@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/shiji-sts.d.ts

@@ -5,8 +5,8 @@ export declare const SHIJI_STS_CAPABILITY = "shiji_sts_pinned_key";
 /**
  * Why a Shiji STS request was refused, reported as the `reason` of the `unsupported_checkout` event
  * and of the attachment's `unsupported` state:
- *   shiji_sts_keep_on_file         a getTokenId in the proxy's shape while Agentcard cannot yet ask the
- *                                  cardholder to let a hotel keep the card to guarantee the stay
+ *   shiji_sts_keep_on_file         a getTokenId in the proxy's shape while the card-on-file policy
+ *                                  refuses (the kill switch): the hotel would keep the card
  *   unsupported_shiji_sts_request  any other request to getTokenId or getCvvId: not the proxy's shape,
  *                                  a query, a port, or a body the classifier cannot read
  *   shiji_sts_foreign_key          a card field encrypted under a key other than the pinned Shiji key
@@ -32,7 +32,7 @@ interface ShijiStsRequest {
 }
 /**
  * The verdict on a request to an STS host that the registry recognized: 'pause' for the one prompt
- * (a getTokenId in the proxy's shape once the card-on-file decision allows it), 'companion' for a
+ * (a getTokenId in the proxy's shape while the card-on-file policy asks), 'companion' for a
  * getCvvId in the proxy's shape, and 'refuse' with a reason for everything else. A classifier that
  * throws refuses.
  */
@@ -52,18 +52,19 @@ interface ServedSubstitutions {
 export declare function isShijiStsServedSubstitution(sub: unknown): sub is ServedSubstitutions;
 /**
  * The page's reviewed getCvvId keys, as the API serves them beside an approved Shiji STS set
- * (checkout.ts approvedShijiStsFields, `shiji_sts_companion`): the keySequence values Agentcard
- * reviewed as the booking page's own getCvvId key (its SPS merchant's settings.client_key).
+ * (checkout.ts approvedShijiStsFields, `shiji_sts_companion`): the SHA-256 (lowercase hex of its UTF-8
+ * bytes) of each keySequence Agentcard reviewed as the booking page's own getCvvId key (its SPS
+ * merchant's settings.client_key). Neither the API nor this SDK holds the key itself.
  */
 export interface ShijiStsServedCompanion {
-    key_sequences: string[];
+    key_sequence_sha256: string[];
 }
 /**
  * Whether the API's `shiji_sts_companion` beside an approved Shiji STS set is one this SDK can bind
- * the companion getCvvId to: exactly `{ key_sequences }`, 1 to 16 non-empty keySequences of printable
- * ASCII. Anything else, an API that serves none included, is not acted on: the approval reads as
- * malformed and the getTokenId is not continued, so no card reaches Shiji while its CVV has no
- * reviewed key to go to.
+ * the companion getCvvId to: exactly `{ key_sequence_sha256 }`, 1 to 16 lowercase hex SHA-256 values.
+ * Anything else, an API that serves none or serves the keys themselves included, is not acted on: the
+ * approval reads as malformed and the getTokenId is not continued, so no card reaches Shiji while its
+ * CVV has no reviewed key to go to.
  */
 export declare function isShijiStsServedCompanion(value: unknown): value is ShijiStsServedCompanion;
 /** The paused request an approval was created from: the URL and body the API reviewed at create. */
@@ -75,9 +76,9 @@ export interface ShijiStsApprovedRequest {
  * The continuation of an approved getTokenId: the paused body with the device's pan and expires
  * written over the page's own at the body root (payment-core substituteShijiSts, which refuses a
  * value that is not a ciphertext under the pinned key), the device's cvv, which this body does not
- * carry and the runtime keeps in memory for the one companion getCvvId, and the reviewed getCvvId
- * keys that companion may carry it under (`companion`, the replay's shijiStsCompanion, which the
- * client read from the API's shiji_sts_companion).
+ * carry and the runtime keeps in memory for the one companion getCvvId, and the SHA-256 of the
+ * reviewed getCvvId keys that companion may carry it under (`companion`, the replay's
+ * shijiStsCompanion, which the client read from the API's shiji_sts_companion).
