@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/client.js

@@ -13,7 +13,7 @@ import { merchantSessionCapture } from './merchant-session-probe.js';
 import { creditguardPageProcessUrl, creditguardPpDomainHost, creditguardPreparationEnvironment, creditguardProcessTxId, sanitizeCreditguardResponse, } from './creditguard.generated.js';
 import { CONVERGE_CAPABILITY } from './elavon-converge.js';
 import { SHIJI_STS_CAPABILITY, SHIJI_STS_PSP, isShijiStsServedCompanion, isShijiStsServedSubstitution } from './shiji-sts.js';
-import { AMADEUS_CHECKOUT_CAPABILITY } from './amadeus-checkout.generated.js';
+import { AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
 import { BuyModule } from './buy.js';
@@ -29,7 +29,7 @@ import { merchantCardEndpointFactsRefusal as sharedFactsRefusal, readMerchantCar
 import { DATATRANS_CAPABILITY } from './datatrans.js';
 import { PELECARD_CAPABILITY, PELECARD_PSP } from './pelecard.js';
 import { PRIMER_CAPABILITY, PRIMER_PSP, primerTokenAnswer } from './primer.js';
-import { PAYRAILS_CAPABILITY, payrailsSaveAnswer } from './payrails.js';
+import { PAYRAILS_CAPABILITY, isPayrailsPaymentUrl, payrailsAnswer } from './payrails.js';
 import { WSPAY_CAPABILITY, WSPAY_PSP } from './wspay.js';
 import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REPLY_WINDOW_MS, secureAcceptanceCheckoutProfile, secureAcceptanceCheckoutRefusal, secureAcceptanceFrameAnswer, } from './cybersource-secure-acceptance.js';
 /**
@@ -37,7 +37,7 @@ import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_AC
  * only recognizers in these modes, so a request this build cannot complete
  * is never paused) and sent on every create. `device_encrypt`: the adapters
  * capture the Payrails session key the page's init payload names (payrails.ts),
- * and the cardholder's device encrypts and sends the save.
+ * and the cardholder's device encrypts and sends the save or card-form payment.
  */
 export const SUPPORTED_MODES = ['token', 'cse', 'hosted_form', 'device_encrypt'];
 /**
@@ -107,14 +107,17 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * `primer_payment_instruments`: Primer's card tokenization, which this build
  * judges before it pauses (primer.ts) and hands back to the page only as a
  * single-use token. A merchant's client session can save the card after the
- * payment with no sign in that request, so the API creates a Primer
- * authorization only for a test-mode client and refuses a live one (400
- * invalid_primer_request, live_keep_on_file) until the cardholder can consent
- * to that save; this build then aborts the paused request with nothing sent. A
- * gated recognizer never sits in BUILTIN_REGISTRY, so it is paused only after a
- * sync.
- * `payrails_device_encrypt`: Payrails' card-form save, which this build pauses
- * only once it has bound the save to a captured session (payrails.ts). A gated
+ * payment with no sign in that request, so the API creates a live Primer
+ * authorization only when it names the checkout page's https origin
+ * (checkout_origin, which this build sends from the page's origin): the
+ * approval says the merchant keeps the card on file, under the merchant name
+ * the create sent, which Agentcard cannot confirm, and pays only with a card
+ * the person stored. A refused create aborts the paused request with nothing
+ * sent. A gated recognizer never sits in BUILTIN_REGISTRY, so it is paused only
+ * after a sync.
+ * `payrails_device_encrypt`: Payrails' card save and card-form payment, which
+ * this build pauses only once it has bound the request to a captured session
+ * (payrails.ts). A gated
  * recognizer never sits in BUILTIN_REGISTRY, so it is paused only after a sync.
  * `converge_hpp_process`: Elavon Converge's Hosted Payment Page card request
  * (elavon-converge.ts), paused in token mode and judged by the pre-claim gate.
@@ -166,8 +169,24 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * finds a card in it (cybersource-secure-acceptance.ts). Served on the same terms,
  * so every other company keeps the stop every build applies to a card posted to
  * Secure Acceptance.
+ * `gravy_session_fields_put`: Gravy Secure Fields' update of a checkout session,
+ * the one card request a recognizer declares as a PUT. This build pauses that PUT
+ * from Gravy's controller frame as it pauses a POST (isRecognizerRequest), creates
+ * the authorization with the PUT, and answers the frame with Gravy's own answer to
+ * the cardholder's device. Served on the same terms; an older build never sees the
+ * entry, and every company Agentcard has not turned Gravy on for keeps today's path,
+ * where the request continues to Gravy untouched.
+ * `moneris_hosted_tokenization`: Moneris Hosted Tokenization's card request, the
+ * frame's form post to /HPPtoken/request.php. This build pauses it only when it
+ * carries the number, the expiry and the CVD the cardholder's device fills, fails a
+ * frame that leaves the expiry or CVD to the merchant's page in the browser with a
+ * `blocked` event, `request_without_card`, and answers with Moneris's token as the
+ * API recorded it. The device sends the card through the checkout relay. Served on
+ * the same terms: only to a build that lists it, for a company Agentcard turned
+ * Moneris on for. A gated recognizer never sits in BUILTIN_REGISTRY, so it is paused
+ * only after a sync.
  */
-export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY];
+export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization'];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -185,12 +204,16 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * it creates a token and charges nothing, and the merchant's server charges its
