@paydock/client-sdk 1.147.0 → 1.148.0-beta

package/bundles/widget.umd.js

@@ -1869,7 +1869,7 @@
     version: 'x-sdk-version',
     type: 'x-sdk-type'
   });
-  SDK._version = 'v1.147.0';
+  SDK._version = 'v1.148.0-beta';
 
   var ACCESS_HEADER_NAME = {
     accessToken: 'x-access-token',
@@ -5018,6 +5018,7 @@
 
   var WALLET_CAPTURE_LINK = '/v1/charges/wallet/capture';
   var WALLET_CALLBACK_LINK = '/v1/charges/wallet/callback';
+  var STANDALONE_3DS_PROCESS_LINK = '/v1/charges/standalone-3ds/process';
   var STANDALONE_3DS_HANDLE_LINK = '/v1/charges/standalone-3ds/handle';
   var ApiChargeInternal = /*#__PURE__*/function () {
     function ApiChargeInternal(api) {
@@ -5034,6 +5035,12 @@
       value: function walletCallback(payload) {
         return this.api.getClientPromise('POST', WALLET_CALLBACK_LINK).send(payload);
       }
+      /** Two-step mode: runs the deferred Standalone 3DS authentication (AReq). Charge-token auth, like `standalone3dsHandle`. */
+    }, {
+      key: "standalone3dsProcess",
+      value: function standalone3dsProcess(payload) {
+        return this.api.getClientPromise('POST', STANDALONE_3DS_PROCESS_LINK).send(payload);
+      }
     }, {
       key: "standalone3dsHandle",
       value: function standalone3dsHandle() {
@@ -5394,6 +5401,51 @@
     IFRAME_STATUS["TIMEOUT"] = "AuthTimedOut";
     IFRAME_STATUS["INVALID"] = "invalid_event";
   })(IFRAME_STATUS || (IFRAME_STATUS = {}));
+  /**
+   * Maps a `/process` rejection onto the error object the one-step callback delivers for the same outcome
+   * (`{ error_code, error_description, gateway_specific_description, process_error_code }`), so `error`
+   * carries the same payload in both flows. Absent fields are left out.
+   */
+  function toOutcomeError(err) {
+    var _a, _b;
+    if (err instanceof Error) {
+      // no API envelope to map (the body was not the API's JSON): report it as unreachable, so the
+      // merchant can tell this retryable case apart from a final API answer by `error_code` alone
+      return {
+        error_code: ERROR_CAUSE.SERVICE_UNREACHABLE,
+        error_description: 'Network request failed: the service did not answer with a valid response.'
+      };
+    }
+    var apiError = err !== null && err !== void 0 ? err : {};
+    var gateway = (_b = (_a = apiError.details) === null || _a === void 0 ? void 0 : _a.messages) === null || _b === void 0 ? void 0 : _b[0];
+    var fields = {
+      error_code: apiError.code,
+      error_description: apiError.message,
+      gateway_specific_description: gateway === null || gateway === void 0 ? void 0 : gateway.gateway_specific_description,
+      process_error_code: gateway === null || gateway === void 0 ? void 0 : gateway.gateway_specific_code
+    };
+    var outcomeError = {};
+    for (var _i = 0, _Object$keys = Object.keys(fields); _i < _Object$keys.length; _i++) {
+      var key = _Object$keys[_i];
+      if (fields[key]) {
+        outcomeError[key] = fields[key];
+      }
+    }
+    return outcomeError;
+  }
+  /**
+   * `true` when `/process` produced no API answer: the request never got a response (network, timeout, abort)
+   * or the response body was not the API's JSON (e.g. an HTML page from a proxy in between).
+   */
+  function isTransportFailure(err) {
+    if (err instanceof Error) {
+      return true;
+    }
+    var code = err === null || err === void 0 ? void 0 : err.code;
+    return code === ERROR_CAUSE.SERVICE_UNREACHABLE || code === ERROR_CAUSE.ABORTED;
+  }
+  /** Callback `process_status` of a two-step charge: fingerprint done, authentication not started. */
+  var PROCESS_STATUS_DEFERRED = 'deferred';
   /**
    * Event name constants emitted during the Standalone 3DS (GPayments) flow.
    * Used internally by `GPaymentsService` and re-exported publicly as `CANVAS_3DS_EVENT`.
@@ -5407,6 +5459,11 @@
     DECOUPLED: 'chargeAuthDecoupled',
     /** Challenge required — issuer demands user interaction. Payload: `Canvas3dsAuthPayload`. */