  *
  * Only into `approved`, the paused getTokenId the approval was created from: `url` and `body` must
  * equal it byte for byte, so the accessToken and keySequence are the ones the API reviewed at create
@@ -88,15 +89,15 @@ export interface ShijiStsApprovedRequest {
  * Null when neither URL is on an STS host, so every other processor keeps the generic swap. Throws
  * for any other body or URL, an STS URL that is not getTokenId, a substitution
  * isShijiStsServedSubstitution refuses (`sub` is whatever the approval served, of any processor's
- * shape), no reviewed getCvvId key to bind the companion to, and while the card-on-file decision is
- * open: in each case before anything continues.
+ * shape), no reviewed getCvvId key to bind the companion to, and while the card-on-file policy
+ * refuses: in each case before anything continues.
  */
 export declare function shijiStsTokenContinuation(url: string, body: string, sub: unknown, approved: ShijiStsApprovedRequest, companion?: {
-    keySequences: readonly string[];
+    keySequenceSha256: readonly string[];
 }): {
     body: string;
     cvv: string;
-    cvvKeySequences: string[];
+    cvvKeySequenceSha256: string[];
 } | null;
 /**
  * One attachment's getCvvId companion: at most one binding, to the getTokenId it last continued with
@@ -113,12 +114,13 @@ export declare class ShijiStsCompanions {
     /**
      * Bind the companion of `tokenRequest` (the paused getTokenId: its URL, method and body) for the
      * page `page` (the adapter's opaque id for the frame that sent it) and keep `cvv`, the device's
-     * CVV ciphertext, for it, to go only into a getCvvId whose keySequence is one of `cvvKeySequences`
-     * (the reviewed getCvvId keys the approval served). Replaces any earlier binding. Throws
-     * ShijiStsError for a request that is not a getTokenId in the proxy's shape, a key list
-     * payment-core refuses (none, empty or malformed), and while the card-on-file decision is open.
+     * CVV ciphertext, for it, to go only into a getCvvId whose keySequence hashes to one of
+     * `cvvKeySequenceSha256` (the SHA-256 of the reviewed getCvvId keys the approval served). Replaces any
+     * earlier binding. Throws ShijiStsError for a request that is not a getTokenId in the proxy's shape,
+     * a digest list payment-core refuses (none, empty or malformed), and while the card-on-file policy
+     * refuses.
      */
-    bind(tokenRequest: ShijiStsRequest, page: string, cvv: string, cvvKeySequences: readonly string[], now?: number): void;
+    bind(tokenRequest: ShijiStsRequest, page: string, cvv: string, cvvKeySequenceSha256: readonly string[], now?: number): void;
     /** Drop the binding and the CVV ciphertext it holds. */
     release(): void;
     /**

package/dist/shiji-sts.generated.d.ts

@@ -61,7 +61,7 @@ declare function shijiStsSubstitutionsRefusal(template: any, substitutions: any)
     code: string;
     message: any;
 } | null;
-declare function createShijiStsCompanion(tokenRequest: any, { page, now, cvvKeySequences }?: {}): Readonly<{
+declare function createShijiStsCompanion(tokenRequest: any, { page, now, cvvKeySequenceSha256 }?: {}): Readonly<{
     claim: (request: any, context?: {}) => any;
 }>;
 declare function shijiStsResponseFacts(status: any, text: any): {

package/dist/shiji-sts.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 364c3799a825b2f0a1058cadcf9aec6c6bf63d845616a9d451f048b8baa4f8de
+// artifact-sha256: 98a535f4ba13e1ee4744fb725ae47c91fd9ca650dcb37fcd9eadd92b85bf6ce1
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -535,7 +535,7 @@ var SHIJI_STS_FIELDS = /* @__PURE__ */ Object.freeze({
