@agent-cards/sdk 0.24.2 → 0.25.0

package/dist/approvals.d.ts

@@ -39,6 +39,50 @@ export interface CreateAuthorizationInput {
     checkout_origin?: string;
     /** Pins the card that pays: one of the person's stored cards. Absent, the person's recommended card pays, else their only card, and `card` on the answer says which. */
     card_id?: string;
+    /**
+     * The products the purchase is for, as your agent's cart has them (1 to 20 lines): the approval page lists them
+     * above the total, labelled as sent by your company. Shown, never charged: the person approves `amount`.
+     * Every amount is in the smallest unit of `currency`. A line the API cannot read is refused by name
+     * (`invalid_request`), never dropped.
+     */
+    line_items?: OrderLineItem[];
+    /** The cart's subtotal, shipping, tax and discount, in the smallest unit of `currency`, each shown only when named. Need `line_items`. */
+    subtotal?: number;
+    shipping?: number;
+    tax?: number;
+    discount?: number;
+    /** Where the order ships, shown in the approval page's Ship to box. Needs `line_items`. Never returned on your reads. */
+    ship_to?: OrderShipTo;
+}
+/** One product of the cart an approval shows. */
+export interface OrderLineItem {
+    /** The product's name as the store shows it. */
+    title: string;
+    /** A positive integer. */
+    quantity: number;
+    /** The price of one, in the smallest unit of the create's `currency`; the line shows `unit_amount × quantity`. */
+    unit_amount?: number;
+    /** The line's own total, in the smallest unit; shown over `unit_amount × quantity` when both are named. */
+    amount?: number;
+    brand?: string;
+    /** The options chosen, as one string (`'Size S · Pink'`) or by name (`{ Size: 'S', Color: 'Pink' }`, shown as `S · Pink`). */
+    options?: string | Record<string, string>;
+    /** An https picture of the product. Shown only from the image hosts the approval page loads; any other shows the line without one. */
+    image_url?: string;
+}
+/** Where an approval's order ships. */
+export interface OrderShipTo {
+    name: string;
+    phone?: string;
+    /** `country` is a two-letter ISO code; absent means `US`. */
+    address: {
+        line1: string;
+        line2?: string;
+        city: string;
+        state?: string;
+        postal_code: string;
+        country?: string;
+    };
 }
 /** The card that pays, as every read names it. */
 export interface PayingCard {

package/dist/approvals.js

@@ -99,6 +99,15 @@ function resultOf(a) {
         ...(approvalUrl && a.status === 'awaiting_approval' ? { approval_url: approvalUrl } : {}),
     };
 }
+/** The cart fields a create names, passed as given: the API checks them and refuses a bad one by name. */
+function orderFieldsOf(input) {
+    const out = {};
+    for (const key of ['line_items', 'subtotal', 'shipping', 'tax', 'discount', 'ship_to']) {
+        if (input[key] !== undefined)
+            out[key] = input[key];
+    }
+    return out;
+}
 /** A random idempotency key for one create, so a retried call makes one purchase. */
 function idempotencyKey() {
     const c = globalThis.crypto;
@@ -148,6 +157,7 @@ export class ApprovalsModule extends ApiModule {
             body: {
                 user, merchant: input.merchant, amount: input.amount, currency: input.currency, psp: input.psp ?? 'stripe', mode: input.mode ?? 'token', request,
                 ...(input.return_url ? { return_url: input.return_url } : {}), ...(checkoutOrigin ? { checkout_origin: checkoutOrigin } : {}), ...(input.card_id ? { card_id: input.card_id } : {}),
+                ...orderFieldsOf(input),
             },
             headers: { 'idempotency-key': input.idempotency_key ?? idempotencyKey() },
         });

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: b51ae1e970674f5e2b35bd33193e9a5ed5b04142e3764296c28dcb3d91e3d17b
+// artifact-sha256: 59a78202e498531ace1ce3391b9ac8b385f55a86e332aca4ac7abdb807d506e7
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -1965,6 +1965,9 @@ function multipartFormRefusal(body, contentType, rule) {
     const read = judge(body, contentType, rule);
     return read.refusal ?? null;
 }
+// src/answer-card-leak.js
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/pay-nl.js
 var PAY_NL_PSP = "pay_nl";
 var PAY_NL_TOKEN_URL = "https://payment.pay.nl/v1/Payment/getCardToken/json";