  * own cart total later, so the agent's pair, which the prepared checkout already
  * carries, is the total the cardholder approves, and the card that pays can spend
- * no more than that (the API's card rule).
+ * no more than that (the API's card rule). Moneris Hosted Tokenization's
+ * request.php carries the card and no price: the merchant's server charges the
+ * token later, so the agent's pair, above zero (MONERIS_PSP below), is the one
+ * figure the approval shows.
  */
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP];
+const MONERIS_PSP = 'moneris';
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance' };
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -1162,8 +1185,9 @@ export class VaultClient {
     }
     /**
      * The recogniser that claims a card request, or null; what a paused request names as
-     * `recognizer`. A POST to a recognised endpoint, or for a recognizer whose card request is a
-     * GET (Worldpay eProtect) that exact GET, query included.
+     * `recognizer`. A POST to a recognised endpoint, a PUT for a recognizer whose card request is
+     * a PUT (Gravy), or for a recognizer whose card request is a GET (Worldpay eProtect) that
+     * exact GET, query included.
      */
     recognizerOf(url, method = 'POST') {
         const rec = findRecognizer(url, this.mergedRegistry(), { sandbox: this.sandbox });
@@ -1189,7 +1213,8 @@ export class VaultClient {
         // payrails_device_encrypt, converge_hpp_process, worldpay_eprotect_jsonp,
         // wspay_confirm, shiji_sts_pinned_key, amadeus_checkout_actions.v1,
         // worldline_mycheckout_form, verifone_card_capture, ekashu_hosted_payment_page,
-        // cybersource_sa_token_create) and
+        // cybersource_sa_token_create, gravy_session_fields_put,
+        // moneris_hosted_tokenization) and
         // the caller's company is one Agentcard turned that processor on for, so this
         // build arms Fiserv's card capture, GMO's getToken, CyberSource Flex's card
         // fields, Juspay's card flow, Datatrans's Secure Fields card post, the
@@ -1197,8 +1222,9 @@ export class VaultClient {
         // CreditGuard's hosted page submit, Primer's card tokenization, Payrails' card
         // save, Converge's payment page, Worldpay eProtect's registration, WSPay's
         // card confirm, Shiji STS's card leg, Amadeus Checkout's card add,
-        // Worldline MyCheckout's card form and CyberSource Secure Acceptance's token
-        // create only for
+        // Worldline MyCheckout's card form, CyberSource Secure Acceptance's token
+        // create, Gravy's session fields PUT and Moneris Hosted
+        // Tokenization's card request only for
         // such a company, and an older build never receives a recognizer it cannot
         // judge. Every other org's registry never recognizes a Flex, Juspay, Datatrans,
         // Pelecard, ACI, CreditGuard, Primer, Payrails, Converge, eProtect, WSPay, Shiji STS, Amadeus or
@@ -1293,8 +1319,9 @@ export class VaultClient {
     }
     /**
      * True when this request is a card tokenization we can take over: a POST to
-     * a recognized endpoint, or for a recognizer whose card request is a GET
-     * (Worldpay eProtect) that exact GET, query included.
+     * a recognized endpoint, a PUT for a recognizer whose card request is a PUT
+     * (Gravy), or for a recognizer whose card request is a GET (Worldpay eProtect)
+     * that exact GET, query included.
      */
     isCardRequest(url, method = 'POST') {
         return this.recognizerOf(url, method) !== null;
@@ -1474,6 +1501,12 @@ export class VaultClient {
             throw fail('secure_acceptance_profile_id_invalid');
         if (secureAcceptance && !input.cardId)
             throw fail('card_required');
+        // Amadeus Checkout: Air France and KLM keep the expiry in their own form, where the agent types the
+        // paying card's real expiry (placeholderCard), so the preparation names that card. The API refuses
+        // one without it and approves no other card; refusing here asks nobody to approve it.
+        const amadeus = input.psp === AMADEUS_CHECKOUT_PSP;
+        if (amadeus && !input.cardId)
+            throw fail('card_required');
         // CyberSource Flex, tokenized before Pay: the loaded card field's capture context and fields,
         // verified here against the keys payment-core pins before anything is created (the API and the
         // cardholder's device verify them again).
@@ -1596,6 +1629,8 @@ export class VaultClient {
                         || (eprotect && (state.paypage_id !== input.paypageId || state.card_id !== input.cardId))
                         // Secure Acceptance: the merchant profile and the card the cardholder approved are the ones asked for.
                         || (secureAcceptance && (state.secure_acceptance_profile_id !== secureAcceptanceProfileId || state.card_id !== input.cardId))
+                        // Amadeus: the card the cardholder approved is the one whose expiry the agent typed.
+                        || (amadeus && state.card_id !== input.cardId)
                         // The API says a preparation tokenizes before Pay exactly when this one carried a capture context.
                         || (state.tokenize_before_pay === true) !== !!flexContext)
                         throw fail('ready_unconfirmed', id);
@@ -1863,7 +1898,12 @@ export class VaultClient {
         // payrails_session_key_required.
         const sidecar = input.request.payrails;
