@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/client.js

@@ -13,7 +13,7 @@ import { merchantSessionCapture } from './merchant-session-probe.js';
 import { creditguardPageProcessUrl, creditguardPpDomainHost, creditguardPreparationEnvironment, creditguardProcessTxId, sanitizeCreditguardResponse, } from './creditguard.generated.js';
 import { CONVERGE_CAPABILITY } from './elavon-converge.js';
 import { SHIJI_STS_CAPABILITY, SHIJI_STS_PSP, isShijiStsServedCompanion, isShijiStsServedSubstitution } from './shiji-sts.js';
-import { AMADEUS_CHECKOUT_CAPABILITY } from './amadeus-checkout.generated.js';
+import { AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
 import { BuyModule } from './buy.js';
@@ -29,7 +29,7 @@ import { merchantCardEndpointFactsRefusal as sharedFactsRefusal, readMerchantCar
 import { DATATRANS_CAPABILITY } from './datatrans.js';
 import { PELECARD_CAPABILITY, PELECARD_PSP } from './pelecard.js';
 import { PRIMER_CAPABILITY, PRIMER_PSP, primerTokenAnswer } from './primer.js';
-import { PAYRAILS_CAPABILITY, payrailsSaveAnswer } from './payrails.js';
+import { PAYRAILS_CAPABILITY, isPayrailsPaymentUrl, payrailsAnswer } from './payrails.js';
 import { WSPAY_CAPABILITY, WSPAY_PSP } from './wspay.js';
 import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REPLY_WINDOW_MS, secureAcceptanceCheckoutProfile, secureAcceptanceCheckoutRefusal, secureAcceptanceFrameAnswer, } from './cybersource-secure-acceptance.js';
 /**
@@ -37,7 +37,7 @@ import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_AC
  * only recognizers in these modes, so a request this build cannot complete
  * is never paused) and sent on every create. `device_encrypt`: the adapters
  * capture the Payrails session key the page's init payload names (payrails.ts),
- * and the cardholder's device encrypts and sends the save.
+ * and the cardholder's device encrypts and sends the save or card-form payment.
  */
 export const SUPPORTED_MODES = ['token', 'cse', 'hosted_form', 'device_encrypt'];
 /**
@@ -107,14 +107,17 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * `primer_payment_instruments`: Primer's card tokenization, which this build
  * judges before it pauses (primer.ts) and hands back to the page only as a
  * single-use token. A merchant's client session can save the card after the
- * payment with no sign in that request, so the API creates a Primer
- * authorization only for a test-mode client and refuses a live one (400
- * invalid_primer_request, live_keep_on_file) until the cardholder can consent
- * to that save; this build then aborts the paused request with nothing sent. A
- * gated recognizer never sits in BUILTIN_REGISTRY, so it is paused only after a
- * sync.
- * `payrails_device_encrypt`: Payrails' card-form save, which this build pauses
- * only once it has bound the save to a captured session (payrails.ts). A gated
+ * payment with no sign in that request, so the API creates a live Primer
+ * authorization only when it names the checkout page's https origin
+ * (checkout_origin, which this build sends from the page's origin): the
+ * approval says the merchant keeps the card on file, under the merchant name
+ * the create sent, which Agentcard cannot confirm, and pays only with a card
+ * the person stored. A refused create aborts the paused request with nothing
+ * sent. A gated recognizer never sits in BUILTIN_REGISTRY, so it is paused only
+ * after a sync.
+ * `payrails_device_encrypt`: Payrails' card save and card-form payment, which
+ * this build pauses only once it has bound the request to a captured session
+ * (payrails.ts). A gated
  * recognizer never sits in BUILTIN_REGISTRY, so it is paused only after a sync.
  * `converge_hpp_process`: Elavon Converge's Hosted Payment Page card request
  * (elavon-converge.ts), paused in token mode and judged by the pre-claim gate.
@@ -166,8 +169,24 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * finds a card in it (cybersource-secure-acceptance.ts). Served on the same terms,
  * so every other company keeps the stop every build applies to a card posted to
  * Secure Acceptance.
+ * `gravy_session_fields_put`: Gravy Secure Fields' update of a checkout session,
+ * the one card request a recognizer declares as a PUT. This build pauses that PUT
+ * from Gravy's controller frame as it pauses a POST (isRecognizerRequest), creates
+ * the authorization with the PUT, and answers the frame with Gravy's own answer to
+ * the cardholder's device. Served on the same terms; an older build never sees the
+ * entry, and every company Agentcard has not turned Gravy on for keeps today's path,
+ * where the request continues to Gravy untouched.
+ * `moneris_hosted_tokenization`: Moneris Hosted Tokenization's card request, the
+ * frame's form post to /HPPtoken/request.php. This build pauses it only when it
+ * carries the number, the expiry and the CVD the cardholder's device fills, fails a
+ * frame that leaves the expiry or CVD to the merchant's page in the browser with a
+ * `blocked` event, `request_without_card`, and answers with Moneris's token as the
+ * API recorded it. The device sends the card through the checkout relay. Served on
+ * the same terms: only to a build that lists it, for a company Agentcard turned
+ * Moneris on for. A gated recognizer never sits in BUILTIN_REGISTRY, so it is paused
+ * only after a sync.
  */
-export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY];
