@agent-cards/sdk 0.23.5 → 0.23.7

package/dist/prepared-processor.d.ts

@@ -11,8 +11,13 @@
  * amadeus_checkout: prepared only. Its SDK tunnel abandons the add after 30 seconds, too soon
  * for an approval after Pay. Its environments are its hosts: paypages (production) and
  * paypages.test (sandbox).
+ *
+ * cybersource_secure_acceptance: prepared only. The merchant's page asks its hidden frame for
+ * CyberSource's reply 30 times, a second apart, from Save (Arrow Electronics), too soon for an
+ * approval after Save. Its environments are its two hosts: secureacceptance (production) and
+ * testsecureacceptance (sandbox).
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -30,7 +35,8 @@ export declare function preparationRequestMethod(psp: string): 'GET' | 'POST';
  * hosts too: connect (production) and connect-cert (sandbox). So are CyberSource
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
- * profile pins.
+ * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
+ * live, testsecureacceptance is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**
@@ -59,13 +65,16 @@ export declare function preparationEndpoint(psp: PreparationProcessor, environme
  * What a preparation binds beyond its processor and environment. CreditGuard: the merchant page the
  * cardholder approved (the submit's ppDomain names it) and the hosted page the checkout framed (the
  * submit must pay that page's own transaction). Worldpay eProtect: the paypageId naming the Worldpay
- * merchant the registration is for, fixed before its page sent anything. Every other processor
- * ignores all three.
+ * merchant the registration is for, fixed before its page sent anything. CyberSource Secure
+ * Acceptance: the profile id naming the CyberSource merchant profile the token is created for, and the
+ * page the cardholder approved, which the request's Origin, Referer and receipt page must be on. Every
+ * other processor ignores all four.
  */
 export interface PreparedRequestBinding {
     merchantOrigin?: string;
     paymentPageUrl?: string;
     paypageId?: string | null;
+    secureAcceptanceProfileId?: string | null;
 }
 /**
  * The approved merchant page's host, with its port if it has one: what the Amadeus SDK sends in its
@@ -100,6 +109,9 @@ export declare function matchesPreparedMerchantRequest(profileId: string, reques
  * A Worldpay eProtect preparation names the paypageId its registration must carry.
  * An Amadeus preparation binds its SDK's Host header to the page the cardholder approved
  * (merchantOrigin), as the API does.
+ * A CyberSource Secure Acceptance preparation names the profile id its token create must carry and
+ * the page it must come from, and its signed currency must be the approved one, as the API's create
+ * holds it.
  */
 export declare function matchesPreparation(preparation: {
     psp: PreparationProcessor;
@@ -111,6 +123,8 @@ export declare function matchesPreparation(preparation: {
     merchantOrigin?: string;
     paymentPageUrl?: string;
     paypageId?: string;
+    secureAcceptanceProfileId?: string;
+    currency?: string;
 }, requestUrl: string, method: string, body?: string | null, headers?: Record<string, string>): boolean;
 /**
  * The reason a claim reports for a request its preparation does not match. An Amadeus preparation
@@ -121,4 +135,4 @@ export declare function matchesPreparation(preparation: {
  * header that does not name the approved page is `amadeus_header_binding`. Everything else, another
  * processor's request or the other environment's host included, is `checkout_changed`.
  */
-export declare function preparedRequestRefusal(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, body?: string | null, headers?: Record<string, string>, merchantOrigin?: string | null): string;
+export declare function preparedRequestRefusal(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, body?: string | null, headers?: Record<string, string>, merchantOrigin?: string | null, currency?: string | null): string;