         if (mode === 'device_encrypt' && (!sidecar || typeof sidecar.encryption_public_key !== 'string' || !sidecar.encryption_public_key)) {
-            throw new Error('A Payrails card save needs request.payrails.encryption_public_key, the session key from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
+            throw new Error('A Payrails card save or card-form payment needs request.payrails.encryption_public_key, the session key from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
+        }
+        // A card-form payment's ciphertext carries the session's holderReference, which its body does not.
+        const payrailsPayment = mode === 'device_encrypt' && isPayrailsPaymentUrl(input.request.url);
+        if (payrailsPayment && (typeof sidecar?.holder_reference !== 'string' || !sidecar.holder_reference)) {
+            throw new Error('A Payrails card-form payment needs request.payrails.holder_reference, the holderReference from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
         }
         // A preparation that tokenized before Pay pays only a field request loaded under the capture
         // context and fields its cardholder approved: the device holds CyberSource's token for that context.
@@ -1871,20 +1911,23 @@ export class VaultClient {
             throw new CheckoutPreparationError(preparation.id, 'checkout_changed');
         }
         // Say no rather than coerce. Each recognizer's card request has exactly one
-        // method (recognizerRequestMethod): a POST body, or for Worldpay eProtect the
-        // GET whose query carries the card. The service stores the replay template
-        // with that method, so a caller handing in another one would get it
-        // silently rewritten and the cardholder's device would replay something the
-        // caller never asked for. A direct caller deserves to be told, not surprised.
-        // A card endpoint has no recognizer: its card request is its profile's own method (a POST, or
-        // Target Optical's PUT), which admitCardEndpoint already held the request to.
+        // method (recognizerRequestMethod): a POST body, Gravy's PUT body, or for
+        // Worldpay eProtect the GET whose query carries the card. The service stores
+        // the replay template with that method, so a caller handing in another one
+        // would get it silently rewritten and the cardholder's device would replay
+        // something the caller never asked for. A direct caller deserves to be told,
+        // not surprised. A card endpoint has no recognizer: its card request is its
+        // profile's own method (a POST, or Target Optical's PUT), which
+        // admitCardEndpoint already held the request to.
         const method = (input.request.method ?? cardEndpoint?.method ?? 'POST').toUpperCase();
         const cardMethod = rec ? recognizerRequestMethod(rec) : cardEndpoint ? cardEndpoint.method : 'POST';
         if (method !== cardMethod) {
             throw new Error(cardMethod === 'GET'
                 ? `a ${rec?.psp} card registration is a GET; got ${method} for ${redactUrl(input.request.url)}.`
-                : `checkout authorization is POST-only; got ${method} for ${redactUrl(input.request.url)}. ` +
-                    'A non-POST tokenizer needs recognizer support before it can be intercepted.');
+                : cardMethod === 'PUT' && rec
+                    ? `a ${rec.psp} card request is a PUT; got ${method} for ${redactUrl(input.request.url)}.`
+                    : `checkout authorization is POST-only; got ${method} for ${redactUrl(input.request.url)}. ` +
+                        'A non-POST tokenizer needs recognizer support before it can be intercepted.');
         }
         // A GET card request is its URL alone. This build completes one: Worldpay
         // eProtect's registration exactly as payment-core admits it, with no body.
@@ -1915,6 +1958,10 @@ export class VaultClient {
         // amount_required.
         if (!hasAmount && rec && AGENT_AMOUNT_PROCESSORS.includes(rec.psp))
             throw new AmountRequiredError(rec.psp);
+        // A Moneris token is charged later for whatever the merchant's server decides, so a zero pair
+        // would show the cardholder no price at all: it is refused like a missing one.
+        if (hasAmount && rec && rec.psp === MONERIS_PSP && Number(input.amount) <= 0)
+            throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the
         // page charges another. The API refuses the same create as page_amount_required.
@@ -1924,7 +1971,8 @@ export class VaultClient {
         // later, under another session), so the price the cardholder approves is
         // the one sent here: the agent's pair or else the page total. Refused
         // before any create or prompt, the way the API refuses amount_required.
-        if (mode === 'device_encrypt' && !hasAmount && !input.pageAmount) {
+        // A card-form payment names the amount it authorizes, which the API reads.
+        if (mode === 'device_encrypt' && !payrailsPayment && !hasAmount && !input.pageAmount) {
             throw new Error('A Payrails card save names no amount, so pass amount and currency (or let the adapter read the page total): that is the amount the cardholder approves. Nothing was created and nothing was charged.');
         }
         const timeoutMs = input.timeoutMs ?? 15 * 60_000;
@@ -1996,8 +2044,10 @@ export class VaultClient {
                     microform: { version: input.request.microform.version, fields: [...input.request.microform.fields],
