@agent-cards/sdk 0.23.6 → 0.23.7

package/dist/cybersource-secure-acceptance.js

@@ -28,10 +28,14 @@
  *     and holds, as every unsupported refusal does;
  *   - no card_number, or an empty one, as in a payment with a stored payment_token: continue untouched;
  *   - a body the adapter could not read: stop that request alone, since nothing proves it carries no card.
- * A request the synced registry recognizes as a card request belongs to that recognizer instead; no
- * build serves one today. Hosted Checkout, the same hosts without /silent/, takes the card on
- * CyberSource's own page, and neither adapter arms it.
+ * A request the synced registry recognizes as a card request belongs to the Secure Acceptance lane
+ * instead (below): the API serves that recognizer only to a build that declares
+ * `cybersource_sa_token_create` and only for a company Agentcard turned the lane on for, and it covers
+ * exactly the token create, POST https://<host>/silent/embedded/token/create on the production or the
+ * test host. Every other company, and every other /silent/ path, keeps the stop above. Hosted Checkout,
+ * the same hosts without /silent/, takes the card on CyberSource's own page, and neither adapter arms it.
  */
+import { SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, isSecureAcceptanceTokenRequest, secureAcceptanceMerchantEntry, secureAcceptanceReplyOutcome, } from './cybersource-secure-acceptance.generated.js';
 export const CYBERSOURCE_SECURE_ACCEPTANCE_REASON = 'unsupported_cybersource_secure_acceptance';
 /** Where the stopped page says the card was going. */
 export const CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT = 'CyberSource';
@@ -212,3 +216,240 @@ function formFields(body) {
             fields.push(pair);
     return fields;
 }
+// ---- The Secure Acceptance lane (dark launch) ----
+//
+// For a company Agentcard turned it on for, the API serves one recognizer (payment-core definitions.js,
+// capability cybersource_sa_token_create) for one request: POST /silent/embedded/token/create on
+// secureacceptance.cybersource.com (production) or testsecureacceptance.cybersource.com (sandbox), a
+// create_payment_token at a signed amount of 0, with the merchant's signed fields and the four unsigned
+// card fields. The rules that judge that request and CyberSource's reply live in payment-core and reach
+// this SDK as cybersource-secure-acceptance.generated.ts; the API and the cardholder's device run the same
+// ones. The lane pays the request only through a prepared checkout, approved before the agent clicks
+// Save, and only as the merchant's hidden frame sends it:
+//   - the pre-claim gate holds a card-bearing post to that URL to a navigation of a frame (pre-claim.ts);
+//     a top navigation, a fetch or an XHR is stopped as an unrecognized post is;
+//   - the claim binds the preparation only to the request payment-core admits for the preparation's
+//     environment, profile id and page origin (prepared-processor.ts);
+//   - the cardholder's device sends the real card to CyberSource through the checkout relay, and the API
+//     hands back CyberSource's own reply page once neither it nor the device finds a card in it;
+//   - the adapters answer the paused frame navigation with that page, status 200 and its one content type
+//     (secureAcceptanceFrameAnswer), so Chrome commits it as CyberSource's own document and its auto-post
+//     reaches the merchant's receipt page in the agent's own session, as it would with no Agentcard.
+// The clocks fit Arrow's page, which asks its frame 30 times, a second apart, from Save: reads every
+// 500 ms for 30 s after the create; a pause with nothing being handed over 20 s after it is retired (the
+// send window, amadeus.ts armSendWindow); a reply not read 45 s after the pause is an unknown outcome;
+// and once the page is delivered, a merchant whose reviewed entry names its next request is watched for
+// it for 10 s.