package/dist/prepared-processor.js

@@ -12,6 +12,7 @@ import { CREDITGUARD_SANDBOX_HOST, creditguardPageProcessUrl, creditguardPrepara
 import { eprotectPreparationUrl, isPreparedEprotectRequest } from './eprotect.generated.js';
 import { amadeusEnvironment, amadeusPreparationUrls, amadeusRequestRefusal, isPreparedAmadeusRequest } from './amadeus-checkout.generated.js';
 import { isPreparedVerifoneRequest } from './verifone.js';
+import { isPreparedSecureAcceptanceRequest, secureAcceptanceEnvironment, secureAcceptancePreparationUrl, secureAcceptanceRequestRefusal, } from './cybersource-secure-acceptance.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -25,12 +26,14 @@ export function preparationRequestMethod(psp) {
  * hosts too: connect (production) and connect-cert (sandbox). So are CyberSource
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
- * profile pins.
+ * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
+ * live, testsecureacceptance is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
-    return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone'].includes(psp) && ['production', 'sandbox'].includes(environment);
+    return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
+        'cybersource_secure_acceptance'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -69,6 +72,9 @@ export function preparationEndpoint(psp, environment) {
         return creditguardPreparationUrl(environment);
     if (psp === 'worldpay_eprotect')
         return eprotectPreparationUrl(environment);
+    // The token-create URL on the environment's host, as the API names it: the one request the claim binds.
+    if (psp === 'cybersource_secure_acceptance')
+        return secureAcceptancePreparationUrl(environment);
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -195,6 +201,20 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     }
     if (method.toUpperCase() !== 'POST' || !validPreparationEnvironment(psp, environment))
         return false;
+    // CyberSource Secure Acceptance: the token create on the prepared environment's host, admitted whole by
+    // payment-core (isPreparedSecureAcceptanceRequest, the rule the API and the Vault bind with too), naming
+    // the profile id the preparation carries, with its Origin, its Referer and its receipt page on the page
+    // the cardholder approved. A preparation that carries no profile id or no page never matches.
+    if (psp === 'cybersource_secure_acceptance') {
+        if (typeof binding.secureAcceptanceProfileId !== 'string' || typeof binding.merchantOrigin !== 'string')
+            return false;
+        try {
+            return isPreparedSecureAcceptanceRequest(requestUrl, 'POST', body ?? '', headers ?? {}, environment, { profileId: binding.secureAcceptanceProfileId, merchantOrigin: binding.merchantOrigin }) === true;
+        }
+        catch {
+            return false;
+        }
+    }
     // CyberSource Flex: this environment's exact tokens URL, application/jwt with only the headers a
     // browser adds beside it, and a Microform field iframe's JWE. The adapters claim only after the
     // Flex gate verified the issuing field iframe's capture context against that JWE's key.
@@ -285,8 +305,16 @@ export function matchesPreparedMerchantRequest(profileId, requestUrl, method, bo
  * A Worldpay eProtect preparation names the paypageId its registration must carry.
  * An Amadeus preparation binds its SDK's Host header to the page the cardholder approved
  * (merchantOrigin), as the API does.
+ * A CyberSource Secure Acceptance preparation names the profile id its token create must carry and
+ * the page it must come from, and its signed currency must be the approved one, as the API's create
+ * holds it.
  */
 export function matchesPreparation(preparation, requestUrl, method, body, headers) {
+    if (preparation.psp === 'cybersource_secure_acceptance') {
+        if (!matchesPreparedRequest(preparation.psp, preparation.environment, requestUrl, method, body, headers, { merchantOrigin: preparation.merchantOrigin, secureAcceptanceProfileId: preparation.secureAcceptanceProfileId }))
+            return false;
+        return secureAcceptanceClaimRefusal(requestUrl, body, headers, preparation.merchantOrigin, preparation.currency) === null;
+    }
     // A Verifone preparation pays only its profile's reviewed leg, as payment-core pauses it.
     if (preparation.psp === 'verifone') {
         return typeof preparation.merchantProfile === 'string' && method.toUpperCase() === 'POST'
@@ -303,6 +331,28 @@ export function matchesPreparation(preparation, requestUrl, method, body, header
     }
     return matchesPreparedRequest(preparation.psp, preparation.environment, requestUrl, method, body, headers, { merchantOrigin: preparation.merchantOrigin, paymentPageUrl: preparation.paymentPageUrl, paypageId: preparation.paypageId });
 }
+/**
+ * What payment-core's request rule (secureAcceptanceRequestRefusal) refuses in a Secure Acceptance token
+ * create sent from the approved page, for the approved currency when one is given, or null when it
+ * refuses nothing. A rule that cannot judge the request refuses it as unreadable.
+ */
+function secureAcceptanceClaimRefusal(requestUrl, body, headers, merchantOrigin, currency) {
+    if (typeof merchantOrigin !== 'string')
+        return 'origin_header';
+    let verdict;
+    try {
+        verdict = secureAcceptanceRequestRefusal({ url: requestUrl, method: 'POST', headers: { ...(headers ?? {}) }, body: body ?? '' }, { merchantOrigin, ...(typeof currency === 'string' ? { currency } : {}) });
+    }
+    catch {
+        return 'body_unreadable';
+    }
+    if (verdict === null || verdict === undefined)
+        return null;
+    if (typeof verdict === 'string')
+        return verdict;
+    const reason = verdict.reason;
+    return typeof reason === 'string' ? reason : 'body_unreadable';
+}
 /**
  * The reason a claim reports for a request its preparation does not match. An Amadeus preparation
  * names what payment-core's Amadeus check refused on its own environment's card URL, as
@@ -312,7 +362,24 @@ export function matchesPreparation(preparation, requestUrl, method, body, header
  * header that does not name the approved page is `amadeus_header_binding`. Everything else, another
  * processor's request or the other environment's host included, is `checkout_changed`.
  */
-export function preparedRequestRefusal(psp, environment, requestUrl, body, headers, merchantOrigin) {
+export function preparedRequestRefusal(psp, environment, requestUrl, body, headers, merchantOrigin, currency) {
+    // A Secure Acceptance token create on the prepared environment's host names what payment-core's request
+    // rule refused, as `secure_acceptance_<reason>`: a frame post with no Origin header is
+    // `secure_acceptance_origin_header`, a receipt page off the approved page `secure_acceptance_receipt_page`.
+    // Another profile id, another host or another request is `checkout_changed`.
+    if (psp === 'cybersource_secure_acceptance') {
+        let hostEnvironment = null;
+        try {
+            hostEnvironment = secureAcceptanceEnvironment(new URL(requestUrl).hostname);
+        }
+        catch {
+            hostEnvironment = null;
+        }
+        if (hostEnvironment !== environment)
+            return 'checkout_changed';
+        const reason = secureAcceptanceClaimRefusal(requestUrl, body, headers, merchantOrigin, currency);
+        return reason === null ? 'checkout_changed' : `secure_acceptance_${reason}`;
+    }
     if (psp !== 'amadeus_checkout' || amadeusEnvironment(requestUrl) !== environment)
         return 'checkout_changed';
     const merchantHost = merchantHostOf(merchantOrigin);