                         ...(input.request.microform.trigger ? { trigger: input.request.microform.trigger } : {}) },
                 } : {}),
-                // Only the key: the token already rides in the passthrough authorization header.
-                ...(mode === 'device_encrypt' && sidecar ? { payrails: { encryption_public_key: sidecar.encryption_public_key } } : {}),
+                // Only the key, and a card-form payment's holderReference: the token already rides in the
+                // passthrough authorization header.
+                ...(mode === 'device_encrypt' && sidecar ? { payrails: { encryption_public_key: sidecar.encryption_public_key,
+                        ...(payrailsPayment ? { holder_reference: sidecar.holder_reference } : {}) } } : {}),
             },
         };
         try {
@@ -2063,7 +2113,13 @@ export class VaultClient {
         // then at the caller's interval; at the default 2 seconds the first read alone would miss it.
         // The API's bind names 100 ms as such a row's poll interval, so slow_down admits these reads
         // (as an eProtect row names the 500 ms read above).
-        const preparedFlexPollUntil = preparation?.cybersourceFlex ? Date.now() + 10_000 : 0;
+        // A prepared Bambora token create too: Custom Checkout's card frame gives its tokenization
+        // request 5 seconds from Pay, and the cardholder's device answers a prepared token 1.5 to 4
+        // seconds after this bind. Read every 2 seconds, an answer later than the first read waited
+        // for the read 4 seconds after the bind, at or past the frame's timer; read every 100 ms, it
+        // reaches the frame within about 0.2 seconds of the device's answer. The API's bind names
+        // 100 ms on such a row too.
+        const preparedTightPollUntil = preparation?.cybersourceFlex || preparation?.psp === 'bambora' ? Date.now() + 10_000 : 0;
         let execution = {};
         let approvalDelivered = false;
         const deliverApproval = (state) => {
@@ -2112,7 +2168,7 @@ export class VaultClient {
                 if (stopSignal?.aborted)
                     throw new PaymentOutcomeUnknownError(authorizationId, input.merchantSignal?.aborted ? 'merchant_request_aborted' : 'local_cancel');
                 const pollInterval = Date.now() < preparedFastPollUntil ? Math.min(this.pollIntervalMs, 500)
-                    : Date.now() < preparedFlexPollUntil ? Math.min(this.pollIntervalMs, 100) : this.pollIntervalMs;
+                    : Date.now() < preparedTightPollUntil ? Math.min(this.pollIntervalMs, 100) : this.pollIntervalMs;
                 // A Secure Acceptance read also wakes when its reply window closes (Infinity for every other processor).
                 await interruptibleSleep(Math.min(pollInterval, Math.max(0, deadline - Date.now()), Math.max(0, secureAcceptanceReplyBy - Date.now())), stopSignal);
                 if (stopSignal?.aborted)
@@ -2247,16 +2303,17 @@ export class VaultClient {
                                 fields: { ...sub.fields },
                                 ...(removeRaw ? { remove: [...removeRaw] } : {}),
                             },
-                            ...(shiji ? { shijiStsCompanion: Object.freeze({ keySequences: Object.freeze([...s.shiji_sts_companion.key_sequences]) }) } : {}),
+                            ...(shiji ? { shijiStsCompanion: Object.freeze({ keySequenceSha256: Object.freeze([...s.shiji_sts_companion.key_sequence_sha256]) }) } : {}),
                             ...amountAuthority,
                             ...execution,
                         };
                     }
                     if (approvedMode === 'device_encrypt') {
                         // The device sent the card to Payrails itself; this is Payrails' answer to it. It
-                        // enters the page only as a 201 for a card instrument, rebuilt from payment-core's
-                        // allow-list under a JSON content type (payrails.ts payrailsSaveAnswer). Anything else
-                        // is never handed over: the card may be saved, so the outcome is unknown, not declined.
+                        // enters the page only as a 201 for a card instrument or, for a card-form payment, a 2xx
+                        // naming the authorize action, rebuilt from payment-core's allow-list under a JSON
+                        // content type (payrails.ts payrailsAnswer, by the paused URL). Anything else is never
+                        // handed over: the card may be saved or paying, so the outcome is unknown, not declined.
                         // Autopilot never runs this mode, so an autopilot answer is not one to act on either.
                         if (execution.executionMode === 'autopilot')
                             throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_submission_mode_invalid');
@@ -2264,7 +2321,7 @@ export class VaultClient {
                             throw new PaymentOutcomeUnknownError(authorizationId, 'approved_mode_unsupported');
                         const saved = s.response;
                         const answer = saved && typeof saved === 'object' && Number.isInteger(saved.status) && typeof saved.body === 'string'
-                            ? payrailsSaveAnswer(saved.status, saved.body) : null;
+                            ? payrailsAnswer(saved.status, saved.body, input.request.url) : null;
                         if (!answer)
                             throw new PaymentOutcomeUnknownError(authorizationId, 'payrails_answer_unconfirmed');
                         if (s.processor_context !== undefined)