     token: Object.freeze(["pan", "expires"]),
     cvv: Object.freeze(["cvv"])
 });
-var SHIJI_STS_KEEP_ON_FILE = "refuse";
+var SHIJI_STS_KEEP_ON_FILE = "ask";
 var SHIJI_STS_REFUSAL_REASONS = /* @__PURE__ */ Object.freeze([
     "unsupported",
     "foreign_key",
@@ -829,16 +829,19 @@ function shijiStsSubstitutionsRefusal(template, substitutions) {
 }
 var PAGE = /^[\x21-\x7e]{1,256}$/;
 var instant = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
-var REVIEWED_KEY_SEQUENCE = /^[\x21-\x7e]{1,256}$/;
+var REVIEWED_KEY_SEQUENCE_SHA256 = /^[0-9a-f]{64}$/;
 var REVIEWED_KEY_SEQUENCES_LIMIT = 16;
-function reviewedKeySequences(list) {
+function reviewedKeySequenceSha256(list) {
     if (!Array.isArray(list) || list.length === 0 || list.length > REVIEWED_KEY_SEQUENCES_LIMIT)
         return null;
-    if (!list.every((key) => typeof key === "string" && REVIEWED_KEY_SEQUENCE.test(key)))
+    if (!list.every((digest) => typeof digest === "string" && REVIEWED_KEY_SEQUENCE_SHA256.test(digest)))
         return null;
     return Object.freeze([...list]);
 }
-function createShijiStsCompanion(tokenRequest, { page, now, cvvKeySequences } = {}) {
+function keySequenceSha256(keySequence) {
+    return typeof keySequence === "string" && keySequence !== "" ? sha256Hex(keySequence) : null;
+}
+function createShijiStsCompanion(tokenRequest, { page, now, cvvKeySequenceSha256 } = {}) {
     const policy = shijiStsKeepOnFileRefusal();
     if (policy)
         throw new ShijiStsError(policy);
@@ -849,7 +852,7 @@ function createShijiStsCompanion(tokenRequest, { page, now, cvvKeySequences } =
         throw new ShijiStsError(token.reason);
     if (typeof page !== "string" || !PAGE.test(page) || !instant(now))
         throw new ShijiStsError("unsupported");
-    const reviewed = reviewedKeySequences(cvvKeySequences);
+    const reviewed = reviewedKeySequenceSha256(cvvKeySequenceSha256);
     if (!reviewed)
         throw new ShijiStsError("unsupported");
     const host = new URL(tokenRequest.url).hostname;
@@ -864,7 +867,8 @@ function createShijiStsCompanion(tokenRequest, { page, now, cvvKeySequences } =
             return cvv.reason;
         if (used)
             return "companion_used";
-        if (new URL(request.url).hostname !== host || context.page !== boundPage || cvv.accessToken !== token.accessToken || cvv.keySequence === null || !reviewed.includes(cvv.keySequence))
+        const keyDigest = keySequenceSha256(cvv.keySequence);
+        if (new URL(request.url).hostname !== host || context.page !== boundPage || cvv.accessToken !== token.accessToken || keyDigest === null || !reviewed.includes(keyDigest))
             return "companion_unbound";
         if (!instant(context.now) || context.now < boundAt || context.now - boundAt > SHIJI_STS_COMPANION_WINDOW_MS)
             return "companion_expired";

package/dist/shiji-sts.js

@@ -1,15 +1,16 @@
 // Shiji Payment Solutions STS, the card leg of the MyCheck Wallet V3 (Shiji Group), as the SDK sees it.
 //
-// La Quinta by Wyndham's booking page loads MyCheck's wallet, whose Shiji proxy (sts.proxy.v2.1.js)
-// encrypts the typed card with RSAES-PKCS1-v1_5 under the RSA-1024 key it hardcodes and sends one
-// fetch from the page:
+// Wyndham's booking pages (every brand, La Quinta and Days Inn among them) load MyCheck's wallet,
+// whose Shiji proxy (sts.proxy.v2.1.js) encrypts the typed card with RSAES-PKCS1-v1_5 under the
+// RSA-1024 key it hardcodes and sends one fetch from the page:
 //   POST https://iframe.vault.eu.prod.shijipayment.com/v1/token/getTokenId   (UAT: iframe.vault.eu.uat...)
