@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/pre-claim.js

@@ -72,7 +72,7 @@ import { isFiservCaptureHost, isFiservPausableBody } from './fiserv.js';
 import { CYBERSOURCE_FLEX_PSP, isCybersourceFlexHost } from './cybersource-flex.js';
 import { cardEndpointCarriesCard, cardEndpointDetail, cardEndpointFor, cardEndpointLive, cardEndpointPasses, cardEndpointResendFor, cardEndpointReviewed, } from './card-endpoint.js';
 import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
-import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsStaticHost, payrailsKeyRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
+import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsPaymentUrl, isPayrailsStaticHost, payrailsKeyRefusal, payrailsPaymentRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
@@ -953,14 +953,17 @@ async function pelecardBlock(ctx, reason) {
 //   - the page's CVC and expiry requests are held until that request's
 //     approval ends, then answered with its answer, never forwarded; they fail
 //     when it failed or never began;
-//   - the holder request continues untouched;
+//   - the holder request, and the ReD Shield device fingerprint the widget
+//     posts on load, continue untouched;
 //   - the /payment submission continues once per answered card-number request,
 //     as a frame navigation, with the placeholder expiry a classic-mode page
 //     puts there removed (only where the browser sends a replaced navigation
 //     body, else aci_expiry_unstrippable), or is refused with the judge's code;
 //   - anything else is refused with payment-core's code: a request that asks ACI
 //     to keep the card or pay with a stored one (aci_card_on_file_refused, which
-//     also retires a ready preparation) or one the widget never sends.
+//     also retires a ready preparation) or one the widget never sends. Only a
+//     refused request that names the card number fails the checkout's waiting
+//     CVC and expiry requests (AciGate.refused).
 // Everything else on ACI's hosts (the widget script, /bins, /v1/collect, GETs)
 // is not a POST to a checkout and defers. Synchronous for the card-number
 // request, so it pauses in the microtask it paused in.
@@ -969,7 +972,7 @@ const aciPreClaim = (ctx) => {
     if (!leg)
         return undefined;
     if (leg.leg === 'refuse') {
-        ctx.aci.refused(leg);
+        ctx.aci.refused(leg, ctx.request.body);
         return aciRefuse(ctx, leg.code);
     }
     if (leg.leg === 'pass')
@@ -1204,9 +1207,17 @@ async function primerUnsupported(ctx, reason) {
 //     static host (assets.payrails.io) is the one exception: it serves the SDK's and the secure
 //     frame's files and takes no payment, so another script's bodyless POST there continues
 //     untouched on both adapters;
-//   - a payment that carries an encrypted card inside paymentComposition (the card form paying,
-//     a stored card with a CVC field) aborts as an unsupported checkout,
-//     `unsupported_payrails_card_payment`, and the attachment holds;
+//   - the card form's payment (an encrypted card inside paymentComposition) on exactly an
+//     execution's authorize link the registry recognizes is judged like a save below, by
+//     payment-core's payment guard: a payment that stores the card at the merchant aborts as
+//     `payrails_card_on_file_consent_required`, a shape this build does not take over as
+//     `unsupported_payrails_card_payment`, and the attachment holds. A sound one is bound to the one
+//     captured session its token, execution, host and providerConfigId name, and pauses carrying
+//     the session's key and holderReference, which the payment's JWE carries;
+//   - any other payment that carries an encrypted card inside paymentComposition (a stored card
+//     with a CVC field, a split payment, another link, or one the registry does not recognize)
+//     aborts as an unsupported checkout, `unsupported_payrails_card_payment`, and the attachment
+//     holds;
 //   - a card save the registry recognizes is judged first by payment-core's guard and its
 //     card-on-file policy: a refusal aborts as an unsupported checkout with that code, and the
 //     attachment holds. Then it is bound to the one captured session its token, URL,
@@ -1214,9 +1225,9 @@ async function primerUnsupported(ctx, reason) {
 //     the page's frame wrapped. A miss aborts that request alone (`payrails_session_unavailable`,
 //     or the key's code) with a message to reload the checkout, and the attachment does not hold,
 //     so the save after a reload is judged afresh. A bound save pauses carrying the key;
-//   - anything else defers to the arbiter: a save with no card pauses there and the claim flow
-//     continues it (passWithoutCard), and every other request continues.
-// Synchronous unless answer bodies are still being read (the save then waits for them, briefly)
+//   - anything else defers to the arbiter: a save or payment with no card pauses there and the
+//     claim flow continues it (passWithoutCard), and every other request continues.