package/dist/creditguard.generated.d.ts

@@ -54,7 +54,7 @@ declare function parseCreditguardTransaction(body: any, txId: any): {
     personalIdAlwaysEnabled: boolean;
     inputs: any;
 } | null;
-declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "transaction_unreadable" | "three_d_secure" | "form_inputs" | "card_field_hidden" | "no_retries_left" | "jwe_public_key_malformed" | null;
+declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "transaction_unreadable" | "three_d_secure" | "form_inputs" | "card_field_hidden" | "jwe_public_key_malformed" | null;
 declare function creditguardSendWindowRefusal(timing: any): "timing_unknown" | "page_expired" | "recaptcha_expired" | null;
 declare var CREDITGUARD_REFUSAL_CODES: readonly string[];
 declare function creditguardResponseOutcome(status: any, body: any, options: any): {

package/dist/creditguard.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 83caafdf10afb4617e5eb3a896d3a1ba4b5c098747495658529c5d13798051cc
+// artifact-sha256: 58593275ccbce7e76a1aa68065eb63063cdf0ed00d533706bec557cb8a21cbc8
 // src/creditguard.js
 var CREDITGUARD_PPS_HOSTS = Object.freeze(["pps.creditguard.co.il", "pps2.creditguard.co.il", "ppsuat.creditguard.co.il"]);
 var CREDITGUARD_SANDBOX_HOST = "ppsuat.creditguard.co.il";
@@ -572,8 +572,6 @@ function creditguardTransactionRefusal(txn, expectation) {
     const form = formInputsRefusal(txn.inputs);
     if (form)
         return form;
-    if (txn.remainingSubmitRetries === null || txn.remainingSubmitRetries === 0)
-        return "no_retries_left";
     const environment = creditguardPreparationEnvironment(expectation.hostname);
     if (environment === null || environment === "sandbox" !== (txn.envType === "test") || typeof expectation.sandbox !== "boolean" || expectation.sandbox !== (environment === "sandbox"))
         return "environment_mismatch";

package/dist/cse-body.d.ts

@@ -13,12 +13,13 @@ import type { PreparedCheckout, ReplayResponse } from './client.js';
  * always a prepared one (authorize() requires it), so its preparation names
  * the processor and the key pin the cardholder approved. It continues only a
  * request on Fiserv's capture hosts, and only when that capture's own pin (its
- * envelope's key, pinned for its endpoint and its merchant) is the approved
- * pin; then Fiserv's own substitution writes only the envelope's four members
- * at source.encryptionData of the live paused body, and throws for a body that
- * is not the capture Agentcard covers or an envelope under another key than
- * the one the paused capture names (fiserv.ts). Any other approval never meets
- * a Fiserv capture host. Every refusal throws before anything is sent.
+ * envelope's key, or for a credentials session's key its merchant's, pinned for
+ * its endpoint and its merchant) is the approved pin; then Fiserv's own
+ * substitution writes only the envelope's four members at source.encryptionData
+ * of the live paused body, and throws for a body that is not the capture
+ * Agentcard covers or an envelope under another key than that pin's
+ * (fiserv.ts). Any other approval never meets a Fiserv capture host. Every
+ * refusal throws before anything is sent.
  */
 export declare function cseBody(body: string, replay: Extract<ReplayResponse, {
     mode: 'cse';