+/** The processor id, as the registry and the API name it. */
+export const SECURE_ACCEPTANCE_PSP = 'cybersource_secure_acceptance';
+/** The dark-launch capability the API serves the Secure Acceptance recognizer behind (payment-core definitions.js). */
+export const SECURE_ACCEPTANCE_CAPABILITY = 'cybersource_sa_token_create';
+/** How long after the pause a paused token request may still be sent; past it, nothing being handed over, it is retired. */
+export const SECURE_ACCEPTANCE_SEND_WINDOW_MS = 20_000;
+/** How long after the pause CyberSource's reply may still be read; past it the outcome is unknown. */
+export const SECURE_ACCEPTANCE_REPLY_WINDOW_MS = 45_000;
+/** How long after the create the authorization is read every 500 ms instead of at the caller's interval. */
+export const SECURE_ACCEPTANCE_FAST_POLL_MS = 30_000;
+/** How long after the page is delivered the merchant's follow-up request is watched for. */
+export const SECURE_ACCEPTANCE_FOLLOW_UP_MS = 10_000;
+/** The one content type the paused frame's answer carries, as CyberSource serves its page. */
+export const SECURE_ACCEPTANCE_ANSWER_CONTENT_TYPE = SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE;
+/** A CyberSource Secure Acceptance profile id: a UUID shape, 36 characters, hex in either case. */
+const PROFILE_ID = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+/** This build's reviewed entries, or the ones a test passes. */
+function reviewedEntries(entries) {
+    return entries ?? SECURE_ACCEPTANCE_MERCHANTS;
+}
+/** The reviewed entry that lists this profile id for this origin, through payment-core's own lookup, or null. */
+function entryFor(profileId, merchantOrigin, entries) {
+    try {
+        return secureAcceptanceMerchantEntry(profileId, merchantOrigin, entries) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The profile id a Secure Acceptance checkout prepares, or null when it can name none. A profile id the
+ * caller passes must have CyberSource's UUID shape, and is the one the bound request must carry. On the
+ * production host the caller may leave it out when exactly one entry this build reviewed lists the
+ * checkout page's origin, under exactly one profile id: that one is used, so the agent names nothing it
+ * cannot see. The test host has no entries (it takes only CyberSource's test cards), so a sandbox
+ * checkout always names its own. `entries` is for tests.
+ */
+export function secureAcceptanceCheckoutProfile(input, entries) {
+    if (input.profileId !== undefined)
+        return typeof input.profileId === 'string' && PROFILE_ID.test(input.profileId) ? input.profileId : null;
+    if (input.environment !== 'production')
+        return null;
+    const listing = reviewedEntries(entries).filter((entry) => entry.environment === 'production' && entry.origins.includes(input.merchantOrigin));
+    if (listing.length !== 1 || listing[0].profileIds.length !== 1)
+        return null;
+    const [profileId] = listing[0].profileIds;
+    return typeof profileId === 'string' && PROFILE_ID.test(profileId) ? profileId : null;
+}
+/**
+ * Why a Secure Acceptance checkout may not be prepared under `merchant`, or null when it may:
+ * `secure_acceptance_profile_id_invalid` when it names no profile id this build can stand behind
+ * (secureAcceptanceCheckoutProfile), and, on the production host, `merchant_profile_mismatch` when the
+ * entry this build reviewed for that profile id and origin names another merchant, the one the approval
+ * shows. A profile id this build has not reviewed is the API's to judge (unsupported_checkout), as an
+ * eProtect paypageId is. `entries` is for tests.
+ */
+export function secureAcceptanceCheckoutRefusal(input, entries) {
+    const profileId = secureAcceptanceCheckoutProfile(input, entries);
+    if (profileId === null)
+        return 'secure_acceptance_profile_id_invalid';
+    if (input.environment !== 'production')
+        return null;
+    const entry = entryFor(profileId, input.merchantOrigin, entries);
+    return entry && entry.merchant !== input.merchant ? 'merchant_profile_mismatch' : null;
+}
+/**
+ * Whether a paused request is the one shape the lane pays: a POST to the exact token-create URL on one of
+ * the two hosts (payment-core isSecureAcceptanceTokenRequest), sent as a navigation of a frame, as a
+ * merchant's form targeted at its hidden iframe sends it. A top navigation, a fetch and an XHR are not.