+export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization'];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -185,12 +204,16 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * it creates a token and charges nothing, and the merchant's server charges its
  * own cart total later, so the agent's pair, which the prepared checkout already
  * carries, is the total the cardholder approves, and the card that pays can spend
- * no more than that (the API's card rule).
+ * no more than that (the API's card rule). Moneris Hosted Tokenization's
+ * request.php carries the card and no price: the merchant's server charges the
+ * token later, so the agent's pair, above zero (MONERIS_PSP below), is the one
+ * figure the approval shows.
  */
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP];
+const MONERIS_PSP = 'moneris';
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance' };
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -400,6 +423,35 @@ const PLACEHOLDER_NUMBERS = Object.freeze({
     discover: '6011000990139424',
     jcb: '3566111111111113',
 });
+/**
+ * The placeholder number a processor needs in place of its network's default above, by processor
+ * (the recognizer's `psp`) and network. A processor whose page reads the typed number's IIN to
+ * pick a card product can read the default as another product than the card that pays:
+ * Worldline MyCheckout read 4111111111111111 as Visa Electron (122), not Visa (1), on CLZ's live
+ * page on 2026-10-12, and switched its form's product. The SDK refuses that submit
+ * (worldline-mycheckout.ts), so until this table names a Visa number Worldline reads as product 1,
+ * a Visa card cannot pay on a MyCheckout page that offers Visa Electron. The default table stays
+ * as it is: CyberSource Flex's Microform rule, ACI's brand check and EBANX's eligibility guard
+ * read its Visa and Mastercard numbers.
+ *
+ * TODO(Felipe): pick worldline_mycheckout's Visa number from Worldline Connect's own test-card
+ * list, then confirm it with one production IIN check on a MyCheckout card form that offers
+ * products 1 and 122: type it, wait for the IIN answer, read paymentProductId and the logo, clear
+ * the field, never Pay. Add it here as `worldline_mycheckout: { visa: '<number>' }`, with the
+ * check's date and merchant, and to the live runner's placeholder allowlist.
+ */
+const PROCESSOR_PLACEHOLDER_NUMBERS = Object.freeze({});
+/**
+ * The placeholder number for a network (lowercase, as GET /api/v2/vault_cards names it) on a
+ * processor's page: the processor's own number for that network when `overrides` names one, else
+ * the network's default, else undefined for a network with no placeholder.
+ */
+export function placeholderNumber(brand, psp, overrides = PROCESSOR_PLACEHOLDER_NUMBERS) {
+    const own = psp !== undefined && Object.prototype.hasOwnProperty.call(overrides, psp) ? overrides[psp] : undefined;
+    if (own && Object.prototype.hasOwnProperty.call(own, brand))
+        return own[brand];
+    return Object.prototype.hasOwnProperty.call(PLACEHOLDER_NUMBERS, brand) ? PLACEHOLDER_NUMBERS[brand] : undefined;
+}
 /**
  * The recognizer says this processor is preparation-required, and no preparation
  * was passed. Its card may be sent only after the cardholder approved a
@@ -1162,8 +1214,9 @@ export class VaultClient {
     }
     /**
      * The recogniser that claims a card request, or null; what a paused request names as
-     * `recognizer`. A POST to a recognised endpoint, or for a recognizer whose card request is a
-     * GET (Worldpay eProtect) that exact GET, query included.
+     * `recognizer`. A POST to a recognised endpoint, a PUT for a recognizer whose card request is
+     * a PUT (Gravy), or for a recognizer whose card request is a GET (Worldpay eProtect) that
+     * exact GET, query included.
      */
     recognizerOf(url, method = 'POST') {
         const rec = findRecognizer(url, this.mergedRegistry(), { sandbox: this.sandbox });
@@ -1189,7 +1242,8 @@ export class VaultClient {
         // payrails_device_encrypt, converge_hpp_process, worldpay_eprotect_jsonp,
         // wspay_confirm, shiji_sts_pinned_key, amadeus_checkout_actions.v1,
         // worldline_mycheckout_form, verifone_card_capture, ekashu_hosted_payment_page,
-        // cybersource_sa_token_create) and
+        // cybersource_sa_token_create, gravy_session_fields_put,
+        // moneris_hosted_tokenization) and
         // the caller's company is one Agentcard turned that processor on for, so this
         // build arms Fiserv's card capture, GMO's getToken, CyberSource Flex's card
         // fields, Juspay's card flow, Datatrans's Secure Fields card post, the
@@ -1197,8 +1251,9 @@ export class VaultClient {
         // CreditGuard's hosted page submit, Primer's card tokenization, Payrails' card
         // save, Converge's payment page, Worldpay eProtect's registration, WSPay's
         // card confirm, Shiji STS's card leg, Amadeus Checkout's card add,
-        // Worldline MyCheckout's card form and CyberSource Secure Acceptance's token
-        // create only for
+        // Worldline MyCheckout's card form, CyberSource Secure Acceptance's token
+        // create, Gravy's session fields PUT and Moneris Hosted
+        // Tokenization's card request only for
         // such a company, and an older build never receives a recognizer it cannot
