@agent-cards/sdk 0.23.6 → 0.23.7

package/dist/cdp.js

@@ -13,7 +13,7 @@ import { DatatransRepeats } from './datatrans.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
 import { isArmedEkashuUrl } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_PATTERNS, isPaypalHostedFieldsConfirm } from './paypal-hosted-fields.js';
-import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, isCybersourceSecureAcceptanceUrl } from './cybersource-secure-acceptance.js';
+import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, SecureAcceptanceFollowUpWatch, isCybersourceSecureAcceptanceUrl, secureAcceptanceFollowUp, secureAcceptanceFrameAnswer, secureAcceptanceReplyLast4, } from './cybersource-secure-acceptance.js';
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
 import { cseBody } from './cse-body.js';
 import { STRIPE_SETUP_INTENT_CONFIRM, setupConfirmPayingWith } from './stripe-setup.js';
@@ -22,7 +22,7 @@ import { verifoneTemplatedUrl } from './verifone.js';
 import { MerchantHandoffWatch } from './merchant-handoff.js';
 import { MERCHANT_PAGE_WAIT_MS, MerchantTotalWatch } from './merchant-total-watch.js';
 import { hostedFormSubmittedPage } from './hosted-form.js';
-import { amadeusSendWindowMs, armSendWindow, failsAsNetworkError } from './amadeus.js';
+import { armSendWindow, failsAsNetworkError, preparedSendWindowMs, sendWindowProcessor } from './amadeus.js';
 import { CheckoutLifecycle, paymentEndpointGuards } from './lifecycle.js';
 import { CaptureContexts, MicroformFrames, judgeMicroformFrameUrls, loadedCardMicroformFromUrls, refusedRequestFailure, } from './cybersource-flex.js';
 import { CARD_ENDPOINT_REFUSED_STEP_ANSWER, CARD_ENDPOINT_WITHHELD_ANSWER, CardEndpointRefusedError, captureCardEndpointSession, cardEndpointAnswerHeaders, cardEndpointCookies, cardEndpointDetail, cardEndpointNavigationAnswer, cardEndpointPatterns, cardEndpointRouted, } from './card-endpoint.js';
@@ -678,6 +678,43 @@ function playwrightCookieParams(cookie) {
 function stoppedNavigationPage(profile, outcome, reason, authorizationId) {
     return cardEndpointStoppedPage({ outcome, reason, merchant: profile.merchant, authorizationId });
 }
+/**
+ * Who a paused request's stopped page names, or null when the request is not a form navigation the
+ * adapters answer with one: a card endpoint profile whose page submits its form as a navigation names
+ * its merchant, and a Secure Acceptance token create the lane held (a frame navigation, pre-claim.ts)
+ * names CyberSource. Any other request is failed instead.
+ */
+function stoppedPageRecipient(profile, secureAcceptance) {
+    if (secureAcceptance)
+        return CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT;
+    return profile && profile.navigation !== null ? profile.merchant : null;
+}
+/**
+ * How a held Secure Acceptance frame post whose approval failed is answered. The card reached
+ * CyberSource once the device approved or the hand-off began, and CyberSource also answered a row the
+ * API declined as processor_refused, or one whose reply the SDK would not hand the frame (a reply that
+ * failed the rule, or one the API no longer serves): each reads `sent_answer_not_shown`. A reply that
+ * never came within the window reads `stopped_before_send` only when the API confirmed it retired the
+ * row before any processor request, and `sent_answer_not_shown` otherwise, since the device may have
+ * sent the card. Everything else reads as for a card endpoint (failedNavigationRefusal).