+ */
+export function isSecureAcceptanceFramePost(request) {
+    if (request.navigation !== 'frame')
+        return false;
+    try {
+        return isSecureAcceptanceTokenRequest(request.url, String(request.method).toUpperCase()) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The answer a paused token request gets, or null when the approved reply is not one to hand the frame:
+ * CyberSource's own page, byte for byte as the API stored it, with status 200 and the one content type
+ * CyberSource serves it with, and no other header. The page must pass payment-core's reply rule for the
+ * paused request (secureAcceptanceReplyOutcome: one hidden-input form posting to the receipt page the
+ * request signed, the request's own echoes, a masked number, a token, no card), run here with no card and
+ * no last four: the device and the API checked those.
+ */
+export function secureAcceptanceFrameAnswer(request, response) {
+    if (!request || typeof request.url !== 'string' || typeof request.body !== 'string' || !response || typeof response.body !== 'string')
+        return null;
+    let verdict;
+    try {
+        // No card and no last four: the device and the API checked the page against the card.
+        verdict = secureAcceptanceReplyOutcome({ status: response.status, headers: { ...(response.headers ?? {}) }, bodyText: response.body }, { url: request.url, body: request.body }, undefined, undefined);
+    }
+    catch {
+        return null;
+    }
+    if (verdict?.outcome !== 'token' || verdict.page !== response.body)
+        return null;
+    return { status: 200, headers: { 'content-type': SECURE_ACCEPTANCE_ANSWER_CONTENT_TYPE }, body: response.body };
+}
+/**
+ * The request a reviewed merchant's page sends once its receipt page answered (Arrow: the payment-method
+ * set), for a production preparation whose profile id and origin an entry lists with one; null otherwise,
+ * the test host included. `entries` is for tests.
+ */
+export function secureAcceptanceFollowUp(preparation, entries) {
+    if (preparation.environment !== 'production' || typeof preparation.secureAcceptanceProfileId !== 'string')
+        return null;
+    const followUp = entryFor(preparation.secureAcceptanceProfileId, preparation.merchantOrigin, entries)?.followUp;
+    if (!followUp || typeof followUp.method !== 'string' || typeof followUp.url !== 'string')
+        return null;
+    try {
+        return { method: followUp.method.toUpperCase(), url: new URL(followUp.url).href };
+    }
+    catch {
+        return null;
+    }
+}
+const INPUT_TAG = /<input\b((?:[^>"']|"[^"]*"|'[^']*')*)>/gi;
+const ATTRIBUTE = /([^\s=/>"']+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+const NAMED_ENTITIES = { amp: '&', quot: '"', apos: "'", lt: '<', gt: '>' };
+function decodeEntities(value) {
+    return value.replace(/&(#x[0-9a-f]{1,6}|#[0-9]{1,7}|[a-z]+);/gi, (whole, entity) => {
+        if (entity[0] === '#') {
+            const code = entity[1] === 'x' || entity[1] === 'X' ? parseInt(entity.slice(2), 16) : parseInt(entity.slice(1), 10);
+            return Number.isInteger(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+        }
+        return NAMED_ENTITIES[entity.toLowerCase()] ?? whole;
+    });
+}
+/**
+ * The last four digits of the masked number CyberSource's reply page echoes (req_card_number, masked as
+ * x's and the last four), or null when the page carries no single such field. The page passed the reply
+ * rule before it was delivered, so this only reads it back for the follow-up event; it never carries more
+ * than those four digits.
