@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/prepared-processor.js

@@ -20,6 +20,22 @@ export function preparationMode(psp) {
 export function preparationRequestMethod(psp) {
     return psp === 'worldpay_eprotect' ? 'GET' : 'POST';
 }
+/**
+ * Whether a prepared checkout's approval outlives the page's own request, as an unprepared token
+ * approval does (cdp.ts survivesAbandonment): the page's next request for the same purchase, from
+ * the card frame that sent the first, is answered from it, with no second prompt. The approval stays
+ * that frame's (cdp.ts sameFrame): another frame's request is refused, and the frame's removal ends it.
+ *
+ * Bambora only. Custom Checkout's card frame fails its tokenization request 5 seconds after
+ * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
+ * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
+ * clicked again). The cardholder's device answers with a token that pays nothing until the
+ * merchant's server charges it. Every other prepared checkout still answers only the request it
+ * was bound to.
+ */
+export function preparedApprovalAnswersRetry(psp) {
+    return psp === 'bambora';
+}
 /**
  * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
  * Adyen can: test and live are separate hosts and key prefixes. Fiserv's are separate
@@ -356,11 +372,11 @@ function secureAcceptanceClaimRefusal(requestUrl, body, headers, merchantOrigin,
 /**
  * The reason a claim reports for a request its preparation does not match. An Amadeus preparation
  * names what payment-core's Amadeus check refused on its own environment's card URL, as
- * `amadeus_<reason>`: Air France's and KLM's add, whose expiry their own form keeps, is
- * `amadeus_merchant_held_expiry`, every Data Collection Page store is
- * `amadeus_dcp_field_config_unreviewed` until a merchant's field config is reviewed, and a Host
- * header that does not name the approved page is `amadeus_header_binding`. Everything else, another
- * processor's request or the other environment's host included, is `checkout_changed`.
+ * `amadeus_<reason>`: every Data Collection Page store is `amadeus_dcp_field_config_unreviewed`
+ * until a merchant's field config is reviewed, an add that keeps the card on file is
+ * `amadeus_card_on_file`, and a Host header that does not name the approved page is
+ * `amadeus_header_binding`. Everything else, another processor's request or the other
+ * environment's host included, is `checkout_changed`.
  */
 export function preparedRequestRefusal(psp, environment, requestUrl, body, headers, merchantOrigin, currency) {
     // A Secure Acceptance token create on the prepared environment's host names what payment-core's request

package/dist/primer.generated.d.ts

@@ -1,5 +1,7 @@
 declare var PRIMER_PCI_HOSTS: readonly string[];
 declare var PRIMER_TOKENIZE_PATH: string;
+declare var PRIMER_SESSION_CARD_ON_FILE_POLICIES: readonly string[];
+declare var PRIMER_SESSION_CARD_ON_FILE: string;
 declare var PRIMER_REFUSAL_REASONS: readonly string[];
 declare var PRIMER_PROVABLE_NETWORKS: readonly string[];
 declare function isPrimerTokenizeUrl(url: any, method?: string): boolean;
@@ -9,6 +11,8 @@ declare function primerKeepOnFileRequested(body: any): boolean | null;
 declare function classifyPrimerRequest(url: any, method: any, body: any, headers: any): "card" | "unsupported" | "keep_on_file" | "unsupported_sdk" | null;
 declare function primerTokenizeRefusal(request: any): "unsupported" | "keep_on_file" | "unsupported_sdk" | null;
 declare function isPrimerTokenizeRequest(request: any): boolean;
+declare function primerCardOnFileDisclosure(url: any, policy?: string): boolean;
+declare function primerCardOnFileRefusal(url: any, options: any, policy?: string): "unsupported" | "keep_on_file" | null;
 declare function primerRefusalMessage(reason: any): string;
 declare function primerCardNetwork(number: any): "VISA" | "AMEX" | "MASTERCARD" | null;
 declare function primerNetworkRefusal(body: any, card: any): "unsupported" | "network_mismatch" | null;