package/dist/registry.js

@@ -10,6 +10,8 @@
 import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
 import { isEprotectTokenRequest } from './eprotect.generated.js';
 import { EPROTECT_PSP } from './eprotect.js';
+import { isSecureAcceptanceTokenRequest } from './cybersource-secure-acceptance.generated.js';
+import { SECURE_ACCEPTANCE_PSP } from './cybersource-secure-acceptance.js';
 export { BUILTIN_REGISTRY };
 /** True for a plain-http loopback address (`127.0.0.1` or `localhost`, any port); the only http a sandbox recogniser admits. */
 export function isLoopbackUrl(parsed) {
@@ -80,6 +82,10 @@ export function findRecognizer(url, registry = BUILTIN_REGISTRY, opts = {}) {
         return (registry.find((r) => {
             if (r.bareEndpoint === true && /[?#]/.test(parsed.href))
                 return false;
+            // CyberSource Secure Acceptance's token create is its exact URL on its own two hosts and nowhere else:
+            // a fixture store pays it on testsecureacceptance.cybersource.com, never on a loopback path.
+            if (r.psp === SECURE_ACCEPTANCE_PSP)
+                return false;
             const anchored = new RegExp(`^(?:${r.match.source})$`, 'i');
             return literalHosts(r.hosts).some((host) => anchored.test(`${host}${parsed.pathname}`));
         }) ?? null);
@@ -110,7 +116,14 @@ export function findRecognizer(url, registry = BUILTIN_REGISTRY, opts = {}) {
         // the request: as on the server (payment-core resolveRecognizerForUrl),
         // only the vendor's exact registration is recognized, never another
         // /eProtect/paypage call.
-        return r.psp !== EPROTECT_PSP || isEprotectTokenRequest(url, 'GET');
+        if (r.psp === EPROTECT_PSP)
+            return isEprotectTokenRequest(url, 'GET');
+        // CyberSource Secure Acceptance's token create is recognized as the server
+        // recognizes it: its exact URL, with no query, fragment, trailing dot or
+        // doubled slash. Any other spelling stays the stop's (pre-claim.ts).
+        if (r.psp === SECURE_ACCEPTANCE_PSP)
+            return isSecureAcceptanceTokenRequest(url, 'POST') === true;
+        return true;
     }) ?? null);
 }
 /**