package/dist/cse-body.js

@@ -18,12 +18,13 @@ import { substituteVerifoneBody } from './verifone.js';
  * always a prepared one (authorize() requires it), so its preparation names
  * the processor and the key pin the cardholder approved. It continues only a
  * request on Fiserv's capture hosts, and only when that capture's own pin (its
- * envelope's key, pinned for its endpoint and its merchant) is the approved
- * pin; then Fiserv's own substitution writes only the envelope's four members
- * at source.encryptionData of the live paused body, and throws for a body that
- * is not the capture Agentcard covers or an envelope under another key than
- * the one the paused capture names (fiserv.ts). Any other approval never meets
- * a Fiserv capture host. Every refusal throws before anything is sent.
+ * envelope's key, or for a credentials session's key its merchant's, pinned for
+ * its endpoint and its merchant) is the approved pin; then Fiserv's own
+ * substitution writes only the envelope's four members at source.encryptionData
+ * of the live paused body, and throws for a body that is not the capture
+ * Agentcard covers or an envelope under another key than that pin's
+ * (fiserv.ts). Any other approval never meets a Fiserv capture host. Every
+ * refusal throws before anything is sent.
  */
 export function cseBody(body, replay, url, preparation) {
     // A Verifone approval is always a prepared one for the profile it pays, and continues only the
@@ -39,7 +40,7 @@ export function cseBody(body, replay, url, preparation) {
         if (replay.kind !== undefined || !isFiservCaptureHost(url) || fiservCapturePinId(url, body) !== preparation.merchantProfile) {
             throw new Error('Refusing to substitute: the paused request is not a Fiserv capture under the key pin the cardholder approved.');
         }
-        return substituteFiservEnvelope(body, replay.substitutions);
+        return substituteFiservEnvelope(body, replay.substitutions, url);
     }
     if (isFiservCaptureHost(url))
         throw new Error('Refusing to substitute: a Fiserv capture continues only through a prepared Fiserv approval.');

package/dist/datatrans.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0179250ba6f44c33967a08dc4ce3a891d8b73f0f7eb60e9cab34f801dc2a4c57
+// artifact-sha256: fdee611015d42dc0a679e93a64766ac971b190fcc8f17a107d761c414569e5f9
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";
@@ -178,15 +178,18 @@ function judgeBody(body) {
     if (!pairs)
         return null;
     const fields = new Map(pairs.map(({ key, value }) => [key, value]));
+    const merchantHeldExpiry = !fields.get("expm") && !fields.get("expy") && fields.has("expm") === fields.has("expy") && fields.get("usage") !== "REGISTRATION";
     for (const [key, value] of fields) {
         if (!KEYS.has(key))
             return null;
+        if (merchantHeldExpiry && (key === "expm" || key === "expy"))
+            continue;
         if (EMPTY_ONLY.has(key) ? value !== "" : !RULES[key](value))
             return null;
     }
-    if (!REQUIRED.every((key) => fields.has(key)))
+    if (!REQUIRED.every((key) => fields.has(key) || merchantHeldExpiry && (key === "expm" || key === "expy")))
         return null;
-    return { pairs, fields, usage: fields.get("usage") ?? "" };
+    return { pairs, fields, usage: fields.get("usage") ?? "", merchantHeldExpiry };
 }
 function datatransRegistrationRefusal(usage, card, policy = DATATRANS_REGISTRATION_POLICY) {
     if (usage !== "REGISTRATION")
@@ -319,14 +322,14 @@ function injectDatatransCard(body, card, policy = DATATRANS_REGISTRATION_POLICY)
     if (!fields.get("cvv") || !digits(card.cvc, 3, 4))
         throw new Error(FILL_REFUSAL);
     const yy = String(year % 100).padStart(2, "0");
-    const values = {
+    const values = judged.merchantHeldExpiry ? { cardNumber: card.number, cvv: card.cvc } : {
         cardNumber: card.number,
         cvv: card.cvc,
         expm: fields.get("expm").length === 2 ? String(month).padStart(2, "0") : String(month),
         expy: fields.get("expy").length === 4 ? `20${yy}` : yy
     };
     const written = judged.pairs.map((pair) => owns(values, pair.key) ? `${pair.rawKey}=${encodeDatatransFormValue(values[pair.key])}` : `${pair.rawKey}=${pair.raw}`);
-    return { body: written.join("&"), where: ["cardNumber", "cvv", "expm", "expy"] };
+    return { body: written.join("&"), where: Object.keys(values) };
 }
 var TRANSACTION_ID = /^[0-9]{18}$/;
 var CARD_WORD = /^[A-Za-z][A-Za-z _-]{0,31}$/;

package/dist/elavon-converge.d.ts

@@ -20,7 +20,7 @@ export declare const CONVERGE_CAPABILITY = "converge_hpp_process";
  */
 export declare const CONVERGE_REFUSAL_REASONS: readonly ["converge_body_malformed", "converge_payment_type_refused", "converge_debit_card_refused", "converge_push_to_card_refused", "converge_gift_card_refused", "converge_credential_refused", "converge_wallet_refused", "converge_captcha_refused", "converge_service_fee_refused", "converge_3ds_follow_up_refused", "converge_surcharge_refused", "converge_amount_add_on_refused", "converge_card_saving_refused", "converge_recurring_refused", "converge_currency_refused", "converge_amount_missing", "converge_context_missing", "converge_card_missing", "converge_card_malformed", "converge_url_refused", "converge_method_refused", "converge_content_type_refused"];
 export type ConvergeRefusalReason = typeof CONVERGE_REFUSAL_REASONS[number];
-/** True when the URL's host is one of Converge's two payment page hosts. */
+/** True when the URL's host is one of Converge's three payment page hosts: api, www and the demo. */
 export declare function isConvergeHost(url: string): boolean;
 /**
  * The pause decision for a card-carrying POST the registry recognized on a Converge host. Null

