@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/verifone.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: cf655438763f54e5d5bfea2555f76941ef80dbfd5aa7bc6342a2a75d1ac9cd39
+// artifact-sha256: db732bdbb517b37ea27d05debafb7659bb456f686edd0c90d78b2fbdb993d68d
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -415,18 +415,44 @@ var VERIFONE_MERCHANT_PROFILES = /* @__PURE__ */ deepFreeze([
         // employee variants (featureConfig verifoneCCEnabled, verifonePLCCEnabled,
         // verifoneEmployeeCCEnabled, verifoneEmployeePLCCEnabled; live from late 2023, still on
         // 2026-09-19). Checkout is www.containerstore.com/checkout?fulfillmentMethod=STANDARD|PICKUP,
-        // on the legacy app behind PerimeterX. Its card request has never been observed: the
-        // CheckoutV2 bundle was never archived and the page is session-gated. So no leg and no key
-        // are pinned, and every blob-bearing request to www.containerstore.com is aborted, until one
-        // person-run checkout captured as a HAR pins the endpoint, the member holding the blob, the
-        // key and its alias, and whether the blob is sent once or twice.
+        // on the legacy app behind PerimeterX.
+        //
+        // The card request, read from TCS's own CheckoutV2 build 3.340.1.16022 (its public source
+        // map: CheckoutForm and the checkout service) and its live guest checkout on 2026-10-10:
+        // Place Order encrypts the card once with verifone.js, and axios posts the order once, as
+        // JSON, to /checkout/api/submit, with the new card last in paymentMethods after any gift
+        // card, as {defaultWallet, cardNumber (masked but its last four), encryptedCard, type
+        // 'CREDIT_CARD', cardType}. A saved card is type 'COF' with a walletId, TCS's own card
+        // 'TCS_CREDIT_CARD'; defaultWallet saves the card to the shopper's wallet, and
+        // popTermsAndConditionsAccepted (the form's popEnroll box) enrolls them in TCS's loyalty
+        // program, Organized Insider (once POP!). A gift card's balance check posts its own blob to
+        // /checkout/api/gift-card, which aborts like any request off the leg.
+        //
+        // The body names no amount (TCS's total is only in its cart response), and the key the page
+        // encrypts under, its verifoneEncryptionKey, is not pinned (verifone-keys.js). So the profile
+        // stays in observe: the leg's requests abort as unreviewed until a person pins the key and the
+        // merchant's total has a reviewed source.
         id: "containerstore_checkout",
         merchant: "The Container Store",
         processor: "verifone",
         status: "observe",
         environment: "production",
         origins: [{ checkout: "https://www.containerstore.com", endpoint: "https://www.containerstore.com" }],
-        legs: [],
+        legs: [{
+                name: "card",
+                method: "POST",
+                path: "/checkout/api/submit",
+                query: {},
+                requires: [{ path: ["paymentMethods", 0, "type"], equals: "CREDIT_CARD" }],
+                refuse: [
+                    { path: ["paymentMethods", 1], when: "present" },
+                    { path: ["paymentMethods", 0, "defaultWallet"], when: "true" },
+                    { path: ["paymentMethods", 0, "walletId"], when: "present" },
+                    { path: ["popTermsAndConditionsAccepted"], when: "true" }
+                ],
+                holder: ["paymentMethods", 0],
+                field: "encryptedCard"
+            }],
         keyPin: null,
         amount: null
     }
@@ -652,8 +678,143 @@ function decodeBase64(text) {
     }
     return encodeBase64(out) === text ? out : null;
 }
+// src/secp256k1.js
+var P = (1n << 256n) - (1n << 32n) - 977n;
+var N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+var G = Object.freeze({
+    x: 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n,
+    y: 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n
+});
+var BYTES = 32;
+var MAX_DRAWS = 16;
+var mod = (a) => {
+    const r = a % P;
+    return r < 0n ? r + P : r;
+};
+function toBigInt(bytes) {
+    let hex2 = "0";
+    for (let i = 0; i < bytes.length; i++)
+        hex2 += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex2}`);
+}
+function toBytes(value) {
+    const hex2 = value.toString(16).padStart(BYTES * 2, "0");
+    const out = new Uint8Array(BYTES);
+    for (let i = 0; i < BYTES; i++)
+        out[i] = parseInt(hex2.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function decodePoint(bytes) {
+    if (!(bytes instanceof Uint8Array) || bytes.length !== 1 + 2 * BYTES || bytes[0] !== 4)