package/dist/cdp.js

@@ -44,6 +44,7 @@ import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, CYBERSOURCE_SECURE_ACCEPTANCE_R
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
 import { cseBody } from './cse-body.js';
 import { STRIPE_SETUP_INTENT_CONFIRM, setupConfirmPayingWith } from './stripe-setup.js';
+import { confirmPayingWith } from './stripe-continuation.js';
 import { replayTemplatedUrl, reviewedMerchantProfileUrlPatterns } from './merchant-hosted.js';
 import { verifoneTemplatedUrl } from './verifone.js';
 import { MerchantHandoffWatch } from './merchant-handoff.js';
@@ -1113,30 +1114,41 @@ function claimStripeContinuation(opts, lifecycle, url, method, body) {
     }
     if (parsed.origin !== 'https://api.stripe.com')
         return null;
-    if (STRIPE_PAYMENT_INTENT_CONFIRM.test(parsed.pathname)) {
-        if (typeof opts.vault.checkStripeContinuation !== 'function' || opts.vault.withoutCard?.(url, body) !== 'refuse')
-            return null;
-        const authorizationId = lifecycle.claimStripeContinuation();
-        return authorizationId ? { authorizationId, kind: 'payment', body, rewritten: false } : null;
-    }
-    if (!STRIPE_SETUP_INTENT_CONFIRM.test(parsed.pathname) || typeof opts.vault.checkStripeSetupContinuation !== 'function')
+    const payment = STRIPE_PAYMENT_INTENT_CONFIRM.test(parsed.pathname);
+    const setup = !payment && STRIPE_SETUP_INTENT_CONFIRM.test(parsed.pathname);
+    if (!payment && !setup)
+        return null;
+    // Each kind needs the client method that judges it; an older client keeps the ordinary hold.
+    if (payment && typeof opts.vault.checkStripeContinuation !== 'function')
+        return null;
+    if (setup && typeof opts.vault.checkStripeSetupContinuation !== 'function')
         return null;
     const withoutCard = opts.vault.withoutCard?.(url, body);
     let send = null;
     if (withoutCard === 'refuse')
         send = body;
     else if (withoutCard === null) {
-        // The card again, inline: only the approved payment method may replace it,
-        // and only when what is left carries no card at all.
-        const paymentMethod = lifecycle.approvedStripePaymentMethod();
-        send = paymentMethod ? setupConfirmPayingWith(body, paymentMethod) : null;
+        // The card again, inline: only the object the cardholder's approval
+        // returned may replace it, and only when what is left carries no card at
+        // all. A payment pays with whichever object its approval produced (a
+        // confirmation token, for a store that creates one for a fraud check and
+        // then confirms with the Payment Element); a card save pays with a payment
+        // method alone, which is all a SetupIntent confirm takes.
+        if (payment) {
+            const way = lifecycle.approvedStripeWay();
+            send = way ? confirmPayingWith(body, way) : null;
+        }
+        else {
+            const paymentMethod = lifecycle.approvedStripePaymentMethod();
+            send = paymentMethod ? setupConfirmPayingWith(body, paymentMethod) : null;
+        }
         if (send !== null && opts.vault.withoutCard?.(url, send) !== 'refuse')
             send = null;
     }
     if (send === null)
         return null;
     const authorizationId = lifecycle.claimStripeContinuation();
-    return authorizationId ? { authorizationId, kind: 'setup', body: send, rewritten: send !== body } : null;
+    return authorizationId ? { authorizationId, kind: payment ? 'payment' : 'setup', body: send, rewritten: send !== body } : null;
 }
 /**
  * Ask the API about a claimed continuation, with the body it would continue
@@ -1159,7 +1171,7 @@ async function checkStripeContinuation(opts, lifecycle, claim, request) {
     if (proceed) {
         opts.onEvent?.(kind === 'setup'
             ? { type: 'stripe_setup_continued', detail: { authorizationId, setupIntentId: intentId, rewritten: claim.rewritten } }
-            : { type: 'stripe_payment_continued', detail: { authorizationId, paymentIntentId: intentId } });
+            : { type: 'stripe_payment_continued', detail: { authorizationId, paymentIntentId: intentId, rewritten: claim.rewritten } });
     }
     else if (intentId !== null)
         opts.onEvent?.({ type: 'blocked', detail: 'stripe_continuation_superseded' });