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 2a58cd64ab81d468d022c21c6f4d6be6e5be4cd29acd1ad8576b549981433afa
+// artifact-sha256: ae602a804a759165b26cb804547bdc99792036a22cc355a6dba49cfb11e92897
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -931,6 +931,37 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         encoding: "jwe",
         passthroughHeaders: []
     },
+    {
+        psp: "cybersource_secure_acceptance",
+        // CyberSource Secure Acceptance's Checkout API (Silent Order POST), Arrow Electronics' card save:
+        // the merchant's page posts its server-signed fields and the unsigned card fields as one hidden
+        // form navigation into a frame, POST /silent/embedded/token/create, application/x-www-form-
+        // urlencoded, a token create at a signed amount of 0. PAN@ card_number (form), expiry @
+        // card_expiry_date (MM-YYYY), CVN @ card_cvn, network @ card_type. cybersource-secure-acceptance.js
+        // holds the request grammar, the reviewed merchants, the device's four-field fill and the reply
+        // rule; recognition also requires isSecureAcceptanceTokenRequest, so only the exact URL on the two
+        // hosts is this request. NOT here: /silent/pay, /silent/token/create, the token update paths and
+        // secureacceptance.in.cybersource.com, which the checkout SDK stops for every company, and Hosted
+        // Checkout (the same hosts without /silent/), where the agent types the card on CyberSource's page.
+        // The test host takes only CyberSource's test cards (S7).
+        // Ships dark: served only to an SDK that declares this capability, gated off for every org until
+        // an operator allowlists one, prepared before Save (the merchant's page asks its frame for the
+        // answer for 30 s), and never replayed by autopilot (EXCLUDED_OPERATIONS).
+        match: "(?:secureacceptance\\.cybersource\\.com|testsecureacceptance\\.cybersource\\.com)/silent/embedded/token/create(?![\\w/.-])",
+        hosts: ["^secureacceptance\\.cybersource\\.com$", "^testsecureacceptance\\.cybersource\\.com$"],
+        sandboxHosts: ["^testsecureacceptance\\.cybersource\\.com$"],
+        hostEnvironmentPinned: true,
+        capability: "cybersource_sa_token_create",
+        preparationRequired: true,
+        encoding: "form",
+        // The paused request's own Origin and Referer: the device sends them with the card, and the
+        // request rule holds both to the preparation's merchant origin. Nothing else rides.
+        passthroughHeaders: ["^origin$", "^referer$"],
+        cardFields: ["card_number"],
+        // A post with no card number on the same URL carries nothing of the agent's and continues untouched.
+        passWithoutCard: "(?:secureacceptance\\.cybersource\\.com|testsecureacceptance\\.cybersource\\.com)/silent/embedded/token/create",
+        request: { method: "POST", cardIn: "body", response: "html_page" }
+    },
     {
         psp: "juspay",
         // Juspay Express Checkout, the merchant-page card flow Swiggy web ships (reviewed bundle
@@ -1381,6 +1412,9 @@ var DATATRANS_TEST_PANS = Object.freeze([
     "36000010000022",
     "3550998599961037"
 ]);
+// src/cybersource-secure-acceptance.js
+var SA_BODY_LIMIT = 32 * 1024;
+var SA_REPLY_LIMIT = 64 * 1024;
 // src/amadeus-checkout.js
 var AMADEUS_CARD_URLS = Object.freeze({
     production: Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.5",
+  "version": "0.23.7",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",