+ */
+function secureAcceptanceFailedRefusal(error, sent, authorizationId) {
+    if (sent)
+        return { outcome: 'sent_answer_not_shown', reason: 'outcome_unknown', authorizationId };
+    if (error instanceof ProcessorRefusedError)
+        return { outcome: 'sent_answer_not_shown', reason: 'answer_withheld', authorizationId: error.authorizationId ?? authorizationId };
+    if (error instanceof PaymentOutcomeUnknownError) {
+        const id = error.authorizationId ?? authorizationId;
+        if (error.reason === 'secure_acceptance_reply_unconfirmed' || error.reason === 'response_expired') {
+            return { outcome: 'sent_answer_not_shown', reason: 'answer_withheld', authorizationId: id };
+        }
+        if (error.reason === 'secure_acceptance_reply_late') {
+            return error.processorRequestStarted === false ? { outcome: 'stopped_before_send', reason: 'not_approved', authorizationId: id }
+                : { outcome: 'sent_answer_not_shown', reason: 'outcome_unknown', authorizationId: id };
+        }
+    }
+    return failedNavigationRefusal(error, false, authorizationId);
+}
 /** The API refused the create because this checkout already has a payment waiting or sent (409 merchant_checkout_in_use). */
 function checkoutInUse(error) {
     return error instanceof CheckoutApiError && error.code === 'merchant_checkout_in_use';
@@ -697,6 +734,18 @@ function heldNavigationRefusal(terminal, awaitingApproval, lifecycle) {
     const outcome = refusedNavigationOutcome({ awaitingApproval, status: state.status });
     return { outcome, reason: 'blocked', authorizationId: outcome === 'payment_in_progress' ? state.authorizationId : null };
 }
+/**
+ * How a held Secure Acceptance frame post that no ready preparation binds is answered (the claim
+ * refused it: none was ready, it names another profile id, it carries no Origin): nothing reached the
+ * API for it and its card never left, so the page says so, unless another payment for this checkout is
+ * waiting or may exist (refusedNavigationOutcome), which the page then names.
+ */
+function unboundNavigationRefusal(awaitingApproval, lifecycle) {
+    const state = lifecycle.getState();
+    const outcome = refusedNavigationOutcome({ awaitingApproval, status: state.status });
+    return outcome === 'payment_in_progress' ? { outcome, reason: 'blocked', authorizationId: state.authorizationId }
+        : { outcome, reason: 'not_approved', authorizationId: null };
+}
 /**
  * How a card form navigation whose approval failed is answered, for `authorizationId`. Once
  * the device approved or the hand-off began (`sent`), the card reached the merchant. Before
@@ -1286,10 +1335,11 @@ function merchantAttempt(lifecycle, survives) {
     let rebound = false;
     let delivering = false;
     let bound = null;
-    // An Amadeus send window closes only once the API confirms the card never left the device and
-    // never can (amadeus.ts): a known non-payment, so the prepared checkout ends failed with that
-    // reason, and a fresh attachment can prepare again. Every other stop leaves the outcome unknown.
-    const error = () => reason === 'amadeus_send_window_closed'
+    // A send window (an Amadeus SDK add's, a Secure Acceptance token create's) closes only once the API
+    // confirms the card never left the device and never can (amadeus.ts): a known non-payment, so the
+    // prepared checkout ends failed with that reason, and a fresh attachment can prepare again. Every
+    // other stop leaves the outcome unknown.
+    const error = () => reason === 'amadeus_send_window_closed' || reason === 'secure_acceptance_send_window_closed'
         ? new CheckoutPreparationError(lifecycle.getState().preparationId ?? null, reason)
         : new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, reason);
     const attempt = {
@@ -1515,13 +1565,15 @@ function pauseForBusiness(opts, lifecycle, attemptSignal, request, pageOrigin) {
     return { replay, delivered: { resolve: deliveredResolve, reject: deliveredReject } };
 }
 /**
- * Arm the send window of a request paused under a preparation, when its processor sets one: only a
- * prepared Amadeus SDK add does (amadeus.ts). Returns the disarm function, or null with no window.
- * lifecycle.begin() cleared the authorization ID, so the one the window reads is this attempt's.
+ * Arm the send window of a request paused under a preparation, when its processor sets one: a
+ * prepared Amadeus SDK add and a prepared Secure Acceptance token create do (amadeus.ts
+ * preparedSendWindowMs). Returns the disarm function, or null with no window. lifecycle.begin()
+ * cleared the authorization ID, so the one the window reads is this attempt's.
