@agent-cards/sdk 0.23.8 → 0.23.9

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Hand Arrow Electronics' token page to its frame when CyberSource's payment token is numeric. CyberSource gives a merchant set up before 2019 a `payment_token` of 22, 19 or 16 digits, and 0.23.8 judged every token but 32 hex characters as `token_shape`, so an approved Arrow save on 2026-10-10 ended `outcome_unknown` (`secure_acceptance_reply_late`) although CyberSource had answered it. The reply rule now takes each format CyberSource documents; a token of any other length or alphabet still reads `token_shape`. The card-free check skips a numeric token as it skips the instrument identifier, because CyberSource's 16- and 19-digit formats pass the card check digit; the device, which holds the card, still refuses a token equal to the card's number. A payment also needs the matching API and Vault releases.
+
 - Pay Arrow Electronics' card save as its live checkout signs it. Arrow's server adds an id of its own, `merchant_defined_data8` (digits), to the form and to the end of `unsigned_field_names` when it signs the save, and 0.23.7 refused that request with `secure_acceptance_unsigned_fields_unreviewed` on 2026-10-10, after the cardholder approved and before any card was sent. The request now passes with that field or without it; a list that names it anywhere but last, names it twice or posts it unlisted is still refused, and a value other than at most 20 digits is refused as `secure_acceptance_merchant_reference`. Nothing else about Arrow's lists changed. A payment also needs the matching API and Vault releases.
 
 - Pause a Worldpay eProtect registration whatever Worldpay key its page names. Worldpay rotates its production eProtect key daily (`26457000011` on 2026-10-08), and 0.23.3 refused every registration whose `publicKeyId` was not `26455500012`, the key it shipped, so an attached checkout at any eProtect merchant read `unsupported`. The SDK now takes any key id in Worldpay's digits; the cardholder's device encrypts the card under the key it reads from Worldpay's own `eProtect-api3.js` and writes that key's id into its copy, so no later rotation needs an SDK release. SmartPak Equine (paypageId `zhs8KzuRAryaq4cs` at `https://www.smartpakequine.com`) and Nordstrom (`fL33BPkRvbRqJ29S` at `https://www.nordstrom.com`) are reviewed eProtect merchants: a live checkout there passes `merchant: 'SmartPak Equine'` or `merchant: 'Nordstrom'` exactly, and `prepare()` refuses another name with `merchant_profile_mismatch` before any network call. eProtect stays dark for every org Agentcard has not enabled, and a payment also needs the matching API and Vault releases.

package/dist/cybersource-secure-acceptance.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 199c6a2402490c7085006c35fe525da2bcd7e99867170b09b5ad3c8caf8194fb
+// artifact-sha256: 9151ab8e96dace64217197a15a2eb2083d454faca475564b96ddcabb2100fa0f
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -159,6 +159,7 @@ var SA_SIGNED_DATE_TIME = /^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01]
 var SA_SIGNATURE = /^[A-Za-z0-9+/]{43}=$/;
 var SA_DEVICE_FINGERPRINT = /^[A-Za-z0-9_.:-]{1,88}$/;
 var SA_MERCHANT_REFERENCE = /^[0-9]{0,20}$/;
+var SA_PAYMENT_TOKEN = /^(?:[0-9A-Fa-f]{32}|[0-9]{22}|[0-9]{19}|[0-9]{16})$/;
 var SA_EXPIRY = /^(?:0[1-9]|1[0-2])-[0-9]{4}$/;
 var saExact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var saControlFree = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -771,7 +772,7 @@ function saTemplateFields(template) {
 }
 var SA_SCRUBBED = /* @__PURE__ */ new Map([
     ["signature", SA_SIGNATURE],
-    ["payment_token", /^[0-9A-Fa-f]{32}$/],
+    ["payment_token", SA_PAYMENT_TOKEN],
     ["transaction_id", /^[0-9]{22}$/],
     ["request_token", /^[A-Za-z0-9+/]{16,512}={0,2}$/],
     ["payment_token_instrument_identifier_id", /^[0-9]{12,32}$/],
@@ -910,7 +911,7 @@ function secureAcceptanceReplyOutcome(reply, template, card, options) {
         return unknown("reply_fields");
     if (SA_MATCHED_ECHOES.some((name) => fields.has(`req_${name}`) && value(`req_${name}`) !== sent.values.get(name)))
         return unknown("reply_mismatch");
-    if (!saExact(/^[0-9]{22}$/, value("transaction_id")) || fields.has("payment_token") && !saExact(/^[0-9A-Fa-f]{32}$/, value("payment_token"))) {
+    if (!saExact(/^[0-9]{22}$/, value("transaction_id")) || fields.has("payment_token") && !saExact(SA_PAYMENT_TOKEN, value("payment_token"))) {
         return unknown("token_shape");
     }
     const masked = value("req_card_number");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.8",
+  "version": "0.23.9",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",