@agent-cards/sdk 0.23.7 → 0.23.9

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Hand Arrow Electronics' token page to its frame when CyberSource's payment token is numeric. CyberSource gives a merchant set up before 2019 a `payment_token` of 22, 19 or 16 digits, and 0.23.8 judged every token but 32 hex characters as `token_shape`, so an approved Arrow save on 2026-10-10 ended `outcome_unknown` (`secure_acceptance_reply_late`) although CyberSource had answered it. The reply rule now takes each format CyberSource documents; a token of any other length or alphabet still reads `token_shape`. The card-free check skips a numeric token as it skips the instrument identifier, because CyberSource's 16- and 19-digit formats pass the card check digit; the device, which holds the card, still refuses a token equal to the card's number. A payment also needs the matching API and Vault releases.
+
+- Pay Arrow Electronics' card save as its live checkout signs it. Arrow's server adds an id of its own, `merchant_defined_data8` (digits), to the form and to the end of `unsigned_field_names` when it signs the save, and 0.23.7 refused that request with `secure_acceptance_unsigned_fields_unreviewed` on 2026-10-10, after the cardholder approved and before any card was sent. The request now passes with that field or without it; a list that names it anywhere but last, names it twice or posts it unlisted is still refused, and a value other than at most 20 digits is refused as `secure_acceptance_merchant_reference`. Nothing else about Arrow's lists changed. A payment also needs the matching API and Vault releases.
+
 - Pause a Worldpay eProtect registration whatever Worldpay key its page names. Worldpay rotates its production eProtect key daily (`26457000011` on 2026-10-08), and 0.23.3 refused every registration whose `publicKeyId` was not `26455500012`, the key it shipped, so an attached checkout at any eProtect merchant read `unsupported`. The SDK now takes any key id in Worldpay's digits; the cardholder's device encrypts the card under the key it reads from Worldpay's own `eProtect-api3.js` and writes that key's id into its copy, so no later rotation needs an SDK release. SmartPak Equine (paypageId `zhs8KzuRAryaq4cs` at `https://www.smartpakequine.com`) and Nordstrom (`fL33BPkRvbRqJ29S` at `https://www.nordstrom.com`) are reviewed eProtect merchants: a live checkout there passes `merchant: 'SmartPak Equine'` or `merchant: 'Nordstrom'` exactly, and `prepare()` refuses another name with `merchant_profile_mismatch` before any network call. eProtect stays dark for every org Agentcard has not enabled, and a payment also needs the matching API and Vault releases.
 
 - Pay Arrow Electronics through the CyberSource Secure Acceptance lane, for a company Agentcard turned the lane on for. Arrow's reviewed entry, `arrow_token_create`, now ships enabled and pins the profile id and access key Arrow's checkout at `https://www.arrow.com` sends, read from Arrow's public page model. `prepare({ psp: 'cybersource_secure_acceptance', environment: 'production' })` at that page fills Arrow's profile id and needs `merchant: 'Arrow Electronics'`, or it fails with `merchant_profile_mismatch` before any call. Once CyberSource's page reaches Arrow's receipt, the SDK watches 10 seconds for Arrow's payment method request and emits `secure_acceptance_reply_unused` when none comes. The API still refuses any other profile id, access key or page on the production host (`unsupported_checkout`), and every company Agentcard has not turned the lane on for keeps the stop.