@@ -35,4 +39,4 @@ declare function primerFacts(status: any, body: any): {
     outcome: string;
     refusalCode: any;
 };
-export { PRIMER_PCI_HOSTS, PRIMER_PROVABLE_NETWORKS, PRIMER_REFUSAL_REASONS, PRIMER_TOKENIZE_PATH, classifyPrimerRequest, injectPrimerCard, isPrimerNewCardBody, isPrimerTokenizeRequest, isPrimerTokenizeUrl, primerBodyRefusal, primerCardNetwork, primerErrorId, primerFacts, primerKeepOnFileRequested, primerNetworkRefusal, primerRefusalMessage, primerResponseOutcome, primerTokenizeRefusal, sanitizePrimerResponse };
+export { PRIMER_PCI_HOSTS, PRIMER_PROVABLE_NETWORKS, PRIMER_REFUSAL_REASONS, PRIMER_SESSION_CARD_ON_FILE, PRIMER_SESSION_CARD_ON_FILE_POLICIES, PRIMER_TOKENIZE_PATH, classifyPrimerRequest, injectPrimerCard, isPrimerNewCardBody, isPrimerTokenizeRequest, isPrimerTokenizeUrl, primerBodyRefusal, primerCardNetwork, primerCardOnFileDisclosure, primerCardOnFileRefusal, primerErrorId, primerFacts, primerKeepOnFileRequested, primerNetworkRefusal, primerRefusalMessage, primerResponseOutcome, primerTokenizeRefusal, sanitizePrimerResponse };

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 6dfbdbf520cb1656f338b88088dde209111190a2cbd3e7767e0e1b6d5e15e5ed
+// artifact-sha256: bbfd8946fd3963bf32fe66d5c17ba50dd69e141187c1d5896ee60c33b3aa0e41
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -37,7 +37,8 @@ function roundTrips(parsed, body) {
 // src/elavon-converge.js
 var CONVERGE_PROCESS_URLS = /* @__PURE__ */ Object.freeze([
     "https://api.convergepay.com/hosted-payments/service/payment/hpp/process",
-    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process"
+    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process",
+    "https://www.convergepay.com/hosted-payments/service/payment/hpp/process"
 ]);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ Object.freeze(["paymentType", "paymentData", "context", "captchaToken", "shippingSameAsBilling"]);
 var WALLET_FIELDS = /* @__PURE__ */ Object.freeze([
@@ -78,6 +79,7 @@ var RECURRING_FIELDS = /* @__PURE__ */ Object.freeze([
     "ssl_recurring_batch_count",
     "ssl_installment_id"
 ]);
+var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
@@ -87,6 +89,7 @@ var CVC = /^\d{3,4}$/;
 var AMOUNT = /^(\d{1,13})(?:\.(\d{1,2}))?$/;
 var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var recurringRequested = (data) => RECURRING_FIELDS.some((key) => owns(data, key) && !(key === "recurring" && data[key] === ONE_TIME_RECURRING_FLAG));
 var refuse = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
 var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
@@ -148,7 +151,7 @@ function convergeBodyVerdict(body) {
     if (owns(data, "ssl_token") || CARD_SAVING_FLAGS.some((key) => owns(data, key) && !(typeof data[key] === "string" && /^n$/i.test(data[key])))) {
         return refuse("converge_card_saving_refused");
     }
-    if (RECURRING_FIELDS.some((key) => owns(data, key)))
+    if (recurringRequested(data))
         return refuse("converge_recurring_refused");
     if (owns(data, "ssl_transaction_currency") && !(typeof data.ssl_transaction_currency === "string" && /^usd$/i.test(data.ssl_transaction_currency))) {
         return refuse("converge_currency_refused");
@@ -177,11 +180,155 @@ function isConvergeProcessUrl(url) {
     }
     return parsed.href === url && CONVERGE_PROCESS_URLS.includes(parsed.href);
 }
-// src/amadeus-body.js
-var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
+// src/gravy.js
+var GRAVY_PSP = "gravy";
+var BODY_LIMIT = 4096;
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["method", "number", "expiration_date", "security_code"]);
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["payment_method", "postal_code"]);
+var CARD_NUMBER2 = /^[0-9]{12,19}$/;
+var EXPIRY = /^(?:0[1-9]|1[0-2])\/[0-9]{2}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var PAN_LIKE = /(?:[0-9][ _.:-]*){12,}/;
+var EXPIRY_OR_CODE = /^(?:expiration_?date|expiry(?:_?date)?|exp_?date|card_?expiry|security_?code|cvc|cvc2|cvv|cvv2|cvd|card_?cvv|card_?cvc|verification_?value)$/i;