+        return null;
+    const x = toBigInt(bytes.subarray(1, 1 + BYTES));
+    const y = toBigInt(bytes.subarray(1 + BYTES));
+    if (x >= P || y >= P)
+        return null;
+    return mod(y * y) === mod(x * x * x + 7n) ? { x, y } : null;
+}
+function isSecp256k1Point(bytes) {
+    return decodePoint(bytes) !== null;
+}
+var INFINITY = Object.freeze({ X: 0n, Y: 1n, Z: 0n });
+function double(p) {
+    if (p.Z === 0n || p.Y === 0n)
+        return INFINITY;
+    const a = mod(p.X * p.X);
+    const b = mod(p.Y * p.Y);
+    const c = mod(b * b);
+    const d = mod(2n * (mod((p.X + b) * (p.X + b)) - a - c));
+    const e = mod(3n * a);
+    const X = mod(e * e - 2n * d);
+    return { X, Y: mod(e * (d - X) - 8n * c), Z: mod(2n * p.Y * p.Z) };
+}
+function add(p, q) {
+    if (p.Z === 0n)
+        return q;
+    if (q.Z === 0n)
+        return p;
+    const z1z1 = mod(p.Z * p.Z);
+    const z2z2 = mod(q.Z * q.Z);
+    const u1 = mod(p.X * z2z2);
+    const u2 = mod(q.X * z1z1);
+    const s1 = mod(p.Y * q.Z * z2z2);
+    const s2 = mod(q.Y * p.Z * z1z1);
+    const h = mod(u2 - u1);
+    const r = mod(2n * (s2 - s1));
+    if (h === 0n)
+        return r === 0n ? double(p) : INFINITY;
+    const i = mod(4n * h * h);
+    const j = mod(h * i);
+    const v = mod(u1 * i);
+    const X = mod(r * r - j - 2n * v);
+    return { X, Y: mod(r * (v - X) - 2n * s1 * j), Z: mod((mod((p.Z + q.Z) * (p.Z + q.Z)) - z1z1 - z2z2) * h) };
+}
+function power(base, exponent) {
+    let result = 1n;
+    let square = mod(base);
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = mod(result * square);
+        square = mod(square * square);
+    }
+    return result;
+}
+function multiply(k, point) {
+    let r0 = INFINITY;
+    let r1 = { X: point.x, Y: point.y, Z: 1n };
+    for (let i = 255; i >= 0; i--) {
+        if (k >> BigInt(i) & 1n) {
+            r0 = add(r0, r1);
+            r1 = double(r1);
+        }
+        else {
+            r1 = add(r0, r1);
+            r0 = double(r0);
+        }
+    }
+    if (r0.Z === 0n)
+        return null;
+    const inverse = power(r0.Z, P - 2n);
+    const inverse2 = mod(inverse * inverse);
+    return { x: mod(r0.X * inverse2), y: mod(r0.Y * inverse2 * inverse) };
+}
+function ephemeralScalar(random) {
+    if (!random || typeof random.getRandomValues !== "function")
+        throw new Error("Refusing to encrypt: no random source.");
+    const draw = new Uint8Array(BYTES);
+    try {
+        for (let round = 0; round < MAX_DRAWS; round++) {
+            random.getRandomValues(draw);
+            const k = toBigInt(draw);
+            if (k > 0n && k < N)
+                return k;
+        }
+    }
+    finally {
+        draw.fill(0);
+    }
+    throw new Error("Refusing to encrypt: the random source drew no usable key.");
+}
+function secp256k1Agreement(recipient, random) {
+    const q = decodePoint(recipient);
+    if (!q)
+        throw new Error("Refusing to encrypt: the key is not a point on secp256k1.");
+    const k = ephemeralScalar(random);
+    const v = multiply(k, G);
+    const s = multiply(k, q);
+    if (!v || !s)
+        throw new Error("Refusing to encrypt: the key agreement reached the point at infinity.");
+    const ephemeralPoint = new Uint8Array(1 + 2 * BYTES);
+    ephemeralPoint[0] = 4;
+    ephemeralPoint.set(toBytes(v.x), 1);
+    ephemeralPoint.set(toBytes(v.y), 1 + BYTES);
+    return { ephemeralPoint, sharedSecret: toBytes(s.x) };
+}
 // src/verifone-pgp.js
-var P256_OID = Object.freeze([42, 134, 72, 206, 61, 3, 1, 7]);
+var CURVE_OIDS = Object.freeze({
+    "P-256": Object.freeze([42, 134, 72, 206, 61, 3, 1, 7]),
+    secp256k1: Object.freeze([43, 129, 4, 0, 10])
+});
 var ALGORITHM_ECDH = 18;
 var ENCRYPTING_ALGORITHMS = Object.freeze([1, 2, 16, 18]);
 var KNOWN_SYMMETRIC = Object.freeze([2, 3, 4, 7, 8, 9, 10]);
@@ -863,7 +1024,8 @@ function keyPacket(body) {
 function ecdhFields(fields) {
     const oidLength = fields[0];
     const oid = fields.subarray(1, 1 + oidLength);
-    if (oidLength !== P256_OID.length || !sameBytes(oid, P256_OID))
+    const curve = sameBytes(oid, CURVE_OIDS["P-256"]) ? "P-256" : sameBytes(oid, CURVE_OIDS.secp256k1) ? "secp256k1" : null;
+    if (!curve)
         return { refusal: "verifone_key_curve_unsupported" };
     let at = 1 + oidLength;
     const bits = fields[at] << 8 | fields[at + 1];
@@ -871,12 +1033,14 @@ function ecdhFields(fields) {
     at += 2 + point.length;
     if (bits !== 515 || point.length !== 65 || point[0] !== 4)
         return { refusal: "verifone_key_malformed" };
+    if (curve === "secp256k1" && !isSecp256k1Point(point))