-//   {"accessToken":"<STS token>","pan":"<b64>","expires":"<b64>","keySequence":"<clientKey>"}
-// and, after MyCheck's payment-methods call, the CVV the same way to /v1/token/getCvvId. The agent's
-// page encrypts the placeholder card. The cardholder's device encrypts the real one under the key
-// payment-core pins (never a key from a row, a request or a page), and the runtime swaps those
-// ciphertexts over the page's own, byte for byte, at the body root, so the accessToken, the
-// keySequence and the origin stay the page's (mode cse).
+//   {"accessToken":"<STS token>","pan":"<b64>","expires":"<b64>"}
+// (a wallet whose merchant has a clientKey adds it as "keySequence"; Wyndham's has none) and, after
+// MyCheck's payment-methods call, the CVV the same way to /v1/token/getCvvId under the merchant's
+// client_key. The agent's page encrypts the placeholder card. The cardholder's device encrypts the
+// real one under the key payment-core pins (never a key from a row, a request or a page), and the
+// runtime swaps those ciphertexts over the page's own, byte for byte, at the body root, so the
+// accessToken, the keySequence and the origin stay the page's (mode cse).
 //
 // The registry entry ships dark (capability shiji_sts_pinned_key). This build declares the
 // capability on syncRegistry, and the API serves the entry only to an org Agentcard enabled for
@@ -19,21 +20,22 @@
 // For an org in the dark launch, a POST the registry recognizes on an STS host is judged by
 // payment-core's classifier (shiji-sts.generated.ts classifyShijiStsRequest), the same rules the API
 // runs at create and the device runs before it encrypts:
-//   - a getTokenId in the proxy's shape is the one prompt, but only once the card-on-file decision is
-//     made: the token Shiji mints guarantees a hotel stay, so while SHIJI_STS_KEEP_ON_FILE is
-//     'refuse' every one is refused in the browser (shiji_sts_keep_on_file) before any create or
-//     prompt, and the page's card never reaches Shiji. Once asked, the device's ciphertext goes only
-//     into that paused request, byte for byte: if the page abandons it, the approval is cancelled
-//     (merchant_request_aborted) and no later getTokenId is answered from it, because one of the
-//     same shape can name another Shiji merchant's accessToken and keySequence;
+//   - a getTokenId in the proxy's shape is the one prompt: the token Shiji mints guarantees a hotel
+//     stay, which the cardholder consents to on the approval screen while SHIJI_STS_KEEP_ON_FILE is
+//     'ask'. Set back to 'refuse' (the kill switch), every one is refused in the browser
+//     (shiji_sts_keep_on_file) before any create or prompt, and the page's card never reaches Shiji.
+//     Once asked, the device's ciphertext goes only into that paused request, byte for byte: if the
+//     page abandons it, the approval is cancelled (merchant_request_aborted) and no later getTokenId
+//     is answered from it, because one of the same shape can name another Shiji merchant's
+//     accessToken and keySequence;
 //   - a getCvvId never prompts. It continues with the device's CVV ciphertext only when it is the
 //     companion of the getTokenId this attachment continued with the Vault's ciphertexts (same host,
-//     same page, same accessToken, a keySequence the API reviewed as that page's getCvvId key and
-//     served with the approval, within 120 s, once), and is refused otherwise, so the agent's
-//     placeholder CVV never rides beside a real card and the real one goes to no unreviewed key. The
-//     binding, and the CVV ciphertext it holds, is dropped as soon as the attachment can no longer
-//     use it: a cancel, the page, frame or target that sent the getTokenId going away, or that frame
-//     committing a new document, which never obtained the approval;
+//     same page, same accessToken, a keySequence whose SHA-256 the API reviewed as that page's
+//     getCvvId key and served with the approval, within 120 s, once), and is refused otherwise, so
+//     the agent's placeholder CVV never rides beside a real card and the real one goes to no
+//     unreviewed key. The binding, and the CVV ciphertext it holds, is dropped as soon as the
+//     attachment can no longer use it: a cancel, the page, frame or target that sent the getTokenId
+//     going away, or that frame committing a new document, which never obtained the approval;
 //   - anything else on those two URLs is refused as an unsupported checkout.