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns2 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var holdsPan = (mopdata) => record(mopdata) && owns2(mopdata, "pan") && mopdata.pan !== null && mopdata.pan !== "";
+function cardNamed(key) {
+    const name = key.slice(key.lastIndexOf(".") + 1);
+    return CARD_NUMBER_KEY.test(name) || /cardnumber$/i.test(name) || EXPIRY_OR_CODE.test(name);
+}
+function cardOutside(root) {
+    const pending = [];
+    for (const key of Object.keys(root)) {
+        const value = root[key];
+        if (key === "payment_method" && record(value)) {
+            for (const inner of Object.keys(value))
+                if (!CARD_KEYS.includes(inner))
+                    pending.push([inner, value[inner]]);
+        }
+        else {
+            pending.push([key, value]);
+        }
+    }
+    while (pending.length > 0) {
+        const [key, value] = pending.pop();
+        if (key !== null && cardNamed(key))
+            return true;
+        if (typeof value === "string" || typeof value === "number") {
+            if (PAN_LIKE.test(String(value)))
+                return true;
+        }
+        else if (Array.isArray(value)) {
+            for (const item of value)
+                pending.push([null, item]);
+        }
+        else if (record(value)) {
+            for (const inner of Object.keys(value))
+                pending.push([inner, value[inner]]);
+        }
+    }
+    return false;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+var refuse2 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD2 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function gravyBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse2("gravy_body_unsupported");
+    if (cardOutside(value))
+        return refuse2("gravy_card_outside_payment_method");
+    const card = value.payment_method;
+    if (!record(card) || card.method !== "card" || !CARD_KEYS.every((key) => owns2(card, key)))
+        return refuse2("gravy_new_card_missing");
+    if (!Object.keys(value).every((key) => ROOT_KEYS.includes(key)) || !Object.keys(card).every((key) => CARD_KEYS.includes(key)) || typeof card.number !== "string" || !CARD_NUMBER2.test(card.number) || typeof card.expiration_date !== "string" || !EXPIRY.test(card.expiration_date) || typeof card.security_code !== "string" || !SECURITY_CODE.test(card.security_code) || owns2(value, "postal_code") && (typeof value.postal_code !== "string" || !POSTAL_CODE.test(value.postal_code))) {
+        return refuse2("gravy_body_unsupported");
+    }
+    return CARD2;
+}
+// src/moneris.js
+var MONERIS_PSP = "moneris";
+var CARD_KEYS2 = /* @__PURE__ */ Object.freeze(["input_data", "input_exp", "input_cvd", "hpt_id", "hpt_ticket", "doTokenize"]);
+var PARTIAL_KEYS = /* @__PURE__ */ Object.freeze([
+    ["input_data", "hpt_id", "hpt_ticket", "doTokenize"],
+    ["input_data", "input_exp", "hpt_id", "hpt_ticket", "doTokenize"],
+    ["input_data", "input_cvd", "hpt_id", "hpt_ticket", "doTokenize"]
+]);
+var CARD_NUMBER3 = /^\d{12,19}$/;
+var GROUPED_DIGITS = /^\d+(?: \d+)*$/;
+var EXPIRY_MMYY2 = /^(0[1-9]|1[0-2])\d{2}$/;
+var CVD = /^\d{3,4}$/;
+var PROFILE_ID = /^ht[A-Za-z0-9]{1,64}$/;
+var TICKET = /^tt[A-Za-z0-9]{1,128}$/;
+var refuse3 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD3 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function readPairs(body) {
+    if (typeof body !== "string" || body === "" || body.length > 4096)
+        return null;
+    const pairs = [];
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq <= 0)
+            return null;
+        pairs.push([chunk.slice(0, eq), chunk.slice(eq + 1)]);
+    }
+    return pairs;
+}
+var hasKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function monerisBodyVerdict(body) {
+    const pairs = readPairs(body);
+    if (pairs === null)
+        return refuse3("moneris_body_malformed");
+    if (PARTIAL_KEYS.some((keys) => hasKeys(pairs, keys)))
+        return refuse3("moneris_partial_card");
+    if (!hasKeys(pairs, CARD_KEYS2))