package/dist/datatrans.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 169752c8d6a6c9f131c83502766f0026b2ffa45cf9f27c450735eef5ad2fa931
+// artifact-sha256: c4280e1c95d016a93163f49d9d66178a9c4fdfae08e4570952c9c7f533a1c643
 // src/answer-card-leak.js
 var DECIMAL = /\p{Nd}/u;
 function digitValue(char) {
@@ -20,6 +20,8 @@ function enclosedValue(char) {
 var asciiDigits = (text2) => (typeof text2.normalize === "function" ? text2.normalize("NFKC") : text2).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var digitCount = (text2) => (asciiDigits(String(text2)).match(/\p{N}/gu) ?? []).length;
 var NAME_DIGITS = 3;
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";

package/dist/index.d.ts

@@ -46,7 +46,7 @@ export type { ApiTransport } from './api-module.js';
 export { BuyModule, BuyError, isBuyDeclined, BUY_TURN_TIMEOUT_MS } from './buy.js';
 export type { BuyStatus, BuyCart, BuyCartLine, BuyDeliveryAddress, BuyPaymentSource, BuyOutcome, BuyPlacement, BuyCatalog, BuyUnmatched, BuyTurn, BuyDeclined, BuyOrder, BuyLastCheckout, BuyConversation, BuyAskInput, BuyConfirmInput, BuyConversationInput, BuyCheckoutHandoff, BuyOpenOffer, BuyBrowserCheckout, BuyApiAmount, } from './buy.js';
 export { ApprovalsModule, CANCEL_REASONS, SANDBOX_REQUEST } from './approvals.js';
-export type { CreateAuthorizationInput, Authorization, AuthorizationResult, AuthorizationFields, Cancelled, PayingCard, ChoosableCard } from './approvals.js';
+export type { CreateAuthorizationInput, OrderLineItem, OrderShipTo, Authorization, AuthorizationResult, AuthorizationFields, Cancelled, PayingCard, ChoosableCard } from './approvals.js';
 export { verifyWebhook, signWebhook, parseWebhookEvent, parseSignatureHeader, isCheckoutAuthorizationEvent, isVaultEvent, CHECKOUT_AUTHORIZATION_EVENT_TYPES, VAULT_EVENT_TYPES } from './webhooks.js';
 export type { WebhookEvent, AgentcardEvent, CheckoutAuthorizationEvent, CheckoutAuthorizationEventType, CheckoutAuthorizationEventData, VaultEvent, VaultEventType, VaultEventData, OtherEvent, VerifyWebhookOptions } from './webhooks.js';
 export { AgentcardError } from './api-types.js';

package/dist/lifecycle.d.ts

@@ -6,6 +6,7 @@ import type { ShijiStsUnsupportedReason } from './shiji-sts.js';
 import type { PaddleVgsPayRefusal } from './paddle-vgs-pay.js';
 import type { PaypalCardFormReason } from './paypal-card-forms.js';
 import { type CardRequestHold, type HoldReleaseInput, type HoldReleaseOutcome } from './hold.js';
+import { type StripeApprovedWay } from './stripe-continuation.js';
 /** The application's resolver confirmed the payment for this checkout authorization. */
 export interface MerchantPaymentConfirmation {
     kind: 'merchant_payment';
@@ -104,7 +105,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private wspayChallenge;
     private heldBeforeHandoff;
     private stripeContinuedReason;
-    private approvedPaymentMethod;
+    private approvedWay;
     private ownedShopOrderId;
     private orderRefusal;
     private readonly handoffs;
@@ -268,12 +269,19 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * VaultClient.withoutCard, which then refuses a Nuvei payment without a card.
      */
     cardHandoffs(): readonly string[];
+    /**
+     * The object a Stripe confirmation may pay with in place of the card it sends
+     * again (cdp.ts claimStripeContinuation): the one this attachment's approved
+     * tokenization returned, with the field that names it, while its continuation
+     * is still open. Null for a tokenization no confirmation names by id
+     * (`/v1/tokens`), and once the checkout was cancelled, aborted or reconciled.
+     */
+    approvedStripeWay(): StripeApprovedWay | null;
     /**
      * The payment method a Stripe card save may pay with in place of the card
-     * it sends again (cdp.ts claimStripeContinuation): the one this
-     * attachment's approved `/v1/payment_methods` request returned, while its
-     * continuation is still open. Null for any other tokenization, and once the
-     * checkout was cancelled, aborted or reconciled.
+     * it sends again: the `pm_` an approved `/v1/payment_methods` request
+     * returned. Null for every other approved object, since a SetupIntent
+     * confirm pays with a payment method alone.
      */
     approvedStripePaymentMethod(): string | null;
     /**