+ */
+export function secureAcceptanceReplyLast4(page) {
+    if (typeof page !== 'string')
+        return null;
+    const values = [];
+    for (const tag of page.matchAll(INPUT_TAG)) {
+        const attributes = new Map();
+        for (const attribute of tag[1].matchAll(ATTRIBUTE)) {
+            const name = attribute[1].toLowerCase();
+            if (!attributes.has(name))
+                attributes.set(name, decodeEntities(attribute[2] ?? attribute[3] ?? attribute[4] ?? ''));
+        }
+        if (attributes.get('name') === 'req_card_number')
+            values.push(attributes.get('value') ?? '');
+    }
+    return values.length === 1 ? /^[xX]{9,15}([0-9]{4})$/.exec(values[0])?.[1] ?? null : null;
+}
+/** A URL's origin and path, the part a follow-up request is matched on (its query is the page's own). */
+function originAndPath(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * One attachment's watch for the merchant's follow-up request after a delivered reply. Read-only: it
+ * pauses, changes and delays nothing. The adapters report every request the page sends (CDP
+ * Network.requestWillBeSent, Playwright page.on('request')) through saw(); when none matches the
+ * merchant's follow-up within SECURE_ACCEPTANCE_FOLLOW_UP_MS, the event `secure_acceptance_reply_unused`
+ * names the authorization and the masked number's last four, so the agent can find the card the merchant
+ * may have kept (in its saved cards, ending in those four) before it ever asks for a new checkout.
+ */
+export class SecureAcceptanceFollowUpWatch {
+    onEvent;
+    ms;
+    watching = null;
+    constructor(onEvent, ms = SECURE_ACCEPTANCE_FOLLOW_UP_MS) {
+        this.onEvent = onEvent;
+        this.ms = ms;
+    }
+    /** Start watching for `followUp` after the reply for `authorizationId` was delivered; a watch already running ends unreported. */
+    begin(followUp, detail) {
+        this.end();
+        const target = originAndPath(followUp.url);
+        if (target === null)
+            return;
+        const timer = setTimeout(() => {
+            if (this.watching?.timer !== timer)
+                return;
+            this.watching = null;
+            this.onEvent?.({ type: 'secure_acceptance_reply_unused', detail: { authorizationId: detail.authorizationId, last4: detail.last4 } });
+        }, this.ms);
+        timer.unref?.();
+        this.watching = { target, method: String(followUp.method).toUpperCase(), timer };
+    }
+    /** A request the page sent: the follow-up, when it is the one being watched for, ends the watch. */
+    saw(method, url) {
+        if (!this.watching || typeof method !== 'string' || typeof url !== 'string')
+            return;
+        if (method.toUpperCase() === this.watching.method && originAndPath(url) === this.watching.target)
+            this.end();
+    }
+    /** True while a watch runs. */
+    get active() { return this.watching !== null; }
+    /** End the watch with no event. */
+    end() {
+        if (!this.watching)
+            return;
+        clearTimeout(this.watching.timer);
+        this.watching = null;
+    }
+}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
 export type { ConvergeRefusalReason } from './elavon-converge.js';
 export type { WspayRefusalReason } from './wspay.js';
 export type { ShijiStsUnsupportedReason } from './shiji-sts.js';
+export type { SecureAcceptanceCheckoutRefusal, SecureAcceptanceUnknownReason } from './cybersource-secure-acceptance.js';
 export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, VerifoneReplay, HostedFormReplay, CardEndpointReplay, DeviceEncryptReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, PlaceholderCard, } from './client.js';
 export type { MicroformField, MicroformSidecar } from './cybersource-flex.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';

package/dist/juspay.generated.d.ts

@@ -20,7 +20,7 @@ declare function juspayTokenizeAnswer(token: any): {
     };
     body: string;
 };