+        return refuse3("moneris_body_malformed");
+    const [[, number], [, expiry], [, cvd], [, profile], [, ticket], [, tokenize]] = pairs;
+    if (!GROUPED_DIGITS.test(number) || !CARD_NUMBER3.test(number.replace(/ /g, "")) || !EXPIRY_MMYY2.test(expiry) || !CVD.test(cvd) || !PROFILE_ID.test(profile) || !TICKET.test(ticket) || tokenize !== "true")
+        return refuse3("moneris_body_malformed");
+    return CARD3;
+}
+var MONERIS_TOKENIZE_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["www3.moneris.com", "gateway.moneris.com"]),
+    sandbox: Object.freeze(["esqa.moneris.com"])
+});
+var MONERIS_TOKENIZE_PATH = "/HPPtoken/request.php";
+function monerisTokenizeEnvironment(url) {
+    if (typeof url !== "string")
+        return null;
+    for (const environment of 
+    /** @type {const} */
+    ["production", "sandbox"]) {
+        if (MONERIS_TOKENIZE_HOSTS[environment].some((host) => url === `https://${host}${MONERIS_TOKENIZE_PATH}`))
+            return environment;
+    }
+    return null;
+}
+function isMonerisTokenizeUrl(url) {
+    return monerisTokenizeEnvironment(url) !== null;
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), profileIds: Object.freeze([...fields.profileIds]) });
+var MONERIS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "jack_org_raisin", merchant: "Jack.org", origins: ["https://jack.akaraisin.com"], profileIds: ["htL7TR9H7ICYN2B"] })
+]);
+// src/amadeus-body.js
+var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns3 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var holdsPan = (mopdata) => record2(mopdata) && owns3(mopdata, "pan") && mopdata.pan !== null && mopdata.pan !== "";
 function amadeusBodyKind(body) {
     let value;
     try {
@@ -190,18 +337,25 @@ function amadeusBodyKind(body) {
     catch {
         return "card";
     }
-    if (!record(value))
+    if (!record2(value))
         return "card";
     if (value.action === "add") {
         const entries = Array.isArray(value.data) ? value.data : [value.data];
-        return entries.some((entry) => record(entry) && typeof entry.mopid === "string" && AMADEUS_CARD_MOPID.test(entry.mopid) && holdsPan(entry.mopdata)) ? "card" : "other";
+        return entries.some((entry) => record2(entry) && typeof entry.mopid === "string" && AMADEUS_CARD_MOPID.test(entry.mopid) && holdsPan(entry.mopdata)) ? "card" : "other";
     }
     if (value.action === "store")
-        return record(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
+        return record2(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
     return "other";
 }
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
+    if (recognizer && recognizer.psp === GRAVY_PSP)
+        return gravyBodyVerdict(body);
+    if (recognizer && recognizer.psp === MONERIS_PSP) {
+        if (url !== void 0 && !isMonerisTokenizeUrl(url))
+            return { verdict: "refuse", code: "moneris_url_refused" };
+        return monerisBodyVerdict(body);
+    }
     if (!recognizer || recognizer.psp !== "elavon_converge")
         return null;
     if (url !== void 0 && !isConvergeProcessUrl(url))
@@ -305,6 +459,9 @@ function namesCardNumber(root, declared) {
 // src/primer.js
 var PRIMER_PCI_HOSTS = /* @__PURE__ */ Object.freeze(["sdk.api.primer.io", "sdk.api.sandbox.primer.io"]);
 var PRIMER_TOKENIZE_PATH = "/payment-instruments";
+var PRIMER_SESSION_CARD_ON_FILE_POLICIES = /* @__PURE__ */ Object.freeze(["refuse", "disclose"]);
+var PRIMER_SESSION_CARD_ON_FILE = "disclose";
+var LIVE_PCI_HOST = "sdk.api.primer.io";
 var PRIMER_REFUSAL_REASONS = /* @__PURE__ */ Object.freeze(["unsupported", "keep_on_file", "unsupported_sdk", "network_mismatch"]);
 var PRIMER_PROVABLE_NETWORKS = /* @__PURE__ */ Object.freeze(["VISA", "MASTERCARD", "AMEX"]);
 var UNSUPPORTED_REFUSAL = "Refusing to pay: unsupported Primer card request.";
@@ -312,13 +469,13 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT = 16384;
+var BODY_LIMIT2 = 16384;
 var RESPONSE_LIMIT = 32768;
-var ROOT_KEYS = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