package/dist/cybersource-secure-acceptance.generated.d.ts

@@ -8,6 +8,7 @@ declare var SECURE_ACCEPTANCE_TOKEN_CREATE_PATH: string;
 declare var SECURE_ACCEPTANCE_SIGNED_FIELDS: readonly string[];
 declare var SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS: readonly string[];
 declare var SECURE_ACCEPTANCE_UNSIGNED_FIELDS: readonly string[];
+declare var SECURE_ACCEPTANCE_OPTIONAL_UNSIGNED_FIELDS: readonly string[];
 declare var SECURE_ACCEPTANCE_CARD_TYPES: Readonly<{
     visa: "001";
     mastercard: "002";
@@ -23,7 +24,7 @@ declare var SECURE_ACCEPTANCE_MERCHANTS: any;
 declare function secureAcceptanceEnvironment(hostname: any): "production" | "sandbox" | null;
 declare function secureAcceptancePreparationUrl(environment: any): string;
 declare function isSecureAcceptanceTokenRequest(url: any, method: any): boolean;
-declare function secureAcceptanceRequestRefusal(request: any, options: any): "card_fields" | "profile_id" | "access_key" | "currency" | "signed_date_time" | "locale" | "origin_header" | "not_token_create" | "content_type" | "referer_header" | "body_unreadable" | "signed_fields_unreviewed" | "unsigned_fields_unreviewed" | "fields_unreviewed" | "transaction_type" | "amount_not_zero" | "payment_method" | "receipt_page" | "keeps_card" | "edits_saved_card" | "card_type" | "bill_to" | "signature" | "request_ids" | "device_fingerprint" | null;
+declare function secureAcceptanceRequestRefusal(request: any, options: any): "card_fields" | "profile_id" | "access_key" | "currency" | "signed_date_time" | "locale" | "origin_header" | "not_token_create" | "content_type" | "referer_header" | "body_unreadable" | "signed_fields_unreviewed" | "unsigned_fields_unreviewed" | "fields_unreviewed" | "transaction_type" | "amount_not_zero" | "payment_method" | "receipt_page" | "keeps_card" | "edits_saved_card" | "merchant_reference" | "card_type" | "bill_to" | "signature" | "request_ids" | "device_fingerprint" | null;
 declare function secureAcceptanceRequestFacts(request: any): {
     environment: string | null;
     profileId: any;
@@ -63,4 +64,4 @@ declare function secureAcceptanceReplyOutcome(reply: any, template: any, card: a
     page?: undefined;
 };
 declare function secureAcceptanceRefusalCode(bodyText: any): any;
-export { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_CARD_TYPES, SECURE_ACCEPTANCE_HOSTS, SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REFUSAL_REASON_CODES, SECURE_ACCEPTANCE_REPLY_REASONS, SECURE_ACCEPTANCE_REQUEST_REFUSALS, SECURE_ACCEPTANCE_SIGNED_FIELDS, SECURE_ACCEPTANCE_TEST_PANS, SECURE_ACCEPTANCE_TOKEN_CREATE_PATH, SECURE_ACCEPTANCE_UNSIGNED_FIELDS, isPreparedSecureAcceptanceRequest, isSecureAcceptanceDeviceRequest, isSecureAcceptanceTokenRequest, secureAcceptanceCardRefusal, secureAcceptanceCardType, secureAcceptanceDeviceRequest, secureAcceptanceEnvironment, secureAcceptanceMerchantEntry, secureAcceptanceMerchantRefusal, secureAcceptancePreparationUrl, secureAcceptanceRefusalCode, secureAcceptanceReplyOutcome, secureAcceptanceRequestFacts, secureAcceptanceRequestRefusal, secureAcceptanceScannedPage };