+// Synchronous unless answer bodies are still being read (the request then waits for them, briefly)
 // or the request aborts.
 const payrailsPreClaim = (ctx) => {
     const capture = ctx.payrails;
@@ -1227,23 +1238,33 @@ const payrailsPreClaim = (ctx) => {
     if (body === null || body === '')
         return isPayrailsStaticHost(url) ? undefined : payrailsUnreadable(ctx);
     const kind = payrailsRequestKind(url, method, body);
-    if (kind === 'card_payment')
-        return payrailsUnsupported(ctx, 'unsupported_payrails_card_payment');
-    if (kind !== 'card' || !ctx.vault.isCardRequest(url, method))
-        return undefined;
-    const refusal = payrailsSaveRefusal(body);
-    if (refusal)
-        return payrailsUnsupported(ctx, refusal);
+    if (kind === 'card_payment') {
+        if (!isPayrailsPaymentUrl(url) || !ctx.vault.isCardRequest(url, method))
+            return payrailsUnsupported(ctx, 'unsupported_payrails_card_payment');
+        const refusal = payrailsPaymentRefusal(body);
+        if (refusal)
+            return payrailsUnsupported(ctx, refusal);
+    }
+    else {
+        if (kind !== 'card' || !ctx.vault.isCardRequest(url, method))
+            return undefined;
+        const refusal = payrailsSaveRefusal(body);
+        if (refusal)
+            return payrailsUnsupported(ctx, refusal);
+    }
     return capture.pending ? capture.settle().then(() => payrailsBind(ctx, capture, body)) : payrailsBind(ctx, capture, body);
 };
 function payrailsBind(ctx, capture, body) {
-    const key = capture.keyFor({ url: ctx.request.url, headers: ctx.request.headers, body });
-    if (key === null)
+    const bound = capture.bind({ url: ctx.request.url, headers: ctx.request.headers, body });
+    if (bound === null)
         return payrailsUnsupported(ctx, 'payrails_session_unavailable');
-    const refusal = payrailsKeyRefusal(key, body);
+    const refusal = payrailsKeyRefusal(bound.key, body);
     if (refusal)
         return payrailsUnsupported(ctx, refusal);
-    return { kind: 'pause', stripeStep: ctx.stripeStep, payrails: { encryption_public_key: key } };
+    // A save names its own holderReference; a card-form payment's JWE needs the session's.
+    const payrails = isPayrailsPaymentUrl(ctx.request.url)
+        ? { encryption_public_key: bound.key, holder_reference: bound.holderReference } : { encryption_public_key: bound.key };
+    return { kind: 'pause', stripeStep: ctx.stripeStep, payrails };
 }
 async function payrailsUnreadable(ctx) {
     ctx.onEvent?.({ type: 'blocked', detail: 'unreadable_payrails_request' });
@@ -1263,8 +1284,8 @@ async function payrailsUnsupported(ctx, reason) {
     return { kind: 'abort' };
 }
 // Elavon Converge's Hosted Payment Page (elavon-converge.ts). Its card URL, POST
-// /hosted-payments/service/payment/hpp/process on api.convergepay.com or
-// api.demo.convergepay.com, also carries electronic check and financing payments
+// /hosted-payments/service/payment/hpp/process on api.convergepay.com,
+// www.convergepay.com or api.demo.convergepay.com, also carries electronic check and financing payments
 // with no card, and card-shaped bodies the Vault never pays: a wallet with a card
 // number the server supplied, the debit, gift card and push-to-card tabs, the
 // follow-ups after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA, a
@@ -1356,12 +1377,13 @@ async function eprotectGiveUp(ctx, attempt, code) {
 // temp_card_id bodies with no new card, and the page builds the transaction object itself, so a
 // POST the registry recognizes on a WSPay host is judged here, before the terminal arbiter would
 // pause it, by the whole-request check the API runs at create:
-//   - a new card for a one-time payment defers, and the arbiter pauses it for approval;
-//   - anything else aborts with a `blocked` event that names why, with no claim, create or
-//     prompt: `unsupported_wspay_payment_method`, or `wspay_keep_on_file_unsupported` for a
-//     confirm that asks WSPay to keep the card on file. Like Braintree's unsupported operation
-//     it neither holds the attachment nor changes its state, so the page's next confirm (a new
-//     card instead of a saved one) is judged afresh.
+//   - a new card defers, and the arbiter pauses it for approval. A confirm that asks WSPay to
+//     keep the card on file defers too: the approval asks the cardholder, and the API's create
+//     judges whether it is the card guarantee it pays;
+//   - anything else aborts with a `blocked` event, `unsupported_wspay_payment_method`, with no
+//     claim, create or prompt. Like Braintree's unsupported operation it neither holds the
+//     attachment nor changes its state, so the page's next confirm (a new card instead of a
+//     saved one) is judged afresh.
 // Nothing is decided without the registry: an SDK that did not sync with the wspay_confirm
 // capability, or whose org Agentcard has not enabled for WSPay (the API then serves no WSPay
 // recognizer), never recognizes a WSPay host, so the gate defers and the request continues as