+var ROOT_KEYS2 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var owns3 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns4 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
@@ -340,7 +497,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
         return null;
     let value;
     try {
@@ -349,18 +506,18 @@ function judgeBody(body) {
     catch {
         return null;
     }
-    if (!record2(value) || !roundTrips(value, body))
+    if (!record3(value) || !roundTrips(value, body))
         return null;
-    if (!Object.keys(value).every((key) => ROOT_KEYS.includes(key)) || !owns3(value, "paymentInstrument"))
+    if (!Object.keys(value).every((key) => ROOT_KEYS2.includes(key)) || !owns4(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record2(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns3(instrument, key)))
+    if (!record3(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns4(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH, instrument.expirationMonth) || !exact(YEAR, instrument.expirationYear))
         return null;
-    if (owns3(instrument, "cardholderName") && instrument.cardholderName !== null && !plain(instrument.cardholderName, 256) || owns3(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact(NETWORK, instrument.preferredNetwork) || owns3(value, "userDescription") && value.userDescription !== null && !plain(value.userDescription, 256) || owns3(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns3(value, "paymentFlow") && value.paymentFlow !== "VAULT")
+    if (owns4(instrument, "cardholderName") && instrument.cardholderName !== null && !plain(instrument.cardholderName, 256) || owns4(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact(NETWORK, instrument.preferredNetwork) || owns4(value, "userDescription") && value.userDescription !== null && !plain(value.userDescription, 256) || owns4(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns4(value, "paymentFlow") && value.paymentFlow !== "VAULT")
         return null;
-    return { value, keepOnFile: owns3(value, "tokenType") || owns3(value, "paymentFlow") };
+    return { value, keepOnFile: owns4(value, "tokenType") || owns4(value, "paymentFlow") };
 }
 function primerBodyRefusal(body) {
     const judged = judgeBody(body);
@@ -382,7 +539,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record2(headers))
+    if (!record3(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -429,13 +586,23 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record2(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record3(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
 function isPrimerTokenizeRequest(request) {
     return primerTokenizeRefusal(request) === null;
 }
+function primerCardOnFileDisclosure(url, policy = PRIMER_SESSION_CARD_ON_FILE) {
+    return policy === "disclose" && isPrimerTokenizeUrl(url) && new URL(url).hostname === LIVE_PCI_HOST;
+}
+function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_FILE) {
+    if (!isPrimerTokenizeUrl(url))
+        return "unsupported";
+    if (new URL(url).hostname !== LIVE_PCI_HOST)
+        return null;
+    return primerCardOnFileDisclosure(url, policy) && record3(options) && options.keepOnFile === true ? null : "keep_on_file";
+}
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
         return KEEP_ON_FILE_REFUSAL;
@@ -518,28 +685,28 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record2(value) ? value : null;
+        return record3(value) ? value : null;
     }
     catch {
         return null;
     }
 }
 var tokenValue = (value) => exact(TOKEN, value) && !panLike(value);
-var optional = (value, key, check) => !owns3(value, key) || value[key] === null || check(value[key]);
+var optional = (value, key, check) => !owns4(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record2(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record3(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record2))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record3))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