-declare function juspayTxnsTemplateRefusal(url: any, headers: any, body: any): "card_token" | "format" | "merchant_id" | "card_security_code" | "merchant_mismatch" | "juspay_endpoint" | "content_type" | "unreadable_body" | "unsupported_field" | "missing_field" | "order_id" | "routing_id" | "payment_method_type" | "redirect_after_payment" | "save_to_locker" | "tokenize" | "card_nickname" | null;
+declare function juspayTxnsTemplateRefusal(url: any, headers: any, body: any): "content_type" | "card_token" | "format" | "merchant_id" | "card_security_code" | "merchant_mismatch" | "juspay_endpoint" | "unreadable_body" | "unsupported_field" | "missing_field" | "order_id" | "routing_id" | "payment_method_type" | "redirect_after_payment" | "save_to_locker" | "tokenize" | "card_nickname" | null;
 declare function assertJuspayTxnsTemplate(url: any, headers: any, body: any): Readonly<{
     environment: "production" | "sandbox" | undefined;
     host: any;

package/dist/pre-claim.d.ts

@@ -35,7 +35,8 @@ export type PreClaimDecision = {
 } | {
     kind: 'answer';
 }
-/** `payrails`: the session key a bound Payrails card save carries onto the create. */
+/** `payrails`: the session key a bound Payrails card save carries onto the create. `secureAcceptance`: a CyberSource
+ * Secure Acceptance token create the lane held, a navigation of a frame, answered with a page whatever its outcome. */
  | {
     kind: 'pause';
     stripeStep: StripeStep;
@@ -43,6 +44,7 @@ export type PreClaimDecision = {
     cardEndpoint?: CardEndpointProfile;
     payrails?: PayrailsSidecar;
     navigation?: 'top' | 'frame';
+    secureAcceptance?: true;
 };
 /** The adapter mechanics a gate performs. Each is awaited where the inline code
  * awaited it; none swallow their own transport failure (a gate adds a .catch

package/dist/pre-claim.js

@@ -76,7 +76,7 @@ import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isP
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
-import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, } from './cybersource-secure-acceptance.js';
+import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -1550,20 +1550,99 @@ async function paypalHostedFieldsUnreadable(ctx) {
 //     proves it carries no card;
 //   - any other request (a payment with a stored payment_token and no card, a GET, a CORS preflight)
 //     defers, and the arbiter continues it untouched.
-// A request the synced registry recognizes as a card request defers too, so the arbiter pauses it for
-// that recognizer; no build serves one today. A path outside /silent/ is not this gate's. Synchronous
-// until it must stop a request, like every gate. Exported for the gate registry's tests.
+// A request the synced registry recognizes as a card request is the Secure Acceptance lane's
+// (cybersource-secure-acceptance.ts): the API serves that recognizer only to a build that declares
+// cybersource_sa_token_create, for a company Agentcard turned the lane on for, and only for the exact token
+// create on the production or the test host. Before it pauses, the gate holds such a request to the one
+// shape the lane pays:
+//   - a card post that a merchant's form submits into a frame (a navigation of a frame, as Arrow's hidden
+//     secureAcceptanceiFrame is) pauses for the claim flow, carrying the mark that answers it with a page
+//     whatever its outcome. With no preparation on this attachment it is not paused: it gets the stopped
+//     page, `stopped_before_send`, with a `blocked` event, `preparation_required`, and nothing reaches the
+//     API, since only a prepared checkout pays it;
+//   - a card post as the page's own navigation, from a fetch or from an XHR, or one whose card field the
+//     recognizer reads under no name of its own (another spelling of card_number, which would otherwise
+//     continue as card-free), is stopped as the post to an unrecognized /silent/ path is;
+//   - a body the adapter could not read is stopped alone, as above;
+//   - a body with no card number defers, and continues untouched (the recognizer's passWithoutCard).