package/dist/lifecycle.js

@@ -3,6 +3,7 @@ import { CardEndpointRefusedError } from './card-endpoint.js';
 import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 import { isWspayChallenge } from './wspay.js';
 import { HoldAnsweredError, HoldEndedError } from './hold.js';
+import { stripeApprovedWay } from './stripe-continuation.js';
 /**
  * The statuses that end an attempt: its outcome is known (`completed`, `declined`, `failed`,
  * `timed_out`, `unsupported`, `cancelled`), or the SDK already reported it unknown with its own
@@ -25,19 +26,6 @@ export const MAX_STRIPE_CONTINUATION_CHECKS = 3;
  * the post becomes a new approval instead of hanging the checkout.
  */
 export const MERCHANT_ORDER_READ_MS = 5_000;
-const STRIPE_PAYMENT_METHOD_ID = /^pm_[A-Za-z0-9]{1,250}$/;
-/** The `pm_` id in a Stripe `/v1/payment_methods` answer, or null for any other body. */
-function stripePaymentMethodId(body) {
-    if (typeof body !== 'string')
-        return null;
-    try {
-        const id = JSON.parse(body)?.id;
-        return typeof id === 'string' && STRIPE_PAYMENT_METHOD_ID.test(id) ? id : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** Shared by the raw CDP and Playwright transports. No browser ownership or payment execution lives here. */
 export class CheckoutLifecycle {
     options;
@@ -62,8 +50,9 @@ export class CheckoutLifecycle {
     heldBeforeHandoff = false;
     // What the continuation that went through confirmed: a payment, or a card save.
     stripeContinuedReason = 'stripe_payment_continued';
-    // The payment method a Stripe /v1/payment_methods approval returned: see approvedStripePaymentMethod.
-    approvedPaymentMethod = null;
+    // The object a Stripe tokenization approval returned, and the field a confirmation
+    // names it by: see approvedStripeWay.
+    approvedWay = null;
     ownedShopOrderId = null;
     // The reason Nike's order was refused while this attempt was under way (merchantOrderRefused): its handoff keeps it failed.
     orderRefusal = null;
@@ -367,8 +356,7 @@ export class CheckoutLifecycle {
                     this.unboundStripeToken = true;
                     this.stripeTokenPrepared = true;
                     this.held = true;
-                    if (url.pathname === '/v1/payment_methods')
-                        this.approvedPaymentMethod = stripePaymentMethodId(replay.body);
+                    this.approvedWay = stripeApprovedWay(url.pathname, replay.body);
                 }
             }
             catch { /* unknown URL cannot establish a token binding */ }
@@ -382,15 +370,25 @@ export class CheckoutLifecycle {
      * VaultClient.withoutCard, which then refuses a Nuvei payment without a card.
      */
     cardHandoffs() { return [...this.handoffs]; }
+    /**
+     * The object a Stripe confirmation may pay with in place of the card it sends
+     * again (cdp.ts claimStripeContinuation): the one this attachment's approved
+     * tokenization returned, with the field that names it, while its continuation
+     * is still open. Null for a tokenization no confirmation names by id
+     * (`/v1/tokens`), and once the checkout was cancelled, aborted or reconciled.
+     */
+    approvedStripeWay() {
+        return this.stripeContinuationOpen() ? this.approvedWay : null;
+    }
     /**
      * The payment method a Stripe card save may pay with in place of the card
-     * it sends again (cdp.ts claimStripeContinuation): the one this
-     * attachment's approved `/v1/payment_methods` request returned, while its
-     * continuation is still open. Null for any other tokenization, and once the
-     * checkout was cancelled, aborted or reconciled.
+     * it sends again: the `pm_` an approved `/v1/payment_methods` request
+     * returned. Null for every other approved object, since a SetupIntent
+     * confirm pays with a payment method alone.
      */
     approvedStripePaymentMethod() {
-        return this.stripeContinuationOpen() ? this.approvedPaymentMethod : null;
+        const way = this.approvedStripeWay();
+        return way?.field === 'payment_method' ? way.id : null;
     }
     /**
      * The approval a page's card-free Stripe confirmation may continue, or null.