-        if (owns3(data, key) && data[key] !== null)
+        if (owns4(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record2(data.binData)) {
+    if (record3(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
-            if (!owns3(data.binData, key) || data.binData[key] === null)
+            if (!owns4(data.binData, key) || data.binData[key] === null)
                 continue;
             if (!plain(data.binData[key], 128))
                 return null;
@@ -552,11 +719,11 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record2(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record3(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
-        if (owns3(value, key) && value[key] !== null)
+        if (owns4(value, key) && value[key] !== null)
             safe[key] = value[key];
     }
     return safe;
@@ -569,7 +736,7 @@ function rebuildToken(value) {
     if (!details || threeDs === void 0)
         return null;
     const safe = { token: value.token };
-    if (owns3(value, "analyticsId") && value.analyticsId !== null)
+    if (owns4(value, "analyticsId") && value.analyticsId !== null)
         safe.analyticsId = value.analyticsId;
     safe.tokenType = "SINGLE_USE";
     safe.paymentInstrumentType = "PAYMENT_CARD";
@@ -580,7 +747,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record2(value.error) ? value.error.errorId : null;
+    const id = value && record3(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {
@@ -621,4 +788,4 @@ function primerFacts(status, body) {
     const verdict = primerResponseOutcome(status, body);
     return { outcome: verdict.outcome, refusalCode: verdict.outcome === "refused" ? verdict.code : null };
 }
-export { PRIMER_PCI_HOSTS, PRIMER_PROVABLE_NETWORKS, PRIMER_REFUSAL_REASONS, PRIMER_TOKENIZE_PATH, classifyPrimerRequest, injectPrimerCard, isPrimerNewCardBody, isPrimerTokenizeRequest, isPrimerTokenizeUrl, primerBodyRefusal, primerCardNetwork, primerErrorId, primerFacts, primerKeepOnFileRequested, primerNetworkRefusal, primerRefusalMessage, primerResponseOutcome, primerTokenizeRefusal, sanitizePrimerResponse };
+export { PRIMER_PCI_HOSTS, PRIMER_PROVABLE_NETWORKS, PRIMER_REFUSAL_REASONS, PRIMER_SESSION_CARD_ON_FILE, PRIMER_SESSION_CARD_ON_FILE_POLICIES, PRIMER_TOKENIZE_PATH, classifyPrimerRequest, injectPrimerCard, isPrimerNewCardBody, isPrimerTokenizeRequest, isPrimerTokenizeUrl, primerBodyRefusal, primerCardNetwork, primerCardOnFileDisclosure, primerCardOnFileRefusal, primerErrorId, primerFacts, primerKeepOnFileRequested, primerNetworkRefusal, primerRefusalMessage, primerResponseOutcome, primerTokenizeRefusal, sanitizePrimerResponse };

package/dist/registry.d.ts

@@ -118,7 +118,9 @@ export interface Recognizer {
      * names `authorize_net_dpm_form`, Pelecard names `pelecard_transaction`,
      * Primer names `primer_payment_instruments`, Payrails names
      * `payrails_device_encrypt`, Elavon Converge names `converge_hpp_process`,
-     * WSPay names `wspay_confirm` and Shiji STS names `shiji_sts_pinned_key`.
+     * WSPay names `wspay_confirm`, Shiji STS names `shiji_sts_pinned_key`, Gravy
+     * names `gravy_session_fields_put` and Moneris Hosted Tokenization names
+     * `moneris_hosted_tokenization`.
      */
     capability?: string;
     /**
@@ -165,13 +167,15 @@ export interface Recognizer {
     /**
      * The card request's shape when it is not a POST body. Worldpay eProtect
      * declares `{ method: 'GET', cardIn: 'query', response: 'jsonp' }`: its card
-     * rides in the query of one JSONP <script> GET. Absent means a POST. Carried
+     * rides in the query of one JSONP <script> GET. Gravy declares
+     * `{ method: 'PUT', cardIn: 'body', response: 'no_content' }`: its card rides in
+     * the JSON body of a PUT, as a POST's does. Absent means a POST. Carried
      * verbatim by syncRegistry; isCardRequest reads `method` through
-     * recognizerRequestMethod, and pauses a GET only for a processor whose exact
-     * query this build can check.