 // Autopilot never pays this processor: the API, the authority and the enclave refuse it.
 import { SHIJI_STS_COMPANION_WINDOW_MS, SHIJI_STS_PSP, ShijiStsError, classifyShijiStsRequest, createShijiStsCompanion, isShijiStsCiphertext, isShijiStsHost, shijiStsEndpoint, substituteShijiSts, } from './shiji-sts.generated.js';
@@ -50,7 +52,7 @@ const REFUSED = Object.freeze({
 });
 /**
  * The verdict on a request to an STS host that the registry recognized: 'pause' for the one prompt
- * (a getTokenId in the proxy's shape once the card-on-file decision allows it), 'companion' for a
+ * (a getTokenId in the proxy's shape while the card-on-file policy asks), 'companion' for a
  * getCvvId in the proxy's shape, and 'refuse' with a reason for everything else. A classifier that
  * throws refuses.
  */
@@ -86,32 +88,32 @@ export function isShijiStsServedSubstitution(sub) {
     return names.length === SERVED_FIELDS.length
         && SERVED_FIELDS.every((name) => isShijiStsCiphertext(fields[name]));
 }
-const SERVED_KEY_SEQUENCE = /^[\x21-\x7e]{1,256}$/;
+const SERVED_KEY_SEQUENCE_SHA256 = /^[0-9a-f]{64}$/;
 const SERVED_KEY_SEQUENCES_LIMIT = 16;
 /**
  * Whether the API's `shiji_sts_companion` beside an approved Shiji STS set is one this SDK can bind
- * the companion getCvvId to: exactly `{ key_sequences }`, 1 to 16 non-empty keySequences of printable
- * ASCII. Anything else, an API that serves none included, is not acted on: the approval reads as
- * malformed and the getTokenId is not continued, so no card reaches Shiji while its CVV has no
- * reviewed key to go to.
+ * the companion getCvvId to: exactly `{ key_sequence_sha256 }`, 1 to 16 lowercase hex SHA-256 values.
+ * Anything else, an API that serves none or serves the keys themselves included, is not acted on: the
+ * approval reads as malformed and the getTokenId is not continued, so no card reaches Shiji while its
+ * CVV has no reviewed key to go to.
  */
 export function isShijiStsServedCompanion(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const names = Object.keys(value);
-    if (names.length !== 1 || names[0] !== 'key_sequences')
+    if (names.length !== 1 || names[0] !== 'key_sequence_sha256')
         return false;
-    const keys = value.key_sequences;
-    return Array.isArray(keys) && keys.length > 0 && keys.length <= SERVED_KEY_SEQUENCES_LIMIT
-        && keys.every((key) => typeof key === 'string' && SERVED_KEY_SEQUENCE.test(key));
+    const digests = value.key_sequence_sha256;
+    return Array.isArray(digests) && digests.length > 0 && digests.length <= SERVED_KEY_SEQUENCES_LIMIT
+        && digests.every((digest) => typeof digest === 'string' && SERVED_KEY_SEQUENCE_SHA256.test(digest));
 }
 /**
  * The continuation of an approved getTokenId: the paused body with the device's pan and expires
  * written over the page's own at the body root (payment-core substituteShijiSts, which refuses a
  * value that is not a ciphertext under the pinned key), the device's cvv, which this body does not
- * carry and the runtime keeps in memory for the one companion getCvvId, and the reviewed getCvvId
- * keys that companion may carry it under (`companion`, the replay's shijiStsCompanion, which the
- * client read from the API's shiji_sts_companion).
+ * carry and the runtime keeps in memory for the one companion getCvvId, and the SHA-256 of the
+ * reviewed getCvvId keys that companion may carry it under (`companion`, the replay's
+ * shijiStsCompanion, which the client read from the API's shiji_sts_companion).