+        return { refusal: "verifone_key_malformed" };
     const kdf = fields.subarray(at, at + 1 + fields[at]);
     if (kdf.length !== 4 || kdf[0] !== 3 || kdf[1] !== 1 || at + 4 !== fields.length)
         return { refusal: "verifone_key_malformed" };
     if (!KDF_HASHES[kdf[2]] || !AES[kdf[3]])
         return { refusal: "verifone_key_kdf_unsupported" };
-    return { point: Uint8Array.from(point), kdfHash: kdf[2], kekAlgorithm: kdf[3] };
+    return { curve, point: Uint8Array.from(point), kdfHash: kdf[2], kekAlgorithm: kdf[3] };
 }
 async function fingerprintOf(body, subtle) {
     return new Uint8Array(await subtle.digest("SHA-1", concat(Uint8Array.of(153), u16(body.length), body)));
@@ -962,6 +1126,7 @@ async function readVerifonePublicKey(publicKeyBase64, facilities) {
         primaryFingerprint: hex(primaryFingerprint),
         encryptionSubkeyId: hex(fingerprint.subarray(12, 20)),
         encryptionFingerprint: fingerprint,
+        curve: ecdh.curve,
         point: ecdh.point,
         kdfHash: ecdh.kdfHash,
         kekAlgorithm: ecdh.kekAlgorithm,
@@ -999,21 +1164,31 @@ ${MESSAGE_END}\r
 `;
     return encodeBase64(asciiBytes(armored));
 }
+async function agree(curve, point, crypto) {
+    if (curve === "secp256k1") {
+        const { ephemeralPoint: ephemeralPoint2, sharedSecret } = secp256k1Agreement(point, crypto);
+        return { ephemeralPoint: ephemeralPoint2, shared: sharedSecret };
+    }
+    const subtle = crypto.subtle;
+    const ephemeral = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const ephemeralPoint = new Uint8Array(await subtle.exportKey("raw", ephemeral.publicKey));
+    const recipient = await subtle.importKey("raw", point, { name: "ECDH", namedCurve: "P-256" }, false, []);
+    const shared = new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: recipient }, ephemeral.privateKey, 256));
+    return { ephemeralPoint, shared };
+}
 async function verifoneEncryptText(key, text, facilities) {
     const crypto = facilities?.crypto;
     const subtle = crypto?.subtle;
     if (!subtle || typeof crypto.getRandomValues !== "function")
         throw new Error("Refusing to encrypt: no WebCrypto.");
-    if (!key || key.refusal || !(key.point instanceof Uint8Array) || !AES[key.sessionCipher] || !AES[key.kekAlgorithm] || !KDF_HASHES[key.kdfHash]) {
+    const oid = key && Object.prototype.hasOwnProperty.call(CURVE_OIDS, key.curve) ? CURVE_OIDS[key.curve] : null;
+    if (!key || key.refusal || !oid || !(key.point instanceof Uint8Array) || !AES[key.sessionCipher] || !AES[key.kekAlgorithm] || !KDF_HASHES[key.kdfHash]) {
         throw new Error("Refusing to encrypt: the Verifone key is not one this codec reads.");
     }
     if (!Number.isSafeInteger(facilities.nowMs) || facilities.nowMs < 0)
         throw new Error("Refusing to encrypt: no clock.");
-    const ephemeral = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    const ephemeralPoint = new Uint8Array(await subtle.exportKey("raw", ephemeral.publicKey));
-    const recipient = await subtle.importKey("raw", key.point, { name: "ECDH", namedCurve: "P-256" }, false, []);
-    const shared = new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: recipient }, ephemeral.privateKey, 256));
-    const param = concat(Uint8Array.of(P256_OID.length), Uint8Array.from(P256_OID), Uint8Array.of(ALGORITHM_ECDH, 3, 1, key.kdfHash, key.kekAlgorithm), asciiBytes("Anonymous Sender    "), key.encryptionFingerprint);
+    const { ephemeralPoint, shared } = await agree(key.curve, key.point, crypto);
+    const param = concat(Uint8Array.of(oid.length), Uint8Array.from(oid), Uint8Array.of(ALGORITHM_ECDH, 3, 1, key.kdfHash, key.kekAlgorithm), asciiBytes("Anonymous Sender    "), key.encryptionFingerprint);
     const derived = new Uint8Array(await subtle.digest(KDF_HASHES[key.kdfHash], concat(u32(1), shared, param)));
     const kek = await subtle.importKey("raw", derived.subarray(0, AES[key.kekAlgorithm]), "AES-KW", false, ["wrapKey"]);
     const sessionKey = crypto.getRandomValues(new Uint8Array(AES[key.sessionCipher]));
@@ -1142,7 +1317,7 @@ function verifoneClockSkewRefusal(deviceNowMs, serverNowMs) {
 }
 var KEY_REFUSALS = Object.freeze({
     verifone_key_unpinned: "Refusing to encrypt: Agentcard has not pinned this Verifone key.",
-    verifone_key_curve_unsupported: "Refusing to encrypt: the Verifone key is not on NIST P-256.",
+    verifone_key_curve_unsupported: "Refusing to encrypt: the Verifone key is on neither NIST P-256 nor secp256k1.",
     verifone_key_expired: "Refusing to encrypt: this Verifone key has expired.",
     verifone_key_revoked: "Refusing to encrypt: this Verifone key was revoked."
 });