         // judge. Every other org's registry never recognizes a Flex, Juspay, Datatrans,
         // Pelecard, ACI, CreditGuard, Primer, Payrails, Converge, eProtect, WSPay, Shiji STS, Amadeus or
@@ -1293,8 +1348,9 @@ export class VaultClient {
     }
     /**
      * True when this request is a card tokenization we can take over: a POST to
-     * a recognized endpoint, or for a recognizer whose card request is a GET
-     * (Worldpay eProtect) that exact GET, query included.
+     * a recognized endpoint, a PUT for a recognizer whose card request is a PUT
+     * (Gravy), or for a recognizer whose card request is a GET (Worldpay eProtect)
+     * that exact GET, query included.
      */
     isCardRequest(url, method = 'POST') {
         return this.recognizerOf(url, method) !== null;
@@ -1378,12 +1434,17 @@ export class VaultClient {
      * preselects that card: without a pin the page preselects its own choice (its recommended
      * card, or the first card the cardholder's device can open), which can be another card. After
      * prepare(), pass the prepared checkout's `cardId`, the card the cardholder already approved.
-     * The facts hold only while the cardholder pays with that card. Throws PlaceholderCardError
-     * when there is no such card, its network has no placeholder, or it carries no expiry.
+     * The facts hold only while the cardholder pays with that card. `psp` names the processor
+     * whose card form the agent types into (the recognizer's name, `worldline_mycheckout`): a
+     * processor that needs its own number for the card's network gets it, and every other gets the
+     * network's default. Throws PlaceholderCardError when there is no such card, its network has no
+     * placeholder, or it carries no expiry.
      */
     async placeholderCard(input) {
         if (!input || typeof input.user !== 'string' || !input.user)
             throw new Error('placeholderCard needs the user whose stored card will pay.');
+        if (input.psp !== undefined && (typeof input.psp !== 'string' || !input.psp))
+            throw new Error('placeholderCard takes psp as the processor\'s name, such as worldline_mycheckout.');
         // The card list lives under /api/v2 only: the API aliases /v2/checkout alone without the prefix.
         const list = await this.get(`/api/v2/vault_cards?user_id=${encodeURIComponent(input.user)}`, input.signal);
         const cards = Array.isArray(list?.data) ? list.data : [];
@@ -1391,7 +1452,7 @@ export class VaultClient {
         if (!card || typeof card !== 'object' || typeof card.id !== 'string' || !card.id)
             throw new PlaceholderCardError('card_not_found');
         const brand = typeof card.brand === 'string' ? card.brand.toLowerCase() : '';
-        const number = Object.prototype.hasOwnProperty.call(PLACEHOLDER_NUMBERS, brand) ? PLACEHOLDER_NUMBERS[brand] : undefined;
+        const number = placeholderNumber(brand, input.psp);
         if (!number)
             throw new PlaceholderCardError('brand_unsupported');
         const month = card.expiry_month, year = card.expiry_year;
@@ -1474,6 +1535,12 @@ export class VaultClient {
             throw fail('secure_acceptance_profile_id_invalid');
         if (secureAcceptance && !input.cardId)
             throw fail('card_required');
+        // Amadeus Checkout: Air France and KLM keep the expiry in their own form, where the agent types the
+        // paying card's real expiry (placeholderCard), so the preparation names that card. The API refuses
+        // one without it and approves no other card; refusing here asks nobody to approve it.
+        const amadeus = input.psp === AMADEUS_CHECKOUT_PSP;
+        if (amadeus && !input.cardId)
+            throw fail('card_required');
         // CyberSource Flex, tokenized before Pay: the loaded card field's capture context and fields,
         // verified here against the keys payment-core pins before anything is created (the API and the
         // cardholder's device verify them again).
@@ -1596,6 +1663,8 @@ export class VaultClient {
                         || (eprotect && (state.paypage_id !== input.paypageId || state.card_id !== input.cardId))
                         // Secure Acceptance: the merchant profile and the card the cardholder approved are the ones asked for.
                         || (secureAcceptance && (state.secure_acceptance_profile_id !== secureAcceptanceProfileId || state.card_id !== input.cardId))
+                        // Amadeus: the card the cardholder approved is the one whose expiry the agent typed.
+                        || (amadeus && state.card_id !== input.cardId)
                         // The API says a preparation tokenizes before Pay exactly when this one carried a capture context.
                         || (state.tokenize_before_pay === true) !== !!flexContext)
                         throw fail('ready_unconfirmed', id);
@@ -1863,7 +1932,12 @@ export class VaultClient {
         // payrails_session_key_required.
         const sidecar = input.request.payrails;
         if (mode === 'device_encrypt' && (!sidecar || typeof sidecar.encryption_public_key !== 'string' || !sidecar.encryption_public_key)) {
-            throw new Error('A Payrails card save needs request.payrails.encryption_public_key, the session key from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
+            throw new Error('A Payrails card save or card-form payment needs request.payrails.encryption_public_key, the session key from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
+        }
+        // A card-form payment's ciphertext carries the session's holderReference, which its body does not.
+        const payrailsPayment = mode === 'device_encrypt' && isPayrailsPaymentUrl(input.request.url);
+        if (payrailsPayment && (typeof sidecar?.holder_reference !== 'string' || !sidecar.holder_reference)) {
+            throw new Error('A Payrails card-form payment needs request.payrails.holder_reference, the holderReference from the checkout\'s Payrails init payload (the adapters capture it). Nothing was created.');
         }
         // A preparation that tokenized before Pay pays only a field request loaded under the capture
         // context and fields its cardholder approved: the device holds CyberSource's token for that context.
@@ -1871,20 +1945,23 @@ export class VaultClient {
             throw new CheckoutPreparationError(preparation.id, 'checkout_changed');
         }
         // Say no rather than coerce. Each recognizer's card request has exactly one
-        // method (recognizerRequestMethod): a POST body, or for Worldpay eProtect the
-        // GET whose query carries the card. The service stores the replay template
-        // with that method, so a caller handing in another one would get it
-        // silently rewritten and the cardholder's device would replay something the
-        // caller never asked for. A direct caller deserves to be told, not surprised.
-        // A card endpoint has no recognizer: its card request is its profile's own method (a POST, or
-        // Target Optical's PUT), which admitCardEndpoint already held the request to.
+        // method (recognizerRequestMethod): a POST body, Gravy's PUT body, or for
+        // Worldpay eProtect the GET whose query carries the card. The service stores
+        // the replay template with that method, so a caller handing in another one
+        // would get it silently rewritten and the cardholder's device would replay
+        // something the caller never asked for. A direct caller deserves to be told,
+        // not surprised. A card endpoint has no recognizer: its card request is its
+        // profile's own method (a POST, or Target Optical's PUT), which
+        // admitCardEndpoint already held the request to.
         const method = (input.request.method ?? cardEndpoint?.method ?? 'POST').toUpperCase();
         const cardMethod = rec ? recognizerRequestMethod(rec) : cardEndpoint ? cardEndpoint.method : 'POST';
         if (method !== cardMethod) {
             throw new Error(cardMethod === 'GET'
                 ? `a ${rec?.psp} card registration is a GET; got ${method} for ${redactUrl(input.request.url)}.`
-                : `checkout authorization is POST-only; got ${method} for ${redactUrl(input.request.url)}. ` +
-                    'A non-POST tokenizer needs recognizer support before it can be intercepted.');
+                : cardMethod === 'PUT' && rec
+                    ? `a ${rec.psp} card request is a PUT; got ${method} for ${redactUrl(input.request.url)}.`
+                    : `checkout authorization is POST-only; got ${method} for ${redactUrl(input.request.url)}. ` +
+                        'A non-POST tokenizer needs recognizer support before it can be intercepted.');
         }
         // A GET card request is its URL alone. This build completes one: Worldpay
         // eProtect's registration exactly as payment-core admits it, with no body.
@@ -1915,6 +1992,10 @@ export class VaultClient {
         // amount_required.
         if (!hasAmount && rec && AGENT_AMOUNT_PROCESSORS.includes(rec.psp))
             throw new AmountRequiredError(rec.psp);
+        // A Moneris token is charged later for whatever the merchant's server decides, so a zero pair
+        // would show the cardholder no price at all: it is refused like a missing one.
+        if (hasAmount && rec && rec.psp === MONERIS_PSP && Number(input.amount) <= 0)
+            throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the
         // page charges another. The API refuses the same create as page_amount_required.
@@ -1924,7 +2005,8 @@ export class VaultClient {
         // later, under another session), so the price the cardholder approves is
         // the one sent here: the agent's pair or else the page total. Refused
         // before any create or prompt, the way the API refuses amount_required.
-        if (mode === 'device_encrypt' && !hasAmount && !input.pageAmount) {
+        // A card-form payment names the amount it authorizes, which the API reads.
+        if (mode === 'device_encrypt' && !payrailsPayment && !hasAmount && !input.pageAmount) {
             throw new Error('A Payrails card save names no amount, so pass amount and currency (or let the adapter read the page total): that is the amount the cardholder approves. Nothing was created and nothing was charged.');
         }
         const timeoutMs = input.timeoutMs ?? 15 * 60_000;
@@ -1996,8 +2078,10 @@ export class VaultClient {
                     microform: { version: input.request.microform.version, fields: [...input.request.microform.fields],
                         ...(input.request.microform.trigger ? { trigger: input.request.microform.trigger } : {}) },
                 } : {}),
-                // Only the key: the token already rides in the passthrough authorization header.
-                ...(mode === 'device_encrypt' && sidecar ? { payrails: { encryption_public_key: sidecar.encryption_public_key } } : {}),
+                // Only the key, and a card-form payment's holderReference: the token already rides in the
+                // passthrough authorization header.
+                ...(mode === 'device_encrypt' && sidecar ? { payrails: { encryption_public_key: sidecar.encryption_public_key,
+                        ...(payrailsPayment ? { holder_reference: sidecar.holder_reference } : {}) } } : {}),
             },
         };
         try {
@@ -2063,7 +2147,13 @@ export class VaultClient {
         // then at the caller's interval; at the default 2 seconds the first read alone would miss it.
         // The API's bind names 100 ms as such a row's poll interval, so slow_down admits these reads
         // (as an eProtect row names the 500 ms read above).
-        const preparedFlexPollUntil = preparation?.cybersourceFlex ? Date.now() + 10_000 : 0;
+        // A prepared Bambora token create too: Custom Checkout's card frame gives its tokenization
+        // request 5 seconds from Pay, and the cardholder's device answers a prepared token 1.5 to 4
+        // seconds after this bind. Read every 2 seconds, an answer later than the first read waited
+        // for the read 4 seconds after the bind, at or past the frame's timer; read every 100 ms, it
+        // reaches the frame within about 0.2 seconds of the device's answer. The API's bind names
+        // 100 ms on such a row too.
+        const preparedTightPollUntil = preparation?.cybersourceFlex || preparation?.psp === 'bambora' ? Date.now() + 10_000 : 0;
         let execution = {};
         let approvalDelivered = false;
         const deliverApproval = (state) => {
@@ -2112,7 +2202,7 @@ export class VaultClient {
                 if (stopSignal?.aborted)
                     throw new PaymentOutcomeUnknownError(authorizationId, input.merchantSignal?.aborted ? 'merchant_request_aborted' : 'local_cancel');
                 const pollInterval = Date.now() < preparedFastPollUntil ? Math.min(this.pollIntervalMs, 500)
-                    : Date.now() < preparedFlexPollUntil ? Math.min(this.pollIntervalMs, 100) : this.pollIntervalMs;
+                    : Date.now() < preparedTightPollUntil ? Math.min(this.pollIntervalMs, 100) : this.pollIntervalMs;
                 // A Secure Acceptance read also wakes when its reply window closes (Infinity for every other processor).
                 await interruptibleSleep(Math.min(pollInterval, Math.max(0, deadline - Date.now()), Math.max(0, secureAcceptanceReplyBy - Date.now())), stopSignal);
                 if (stopSignal?.aborted)
@@ -2247,16 +2337,17 @@ export class VaultClient {
                                 fields: { ...sub.fields },
                                 ...(removeRaw ? { remove: [...removeRaw] } : {}),
                             },
-                            ...(shiji ? { shijiStsCompanion: Object.freeze({ keySequences: Object.freeze([...s.shiji_sts_companion.key_sequences]) }) } : {}),
+                            ...(shiji ? { shijiStsCompanion: Object.freeze({ keySequenceSha256: Object.freeze([...s.shiji_sts_companion.key_sequence_sha256]) }) } : {}),
                             ...amountAuthority,
                             ...execution,
                         };
                     }
                     if (approvedMode === 'device_encrypt') {
                         // The device sent the card to Payrails itself; this is Payrails' answer to it. It
-                        // enters the page only as a 201 for a card instrument, rebuilt from payment-core's
-                        // allow-list under a JSON content type (payrails.ts payrailsSaveAnswer). Anything else
-                        // is never handed over: the card may be saved, so the outcome is unknown, not declined.
+                        // enters the page only as a 201 for a card instrument or, for a card-form payment, a 2xx
+                        // naming the authorize action, rebuilt from payment-core's allow-list under a JSON
+                        // content type (payrails.ts payrailsAnswer, by the paused URL). Anything else is never
+                        // handed over: the card may be saved or paying, so the outcome is unknown, not declined.
                         // Autopilot never runs this mode, so an autopilot answer is not one to act on either.
                         if (execution.executionMode === 'autopilot')
                             throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_submission_mode_invalid');
@@ -2264,7 +2355,7 @@ export class VaultClient {
                             throw new PaymentOutcomeUnknownError(authorizationId, 'approved_mode_unsupported');
                         const saved = s.response;
                         const answer = saved && typeof saved === 'object' && Number.isInteger(saved.status) && typeof saved.body === 'string'
-                            ? payrailsSaveAnswer(saved.status, saved.body) : null;
+                            ? payrailsAnswer(saved.status, saved.body, input.request.url) : null;
                         if (!answer)
                             throw new PaymentOutcomeUnknownError(authorizationId, 'payrails_answer_unconfirmed');
                         if (s.processor_context !== undefined)