+     * recognizerRequestMethod, pauses a PUT as it pauses a POST, and pauses a GET
+     * only for a processor whose exact query this build can check.
      */
     request?: {
-        method: 'GET' | 'POST';
+        method: 'GET' | 'POST' | 'PUT';
         cardIn?: string;
         response?: string;
     };
@@ -212,15 +216,17 @@ export declare function urlsOnProcessorHosts(url: string, rec: Recognizer, opts?
 export declare function findRecognizer(url: string, registry?: Recognizer[], opts?: RecognizerOptions): Recognizer | null;
 /**
  * The HTTP method of a recognizer's card request, the rule payment-core's
- * recognizerRequestMethod applies: GET only when the entry declares
- * `request.method: 'GET'` (Worldpay eProtect), POST for everything else, so a
- * value that rode in over the wire as anything else never widens a POST
- * recognizer.
+ * recognizerRequestMethod applies: GET or PUT only when the entry declares that
+ * `request.method` (Worldpay eProtect's GET, Gravy's PUT), POST for everything
+ * else, so a value that rode in over the wire as anything else never widens a
+ * POST recognizer.
  */
-export declare function recognizerRequestMethod(rec: Pick<Recognizer, 'request'>): 'GET' | 'POST';
+export declare function recognizerRequestMethod(rec: Pick<Recognizer, 'request'>): 'GET' | 'POST' | 'PUT';
 /**
- * Whether `method` is this recognizer's card request method for `url`. A GET
- * carries the card in its URL, so a GET recognizer is a card request only for a
+ * Whether `method` is this recognizer's card request method for `url`. A PUT
+ * recognizer (Gravy) carries the card in its body as a POST one does, so its PUT
+ * pauses like a POST, and neither pauses in the other's method. A GET carries
+ * the card in its URL, so a GET recognizer is a card request only for a
  * processor whose exact query this build checks (Worldpay eProtect, through
  * payment-core's grammar); any other GET recognizer is nothing this build can
  * complete and is never paused.

package/dist/registry.js

@@ -128,17 +128,20 @@ export function findRecognizer(url, registry = BUILTIN_REGISTRY, opts = {}) {
 }
 /**
  * The HTTP method of a recognizer's card request, the rule payment-core's
- * recognizerRequestMethod applies: GET only when the entry declares
- * `request.method: 'GET'` (Worldpay eProtect), POST for everything else, so a
- * value that rode in over the wire as anything else never widens a POST
- * recognizer.
+ * recognizerRequestMethod applies: GET or PUT only when the entry declares that
+ * `request.method` (Worldpay eProtect's GET, Gravy's PUT), POST for everything
+ * else, so a value that rode in over the wire as anything else never widens a
+ * POST recognizer.
  */
 export function recognizerRequestMethod(rec) {
-    return rec?.request?.method === 'GET' ? 'GET' : 'POST';
+    const method = rec?.request?.method;
+    return method === 'GET' || method === 'PUT' ? method : 'POST';
 }
 /**
- * Whether `method` is this recognizer's card request method for `url`. A GET
- * carries the card in its URL, so a GET recognizer is a card request only for a
+ * Whether `method` is this recognizer's card request method for `url`. A PUT
+ * recognizer (Gravy) carries the card in its body as a POST one does, so its PUT
+ * pauses like a POST, and neither pauses in the other's method. A GET carries
+ * the card in its URL, so a GET recognizer is a card request only for a
  * processor whose exact query this build checks (Worldpay eProtect, through
  * payment-core's grammar); any other GET recognizer is nothing this build can
  * complete and is never paused.
@@ -147,7 +150,7 @@ export function isRecognizerRequest(rec, url, method) {
     const expected = recognizerRequestMethod(rec);
     if (typeof method !== 'string' || method.toUpperCase() !== expected)
         return false;
-    return expected === 'POST' || (rec.psp === EPROTECT_PSP && isEprotectTokenRequest(url, 'GET'));
+    return expected !== 'GET' || (rec.psp === EPROTECT_PSP && isEprotectTokenRequest(url, 'GET'));
 }
 /**
  * True when this processor cannot be taken over on an ordinary authorization: