@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/wspay.generated.d.ts

@@ -6,6 +6,11 @@ declare function isWspayNewCardBody(body: any, clientSecret: any, options: any):
 declare function classifyWspayRequest(url: any, method: any, body: any, options: any): "card" | "unsupported" | null;
 declare function isWspayConfirmRequest(request: any, options: any): any;
 declare function wspayStoredCredentialRequested(body: any): boolean | null;
+declare var WSPAY_GUARANTEE: Readonly<{
+    amount: 100;
+    currency: "eur";
+}>;
+declare function wspayKeepOnFileRefusal(body: any, amount: any, currency: any): "keep_on_file" | null;
 declare function wspayConfirmRefusal(request: any, options: any): "unsupported" | "keep_on_file" | null;
 declare function wspayRefusalMessage(reason: any): string;
 declare function injectWspayCard(body: any, card: any, options: any): {
@@ -38,4 +43,4 @@ declare function wspayFacts(status: any, text2: any): {
     outcome: string;
     refusalCode: any;
 };
-export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };
+export { WSPAY_CONFIRM_HOSTS, WSPAY_GUARANTEE, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayKeepOnFileRefusal, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };

package/dist/wspay.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 560fa6d54ff04e65a21dc08d3046495f67499274b35c83053f8b25370f13a17a
+// artifact-sha256: 9ba65916c5dc5ee3ca830d630cafbde62d537e61991c33c80f1520ac93ef0b0d
 // src/wspay.js
 var WSPAY_CONFIRM_HOSTS = Object.freeze(["proxy.wspay.biz", "proxy-test.wspay.biz"]);
 var WSPAY_TEST_HOST = "proxy-test.wspay.biz";
@@ -224,6 +224,12 @@ function wspayStoredCredentialRequested(body) {
     const value = confirmBody(body);
     return value === null ? null : value.payment_method.data.tokenize_pan === true;
 }
+var WSPAY_GUARANTEE = Object.freeze({ amount: 100, currency: "eur" });
+function wspayKeepOnFileRefusal(body, amount, currency) {
+    if (wspayStoredCredentialRequested(body) !== true)
+        return null;
+    return amount === WSPAY_GUARANTEE.amount && typeof currency === "string" && currency.toLowerCase() === WSPAY_GUARANTEE.currency ? null : "keep_on_file";
+}
 function wspayConfirmRefusal(request, options) {
     if (!isWspayConfirmRequest(request, { keepOnFile: true }))
         return "unsupported";
@@ -358,7 +364,11 @@ function sanitizeWspayResponse(text2, options) {
         if (pm !== null && pm !== void 0) {
             if (!keysWithin(pm, ["type", "data"]) || pm.type !== "card" || !keysWithin(data, ["brand", "issuer", "masked", "expiration_date", "token"]) || !opaqueId(data.token) || owns(data, "brand") && !opaqueId(data.brand, 32) || owns(data, "issuer") && !opaqueId(data.issuer, 64) || owns(data, "expiration_date") && !yymm(data.expiration_date) || owns(data, "masked") && !exact(/^[0-9]{0,6}[-* xX]{4,16}[0-9]{4}$/, data.masked))
                 return fail();
-            safe.payment_method = { type: "card", data: { ...data } };
+            const card = {};
+            for (const key of ["brand", "issuer", "token"])
+                if (owns(data, key))
+                    card[key] = data[key];
+            safe.payment_method = { type: "card", data: card };
         }
     }
     return JSON.stringify({ status: "approved", action_required: null, payment_result: safe });
@@ -367,4 +377,4 @@ function wspayFacts(status, text2) {
     const verdict = wspayResponseOutcome(status, text2);
     return { outcome: verdict.outcome, refusalCode: verdict.outcome === "refused" ? verdict.code : null };
 }
-export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };
+export { WSPAY_CONFIRM_HOSTS, WSPAY_GUARANTEE, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayKeepOnFileRefusal, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };

package/dist/wspay.js

@@ -28,19 +28,17 @@ export function isWspayHost(url) {
 }
 /**
  * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
- * card frame's confirm of a new card for a one-time payment, which pauses for approval;
- * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
- * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
- * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
- * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
- * the cardholder.
+ * card frame's confirm of a new card, which pauses for approval; otherwise the reason it is
+ * refused. It judges the whole request (the exact URL, the frame's content type, Accept and
+ * WP3-v2-Client authorization, and a body of the frame's own keys bound to the URL's
+ * client_secret) with payment-core's wspayConfirmRefusal, the check the API runs at create.
+ * It passes keep-on-file consent because the approval that follows asks the cardholder for it.
  */
 export function wspayRefusal(request) {
-    // No keep-on-file consent (the second argument): no approval asks for it yet.
-    const refusal = wspayConfirmRefusal({ url: request.url, method: 'POST', headers: request.headers ?? {}, body: request.body ?? '' }, undefined);
-    if (refusal === null)
-        return null;
-    return refusal === 'keep_on_file' ? 'wspay_keep_on_file_unsupported' : 'unsupported_wspay_payment_method';
+    // Keep-on-file consent (the second argument): the Vault's approval asks the cardholder whether
+    // the merchant may keep the card, and the API admits such a confirm only as a card guarantee.
+    const refusal = wspayConfirmRefusal({ url: request.url, method: 'POST', headers: request.headers ?? {}, body: request.body ?? '' }, { keepOnFile: true });
+    return refusal === null ? null : 'unsupported_wspay_payment_method';
 }
 /**
  * Whether an approved answer handed to a WSPay confirm is WSPay's 3-D Secure step: HTTP 200 with

package/examples/preflight/kernel-native/README.md

@@ -2,7 +2,7 @@
 
 You can detect a checkout's PSP before entering card details with `@agent-cards/sdk`. Kernel native support needs a separate profile for the native adapter that actually runs the checkout. The direct SDK's coverage does not establish Kernel's native coverage.
 
-No qualified native profile accompanies this kit. The inventory covers all 25 PSPs in the checkout catalog and reports `unknown` for every native runtime status. Kernel's pinned documentation lists Stripe, Shopify, Square, Recurly, and Razorpay. The other processors are unestablished, rather than explicitly unsupported. See the endpoint constraints and source hashes in [documented-adapters.json](./documented-adapters.json).
+No qualified native profile accompanies this kit. The inventory covers all 24 PSPs in the checkout catalog and reports `unknown` for every native runtime status. Kernel's pinned documentation lists Stripe, Shopify, Square, Recurly, and Razorpay. The other processors are unestablished, rather than explicitly unsupported. See the endpoint constraints and source hashes in [documented-adapters.json](./documented-adapters.json).
 
 ## Use the detector now
 

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "a1bfa3f9da2942711afca14cfc7158a49274869c66e685abc0d36839d2e96454",
+  "catalog_sha256": "47dd1bc5a749224f66980b42b758f9a19d9ac849e3a8d5230075226a4870fde5",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,
@@ -202,15 +202,6 @@
         "Native runtime evidence is missing."
       ]
     },
-    {
-      "psp": "moneris",
-      "mode": "token",
-      "documentation": "not_documented",
-      "status": "unknown",
-      "limitations": [
-        "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
-      ]
-    },
     {
       "psp": "bambora",
       "mode": "token",
@@ -228,15 +219,6 @@
       "limitations": [
         "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
       ]
-    },
-    {
-      "psp": "gravy",
-      "mode": "token",
-      "documentation": "not_documented",
-      "status": "unknown",
-      "limitations": [
-        "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
-      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.9",
+  "version": "0.23.11",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",