EPROTECT_HOSTS, EPROTECT_KEYS, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, sanitizeEprotectRegistration };
+export { EPROTECT_HOSTS, EPROTECT_KEY_SCRIPT_MAX_BYTES, EPROTECT_KEY_SOURCES, EPROTECT_MERCHANT_PINS, EPROTECT_PATH, EPROTECT_REFUSAL_CODES, EPROTECT_SECONDARY_HOST, EPROTECT_TEST_PANS, eprotectCardRefusal, eprotectDeviceRequest, eprotectEncrypt, eprotectEnvironment, eprotectGiveUp, eprotectJsonp, eprotectKeyReport, eprotectKeyScriptVerdict, eprotectKeySourceUrl, eprotectMerchantPin, eprotectMerchantRefusal, eprotectOutcome, eprotectPreparationUrl, eprotectRefusalCode, eprotectRequestFacts, eprotectScriptFacts, eprotectSecondaryAttempt, isEprotectDeviceRequest, isEprotectRequest, isEprotectTokenRequest, isPreparedEprotectRequest, readEprotectKeyScript, sanitizeEprotectRegistration };

package/dist/eprotect.js

@@ -3,8 +3,9 @@
 // The vendor's browser script (eProtect-api2/3, litle-api2/3, and the Worldpay iframe, which runs
 // them in a Worldpay-origin frame) encrypts the card in the page and sends it as ONE JSONP
 // <script> GET to /eProtect/paypage; the answer is `<callback>({...})`. The rules that judge that
-// request (the query grammar, the pinned keys, the failover and give-up reports, the answer
-// allowlist) live in payment-core and reach this SDK as eprotect.generated.ts. This module holds
+// request (the query grammar, which takes any key id in Worldpay's digits because Worldpay rotates
+// its production key daily, the failover and give-up reports, the answer allowlist, the reviewed
+// merchants) live in payment-core and reach this SDK as eprotect.generated.ts. This module holds
 // only what an attachment decides from them:
 //   - which request on eProtect's hosts is the registration to pause for the vault;
 //   - which is the vendor's failover re-send of a registration the page already sent (aborted
@@ -28,8 +29,8 @@ const EPROTECT_HOSTNAMES = [EPROTECT_HOSTS.production, EPROTECT_HOSTS.sandbox, E
  * (merchant_profile_mismatch) before any preparation exists. When this build pins the paypageId
  * too, it refuses another name first, before any network call, as a Fiserv checkout must name its
  * key pin's merchant. A paypageId this build does not pin is the API's to judge (unsupported_checkout
- * with no pin); none is pinned on either side yet. The pre-live host takes only the guide's test
- * cards and needs no pin. `pins` is for tests.
+ * with no pin). This build pins SmartPak Equine and Nordstrom, under those exact names. The pre-live
+ * host takes only the guide's test cards and needs no pin. `pins` is for tests.
  */
 export function eprotectCheckoutRefusal(input, pins) {
     if (input.environment !== 'production')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.5",
+  "version": "0.23.6",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",