  */
 function armWindowFor(opts, lifecycle, attempt, preparation, url, delivering) {
-    const ms = preparation ? amadeusSendWindowMs(preparation.psp, url) : null;
-    if (ms === null || !preparation)
+    const ms = preparation ? preparedSendWindowMs(preparation.psp, url) : null;
+    const processor = preparation ? sendWindowProcessor(preparation.psp) : null;
+    if (ms === null || processor === null || !preparation)
         return null;
     return armSendWindow(ms, attempt, {
         authorizationId: () => lifecycle.getState().authorizationId,
@@ -1529,7 +1581,19 @@ function armWindowFor(opts, lifecycle, attempt, preparation, url, delivering) {
         cancel: typeof opts.vault?.cancelAuthorization === 'function' ? (id) => opts.vault.cancelAuthorization(id) : undefined,
         retirePreparation: typeof opts.vault?.retirePreparation === 'function' ? () => opts.vault.retirePreparation(preparation.id) : undefined,
         onEvent: opts.onEvent,
-    });
+    }, processor);
+}
+/**
+ * Begin the follow-up watch after a Secure Acceptance reply was delivered to the frame, when the
+ * preparation's merchant has a reviewed entry that names its next request (secureAcceptanceFollowUp):
+ * none on the test host. Read-only; see SecureAcceptanceFollowUpWatch.
+ */
+function watchSecureAcceptanceFollowUp(watch, preparation, replay) {
+    if (!preparation)
+        return;
+    const followUp = secureAcceptanceFollowUp(preparation);
+    if (followUp)
+        watch.begin(followUp, { authorizationId: replay.authorizationId, last4: secureAcceptanceReplyLast4(replay.body) });
 }
 /**
  * Take over card tokenization for a page.
@@ -1613,6 +1677,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     };
     let merchantContext;
     let targetContextKnown = false;
+    // The page target's id, which is its main frame's id; read once the attachment is set up.
+    let pageTargetId;
     const lifecycle = new CheckoutLifecycle(opts);
     const stripeCheckout = new StripeCheckoutGate(opts);
     const mercadoCheckout = new MercadoCheckoutGate();
@@ -1653,6 +1719,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     const juspayCheckout = new JuspayCheckoutGate(opts.vault);
     const aci = new AciGate(opts.vault);
     const eprotect = new EprotectGate(opts.vault);
+    // The merchant's follow-up request after a delivered Secure Acceptance reply (cybersource-secure-acceptance.ts).
+    const secureAcceptanceFollowUpWatch = new SecureAcceptanceFollowUpWatch(opts.onEvent);
+    lifecycle.abort.signal.addEventListener('abort', () => secureAcceptanceFollowUpWatch.end(), { once: true });
     let preparationFrameId;
     const readDocumentUrl = async () => {
         const tree = await cdp.send('Page.getFrameTree', {}, pageSessionId);
@@ -1697,15 +1766,34 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             return null;
         return { navigation: frame.parentId || sessionId !== pageSessionId ? 'frame' : 'top', url: typeof frame.url === 'string' ? frame.url : undefined };
     };
+    /**
+     * Which frame a paused document request navigates, as documentFrame reads it, without the frame tree where
+     * the answer is already known: a navigation paused on an iframe target's session is a frame's, and one of
+     * the page's main frame (whose id is the page target's id) is the page's own. Chromium does not answer
+     * Page.getFrameTree on a session while that session's own top-level navigation is paused, so the read
+     * would wait for a decision only this answer can make; any other frame's is read from the tree.
+     */
+    const pausedNavigation = async (sessionId, frameId) => {
+        if (typeof frameId !== 'string' || !frameId)
+            return null;
+        if (sessionId && sessionId !== pageSessionId && sessionTypes.get(sessionId) === 'iframe')
+            return 'frame';
+        if (sessionId === pageSessionId && pageTargetId !== undefined && frameId === pageTargetId)
+            return 'top';
+        return (await documentFrame(sessionId, frameId))?.navigation ?? null;
+    };
     /**
      * Refuse a paused request after the pre-claim gates: a card form navigation gets the
      * stopped page (card-endpoint-page.ts) that `refusal` describes, since an aborted page
      * load renders nothing and invites another click on Pay; any other request fails as
-     * cdpFailure says (a network error for CyberSource Flex and Amadeus, else an abort).
+     * cdpFailure says (a network error for CyberSource Flex and Amadeus, else an abort). A
+     * Secure Acceptance token create the lane held is a frame navigation, and its page names
+     * CyberSource (stoppedPageRecipient).