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 4acbca9604c5eee50f5f73dc3dea5ab0d40c9cba1214ccda0d2074271b3554a5
+// artifact-sha256: e2228c7919341a7b3615b285c3aa77948c247c13145a1e394a1bb1c64acbca06
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -318,17 +318,39 @@ function enclosedValue(char) {
 }
 var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var unescaped = (text) => text.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
+var UTF8_ONE = /* @__PURE__ */ new RegExp(UTF8_SEQUENCE, "g");
+function utf8Of(bytes) {
+    if (!/[\x80-\xff]/.test(bytes) || !UTF8_WHOLE.test(bytes))
+        return null;
+    return bytes.replace(UTF8_ONE, (sequence) => {
+        if (sequence.length === 1)
+            return sequence;
+        const lead = sequence.charCodeAt(0);
+        let point = lead & (sequence.length === 2 ? 31 : sequence.length === 3 ? 15 : 7);
+        for (let i = 1; i < sequence.length; i += 1)
+            point = point << 6 | sequence.charCodeAt(i) & 63;
+        return String.fromCodePoint(point);
+    });
+}
+var utf8Runs = (text) => text.replace(/[\x80-\xff]+/g, (run) => utf8Of(run) ?? run);
 var decodedInPlace = (text) => text.replace(BASE64_PIECE, (piece) => {
     const bare = piece.replace(/=+$/, "");
     for (let skip = 0; skip < 4 && skip < bare.length - 1; skip += 1) {
         const bytes = base64Text(bare.slice(skip));
         if (/^[\x20-\x7e]+$/.test(bytes))
             return bare.slice(0, skip) + bytes;
+        const utf82 = utf8Of(bytes);
+        if (utf82 !== null && !/\p{C}/u.test(utf82))
+            return bare.slice(0, skip) + utf82;
     }
     return piece;
 });
 function collect(text, layers, streams, runs) {
     const base = /* @__PURE__ */ new Set([...readings(text), ...readings(unescaped(text))]);
+    for (const reading of [...base])
+        base.add(utf8Runs(reading));
     for (const reading of /* @__PURE__ */ new Set([...base, ...[...base].map(decodedInPlace)])) {
         const digits = asciiDigits(reading);
         const sequence = digits.match(/[0-9]+/g) ?? [];
@@ -341,8 +363,13 @@ function collect(text, layers, streams, runs) {
         if (layers === 0)
             continue;
         for (const run of new Set(reading.match(BASE64_RUN))) {
-            for (let skip = 0; skip < 4; skip += 1)
-                collect(base64Text(run.slice(skip)), layers - 1, streams, runs);
+            for (let skip = 0; skip < 4; skip += 1) {
+                const bytes = base64Text(run.slice(skip));
+                collect(bytes, layers - 1, streams, runs);
+                const utf82 = utf8Of(bytes);
+                if (utf82 !== null)
+                    collect(utf82, layers - 1, streams, runs);
+            }
         }
     }
 }

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d6d50b6577a932c3586fcade6b8cbd03c562bd3394e8addcb954d797ea9999b4
+// artifact-sha256: d5e732dd0bce3debee02e3f31107e65059e0d3888b54a605357a5817bb8909ce
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -29,6 +29,8 @@ function enclosedValue(char) {
 var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var digitCount = (text) => (asciiDigits(String(text)).match(/\p{N}/gu) ?? []).length;
 var NAME_DIGITS = 3;
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 90e78fe2563fa4e058ffb098ef6a1354baffee49d6d73fc52018b2700683b755
+// artifact-sha256: 8c51d9a96bc459152335ed188a90bb7d6b3548469c16938af3e384afdad5370b
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -1992,6 +1992,8 @@ function enclosedValue(char) {
 var asciiDigits = (text11) => (typeof text11.normalize === "function" ? text11.normalize("NFKC") : text11).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var digitCount = (text11) => (asciiDigits(String(text11)).match(/\p{N}/gu) ?? []).length;
 var NAME_DIGITS = 3;
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/pay-nl.js
 var PAY_NL_PSP = "pay_nl";
 var PAY_NL_TOKEN_URL = "https://payment.pay.nl/v1/Payment/getCardToken/json";