+// A path outside /silent/ is not this gate's. Synchronous until it must read the frame or stop a request,
+// like every gate. Exported for the gate registry's tests.
 export const cybersourceSecureAcceptancePreClaim = (ctx) => {
     const { url, method } = ctx.request;
-    if (!isCybersourceSecureAcceptanceUrl(url) || ctx.vault.isCardRequest(url, method))
+    if (!isCybersourceSecureAcceptanceUrl(url))
         return undefined;
+    const recognized = ctx.vault.isCardRequest(url, method);
     // A reader that throws (Playwright's postData() can) reads as a body the adapter could not read.
     const { body, contentType } = cardEndpointPausedBody(ctx);
     const carried = cybersourceSecureAcceptanceRequest(url, method, body, contentType);
     if (carried === 'no_card')
         return undefined;
-    return carried === 'card' ? cybersourceSecureAcceptanceUnsupported(ctx) : cybersourceSecureAcceptanceUnreadable(ctx);
+    if (carried === 'unreadable')
+        return cybersourceSecureAcceptanceUnreadable(ctx);
+    if (!recognized)
+        return cybersourceSecureAcceptanceUnsupported(ctx);
+    // The recognizer's own reading must find the card this gate found, or the adapter would continue the
+    // post as card-free (passWithoutCard) with the agent's card in it.
+    if ((ctx.vault.withoutCard?.(url, body) ?? null) !== null)
+        return cybersourceSecureAcceptanceUnsupported(ctx);
+    return secureAcceptanceHold(ctx);
 };
+/**
+ * The lane's hold on a recognized card post: a navigation of a frame pauses, marked, unless no
+ * preparation exists on an idle attachment; anything else is stopped as unsupported.
+ */
+async function secureAcceptanceHold(ctx) {
+    let navigation = null;
+    try {
+        navigation = ctx.request.navigation === true ? await boundedNavigation(ctx) : null;
+    }
+    catch {
+        navigation = null;
+    }
+    if (!isSecureAcceptanceFramePost({ url: ctx.request.url, method: ctx.request.method, navigation }))
+        return cybersourceSecureAcceptanceUnsupported(ctx);
+    const idle = ctx.attachmentReady() && !ctx.stripeAttachmentBusy() && !ctx.interceptionAborted() && !ctx.terminal()
+        && !ctx.lifecycle.isBlocked() && !ctx.awaitingApproval();
+    if (idle && !ctx.preparationGate.isEngaged())
+        return secureAcceptancePreparationRequired(ctx);
+    return { kind: 'pause', stripeStep: ctx.stripeStep, navigation: 'frame', secureAcceptance: true };
+}
+/** How long the lane waits for the adapter to say which frame a paused navigation is for. */
+const SECURE_ACCEPTANCE_NAVIGATION_READ_MS = 2_000;
+/**
+ * Which frame a paused navigation is for, as the adapter reads it, or null when it cannot say within
+ * SECURE_ACCEPTANCE_NAVIGATION_READ_MS. A read that does not answer (Chromium does not answer a raw CDP
+ * frame tree read on a session whose own top-level navigation is paused) stops the post as not the
+ * reviewed shape, rather than leaving it paused.
+ */
+async function boundedNavigation(ctx) {
+    if (typeof ctx.navigation !== 'function')
+        return null;
+    let timer;
+    const late = new Promise((resolve) => { timer = setTimeout(() => resolve(null), SECURE_ACCEPTANCE_NAVIGATION_READ_MS); });
+    try {
+        return (await Promise.race([ctx.navigation().catch(() => null), late])) ?? null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * A held frame post with no preparation on this attachment: refused before any pause, prompt or
+ * authorization, as a Fiserv capture is, and answered with the stopped page naming CyberSource. A later
+ * prepare() is refused too, as after any first card request.