package/dist/preflight-capabilities.generated.d.ts

@@ -1097,54 +1097,6 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "moneris";
-        readonly status: "supported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "moneris.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "moneris";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "supported";
-                readonly reason: "card_request_adapter_implemented";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
-            };
-            readonly save_card: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
-            };
-            readonly subscription_initial: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The implemented integration is Moneris Hosted Tokenization."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "moneris_checkout_chkt";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
     }, {
         readonly psp: "bambora";
         readonly status: "supported";
@@ -1236,64 +1188,6 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "gravy";
-        readonly status: "unsupported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "gravy.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "gravy";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly save_card: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_initial: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.", "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.", "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.", "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "embed_hosted_checkout";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path.";
-        }, {
-            readonly variant: "stored_payment_method_or_security_code_only";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Saved payment methods and security-code-only updates are outside new-card session updates.";
-        }, {
-            readonly variant: "checkout_session_create_or_transaction";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "test/fixtures/gravy-secure-fields.json"];
     }];
     readonly exclusions: readonly [{
         readonly psp: "vgs";

package/dist/preflight-capabilities.generated.js

@@ -1690,81 +1690,6 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
                 "src/backend.js"
             ]
         },
-        {
-            "psp": "moneris",
-            "status": "supported",
-            "mode": "token",
-            "operations": [
-                {
-                    "id": "moneris.card_request",
-                    "effect": "processor_specific_card_request",
-                    "amount_binding": "unestablished",
-                    "psp": "moneris",
-                    "version": 1,
-                    "mode": "token",
-                    "autopilot_eligible": false,
-                    "requires": "reviewed_final_payment_and_continuation_evidence"
-                }
-            ],
-            "scenarios": {
-                "one_time": {
-                    "status": "supported",
-                    "reason": "card_request_adapter_implemented",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation"
-                    ]
-                },
-                "save_card": {
-                    "status": "conditional",
-                    "reason": "merchant_card_storage_and_consent_required",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation",
-                        "stored_card_consent",
-                        "merchant_card_saved"
-                    ]
-                },
-                "subscription_initial": {
-                    "status": "conditional",
-                    "reason": "merchant_card_storage_and_consent_required",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation",
-                        "stored_card_consent",
-                        "merchant_subscription_confirmation"
-                    ]
-                },
-                "subscription_renewal": {
-                    "status": "outside_vault",
-                    "reason": "renewal_managed_by_merchant",
-                    "requirements": [
-                        "verify_merchant_billing"
-                    ]
-                }
-            },
-            "limitations": [
-                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-                "The implemented integration is Moneris Hosted Tokenization."
-            ],
-            "unsupported_variants": [
-                {
-                    "variant": "moneris_checkout_chkt",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented."
-                }
-            ],
-            "processor_amount": "none",
-            "challenge_surface": "merchant_browser",
-            "merchant_confirmation_required": true,
-            "live_validation": "not_established_by_catalog",
-            "sources": [
-                "src/definitions.js",
-                "src/operations.js",
-                "src/backend.js"
-            ]
-        },
         {
             "psp": "bambora",
             "status": "supported",
@@ -1907,84 +1832,6 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
                 "src/operations.js",
                 "src/backend.js"
             ]
-        },
-        {
-            "psp": "gravy",
-            "status": "unsupported",
-            "mode": "token",
-            "operations": [
-                {
-                    "id": "gravy.card_request",
-                    "effect": "processor_specific_card_request",
-                    "amount_binding": "unestablished",
-                    "psp": "gravy",
-                    "version": 1,
-                    "mode": "token",
-                    "autopilot_eligible": false,
-                    "requires": "reviewed_final_payment_and_continuation_evidence"
-                }
-            ],
-            "scenarios": {
-                "one_time": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "save_card": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "subscription_initial": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "subscription_renewal": {
-                    "status": "outside_vault",
-                    "reason": "renewal_managed_by_merchant",
-                    "requirements": [
-                        "verify_merchant_billing"
-                    ]
-                }
-            },
-            "limitations": [
-                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-                "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.",
-                "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.",
-                "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.",
-                "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."
-            ],
-            "unsupported_variants": [
-                {
-                    "variant": "embed_hosted_checkout",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path."
-                },
-                {
-                    "variant": "stored_payment_method_or_security_code_only",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Saved payment methods and security-code-only updates are outside new-card session updates."
-                },
-                {
-                    "variant": "checkout_session_create_or_transaction",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser."
-                }
-            ],
-            "processor_amount": "none",
-            "challenge_surface": "merchant_browser",
-            "merchant_confirmation_required": true,
-            "live_validation": "not_established_by_catalog",
-            "sources": [
-                "src/definitions.js",
-                "src/operations.js",
-                "src/backend.js",
-                "test/fixtures/gravy-secure-fields.json"
-            ]
         }
     ],
     "exclusions": [