      */
-    const refusePaused = async (requestId, sessionId, url, profile, refusal) => {
-        if (profile && profile.navigation !== null) {
-            const page = stoppedNavigationPage(profile, refusal.outcome, refusal.reason, refusal.authorizationId);
+    const refusePaused = async (requestId, sessionId, url, profile, refusal, secureAcceptance = false) => {
+        const merchant = stoppedPageRecipient(profile, secureAcceptance);
+        if (merchant !== null) {
+            const page = cardEndpointStoppedPage({ outcome: refusal.outcome, reason: refusal.reason, merchant, authorizationId: refusal.authorizationId });
             await cdp.send('Fetch.fulfillRequest', { requestId, responseCode: page.status, responseHeaders: headerEntries(page.headers),
                 body: Buffer.from(page.body).toString('base64') }, sessionId).catch(() => { });
             return;
@@ -2071,6 +2159,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // Read-only: the page this request came from (its session and document loader), and
             // the request itself when a priced merchant profile's rules read it.
             if (!sessionDetached(sessionId) && params.request) {
+                // The merchant's follow-up after a delivered Secure Acceptance reply ends its watch (read-only).
+                secureAcceptanceFollowUpWatch.saw(params.request.method, params.request.url);
                 merchantTotal.sent(key, { method: params.request.method, url: params.request.url,
                     ...(typeof params.request.postData === 'string' ? { requestBody: params.request.postData } : {}),
                     ...(typeof params.loaderId === 'string' && params.loaderId ? { page: `${owner}:${params.loaderId}` } : {}) });
@@ -2317,7 +2407,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             replacesNavigationBody: async () => true,
             readDocumentUrl, lifecycle, preparationGate, onEvent: opts.onEvent, failureSummary,
             // Read only for a card endpoint whose page submits its form as a navigation.
-            navigation: async () => (resourceType === 'Document' ? (await documentFrame(sessionId, frameId))?.navigation ?? null : null),
+            navigation: async () => (resourceType === 'Document' ? pausedNavigation(sessionId, frameId) : null),
             effects: {
                 continueRequest: (postData) => cdp.send('Fetch.continueRequest', { requestId, ...(postData !== undefined ? { postData: Buffer.from(postData).toString('base64') } : {}) }, sessionId),
                 answer: (response) => cdp.send('Fetch.fulfillRequest', { requestId, responseCode: response.status,
@@ -2360,9 +2450,12 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         // A Payrails card save the gate bound to a captured session: its key rides on the create.
         const payrailsSidecar = preClaim.payrails;
         const cardNavigation = preClaim.navigation;
+        // A Secure Acceptance token create the lane held, a navigation of the merchant's hidden frame: every
+        // refusal answers it with the stopped page naming CyberSource, and its approval with CyberSource's page.
+        const secureAcceptance = preClaim.secureAcceptance === true;
         if (!attachmentReady || arming.has(sessionId ?? '__root__') || setupStop.signal.aborted) {
             opts.onEvent?.({ type: 'blocked', detail: 'checkout_interception_not_ready' });
-            await refusePaused(requestId, sessionId, request.url, cardEndpoint, heldNavigationRefusal(terminal, awaitingApproval, lifecycle));
+            await refusePaused(requestId, sessionId, request.url, cardEndpoint, heldNavigationRefusal(terminal, awaitingApproval, lifecycle), secureAcceptance);
             return;
         }
         // A request the catalog marks as routine without a card (a confirmation
@@ -2389,7 +2482,12 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         }
         catch (error) {
             opts.onEvent?.({ type: 'blocked', detail: failureSummary(error) });
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: cdpFailure(request.url) }, sessionId).catch(() => { });
+            // A Secure Acceptance frame post no ready preparation binds (none ready, another profile, no Origin)
+            // ends on the stopped page: nothing reached the API, and the card never left.