package/dist/creditguard.generated.d.ts

@@ -54,7 +54,7 @@ declare function parseCreditguardTransaction(body: any, txId: any): {
     personalIdAlwaysEnabled: boolean;
     inputs: any;
 } | null;
-declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "transaction_unreadable" | "three_d_secure" | "form_inputs" | "card_field_hidden" | "no_retries_left" | "jwe_public_key_malformed" | null;
+declare function creditguardTransactionRefusal(txn: any, expectation: any): "otp" | "keep_on_file" | "dcc" | "installments" | "personal_id" | "jwe_unsupported" | "transaction_type" | "amount_mismatch" | "environment_mismatch" | "currency_mismatch" | "transaction_unreadable" | "three_d_secure" | "form_inputs" | "card_field_hidden" | "jwe_public_key_malformed" | null;
 declare function creditguardSendWindowRefusal(timing: any): "timing_unknown" | "page_expired" | "recaptcha_expired" | null;
 declare var CREDITGUARD_REFUSAL_CODES: readonly string[];
 declare function creditguardResponseOutcome(status: any, body: any, options: any): {

package/dist/creditguard.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 83caafdf10afb4617e5eb3a896d3a1ba4b5c098747495658529c5d13798051cc
+// artifact-sha256: 58593275ccbce7e76a1aa68065eb63063cdf0ed00d533706bec557cb8a21cbc8
 // src/creditguard.js
 var CREDITGUARD_PPS_HOSTS = Object.freeze(["pps.creditguard.co.il", "pps2.creditguard.co.il", "ppsuat.creditguard.co.il"]);
 var CREDITGUARD_SANDBOX_HOST = "ppsuat.creditguard.co.il";
@@ -572,8 +572,6 @@ function creditguardTransactionRefusal(txn, expectation) {
     const form = formInputsRefusal(txn.inputs);
     if (form)
         return form;
-    if (txn.remainingSubmitRetries === null || txn.remainingSubmitRetries === 0)
-        return "no_retries_left";
     const environment = creditguardPreparationEnvironment(expectation.hostname);
     if (environment === null || environment === "sandbox" !== (txn.envType === "test") || typeof expectation.sandbox !== "boolean" || expectation.sandbox !== (environment === "sandbox"))
         return "environment_mismatch";

package/dist/cse-body.d.ts

@@ -13,12 +13,13 @@ import type { PreparedCheckout, ReplayResponse } from './client.js';
  * always a prepared one (authorize() requires it), so its preparation names
  * the processor and the key pin the cardholder approved. It continues only a
  * request on Fiserv's capture hosts, and only when that capture's own pin (its
- * envelope's key, pinned for its endpoint and its merchant) is the approved
- * pin; then Fiserv's own substitution writes only the envelope's four members
- * at source.encryptionData of the live paused body, and throws for a body that
- * is not the capture Agentcard covers or an envelope under another key than
- * the one the paused capture names (fiserv.ts). Any other approval never meets
- * a Fiserv capture host. Every refusal throws before anything is sent.
+ * envelope's key, or for a credentials session's key its merchant's, pinned for
+ * its endpoint and its merchant) is the approved pin; then Fiserv's own
+ * substitution writes only the envelope's four members at source.encryptionData
+ * of the live paused body, and throws for a body that is not the capture
+ * Agentcard covers or an envelope under another key than that pin's
+ * (fiserv.ts). Any other approval never meets a Fiserv capture host. Every
+ * refusal throws before anything is sent.
  */
 export declare function cseBody(body: string, replay: Extract<ReplayResponse, {
     mode: 'cse';

package/dist/cse-body.js

@@ -18,12 +18,13 @@ import { substituteVerifoneBody } from './verifone.js';
  * always a prepared one (authorize() requires it), so its preparation names
  * the processor and the key pin the cardholder approved. It continues only a
  * request on Fiserv's capture hosts, and only when that capture's own pin (its
- * envelope's key, pinned for its endpoint and its merchant) is the approved
- * pin; then Fiserv's own substitution writes only the envelope's four members
- * at source.encryptionData of the live paused body, and throws for a body that
- * is not the capture Agentcard covers or an envelope under another key than
- * the one the paused capture names (fiserv.ts). Any other approval never meets
- * a Fiserv capture host. Every refusal throws before anything is sent.
+ * envelope's key, or for a credentials session's key its merchant's, pinned for
+ * its endpoint and its merchant) is the approved pin; then Fiserv's own
+ * substitution writes only the envelope's four members at source.encryptionData
+ * of the live paused body, and throws for a body that is not the capture
+ * Agentcard covers or an envelope under another key than that pin's
+ * (fiserv.ts). Any other approval never meets a Fiserv capture host. Every
+ * refusal throws before anything is sent.
  */
 export function cseBody(body, replay, url, preparation) {
     // A Verifone approval is always a prepared one for the profile it pays, and continues only the
@@ -39,7 +40,7 @@ export function cseBody(body, replay, url, preparation) {
         if (replay.kind !== undefined || !isFiservCaptureHost(url) || fiservCapturePinId(url, body) !== preparation.merchantProfile) {
             throw new Error('Refusing to substitute: the paused request is not a Fiserv capture under the key pin the cardholder approved.');
         }
-        return substituteFiservEnvelope(body, replay.substitutions);
+        return substituteFiservEnvelope(body, replay.substitutions, url);
     }
     if (isFiservCaptureHost(url))
         throw new Error('Refusing to substitute: a Fiserv capture continues only through a prepared Fiserv approval.');