+export { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_CARD_TYPES, SECURE_ACCEPTANCE_HOSTS, SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS, SECURE_ACCEPTANCE_OPTIONAL_UNSIGNED_FIELDS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REFUSAL_REASON_CODES, SECURE_ACCEPTANCE_REPLY_REASONS, SECURE_ACCEPTANCE_REQUEST_REFUSALS, SECURE_ACCEPTANCE_SIGNED_FIELDS, SECURE_ACCEPTANCE_TEST_PANS, SECURE_ACCEPTANCE_TOKEN_CREATE_PATH, SECURE_ACCEPTANCE_UNSIGNED_FIELDS, isPreparedSecureAcceptanceRequest, isSecureAcceptanceDeviceRequest, isSecureAcceptanceTokenRequest, secureAcceptanceCardRefusal, secureAcceptanceCardType, secureAcceptanceDeviceRequest, secureAcceptanceEnvironment, secureAcceptanceMerchantEntry, secureAcceptanceMerchantRefusal, secureAcceptancePreparationUrl, secureAcceptanceRefusalCode, secureAcceptanceReplyOutcome, secureAcceptanceRequestFacts, secureAcceptanceRequestRefusal, secureAcceptanceScannedPage };

package/dist/cybersource-secure-acceptance.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: bd26046b49ee14791e119bd7d6c8ebf370940ee2371099e13582566579c485d5
+// artifact-sha256: 9151ab8e96dace64217197a15a2eb2083d454faca475564b96ddcabb2100fa0f
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -67,6 +67,7 @@ var SECURE_ACCEPTANCE_UNSIGNED_FIELDS = /* @__PURE__ */ Object.freeze([
     "bill_to_address_line2",
     "card_cvn"
 ]);
+var SECURE_ACCEPTANCE_OPTIONAL_UNSIGNED_FIELDS = /* @__PURE__ */ Object.freeze(["merchant_defined_data8"]);
 var SECURE_ACCEPTANCE_CARD_TYPES = /* @__PURE__ */ Object.freeze({ visa: "001", mastercard: "002", amex: "003", discover: "004" });
 var SECURE_ACCEPTANCE_TEST_PANS = /* @__PURE__ */ immutableSet([
     "4111111111111111",
@@ -102,6 +103,7 @@ var SECURE_ACCEPTANCE_REQUEST_REFUSALS = /* @__PURE__ */ Object.freeze([
     "receipt_page",
     "keeps_card",
     "edits_saved_card",
+    "merchant_reference",
     "card_type",
     "card_fields",
     "bill_to",
@@ -156,6 +158,8 @@ var SA_REQUEST_ID = /^[A-Za-z0-9-]{1,50}$/;
 var SA_SIGNED_DATE_TIME = /^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]Z$/;
 var SA_SIGNATURE = /^[A-Za-z0-9+/]{43}=$/;
 var SA_DEVICE_FINGERPRINT = /^[A-Za-z0-9_.:-]{1,88}$/;
+var SA_MERCHANT_REFERENCE = /^[0-9]{0,20}$/;
+var SA_PAYMENT_TOKEN = /^(?:[0-9A-Fa-f]{32}|[0-9]{22}|[0-9]{19}|[0-9]{16})$/;
 var SA_EXPIRY = /^(?:0[1-9]|1[0-2])-[0-9]{4}$/;
 var saExact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var saControlFree = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -232,13 +236,19 @@ function saSignedListAllowed(value) {
     const [state, postal] = SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS;
     return [base, `${base},${state}`, `${base},${postal}`, `${base},${state},${postal}`].includes(value);
 }
+function saUnsignedListAllowed(value) {
+    const base = SECURE_ACCEPTANCE_UNSIGNED_FIELDS.join(",");
+    const [reference] = SECURE_ACCEPTANCE_OPTIONAL_UNSIGNED_FIELDS;
+    return value === base || value === `${base},${reference}`;
+}
 function saFieldListRefusal(form) {
     const signed = form.values.get("signed_field_names");
     if (!saSignedListAllowed(signed))
         return "signed_fields_unreviewed";
-    if (form.values.get("unsigned_field_names") !== SECURE_ACCEPTANCE_UNSIGNED_FIELDS.join(","))
+    const unsigned = form.values.get("unsigned_field_names");
+    if (!saUnsignedListAllowed(unsigned))
         return "unsigned_fields_unreviewed";
-    const expected = /* @__PURE__ */ new Set([...signed.split(","), ...SECURE_ACCEPTANCE_UNSIGNED_FIELDS, "signature"]);
+    const expected = /* @__PURE__ */ new Set([...signed.split(","), ...unsigned.split(","), "signature"]);
     if (form.pairs.length !== expected.size || form.pairs.some(({ name }) => !expected.has(name)))
         return "fields_unreviewed";
     return null;
@@ -360,6 +370,8 @@ function secureAcceptanceRequestRefusal(request, options) {
         return "keeps_card";
     if (v("merchant_defined_data7") !== "")
         return "edits_saved_card";