+            if (secureAcceptance)
+                await refusePaused(requestId, sessionId, request.url, null, unboundNavigationRefusal(awaitingApproval, lifecycle), true);
+            else
+                await cdp.send('Fetch.failRequest', { requestId, errorReason: cdpFailure(request.url) }, sessionId).catch(() => { });
             return;
         }
         // The page asking again for the purchase an outstanding approval is for:
@@ -2450,7 +2548,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             if (preparation)
                 preparationGate.retireUnboundClaim();
             // A card form navigation never reads that nothing was sent while a payment for this checkout may exist.
-            await refusePaused(requestId, sessionId, request.url, cardEndpoint, heldNavigationRefusal(terminal, awaitingApproval, lifecycle));
+            await refusePaused(requestId, sessionId, request.url, cardEndpoint, heldNavigationRefusal(terminal, awaitingApproval, lifecycle), secureAcceptance);
             if (repeatedAuthorizationId)
                 void opts.vault.reportDuplicateGuard?.(repeatedAuthorizationId);
             return;
@@ -2717,6 +2815,27 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 attempt.assertLive();
                 opts.onEvent?.({ type: 'authorized', detail: cseAuthorizedDetail(replay, deliverRequest.url, continuation.shijiCvv) });
             }
+            else if (secureAcceptance) {
+                // CyberSource's own reply page for the paused frame navigation, as the API stored it and authorize()
+                // checked it, checked once more here so a replay from any path meets the same rule
+                // (secureAcceptanceFrameAnswer): status 200, its one content type, and no CORS answer, which a
+                // navigation never reads. Chrome commits it as CyberSource's own document in the merchant's hidden
+                // frame, and its auto-post takes CyberSource's signed reply to the merchant's receipt page in this
+                // browser's own session, as it would with no Agentcard in between.
+                const answer = replay.mode === 'device_encrypt' ? null : secureAcceptanceFrameAnswer({ url: request.url, body }, replay);
+                if (!answer)
+                    throw new PaymentOutcomeUnknownError(replay.authorizationId, 'secure_acceptance_reply_unconfirmed');
+                await cdp.send('Fetch.fulfillRequest', {
+                    requestId: deliverTo,
+                    responseCode: answer.status,
+                    responseHeaders: headerEntries(answer.headers),
+                    body: Buffer.from(answer.body).toString('base64'),
+                }, deliverOn);
+                attempt.assertLive();
+                opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId,
+                        amountVerified: replay.mode === 'device_encrypt' ? null : replay.amountVerified ?? null, cors: 'none' } });
+                watchSecureAcceptanceFollowUp(secureAcceptanceFollowUpWatch, preparation, replay);
+            }
             else {
                 // The processor's answer, handed to the page as if the processor had
                 // sent it. Cross-origin, the browser then runs its CORS check on it:
@@ -2790,7 +2909,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             }
             // A card form navigation ends on the stopped page: its card reached the merchant once the
             // device approved (the merchant answered it) or the hand-off began; see failedNavigationRefusal.
-            await refusePaused(dead.requestId, dead.sessionId, request.url, cardEndpoint, failedNavigationRefusal(err, handoffStarted || approvedId !== null, approvedId ?? lifecycle.getState().authorizationId));
+            // A Secure Acceptance frame post reads CyberSource's side too (secureAcceptanceFailedRefusal).
+            const sent = handoffStarted || approvedId !== null, failedFor = approvedId ?? lifecycle.getState().authorizationId;
+            await refusePaused(dead.requestId, dead.sessionId, request.url, cardEndpoint, secureAcceptance ? secureAcceptanceFailedRefusal(err, sent, failedFor) : failedNavigationRefusal(err, sent, failedFor), secureAcceptance);
             settlePause();
         }
         finally {
@@ -2815,6 +2936,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             }
             merchantContext = targetInfo.browserContextId;
             targetContextKnown = true;
+            // A page target's id is its main frame's id: a navigation of that frame is the page's own (pausedNavigation).
+            pageTargetId = typeof targetInfo.targetId === 'string' && targetInfo.targetId ? targetInfo.targetId : undefined;
             await cdp.send('Target.setDiscoverTargets', { discover: true });
             assertActive();
             const { targetInfos } = await cdp.send('Target.getTargets');
@@ -2895,6 +3018,9 @@ export async function attachToPlaywright(page, opts) {
     const aci = new AciGate(opts.vault);
     let navigationBodyReplaced;
     const eprotect = new EprotectGate(opts.vault);
+    // The merchant's follow-up request after a delivered Secure Acceptance reply (cybersource-secure-acceptance.ts).