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 2b384766928412dadfb553ebd4ae0ba3454599de5b60b5abcb0fd26775fb53b5
+// artifact-sha256: b2ba367a9b8d1758f1deea226abb2ca6637b40a88aa0c5ee7f359e074f4c017e
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -5797,6 +5797,9 @@ function trustedClientRecognizer(pspOrEntry) {
         throw new Error("Refusing to pay: unknown payment processor.");
     return definition;
 }
+// src/answer-card-leak.js
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_REFUSAL_REASONS = Object.freeze(["unsupported", "card_on_file", "brand_mismatch", "unregistered_merchant"]);

package/dist/stripe-continuation.d.ts

@@ -0,0 +1,45 @@
+/**
+ * How an approved tokenization is named in the confirmation that pays with it,
+ * by the Stripe endpoint whose answer produced it. The same four endpoints mint
+ * an approved object (lifecycle.ts), and this table holds the three a
+ * confirmation names by id on its own. It mirrors APPROVED_OBJECT in the
+ * backend's checkout-continuation.ts, which judges exactly this shape: exactly
+ * one such field, and no payment_method_data field left beside it.
+ *
+ * `/v1/tokens` is deliberately absent. Its field lives inside the method data
+ * (payment_method_data[card][token]), so paying with a card token means writing
+ * into the method data this rewrite strips rather than replacing it, and no page
+ * has been seen doing that. A confirm carrying a card token keeps the ordinary
+ * hold until one is.
+ */
+export declare const STRIPE_APPROVED_WAY: Readonly<Record<string, Readonly<{
+    field: string;
+    prefix: string;
+}>>>;
+/** An approved object a confirmation can pay with: the field that names it, and its id. */
+export type StripeApprovedWay = {
+    field: string;
+    id: string;
+};
+/**
+ * The approved object a Stripe tokenization answer returned, for the endpoint
+ * that answered: its field and its id. Null for an endpoint no confirmation
+ * names by id, for a body that will not parse, and for an id that is not the
+ * one that endpoint mints, so a confirmation can never be sent paying with
+ * something another endpoint produced.
+ */
+export declare function stripeApprovedWay(pathname: string, body: unknown): StripeApprovedWay | null;
+/**
+ * The page's confirmation, paying with `way` instead of the card it carries:
+ * every `payment_method_data[...]` field goes (the card, and the billing details
+ * and telemetry Stripe.js sends beside it; the approved object already carries
+ * the billing details of the approved request), and `<field>=<id>` takes the
+ * place of the first one. Every other field stays byte for byte as the page
+ * wrote it (client_secret, key, expected_payment_method_type, use_stripe_sdk,
+ * return_url, mandate and option fields). Null, and nothing is rewritten, when
+ * the field is not one a confirmation pays with, when the id is not one Stripe
+ * mints, when a key cannot be decoded, when the body already names a way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
+ */
+export declare function confirmPayingWith(body: string, way: StripeApprovedWay): string | null;