  *
  * Only into `approved`, the paused getTokenId the approval was created from: `url` and `body` must
  * equal it byte for byte, so the accessToken and keySequence are the ones the API reviewed at create
@@ -122,8 +124,8 @@ export function isShijiStsServedCompanion(value) {
  * Null when neither URL is on an STS host, so every other processor keeps the generic swap. Throws
  * for any other body or URL, an STS URL that is not getTokenId, a substitution
  * isShijiStsServedSubstitution refuses (`sub` is whatever the approval served, of any processor's
- * shape), no reviewed getCvvId key to bind the companion to, and while the card-on-file decision is
- * open: in each case before anything continues.
+ * shape), no reviewed getCvvId key to bind the companion to, and while the card-on-file policy
+ * refuses: in each case before anything continues.
  */
 export function shijiStsTokenContinuation(url, body, sub, approved, companion) {
     if (!isShijiStsHost(url) && !isShijiStsHost(approved.url))
@@ -132,10 +134,10 @@ export function shijiStsTokenContinuation(url, body, sub, approved, companion) {
         throw new ShijiStsError('unsupported');
     if (shijiStsEndpoint(url, 'POST') !== 'token' || !isShijiStsServedSubstitution(sub))
         throw new ShijiStsError('unsupported');
-    const keys = companion && Array.isArray(companion.keySequences) ? [...companion.keySequences] : null;
-    if (!keys || !isShijiStsServedCompanion({ key_sequences: keys }))
+    const digests = companion && Array.isArray(companion.keySequenceSha256) ? [...companion.keySequenceSha256] : null;
+    if (!digests || !isShijiStsServedCompanion({ key_sequence_sha256: digests }))
         throw new ShijiStsError('unsupported');
-    return { body: substituteShijiSts(url, body, { pan: sub.fields.pan, expires: sub.fields.expires }), cvv: sub.fields.cvv, cvvKeySequences: keys };
+    return { body: substituteShijiSts(url, body, { pan: sub.fields.pan, expires: sub.fields.expires }), cvv: sub.fields.cvv, cvvKeySequenceSha256: digests };
 }
 /**
  * One attachment's getCvvId companion: at most one binding, to the getTokenId it last continued with
@@ -152,16 +154,17 @@ export class ShijiStsCompanions {
     /**
      * Bind the companion of `tokenRequest` (the paused getTokenId: its URL, method and body) for the
      * page `page` (the adapter's opaque id for the frame that sent it) and keep `cvv`, the device's
-     * CVV ciphertext, for it, to go only into a getCvvId whose keySequence is one of `cvvKeySequences`
-     * (the reviewed getCvvId keys the approval served). Replaces any earlier binding. Throws
-     * ShijiStsError for a request that is not a getTokenId in the proxy's shape, a key list
-     * payment-core refuses (none, empty or malformed), and while the card-on-file decision is open.
+     * CVV ciphertext, for it, to go only into a getCvvId whose keySequence hashes to one of
+     * `cvvKeySequenceSha256` (the SHA-256 of the reviewed getCvvId keys the approval served). Replaces any
+     * earlier binding. Throws ShijiStsError for a request that is not a getTokenId in the proxy's shape,
+     * a digest list payment-core refuses (none, empty or malformed), and while the card-on-file policy
+     * refuses.
      */
-    bind(tokenRequest, page, cvv, cvvKeySequences, now = Date.now()) {
+    bind(tokenRequest, page, cvv, cvvKeySequenceSha256, now = Date.now()) {
         this.release();
         if (!isShijiStsCiphertext(cvv))
             throw new ShijiStsError('unsupported');
-        const companion = createShijiStsCompanion({ url: tokenRequest.url, method: tokenRequest.method.toUpperCase(), body: tokenRequest.body }, { page, now, cvvKeySequences: Array.isArray(cvvKeySequences) ? [...cvvKeySequences] : cvvKeySequences });
+        const companion = createShijiStsCompanion({ url: tokenRequest.url, method: tokenRequest.method.toUpperCase(), body: tokenRequest.body }, { page, now, cvvKeySequenceSha256: Array.isArray(cvvKeySequenceSha256) ? [...cvvKeySequenceSha256] : cvvKeySequenceSha256 });
         const timer = setTimeout(() => { if (this.bound?.timer === timer)
             this.bound = null; }, SHIJI_STS_COMPANION_WINDOW_MS + 1000);
         timer.unref?.();