+    const secureAcceptanceFollowUpWatch = new SecureAcceptanceFollowUpWatch(opts.onEvent);
+    lifecycle.abort.signal.addEventListener('abort', () => secureAcceptanceFollowUpWatch.end(), { once: true });
     const readDocumentUrl = async () => {
         if (page.isClosed?.() || typeof page.url !== 'function')
             throw new Error('merchant_document_unavailable');
@@ -2966,6 +3092,13 @@ export async function attachToPlaywright(page, opts) {
         // A new document is on its way: the main frame's next navigation commits it.
         if (mainDocument(request))
             documentRequest = request;
+        // The merchant's follow-up after a delivered Secure Acceptance reply ends its watch (read-only).
+        if (secureAcceptanceFollowUpWatch.active) {
+            try {
+                secureAcceptanceFollowUpWatch.saw(request.method(), request.url());
+            }
+            catch { /* a request the page already dropped */ }
+        }
         try {
             const body = typeof request.postData === 'function' ? request.postData() : null;
             merchantTotal.sent(keyOf(request), { method: request.method(), url: request.url(),
@@ -3303,11 +3436,16 @@ export async function attachToPlaywright(page, opts) {
             // A Payrails card save the gate bound to a captured session: its key rides on the create.
             const payrailsSidecar = preClaim.payrails;
             const cardNavigation = preClaim.navigation;
+            // A Secure Acceptance token create the lane held, a navigation of the merchant's hidden frame (see attachToCdp).
+            const secureAcceptance = preClaim.secureAcceptance === true;
             // A card form navigation is refused with the stopped page, anything else as refusalFailure says (see attachToCdp
             // refusePaused).
-            const refuseRoute = (target, refusal) => (cardEndpoint && cardEndpoint.navigation !== null
-                ? target.fulfill(stoppedNavigationPage(cardEndpoint, refusal.outcome, refusal.reason, refusal.authorizationId))
-                : target.abort(refusalFailure(request.url())));
+            const refuseRoute = (target, refusal) => {
+                const merchant = stoppedPageRecipient(cardEndpoint, secureAcceptance);
+                return merchant !== null
+                    ? target.fulfill(cardEndpointStoppedPage({ outcome: refusal.outcome, reason: refusal.reason, merchant, authorizationId: refusal.authorizationId }))
+                    : target.abort(refusalFailure(request.url()));
+            };
             if (!attachmentReady || setupStop.signal.aborted) {
                 opts.onEvent?.({ type: 'blocked', detail: 'checkout_interception_not_ready' });
                 return refuseRoute(route, heldNavigationRefusal(terminal, awaitingApproval, lifecycle));
@@ -3325,6 +3463,9 @@ export async function attachToPlaywright(page, opts) {
             }
             catch (error) {
                 opts.onEvent?.({ type: 'blocked', detail: failureSummary(error) });
+                // As in attachToCdp: a Secure Acceptance frame post no ready preparation binds ends on the stopped page.
+                if (secureAcceptance)
+                    return refuseRoute(route, unboundNavigationRefusal(awaitingApproval, lifecycle));
                 return route.abort(refusalFailure(request.url()));
             }
             // The page asking again for the purchase an outstanding approval is
@@ -3614,6 +3755,20 @@ export async function attachToPlaywright(page, opts) {
                     assertRequestLive();
                     opts.onEvent?.({ type: 'authorized', detail: cseAuthorizedDetail(replay, deliverRequest.url(), continuation.shijiCvv) });
                 }
+                else if (secureAcceptance) {
+                    // Same as the CDP path: CyberSource's own page, status 200 and its one content type, checked once
+                    // more, for the paused frame navigation. The SDK writes no CORS answer; Playwright appends its own to
+                    // any cross-origin fulfill whose request names an Origin (microsoft/playwright#12929), which a
+                    // navigation never reads.