package/dist/verifone.js

@@ -18,7 +18,7 @@
  * key paths, never a value) and aborts it, so the agent's placeholder card never
  * reaches the merchant and nothing is charged; 'enabled' lets a prepared checkout
  * pay the reviewed leg. A profile is 'enabled' only when the API and this build both
- * say so. The Container Store ships in 'observe', with no leg and no key reviewed.
+ * say so. The Container Store ships in 'observe', its card request reviewed and no key pinned.
  */
 import * as generated from './verifone.generated.js';
 import { sha256Hex as sharedSha256Hex } from './adyen-merchant-hosted.generated.js';

package/dist/wspay.d.ts

@@ -4,27 +4,28 @@ export declare const WSPAY_PSP = "wspay";
 export declare const WSPAY_CAPABILITY = "wspay_confirm";
 /**
  * Why the SDK refuses a WSPay request before anything is claimed, created or prompted:
- *   - `unsupported_wspay_payment_method`: not the card frame's new-card confirm. That covers a
- *     saved_card or temp_card_id body (no new card to fill), a card-shaped object the page
- *     built into the transaction, another URL shape on the host, or headers the frame does not
- *     send. The cardholder's device could never fill it.
- *   - `wspay_keep_on_file_unsupported`: a sound confirm that asks WSPay to keep the card on file
- *     (tokenize_pan true), so the merchant could charge it later without another approval. Only
- *     the cardholder can agree to that, and no approval asks them yet.
- * The API refuses the same requests at create (invalid_wspay_request and
- * wspay_keep_on_file_unsupported), so a refusal here only saves the round trip.
+ * `unsupported_wspay_payment_method`, not the card frame's new-card confirm. That covers a
+ * saved_card or temp_card_id body (no new card to fill), a card-shaped object the page built
+ * into the transaction, another URL shape on the host, or headers the frame does not send. The
+ * cardholder's device could never fill it, and the API refuses the same requests at create
+ * (invalid_wspay_request), so a refusal here only saves the round trip.
+ *
+ * A sound confirm that asks WSPay to keep the card on file (tokenize_pan true) pauses like a
+ * one-time one: the approval that follows asks the cardholder whether the merchant may keep the
+ * card. The API offers it for that approval only as a hotel's EUR 1.00 card guarantee paid with a
+ * card the cardholder stored, and refuses any other at create (wspay_keep_on_file_unsupported,
+ * card_not_stored).
  */
-export type WspayRefusalReason = 'unsupported_wspay_payment_method' | 'wspay_keep_on_file_unsupported';
+export type WspayRefusalReason = 'unsupported_wspay_payment_method';
 /** True when the URL's host is one of WSPay's two Components hosts. */
 export declare function isWspayHost(url: string): boolean;
 /**
  * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
- * card frame's confirm of a new card for a one-time payment, which pauses for approval;
- * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
- * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
- * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
- * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
- * the cardholder.
+ * card frame's confirm of a new card, which pauses for approval; otherwise the reason it is
+ * refused. It judges the whole request (the exact URL, the frame's content type, Accept and
+ * WP3-v2-Client authorization, and a body of the frame's own keys bound to the URL's
+ * client_secret) with payment-core's wspayConfirmRefusal, the check the API runs at create.
+ * It passes keep-on-file consent because the approval that follows asks the cardholder for it.
  */
 export declare function wspayRefusal(request: {
     url: string;