package/dist/datatrans.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0179250ba6f44c33967a08dc4ce3a891d8b73f0f7eb60e9cab34f801dc2a4c57
+// artifact-sha256: fdee611015d42dc0a679e93a64766ac971b190fcc8f17a107d761c414569e5f9
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";
@@ -178,15 +178,18 @@ function judgeBody(body) {
     if (!pairs)
         return null;
     const fields = new Map(pairs.map(({ key, value }) => [key, value]));
+    const merchantHeldExpiry = !fields.get("expm") && !fields.get("expy") && fields.has("expm") === fields.has("expy") && fields.get("usage") !== "REGISTRATION";
     for (const [key, value] of fields) {
         if (!KEYS.has(key))
             return null;
+        if (merchantHeldExpiry && (key === "expm" || key === "expy"))
+            continue;
         if (EMPTY_ONLY.has(key) ? value !== "" : !RULES[key](value))
             return null;
     }
-    if (!REQUIRED.every((key) => fields.has(key)))
+    if (!REQUIRED.every((key) => fields.has(key) || merchantHeldExpiry && (key === "expm" || key === "expy")))
         return null;
-    return { pairs, fields, usage: fields.get("usage") ?? "" };
+    return { pairs, fields, usage: fields.get("usage") ?? "", merchantHeldExpiry };
 }
 function datatransRegistrationRefusal(usage, card, policy = DATATRANS_REGISTRATION_POLICY) {
     if (usage !== "REGISTRATION")
@@ -319,14 +322,14 @@ function injectDatatransCard(body, card, policy = DATATRANS_REGISTRATION_POLICY)
     if (!fields.get("cvv") || !digits(card.cvc, 3, 4))
         throw new Error(FILL_REFUSAL);
     const yy = String(year % 100).padStart(2, "0");
-    const values = {
+    const values = judged.merchantHeldExpiry ? { cardNumber: card.number, cvv: card.cvc } : {
         cardNumber: card.number,
         cvv: card.cvc,
         expm: fields.get("expm").length === 2 ? String(month).padStart(2, "0") : String(month),
         expy: fields.get("expy").length === 4 ? `20${yy}` : yy
     };
     const written = judged.pairs.map((pair) => owns(values, pair.key) ? `${pair.rawKey}=${encodeDatatransFormValue(values[pair.key])}` : `${pair.rawKey}=${pair.raw}`);
-    return { body: written.join("&"), where: ["cardNumber", "cvv", "expm", "expy"] };
+    return { body: written.join("&"), where: Object.keys(values) };
 }
 var TRANSACTION_ID = /^[0-9]{18}$/;
 var CARD_WORD = /^[A-Za-z][A-Za-z _-]{0,31}$/;

package/dist/elavon-converge.d.ts

@@ -7,9 +7,12 @@ export declare const CONVERGE_CAPABILITY = "converge_hpp_process";
  * the device refuses with, so an integrator reads one code whichever of them refused.
  *   - A shape the Vault never pays: `converge_wallet_refused`, `converge_debit_card_refused`,
  *     `converge_push_to_card_refused`, `converge_gift_card_refused`, `converge_payment_type_refused`,
- *     `converge_captcha_refused`, `converge_service_fee_refused`, `converge_recurring_refused`,
+ *     `converge_service_fee_refused`, `converge_recurring_refused`,
  *     `converge_card_saving_refused` (ssl_get_token or ssl_add_token), `converge_amount_add_on_refused`
  *     (a tip or cash back) and `converge_currency_refused` (anything but US dollars).
+ *   - A CAPTCHA answer Google never issued: `converge_captcha_refused` (a captchaToken that is not a
+ *     non-empty string of at most 4,096 URL-safe characters). A page with its CAPTCHA on pauses like
+ *     any other once a person solved it, and the answer rides to Converge unchanged.
  *   - A follow-up after a step the Vault cannot complete: `converge_3ds_follow_up_refused` (3-D
  *     Secure or Pay Defense) and `converge_surcharge_refused`.
  *   - A body the cardholder has nothing to approve on: `converge_amount_missing` and
@@ -20,7 +23,7 @@ export declare const CONVERGE_CAPABILITY = "converge_hpp_process";
  */
 export declare const CONVERGE_REFUSAL_REASONS: readonly ["converge_body_malformed", "converge_payment_type_refused", "converge_debit_card_refused", "converge_push_to_card_refused", "converge_gift_card_refused", "converge_credential_refused", "converge_wallet_refused", "converge_captcha_refused", "converge_service_fee_refused", "converge_3ds_follow_up_refused", "converge_surcharge_refused", "converge_amount_add_on_refused", "converge_card_saving_refused", "converge_recurring_refused", "converge_currency_refused", "converge_amount_missing", "converge_context_missing", "converge_card_missing", "converge_card_malformed", "converge_url_refused", "converge_method_refused", "converge_content_type_refused"];
 export type ConvergeRefusalReason = typeof CONVERGE_REFUSAL_REASONS[number];
-/** True when the URL's host is one of Converge's two payment page hosts. */
+/** True when the URL's host is one of Converge's three payment page hosts: api, www and the demo. */
 export declare function isConvergeHost(url: string): boolean;
 /**
  * The pause decision for a card-carrying POST the registry recognized on a Converge host. Null