package/dist/stripe-continuation.js

@@ -0,0 +1,106 @@
+// What a Stripe confirmation the cardholder already approved may pay with,
+// shared by the card save and the payment (cdp.ts claimStripeContinuation).
+// Kept in its own module, outside the package's published entries, so its
+// tests can reach it and lifecycle.ts can read the same table.
+//
+// A page tokenizes the card through an approval and then confirms. Some pages
+// confirm with the object they got back, which carries no card. Others send
+// the card again inline, as payment_method_data[card][number] in the confirm:
+// confirmCardSetup with the Card Element after createPaymentMethod does on a
+// SetupIntent, and a store that creates a confirmation token for a fraud check
+// and then calls confirmPayment({ elements }) does on a PaymentIntent. The card
+// in that second request is whatever the agent typed; the approved object holds
+// the cardholder's card. So that confirm is sent paying with the approved
+// object instead, with no card in it, and the API decides whether it is the
+// payment the cardholder approved.
+/**
+ * How an approved tokenization is named in the confirmation that pays with it,
+ * by the Stripe endpoint whose answer produced it. The same four endpoints mint
+ * an approved object (lifecycle.ts), and this table holds the three a
+ * confirmation names by id on its own. It mirrors APPROVED_OBJECT in the
+ * backend's checkout-continuation.ts, which judges exactly this shape: exactly
+ * one such field, and no payment_method_data field left beside it.
+ *
+ * `/v1/tokens` is deliberately absent. Its field lives inside the method data
+ * (payment_method_data[card][token]), so paying with a card token means writing
+ * into the method data this rewrite strips rather than replacing it, and no page
+ * has been seen doing that. A confirm carrying a card token keeps the ordinary
+ * hold until one is.
+ */
+export const STRIPE_APPROVED_WAY = Object.freeze({
+    '/v1/payment_methods': Object.freeze({ field: 'payment_method', prefix: 'pm_' }),
+    '/v1/confirmation_tokens': Object.freeze({ field: 'confirmation_token', prefix: 'ctoken_' }),
+    '/v1/sources': Object.freeze({ field: 'source', prefix: 'src_' }),
+});
+// The other ways a confirmation can say what it pays with. A body that already
+// names one is not the shape rewritten here, the field about to be written
+// included: there is then nothing to replace, and the body already names a way
+// to pay, so the ordinary hold decides it.
+const OTHER_WAYS_TO_PAY = new Set(['payment_method', 'source', 'confirmation_token']);
+// An id as Stripe mints it, and as a form field can carry it unescaped.
+const APPROVED_ID = /^[a-z]+_[A-Za-z0-9]{1,250}$/;
+/**
+ * The approved object a Stripe tokenization answer returned, for the endpoint
+ * that answered: its field and its id. Null for an endpoint no confirmation
+ * names by id, for a body that will not parse, and for an id that is not the
+ * one that endpoint mints, so a confirmation can never be sent paying with
+ * something another endpoint produced.
+ */
+export function stripeApprovedWay(pathname, body) {
+    const way = Object.prototype.hasOwnProperty.call(STRIPE_APPROVED_WAY, pathname) ? STRIPE_APPROVED_WAY[pathname] : undefined;
+    if (!way || typeof body !== 'string')
+        return null;
+    let id;
+    try {
+        id = JSON.parse(body)?.id;
+    }
+    catch {
+        return null;
+    }
+    if (typeof id !== 'string' || !id.startsWith(way.prefix) || !APPROVED_ID.test(id))
+        return null;
+    return { field: way.field, id };
+}
+/**
+ * The page's confirmation, paying with `way` instead of the card it carries:
+ * every `payment_method_data[...]` field goes (the card, and the billing details
+ * and telemetry Stripe.js sends beside it; the approved object already carries
+ * the billing details of the approved request), and `<field>=<id>` takes the
+ * place of the first one. Every other field stays byte for byte as the page
+ * wrote it (client_secret, key, expected_payment_method_type, use_stripe_sdk,
+ * return_url, mandate and option fields). Null, and nothing is rewritten, when
+ * the field is not one a confirmation pays with, when the id is not one Stripe
+ * mints, when a key cannot be decoded, when the body already names a way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
+ */
+export function confirmPayingWith(body, way) {
+    if (typeof body !== 'string' || body === '')
+        return null;
+    if (!way || !OTHER_WAYS_TO_PAY.has(way.field) || !APPROVED_ID.test(way.id))
+        return null;
+    const kept = [];
+    let replaced = false;
+    for (const chunk of body.split('&')) {
+        if (chunk === '')
+            continue;
+        const eq = chunk.indexOf('=');
+        let key;
+        try {
+            key = decodeURIComponent((eq < 0 ? chunk : chunk.slice(0, eq)).replace(/\+/g, ' '));
+        }
+        catch {
+            return null;
+        }
+        if (OTHER_WAYS_TO_PAY.has(key))
+            return null;
+        if (key.startsWith('payment_method_data[')) {
+            if (!replaced)
+                kept.push(`${way.field}=${way.id}`);
+            replaced = true;
+            continue;
+        }
+        kept.push(chunk);
+    }
+    return replaced ? kept.join('&') : null;
+}

package/dist/stripe-setup.d.ts

@@ -2,15 +2,10 @@
 export declare const STRIPE_SETUP_INTENT_CONFIRM: RegExp;
 /**
  * The page's SetupIntent confirm, paying with `paymentMethod` instead of the
- * card it carries: every `payment_method_data[...]` field goes (the card, and
- * the billing details and telemetry Stripe.js sends beside it; the payment
- * method already carries the billing details of the approved request), and
- * `payment_method=<id>` takes the place of the first one. Every other field
- * stays byte for byte as the page wrote it (client_secret, key,
- * expected_payment_method_type, use_stripe_sdk, return_url, mandate and option
- * fields). Null, and nothing is rewritten, when the id is not a payment
- * method's, when a key cannot be decoded, when the body already names another
- * way to pay (payment_method, source, confirmation_token), or when it carries
- * no payment_method_data at all.
+ * card it carries (confirmPayingWith, with the payment method as the way to
+ * pay). Null, and nothing is rewritten, when the id is not a payment method's,
+ * when a key cannot be decoded, when the body already names another way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
  */
 export declare function setupConfirmPayingWith(body: string, paymentMethod: string): string | null;