package/dist/wspay.generated.d.ts

@@ -6,6 +6,11 @@ declare function isWspayNewCardBody(body: any, clientSecret: any, options: any):
 declare function classifyWspayRequest(url: any, method: any, body: any, options: any): "card" | "unsupported" | null;
 declare function isWspayConfirmRequest(request: any, options: any): any;
 declare function wspayStoredCredentialRequested(body: any): boolean | null;
+declare var WSPAY_GUARANTEE: Readonly<{
+    amount: 100;
+    currency: "eur";
+}>;
+declare function wspayKeepOnFileRefusal(body: any, amount: any, currency: any): "keep_on_file" | null;
 declare function wspayConfirmRefusal(request: any, options: any): "unsupported" | "keep_on_file" | null;
 declare function wspayRefusalMessage(reason: any): string;
 declare function injectWspayCard(body: any, card: any, options: any): {
@@ -38,4 +43,4 @@ declare function wspayFacts(status: any, text2: any): {
     outcome: string;
     refusalCode: any;
 };
-export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };
+export { WSPAY_CONFIRM_HOSTS, WSPAY_GUARANTEE, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayKeepOnFileRefusal, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };

package/dist/wspay.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 560fa6d54ff04e65a21dc08d3046495f67499274b35c83053f8b25370f13a17a
+// artifact-sha256: 9ba65916c5dc5ee3ca830d630cafbde62d537e61991c33c80f1520ac93ef0b0d
 // src/wspay.js
 var WSPAY_CONFIRM_HOSTS = Object.freeze(["proxy.wspay.biz", "proxy-test.wspay.biz"]);
 var WSPAY_TEST_HOST = "proxy-test.wspay.biz";
@@ -224,6 +224,12 @@ function wspayStoredCredentialRequested(body) {
     const value = confirmBody(body);
     return value === null ? null : value.payment_method.data.tokenize_pan === true;
 }
+var WSPAY_GUARANTEE = Object.freeze({ amount: 100, currency: "eur" });
+function wspayKeepOnFileRefusal(body, amount, currency) {
+    if (wspayStoredCredentialRequested(body) !== true)
+        return null;
+    return amount === WSPAY_GUARANTEE.amount && typeof currency === "string" && currency.toLowerCase() === WSPAY_GUARANTEE.currency ? null : "keep_on_file";
+}
 function wspayConfirmRefusal(request, options) {
     if (!isWspayConfirmRequest(request, { keepOnFile: true }))
         return "unsupported";
@@ -358,7 +364,11 @@ function sanitizeWspayResponse(text2, options) {
         if (pm !== null && pm !== void 0) {
             if (!keysWithin(pm, ["type", "data"]) || pm.type !== "card" || !keysWithin(data, ["brand", "issuer", "masked", "expiration_date", "token"]) || !opaqueId(data.token) || owns(data, "brand") && !opaqueId(data.brand, 32) || owns(data, "issuer") && !opaqueId(data.issuer, 64) || owns(data, "expiration_date") && !yymm(data.expiration_date) || owns(data, "masked") && !exact(/^[0-9]{0,6}[-* xX]{4,16}[0-9]{4}$/, data.masked))
                 return fail();
-            safe.payment_method = { type: "card", data: { ...data } };
+            const card = {};
+            for (const key of ["brand", "issuer", "token"])
+                if (owns(data, key))
+                    card[key] = data[key];
+            safe.payment_method = { type: "card", data: card };
         }
     }
     return JSON.stringify({ status: "approved", action_required: null, payment_result: safe });
@@ -367,4 +377,4 @@ function wspayFacts(status, text2) {
     const verdict = wspayResponseOutcome(status, text2);
     return { outcome: verdict.outcome, refusalCode: verdict.outcome === "refused" ? verdict.code : null };
 }
-export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };
+export { WSPAY_CONFIRM_HOSTS, WSPAY_GUARANTEE, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayKeepOnFileRefusal, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };

package/dist/wspay.js

@@ -28,19 +28,17 @@ export function isWspayHost(url) {
 }
 /**
  * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
- * card frame's confirm of a new card for a one-time payment, which pauses for approval;
- * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
- * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
- * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
- * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
- * the cardholder.
+ * card frame's confirm of a new card, which pauses for approval; otherwise the reason it is
+ * refused. It judges the whole request (the exact URL, the frame's content type, Accept and
+ * WP3-v2-Client authorization, and a body of the frame's own keys bound to the URL's
+ * client_secret) with payment-core's wspayConfirmRefusal, the check the API runs at create.
+ * It passes keep-on-file consent because the approval that follows asks the cardholder for it.
  */
 export function wspayRefusal(request) {
-    // No keep-on-file consent (the second argument): no approval asks for it yet.
-    const refusal = wspayConfirmRefusal({ url: request.url, method: 'POST', headers: request.headers ?? {}, body: request.body ?? '' }, undefined);
-    if (refusal === null)
-        return null;
-    return refusal === 'keep_on_file' ? 'wspay_keep_on_file_unsupported' : 'unsupported_wspay_payment_method';
+    // Keep-on-file consent (the second argument): the Vault's approval asks the cardholder whether
+    // the merchant may keep the card, and the API admits such a confirm only as a card guarantee.
+    const refusal = wspayConfirmRefusal({ url: request.url, method: 'POST', headers: request.headers ?? {}, body: request.body ?? '' }, { keepOnFile: true });
+    return refusal === null ? null : 'unsupported_wspay_payment_method';
 }
 /**
  * Whether an approved answer handed to a WSPay confirm is WSPay's 3-D Secure step: HTTP 200 with

package/examples/preflight/kernel-native/README.md

@@ -2,7 +2,7 @@
 
 You can detect a checkout's PSP before entering card details with `@agent-cards/sdk`. Kernel native support needs a separate profile for the native adapter that actually runs the checkout. The direct SDK's coverage does not establish Kernel's native coverage.
 
-No qualified native profile accompanies this kit. The inventory covers all 25 PSPs in the checkout catalog and reports `unknown` for every native runtime status. Kernel's pinned documentation lists Stripe, Shopify, Square, Recurly, and Razorpay. The other processors are unestablished, rather than explicitly unsupported. See the endpoint constraints and source hashes in [documented-adapters.json](./documented-adapters.json).
+No qualified native profile accompanies this kit. The inventory covers all 24 PSPs in the checkout catalog and reports `unknown` for every native runtime status. Kernel's pinned documentation lists Stripe, Shopify, Square, Recurly, and Razorpay. The other processors are unestablished, rather than explicitly unsupported. See the endpoint constraints and source hashes in [documented-adapters.json](./documented-adapters.json).
 
 ## Use the detector now
 

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "a1bfa3f9da2942711afca14cfc7158a49274869c66e685abc0d36839d2e96454",
+  "catalog_sha256": "47dd1bc5a749224f66980b42b758f9a19d9ac849e3a8d5230075226a4870fde5",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,
@@ -202,15 +202,6 @@
         "Native runtime evidence is missing."
       ]
     },
-    {
-      "psp": "moneris",
-      "mode": "token",
-      "documentation": "not_documented",
-      "status": "unknown",
-      "limitations": [
-        "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
-      ]
-    },
     {
       "psp": "bambora",
       "mode": "token",
@@ -228,15 +219,6 @@
       "limitations": [
         "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
       ]
-    },
-    {
-      "psp": "gravy",
-      "mode": "token",
-      "documentation": "not_documented",
-      "status": "unknown",
-      "limitations": [
-        "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
-      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.9",
+  "version": "0.23.10",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",