+                    const answer = replay.mode === 'device_encrypt' ? null : secureAcceptanceFrameAnswer({ url: request.url(), body }, replay);
+                    if (!answer)
+                        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'secure_acceptance_reply_unconfirmed');
+                    await deliverTo.fulfill({ status: answer.status, headers: answer.headers, body: answer.body });
+                    assertRequestLive();
+                    opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId,
+                            amountVerified: replay.mode === 'device_encrypt' ? null : replay.amountVerified ?? null, cors: 'none' } });
+                    watchSecureAcceptanceFollowUp(secureAcceptanceFollowUpWatch, preparation, replay);
+                }
                 else {
                     // Playwright adds these itself when a cross-origin fulfill carries
                     // none; written here anyway (replacing a stale value) so a
@@ -3658,8 +3813,10 @@ export async function attachToPlaywright(page, opts) {
                     reportCardEndpointRefusal(opts, cardEndpoint, err);
                     opts.onEvent?.({ type: 'failed', detail: failureSummary(err) });
                 }
-                // As in attachToCdp: a card form navigation ends on the stopped page (failedNavigationRefusal).
-                await Promise.resolve().then(() => refuseRoute(dead, failedNavigationRefusal(err, handoffStarted || approvedId !== null, approvedId ?? lifecycle.getState().authorizationId))).catch(() => { });
+                // As in attachToCdp: a card form navigation ends on the stopped page (failedNavigationRefusal), and a
+                // Secure Acceptance frame post reads CyberSource's side too (secureAcceptanceFailedRefusal).
+                const sent = handoffStarted || approvedId !== null, failedFor = approvedId ?? lifecycle.getState().authorizationId;
+                await Promise.resolve().then(() => refuseRoute(dead, secureAcceptance ? secureAcceptanceFailedRefusal(err, sent, failedFor) : failedNavigationRefusal(err, sent, failedFor))).catch(() => { });
             }
             finally {
                 disarmSendWindow?.();

package/dist/client.d.ts

@@ -176,6 +176,13 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * `ekashu_hosted_payment_page`: NMI's hosted payment page, whose card-free entry this
  * build pauses for the cardholder's device and whose card page this build never lets
  * the agent's browser post to (pre-claim.ts, ekashu.ts); served on the same terms.
+ * `cybersource_sa_token_create`: CyberSource Secure Acceptance's token create
+ * (POST /silent/embedded/token/create), which this build pauses only as the
+ * merchant's hidden frame sends it, binds to a prepared checkout, and answers with
+ * CyberSource's own reply page once neither the API nor the cardholder's device
+ * finds a card in it (cybersource-secure-acceptance.ts). Served on the same terms,
+ * so every other company keeps the stop every build applies to a card posted to
+ * Secure Acceptance.
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -456,6 +463,19 @@ export interface PrepareCheckoutOptions {
      * processor.
      */
     paypageId?: string;
+    /**
+     * CyberSource Secure Acceptance only: the merchant's Secure Acceptance profile
+     * id, CyberSource's UUID shape (36 characters, hex in either case). It names
+     * the CyberSource merchant profile the card's token is created for, so it is
+     * fixed before the page sends anything: a token request naming another profile
+     * id never spends the approval. Required on the sandbox environment (your own
+     * test profile on testsecureacceptance.cybersource.com). On production leave it
+     * out for a merchant Agentcard reviewed: the SDK fills the one profile id its
+     * entry pins for the checkout page's origin, and refuses a checkout it can name
+     * none for (`secure_acceptance_profile_id_invalid`). Refused on every other
+     * processor.
+     */
+    secureAcceptanceProfileId?: string;
     /**
      * CyberSource Flex only: the cardholder's device tokenizes the card when it approves, before
      * Pay, under the capture context of the card fields the page already loaded, so the page's
@@ -525,6 +545,8 @@ export interface PreparedCheckout {
     readonly paymentPageUrl?: string;
     /** Worldpay eProtect only: the paypageId the API confirmed, the one merchant whose registration may spend this approval. */
     readonly paypageId?: string;
+    /** CyberSource Secure Acceptance only: the profile id the API confirmed, the one merchant profile whose token create may spend this approval. */
+    readonly secureAcceptanceProfileId?: string;
     /**
      * CyberSource Flex, tokenized before Pay: the capture context and fields the cardholder's device
      * tokenized the card under. Only a field request loaded under this context, with these fields,