package/dist/stripe-setup.js

@@ -1,6 +1,8 @@
 // The SetupIntent confirm a Stripe card save continues with, shared by both
 // adapters (cdp.ts claimStripeContinuation). Kept in its own module, outside the
-// package's published entries, so its tests can reach it.
+// package's published entries, so its tests can reach it. The rewrite itself,
+// and the table of approved objects a confirmation can pay with, live in
+// stripe-continuation.ts, which the payment side reads too.
 //
 // A page that creates the payment method first (createPaymentMethod, which the
 // cardholder approves) and then confirms a SetupIntent usually pays with the
@@ -12,50 +14,20 @@
 // agent typed; the approved payment method holds the cardholder's card. So that
 // confirm continues paying with the approved payment method instead, once the
 // API allows it.
+import { confirmPayingWith } from './stripe-continuation.js';
 /** A SetupIntent confirm's path, as Stripe.js sends it. */
 export const STRIPE_SETUP_INTENT_CONFIRM = /^\/v1\/setup_intents\/seti_[A-Za-z0-9]+\/confirm$/;
 const PAYMENT_METHOD_ID = /^pm_[A-Za-z0-9]{1,250}$/;
-// The other ways a confirm can say what it pays with. A body that already names
-// one is not the shape rewritten here.
-const OTHER_WAYS_TO_PAY = new Set(['payment_method', 'source', 'confirmation_token']);
 /**
  * The page's SetupIntent confirm, paying with `paymentMethod` instead of the
- * card it carries: every `payment_method_data[...]` field goes (the card, and
- * the billing details and telemetry Stripe.js sends beside it; the payment
- * method already carries the billing details of the approved request), and
- * `payment_method=<id>` takes the place of the first one. Every other field
- * stays byte for byte as the page wrote it (client_secret, key,
- * expected_payment_method_type, use_stripe_sdk, return_url, mandate and option
- * fields). Null, and nothing is rewritten, when the id is not a payment
- * method's, when a key cannot be decoded, when the body already names another
- * way to pay (payment_method, source, confirmation_token), or when it carries
- * no payment_method_data at all.
+ * card it carries (confirmPayingWith, with the payment method as the way to
+ * pay). Null, and nothing is rewritten, when the id is not a payment method's,
+ * when a key cannot be decoded, when the body already names another way to pay
+ * (payment_method, source, confirmation_token), or when it carries no
+ * payment_method_data at all.
  */
 export function setupConfirmPayingWith(body, paymentMethod) {
-    if (!PAYMENT_METHOD_ID.test(paymentMethod) || typeof body !== 'string' || body === '')
+    if (!PAYMENT_METHOD_ID.test(paymentMethod))
         return null;
-    const kept = [];
-    let replaced = false;
-    for (const chunk of body.split('&')) {
-        if (chunk === '')
-            continue;
-        const eq = chunk.indexOf('=');
-        let key;
-        try {
-            key = decodeURIComponent((eq < 0 ? chunk : chunk.slice(0, eq)).replace(/\+/g, ' '));
-        }
-        catch {
-            return null;
-        }
-        if (OTHER_WAYS_TO_PAY.has(key))
-            return null;
-        if (key.startsWith('payment_method_data[')) {
-            if (!replaced)
-                kept.push(`payment_method=${paymentMethod}`);
-            replaced = true;
-            continue;
-        }
-        kept.push(chunk);
-    }
-    return replaced ? kept.join('&') : null;
+    return confirmPayingWith(body, { field: 'payment_method', id: paymentMethod });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; buy asks the Purchase API for a cart and places it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs token-repeat.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs nike-order.test.mjs nike-order-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-payment-continuation.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs processout.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs agentcard.test.mjs buy.test.mjs clean-dist.test.mjs approvals.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs paymob.test.mjs payu-latam.test.mjs nexi-checkout.test.mjs oceanpayment.test.mjs pin-payments.test.mjs payplug.test.mjs cardlink-vpos.test.mjs eghl.test.mjs paymentwall.test.mjs vtex-payments.test.mjs vtex-payments-window.test.mjs iyzico.test.mjs usaepay.test.mjs viva-wallet.test.mjs aurus.test.mjs monei.test.mjs paystack.test.mjs frisbii.test.mjs token-repeat.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",