+ */
+async function secureAcceptancePreparationRequired(ctx) {
+    ctx.preparationGate.observeUnprepared();
+    ctx.lifecycle.preparationRequired();
+    ctx.onEvent?.({ type: 'blocked', detail: 'preparation_required' });
+    try {
+        return await stopNavigationBeforeSend(ctx, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, 'not_approved');
+    }
+    catch { /* the page could not be answered: fail the request below */ }
+    await ctx.effects.abort().catch(() => { });
+    return { kind: 'abort' };
+}
 async function cybersourceSecureAcceptanceUnsupported(ctx) {
     const { url, method } = ctx.request;
     ctx.preparationGate.invalidate('unsupported_checkout');

package/dist/preparation.js

@@ -1,6 +1,7 @@
 import { CheckoutPreparationError } from './client.js';
 import { amountRefusal, validAmountInput } from './client.js';
 import { matchesPreparation, validPreparationEnvironment, preparationEndpoint, preparationBindsByShape, preparationRequestMethod, preparedRequestRefusal } from './prepared-processor.js';
+import { SECURE_ACCEPTANCE_PSP, secureAcceptanceCheckoutProfile } from './cybersource-secure-acceptance.js';
 /** A local, one-use rendezvous. It never starts or retries a merchant request. */
 export class PreparationGate {
     opts;
@@ -106,6 +107,13 @@ export class PreparationGate {
             const page = new URL(this.documentUrl);
             if (!(page.protocol === 'https:' || (page.protocol === 'http:' && page.hostname === 'localhost')) || page.username || page.password)
                 throw new CheckoutPreparationError(null, 'merchant_origin_invalid');
+            // A CyberSource Secure Acceptance checkout names the profile id its token create must carry: the one
+            // passed, or on the production host the one this build's reviewed entry for the page's origin pins
+            // (secureAcceptanceCheckoutProfile). prepareCheckout refuses a checkout that can name none, and the
+            // handle it returns must carry exactly this one.
+            const secureAcceptanceProfileId = options.psp === SECURE_ACCEPTANCE_PSP
+                ? secureAcceptanceCheckoutProfile({ environment: options.environment, profileId: options.secureAcceptanceProfileId, merchantOrigin: page.origin }) ?? undefined
+                : undefined;
             const prepared = await this.opts.vault.prepareCheckout({
                 ...options, user: this.opts.user, merchant: this.opts.merchant,
                 amount: this.opts.amount, currency: this.opts.currency, cardId: this.opts.cardId,
@@ -125,8 +133,10 @@ export class PreparationGate {
             this.prepared = prepared;
             // A Fiserv preparation also names the key pin the cardholder approves (merchantProfile).
             // One that tokenizes before Pay names the capture context its cardholder approved under.
+            // A Secure Acceptance preparation names the profile id its cardholder approved for.
             if (prepared.psp !== options.psp || prepared.environment !== options.environment
                 || prepared.merchantProfile !== options.merchantProfile
+                || prepared.secureAcceptanceProfileId !== secureAcceptanceProfileId
                 || (prepared.cybersourceFlex?.captureContext ?? null) !== (cybersourceFlex?.captureContext ?? null))
                 throw new CheckoutPreparationError(prepared.id, 'checkout_changed');
             if (signal.aborted || this.state !== 'preparing') {
@@ -169,11 +179,14 @@ export class PreparationGate {
         // A Fiserv preparation claims only a capture under the key pin it names.
         // A CreditGuard preparation claims only a submit to the page it framed.
         // A Worldpay eProtect preparation claims only its registration GET naming the paypageId it carries.
+        // A CyberSource Secure Acceptance preparation claims only its token create naming the profile id it
+        // carries, sent from the page it approved (the request's own Origin header names it).
         if (Date.parse(prepared.expiresAt) <= Date.now() || !matchesPreparation(prepared, requestUrl, requestMethod, requestBody, requestHeaders)) {
             // An Amadeus request payment-core refuses names its own reason (preparedRequestRefusal), so
-            // Air France's split expiry reads amadeus_merchant_held_expiry rather than a changed checkout.