package/dist/elavon-converge.generated.js

@@ -1,13 +1,14 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: dc4269c2533c43ddcc4f7be0f3a4645beea09bce6854c98e38701f29cf037e2b
+// artifact-sha256: 009a8b902de51c4dadddae592b32d2edbd5b394f130938e1a41cd62a06a234a8
 // src/elavon-converge.js
-var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com"]);
+var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com", "www.convergepay.com"]);
 var CONVERGE_DEMO_HOST = "api.demo.convergepay.com";
 var CONVERGE_PROCESS_PATH = "/hosted-payments/service/payment/hpp/process";
 var CONVERGE_PROCESS_URLS = /* @__PURE__ */ Object.freeze([
     "https://api.convergepay.com/hosted-payments/service/payment/hpp/process",
-    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process"
+    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process",
+    "https://www.convergepay.com/hosted-payments/service/payment/hpp/process"
 ]);
 var CONVERGE_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
     "converge_body_malformed",
@@ -72,6 +73,7 @@ var RECURRING_FIELDS = /* @__PURE__ */ Object.freeze([
     "ssl_recurring_batch_count",
     "ssl_installment_id"
 ]);
+var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
@@ -81,6 +83,7 @@ var CVC = /^\d{3,4}$/;
 var AMOUNT = /^(\d{1,13})(?:\.(\d{1,2}))?$/;
 var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var recurringRequested = (data) => RECURRING_FIELDS.some((key) => owns(data, key) && !(key === "recurring" && data[key] === ONE_TIME_RECURRING_FLAG));
 var refuse = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
 var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
@@ -142,7 +145,7 @@ function convergeBodyVerdict(body) {
     if (owns(data, "ssl_token") || CARD_SAVING_FLAGS.some((key) => owns(data, key) && !(typeof data[key] === "string" && /^n$/i.test(data[key])))) {
         return refuse("converge_card_saving_refused");
     }
-    if (RECURRING_FIELDS.some((key) => owns(data, key)))
+    if (recurringRequested(data))
         return refuse("converge_recurring_refused");
     if (owns(data, "ssl_transaction_currency") && !(typeof data.ssl_transaction_currency === "string" && /^usd$/i.test(data.ssl_transaction_currency))) {
         return refuse("converge_currency_refused");

package/dist/elavon-converge.js

@@ -1,6 +1,7 @@
 // Elavon Converge Hosted Payment Page (psp `elavon_converge`): the page NY DMV's payment apps
-// redirect to, api.convergepay.com/hosted-payments/?ssl_txn_auth_token=<one-time token> (the
-// demo environment serves the same page on api.demo.convergepay.com). Converge's own AngularJS
+// redirect to, api.convergepay.com/hosted-payments/?ssl_txn_auth_token=<one-time token>. Every
+// Converge Buy Button and pay link opens the same page on www.convergepay.com, and the demo
+// environment serves it on api.demo.convergepay.com. Converge's own AngularJS
 // app posts the card in one same-origin JSON XHR, POST /hosted-payments/service/payment/hpp/process,
 // with the card at paymentData.ssl_card_number, ssl_exp_date (MMYY) and ssl_cvv2cvc2, the amount
 // at paymentData.ssl_amount, and the page's rolling session in `context`. The same URL also takes
@@ -59,7 +60,7 @@ export const CONVERGE_REFUSAL_REASONS = [
     'converge_method_refused',
     'converge_content_type_refused',
 ];
-/** True when the URL's host is one of Converge's two payment page hosts. */
+/** True when the URL's host is one of Converge's three payment page hosts: api, www and the demo. */
 export function isConvergeHost(url) {
     try {
         return CONVERGE_HOSTS.includes(new URL(url).hostname);

package/dist/fiserv.d.ts

@@ -17,8 +17,9 @@ export declare function isFiservCaptureHost(url: string): boolean;
 /** The pinned key with this id, in either environment, or null. */
 export declare function fiservKeyPinById(id: unknown): FiservKeyPin | null;
 /**
- * The id of the pin a paused capture's card may be sealed under (its envelope's key,
- * pinned for its endpoint's environment and for the merchant its body names), or null.
+ * The id of the pin a paused capture's card may be sealed under (its envelope's key or,
+ * for a credentials session's key, the key pinned for the merchant its body names; for its
+ * endpoint's environment and that merchant), or null.
  */
 export declare function fiservCapturePinId(url: string, body: string | null): string | null;
 /** The card-capture endpoint a Fiserv preparation names for its environment. */
@@ -59,7 +60,10 @@ export declare function isFiservSubstitution(sub: unknown): boolean;
  * The paused Fiserv capture with the approval's envelope written over the four members
  * its source.encryptionData already carries, and every other byte the frame's own. It
  * throws, writing nothing, for a body that is not the capture Agentcard covers, for any
- * substitution but Fiserv's envelope, and for an envelope under another key than the one
- * the paused capture names. Run this on a Fiserv approval, never substituteEncryptedFields.
+ * substitution but Fiserv's envelope, and for an envelope under another key than the
+ * paused capture's card goes under: the key it names or, when it names a credentials
+ * session's key, the key pinned for its merchant on the endpoint `url` names (the paused
+ * capture's own URL, which a session's key requires), whose id then replaces the session's.
+ * Run this on a Fiserv approval, never substituteEncryptedFields.
  */
-export declare function substituteFiservEnvelope(body: string, sub: Substitutions): string;
+export declare function substituteFiservEnvelope(body: string, sub: Substitutions, url?: string): string;