+    if (form.values.has("merchant_defined_data8") && !saExact(SA_MERCHANT_REFERENCE, v("merchant_defined_data8")))
+        return "merchant_reference";
     if (!SA_CARD_VALUES.get("card_type")(v("card_type")))
         return "card_type";
     if (!["card_number", "card_expiry_date", "card_cvn"].every((name) => SA_CARD_VALUES.get(name)(v(name))))
@@ -760,7 +772,7 @@ function saTemplateFields(template) {
 }
 var SA_SCRUBBED = /* @__PURE__ */ new Map([
     ["signature", SA_SIGNATURE],
-    ["payment_token", /^[0-9A-Fa-f]{32}$/],
+    ["payment_token", SA_PAYMENT_TOKEN],
     ["transaction_id", /^[0-9]{22}$/],
     ["request_token", /^[A-Za-z0-9+/]{16,512}={0,2}$/],
     ["payment_token_instrument_identifier_id", /^[0-9]{12,32}$/],
@@ -899,7 +911,7 @@ function secureAcceptanceReplyOutcome(reply, template, card, options) {
         return unknown("reply_fields");
     if (SA_MATCHED_ECHOES.some((name) => fields.has(`req_${name}`) && value(`req_${name}`) !== sent.values.get(name)))
         return unknown("reply_mismatch");
-    if (!saExact(/^[0-9]{22}$/, value("transaction_id")) || fields.has("payment_token") && !saExact(/^[0-9A-Fa-f]{32}$/, value("payment_token"))) {
+    if (!saExact(/^[0-9]{22}$/, value("transaction_id")) || fields.has("payment_token") && !saExact(SA_PAYMENT_TOKEN, value("payment_token"))) {
         return unknown("token_shape");
     }
     const masked = value("req_card_number");
@@ -952,4 +964,4 @@ function secureAcceptanceRefusalCode(bodyText) {
     const code = page.fields.get("reason_code")?.value;
     return (decision === "DECLINE" || decision === "ERROR") && saExact(/^[0-9]{3}$/, code) ? code : null;
 }
-export { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_CARD_TYPES, SECURE_ACCEPTANCE_HOSTS, SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REFUSAL_REASON_CODES, SECURE_ACCEPTANCE_REPLY_REASONS, SECURE_ACCEPTANCE_REQUEST_REFUSALS, SECURE_ACCEPTANCE_SIGNED_FIELDS, SECURE_ACCEPTANCE_TEST_PANS, SECURE_ACCEPTANCE_TOKEN_CREATE_PATH, SECURE_ACCEPTANCE_UNSIGNED_FIELDS, isPreparedSecureAcceptanceRequest, isSecureAcceptanceDeviceRequest, isSecureAcceptanceTokenRequest, secureAcceptanceCardRefusal, secureAcceptanceCardType, secureAcceptanceDeviceRequest, secureAcceptanceEnvironment, secureAcceptanceMerchantEntry, secureAcceptanceMerchantRefusal, secureAcceptancePreparationUrl, secureAcceptanceRefusalCode, secureAcceptanceReplyOutcome, secureAcceptanceRequestFacts, secureAcceptanceRequestRefusal, secureAcceptanceScannedPage };
+export { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_CARD_TYPES, SECURE_ACCEPTANCE_HOSTS, SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS, SECURE_ACCEPTANCE_OPTIONAL_UNSIGNED_FIELDS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REFUSAL_REASON_CODES, SECURE_ACCEPTANCE_REPLY_REASONS, SECURE_ACCEPTANCE_REQUEST_REFUSALS, SECURE_ACCEPTANCE_SIGNED_FIELDS, SECURE_ACCEPTANCE_TEST_PANS, SECURE_ACCEPTANCE_TOKEN_CREATE_PATH, SECURE_ACCEPTANCE_UNSIGNED_FIELDS, isPreparedSecureAcceptanceRequest, isSecureAcceptanceDeviceRequest, isSecureAcceptanceTokenRequest, secureAcceptanceCardRefusal, secureAcceptanceCardType, secureAcceptanceDeviceRequest, secureAcceptanceEnvironment, secureAcceptanceMerchantEntry, secureAcceptanceMerchantRefusal, secureAcceptancePreparationUrl, secureAcceptanceRefusalCode, secureAcceptanceReplyOutcome, secureAcceptanceRequestFacts, secureAcceptanceRequestRefusal, secureAcceptanceScannedPage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.7",
+  "version": "0.23.9",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",