+            // Air France's split expiry reads amadeus_merchant_held_expiry rather than a changed checkout,
+            // and a Secure Acceptance frame post with no Origin reads secure_acceptance_origin_header.
             const reason = Date.parse(prepared.expiresAt) <= Date.now() ? 'expired'
-                : preparedRequestRefusal(prepared.psp, prepared.environment, requestUrl, requestBody, requestHeaders, prepared.merchantOrigin);
+                : preparedRequestRefusal(prepared.psp, prepared.environment, requestUrl, requestBody, requestHeaders, prepared.merchantOrigin, prepared.currency);
             this.invalidate(reason);
             throw new CheckoutPreparationError(prepared.id, reason);
         }

package/dist/prepared-processor.d.ts

@@ -11,8 +11,13 @@
  * amadeus_checkout: prepared only. Its SDK tunnel abandons the add after 30 seconds, too soon
  * for an approval after Pay. Its environments are its hosts: paypages (production) and
  * paypages.test (sandbox).
+ *
+ * cybersource_secure_acceptance: prepared only. The merchant's page asks its hidden frame for
+ * CyberSource's reply 30 times, a second apart, from Save (Arrow Electronics), too soon for an
+ * approval after Save. Its environments are its two hosts: secureacceptance (production) and
+ * testsecureacceptance (sandbox).
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -30,7 +35,8 @@ export declare function preparationRequestMethod(psp: string): 'GET' | 'POST';
  * hosts too: connect (production) and connect-cert (sandbox). So are CyberSource
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
- * profile pins.
+ * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
+ * live, testsecureacceptance is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**
@@ -59,13 +65,16 @@ export declare function preparationEndpoint(psp: PreparationProcessor, environme
  * What a preparation binds beyond its processor and environment. CreditGuard: the merchant page the
  * cardholder approved (the submit's ppDomain names it) and the hosted page the checkout framed (the
  * submit must pay that page's own transaction). Worldpay eProtect: the paypageId naming the Worldpay
- * merchant the registration is for, fixed before its page sent anything. Every other processor
- * ignores all three.
+ * merchant the registration is for, fixed before its page sent anything. CyberSource Secure
+ * Acceptance: the profile id naming the CyberSource merchant profile the token is created for, and the
+ * page the cardholder approved, which the request's Origin, Referer and receipt page must be on. Every
+ * other processor ignores all four.
  */
 export interface PreparedRequestBinding {
     merchantOrigin?: string;
     paymentPageUrl?: string;
     paypageId?: string | null;
+    secureAcceptanceProfileId?: string | null;
 }
 /**
  * The approved merchant page's host, with its port if it has one: what the Amadeus SDK sends in its
@@ -100,6 +109,9 @@ export declare function matchesPreparedMerchantRequest(profileId: string, reques
  * A Worldpay eProtect preparation names the paypageId its registration must carry.
  * An Amadeus preparation binds its SDK's Host header to the page the cardholder approved
  * (merchantOrigin), as the API does.
+ * A CyberSource Secure Acceptance preparation names the profile id its token create must carry and
+ * the page it must come from, and its signed currency must be the approved one, as the API's create
+ * holds it.
  */
 export declare function matchesPreparation(preparation: {
     psp: PreparationProcessor;
@@ -111,6 +123,8 @@ export declare function matchesPreparation(preparation: {
     merchantOrigin?: string;
     paymentPageUrl?: string;
     paypageId?: string;
+    secureAcceptanceProfileId?: string;
+    currency?: string;
 }, requestUrl: string, method: string, body?: string | null, headers?: Record<string, string>): boolean;
 /**
  * The reason a claim reports for a request its preparation does not match. An Amadeus preparation
@@ -121,4 +135,4 @@ export declare function matchesPreparation(preparation: {
  * header that does not name the approved page is `amadeus_header_binding`. Everything else, another
  * processor's request or the other environment's host included, is `checkout_changed`.
  */
-export declare function preparedRequestRefusal(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, body?: string | null, headers?: Record<string, string>, merchantOrigin?: string | null): string;
+export declare function preparedRequestRefusal(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, body?: string | null, headers?: Record<string, string>, merchantOrigin?: string | null, currency?: string | null): string;