package/dist/fiserv.generated.d.ts

@@ -15,6 +15,7 @@ declare var FISERV_KEY_PINS: any;
 declare function fiservKeyPin(keyId: any, environment: any): any;
 declare function isFiservPinnedKeyId(keyId: any): any;
 declare function fiservKeyRefusal(keyId: any, environment: any, nowMs: any): "fiserv_key_unpinned" | "fiserv_key_inactive" | "fiserv_key_outside_validity" | null;
+declare function fiservCheckoutHost(pinId: any, origin: any): string | null;
 declare function parseFiservPublishedKey(text2: any): {
     keyId: any;
     encryptionType: any;
@@ -38,7 +39,6 @@ declare function fiservErrorIdentifiers(text2: any): {
 declare function fiservCardCaptureRefusal(request: any): "fiserv_request_invalid" | "fiserv_endpoint_invalid" | "fiserv_body_invalid" | "fiserv_body_member_not_allowed" | "fiserv_source_not_encrypted_card" | "fiserv_envelope_invalid" | "fiserv_merchant_invalid" | "fiserv_transaction_details_invalid" | "fiserv_billing_address_invalid" | "fiserv_method_invalid" | "fiserv_headers_invalid" | "fiserv_header_not_allowed" | "fiserv_content_type_invalid" | "fiserv_auth_token_type_invalid" | "fiserv_merchant_header_mismatch" | "fiserv_terminal_header_mismatch" | "fiserv_header_value_invalid" | null;
 declare function isFiservCardCaptureRequest(request: any): boolean;
 declare function isFiservPausableBody(body: any): boolean;
-declare function fiservTemplateKeyId(body: any): any;
 declare function fiservCaptureMerchant(body: any): {
     merchantId: any;
     terminalId: any;
@@ -69,5 +69,5 @@ declare function fiservSubstitutions(envelope: any): {
         [k: string]: any;
     };
 };
-declare function substituteFiservEnvelope(body: any, sub: any): string;
-export { FISERV_CARD_CAPTURE_ENDPOINTS, FISERV_ENVELOPE_CONSTANTS, FISERV_KEY_PINS, FISERV_SIMULATOR_PANS, FISERV_SUBSTITUTION, encryptFiservCard, fiservApprovedEnvelopeRefusal, fiservCaptureCardMismatch, fiservCaptureKeyRefusal, fiservCaptureMerchant, fiservCapturePin, fiservCardCaptureRefusal, fiservEnvironment, fiservErrorIdentifiers, fiservKeyPin, fiservKeyRefusal, fiservPreparationUrl, fiservPublishedKeyRefusal, fiservSubstitutionFieldsRefusal, fiservSubstitutions, fiservTemplateKeyId, fiservTimestampMs, isFiservCardCaptureRequest, isFiservCardCaptureUrl, isFiservPausableBody, isFiservPinnedKeyId, isPreparedFiservRequest, parseFiservPublishedKey, sanitizeFiservCaptureResponse, substituteFiservEnvelope };
+declare function substituteFiservEnvelope(body: any, sub: any, url?: null): string;
+export { FISERV_CARD_CAPTURE_ENDPOINTS, FISERV_ENVELOPE_CONSTANTS, FISERV_KEY_PINS, FISERV_SIMULATOR_PANS, FISERV_SUBSTITUTION, encryptFiservCard, fiservApprovedEnvelopeRefusal, fiservCaptureCardMismatch, fiservCaptureKeyRefusal, fiservCaptureMerchant, fiservCapturePin, fiservCardCaptureRefusal, fiservCheckoutHost, fiservEnvironment, fiservErrorIdentifiers, fiservKeyPin, fiservKeyRefusal, fiservPreparationUrl, fiservPublishedKeyRefusal, fiservSubstitutionFieldsRefusal, fiservSubstitutions, fiservTimestampMs, isFiservCardCaptureRequest, isFiservCardCaptureUrl, isFiservPausableBody, isFiservPinnedKeyId, isPreparedFiservRequest, parseFiservPublishedKey, sanitizeFiservCaptureResponse, substituteFiservEnvelope };