package/dist/elavon-converge.generated.js

@@ -1,13 +1,14 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: dc4269c2533c43ddcc4f7be0f3a4645beea09bce6854c98e38701f29cf037e2b
+// artifact-sha256: 136e1c2b0fd2bdee0cfbf5efbbfaf1a92ace7d1cc52e17a3fd5a4584370e5e53
 // src/elavon-converge.js
-var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com"]);
+var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com", "www.convergepay.com"]);
 var CONVERGE_DEMO_HOST = "api.demo.convergepay.com";
 var CONVERGE_PROCESS_PATH = "/hosted-payments/service/payment/hpp/process";
 var CONVERGE_PROCESS_URLS = /* @__PURE__ */ Object.freeze([
     "https://api.convergepay.com/hosted-payments/service/payment/hpp/process",
-    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process"
+    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process",
+    "https://www.convergepay.com/hosted-payments/service/payment/hpp/process"
 ]);
 var CONVERGE_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
     "converge_body_malformed",
@@ -72,15 +73,18 @@ var RECURRING_FIELDS = /* @__PURE__ */ Object.freeze([
     "ssl_recurring_batch_count",
     "ssl_installment_id"
 ]);
+var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
 var AMOUNT = /^(\d{1,13})(?:\.(\d{1,2}))?$/;
 var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var recurringRequested = (data) => RECURRING_FIELDS.some((key) => owns(data, key) && !(key === "recurring" && data[key] === ONE_TIME_RECURRING_FLAG));
 var refuse = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
 var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
@@ -129,7 +133,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");
@@ -142,7 +146,7 @@ function convergeBodyVerdict(body) {
     if (owns(data, "ssl_token") || CARD_SAVING_FLAGS.some((key) => owns(data, key) && !(typeof data[key] === "string" && /^n$/i.test(data[key])))) {
         return refuse("converge_card_saving_refused");
     }
-    if (RECURRING_FIELDS.some((key) => owns(data, key)))
+    if (recurringRequested(data))
         return refuse("converge_recurring_refused");
     if (owns(data, "ssl_transaction_currency") && !(typeof data.ssl_transaction_currency === "string" && /^usd$/i.test(data.ssl_transaction_currency))) {
         return refuse("converge_currency_refused");

package/dist/elavon-converge.js

@@ -1,6 +1,7 @@
 // Elavon Converge Hosted Payment Page (psp `elavon_converge`): the page NY DMV's payment apps
-// redirect to, api.convergepay.com/hosted-payments/?ssl_txn_auth_token=<one-time token> (the
-// demo environment serves the same page on api.demo.convergepay.com). Converge's own AngularJS
+// redirect to, api.convergepay.com/hosted-payments/?ssl_txn_auth_token=<one-time token>. Every
+// Converge Buy Button and pay link opens the same page on www.convergepay.com, and the demo
+// environment serves it on api.demo.convergepay.com. Converge's own AngularJS
 // app posts the card in one same-origin JSON XHR, POST /hosted-payments/service/payment/hpp/process,
 // with the card at paymentData.ssl_card_number, ssl_exp_date (MMYY) and ssl_cvv2cvc2, the amount
 // at paymentData.ssl_amount, and the page's rolling session in `context`. The same URL also takes
@@ -24,9 +25,12 @@ export const CONVERGE_CAPABILITY = 'converge_hpp_process';
  * the device refuses with, so an integrator reads one code whichever of them refused.
  *   - A shape the Vault never pays: `converge_wallet_refused`, `converge_debit_card_refused`,
  *     `converge_push_to_card_refused`, `converge_gift_card_refused`, `converge_payment_type_refused`,
- *     `converge_captcha_refused`, `converge_service_fee_refused`, `converge_recurring_refused`,
+ *     `converge_service_fee_refused`, `converge_recurring_refused`,
  *     `converge_card_saving_refused` (ssl_get_token or ssl_add_token), `converge_amount_add_on_refused`
  *     (a tip or cash back) and `converge_currency_refused` (anything but US dollars).
+ *   - A CAPTCHA answer Google never issued: `converge_captcha_refused` (a captchaToken that is not a
+ *     non-empty string of at most 4,096 URL-safe characters). A page with its CAPTCHA on pauses like
+ *     any other once a person solved it, and the answer rides to Converge unchanged.
  *   - A follow-up after a step the Vault cannot complete: `converge_3ds_follow_up_refused` (3-D
  *     Secure or Pay Defense) and `converge_surcharge_refused`.
  *   - A body the cardholder has nothing to approve on: `converge_amount_missing` and
@@ -59,7 +63,7 @@ export const CONVERGE_REFUSAL_REASONS = [
     'converge_method_refused',
     'converge_content_type_refused',
 ];
-/** True when the URL's host is one of Converge's two payment page hosts. */
+/** True when the URL's host is one of Converge's three payment page hosts: api, www and the demo. */
 export function isConvergeHost(url) {
     try {
         return CONVERGE_HOSTS.includes(new URL(url).hostname);