@agent-cards/sdk 0.24.1 → 0.24.2

package/dist/token-repeats.d.ts

@@ -0,0 +1,32 @@
+import type { ReplayResponse } from './client.js';
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export declare const TOKEN_REPEAT_WINDOW_MS: number;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export declare const MAX_TOKEN_REPEATS = 3;
+export interface TokenRepeatAnswer {
+    authorizationId: string;
+    response: {
+        status: number;
+        headers: Record<string, string>;
+        body: string;
+    };
+}
+export declare class TokenRepeats {
+    private readonly now;
+    private last;
+    constructor(now?: () => number);
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame: unknown, url: string, body: string | null, replay: ReplayResponse): void;
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame: unknown, url: string, body: string | null, authorizationId: string | null): TokenRepeatAnswer | null;
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId: string): void;
+}

package/dist/token-repeats.js

@@ -0,0 +1,64 @@
+// The page's own re-send of a card request this attachment already answered with an approved token.
+//
+// Once the cardholder's device replayed the card and the processor's token reached the page, a checkout can send the
+// very same card request again before the merchant confirms the order: Shopify's card frame did, after a checkout that
+// sat a few minutes between its total and Pay (lexmod.com, expedusa.com and four more stores, 2026-10-27 to 2026-11-05).
+// The SDK held every such re-send while the merchant resolver read the order as pending (lifecycle.ts resolve), so the
+// page never got a token it would submit and the order stayed unconfirmed with the card already out of the device.
+//
+// TokenRepeats keeps the one answer this attachment last handed a plain token request, and hands it out again only for
+// a byte-identical request from the same frame to the same URL under the same approval: the same card fields, the same
+// amount the approval was given for, and no new question for the cardholder. The pre-claim gate (pre-claim.ts tokenRepeatPreClaim) also
+// asks the merchant resolver first and answers only while the order reads pending, so the stored token never reaches a
+// later purchase. A token the processor takes once is refused by the processor the second time, and nothing charges
+// twice: the page holds the same token it already had, never a second payment.
+/** How long an approved answer may answer a re-send: the approval's own lifetime (cdp.ts HOSTED_FORM_REPEAT_QUIET_MS). */
+export const TOKEN_REPEAT_WINDOW_MS = 15 * 60_000;
+/** How many re-sends one approved answer answers. Shopify's frame sent 11 in a row; past this the re-send is held. */
+export const MAX_TOKEN_REPEATS = 3;
+export class TokenRepeats {
+    now;
+    last = null;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /**
+     * Keep the answer a token replay handed to a card request, once it reached the page. Only a plain token answer the
+     * processor accepted (a 2xx): a hosted form, a card endpoint, a client-side encryption or a device's own send is
+     * never answered again from here. A new answer replaces the last, so an earlier approval answers nothing.
+     */
+    remember(frame, url, body, replay) {
+        try {
+            if (frame === undefined || frame === null || frame === '' || body === null || (replay.mode !== undefined && replay.mode !== 'token'))
+                return;
+            const { status, headers } = replay;
+            if (!(status >= 200 && status < 300) || typeof replay.body !== 'string')
+                return;
+            this.last = { frame, url, body, authorizationId: replay.authorizationId, response: { status, headers: { ...headers }, body: replay.body }, at: this.now(), answered: 0 };
+        }
+        catch {
+            this.last = null;
+        }
+    }
+    /**
+     * The stored answer for a byte-identical re-send from the same frame under `authorizationId`, inside the window and
+     * the count, or null. Handing one out reserves a place in the count; the caller gives it back (released) when the
+     * answer never reached the page.
+     */
+    answerFor(frame, url, body, authorizationId) {
+        const last = this.last;
+        if (!last || !authorizationId || body === null || frame === undefined || frame === null || frame === '')
+            return null;
+        if (last.authorizationId !== authorizationId || last.frame !== frame || last.url !== url || last.body !== body)
+            return null;
+        if (this.now() - last.at >= TOKEN_REPEAT_WINDOW_MS || last.answered >= MAX_TOKEN_REPEATS)
+            return null;
+        last.answered += 1;
+        return { authorizationId, response: { ...last.response, headers: { ...last.response.headers } } };
+    }
+    /** Give back a place answerFor reserved for an answer that never reached the page. */
+    released(authorizationId) {
+        if (this.last?.authorizationId === authorizationId && this.last.answered > 0)
+            this.last.answered -= 1;
+    }
+}

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "86bf0b382e6d847b49d00310f262cf697a0189d4badf89c36ebfb595e07a005b",
+  "catalog_sha256": "87d4e75b981d7186a2cd39b6f382717acf5b757d053ed389cb8e181f261f0a49",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.24.1",
+  "version": "0.24.2",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs token-repeat.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",