     CHALLENGE: 'chargeAuthChallenge',
+    /**
+     * Two-step mode only: fingerprint done, SDK waiting for `Canvas3ds.authenticate()`. Emitted once, before any
+     * outcome event (`INFO` may precede it); never for a one-step charge. Payload: `Canvas3dsReadyPayload`.
+     */
+    READY: 'chargeAuthReady',
     /**
      * The challenge iframe fired its FIRST `load` after `chargeAuthChallenge` (the ACS page has painted),
      * or the `CHALLENGE_LOADED_FALLBACK_MS` safety fallback elapsed without one. Emitted exactly once per
@@ -5482,6 +5539,14 @@
       this.resultPollTimer = null;
       /** One-shot guard for the `chargeAuth` leg — the callback message may be delivered more than once. */
       this.authHandled = false;
+      /** Two-step mode: `charge_3ds_id` of the deferred callback message; `null` until it arrives (always for one-step). */
+      this.deferredCharge3dsId = null;
+      /** `authenticate()` latch; consumed when the deferred message arrives, reset only after a `/process` transport failure. */
+      this.authenticateRequested = false;
+      /** One `/process` call per widget instance (a transport failure allows one more `authenticate()`). */
+      this.authenticationStarted = false;
+      /** The single `/process` retry after a transport failure has been granted; the next failure is final. */
+      this.authenticationRetryUsed = false;
       this.iFrameEvent = new IFrameEvent(window);
     }
     return _createClass(GPaymentsService, [{
@@ -5567,7 +5632,16 @@
               });
             }
             _this2.removeIframes();
-            if (typeof data.process_status === 'string') {
+            if (data.process_status === PROCESS_STATUS_DEFERRED) {
+              // two-step: announce readiness; authenticate now only if `authenticate()` was already called
+              _this2.deferredCharge3dsId = data.charge_3ds_id;
+              _this2.eventEmitter.emit(GPAYMENTS_EVENT.READY, {
+                charge_3ds_id: data.charge_3ds_id
+              });
+              if (_this2.authenticateRequested) {
+                _this2.performAuthentication(data.charge_3ds_id);
+              }
+            } else if (typeof data.process_status === 'string') {
               // the API already ran the authentication inside the callback: no /process call needed
               _this2.handleAuthenticationOutcome({
                 status: data.process_status,
@@ -5605,6 +5679,55 @@
           }
         });
       }
+      /**
+       * Two-step mode: run the deferred authentication (`POST /standalone-3ds/process`). Never throws: runs now if
+       * the deferred message already arrived, otherwise as soon as it does; a no-op on one-step charges, repeated
+       * calls or after a terminal outcome. The outcome flows through the usual events.
+       */
+    }, {
+      key: "authenticate",
+      value: function authenticate() {
+        if (this.authenticateRequested) {
+          return;
+        }
+        this.authenticateRequested = true;
+        if (this.deferredCharge3dsId !== null) {
+          this.performAuthentication(this.deferredCharge3dsId);
+        }
+      }
+      /**
+       * Calls `/process` once per instance (reachable from both the deferred message and `authenticate()`). The
+       * response has the callback-outcome shape, so the challenge / decoupled / result legs are shared with
+       * one-step. A rejection surfaces as `error`, with the same error object shape as the one-step callback
+       * (`toOutcomeError`). An API answer (stale session, rejected authentication…) is terminal. The first transport
+       * failure is not: the AReq may have run with its response lost, so the latches are reset and the merchant may
+       * call `authenticate()` once more — `/process` is idempotent and replays the stored outcome. A failure of that
+       * retry, of any kind, is final.
+       */
+    }, {
+      key: "performAuthentication",
+      value: function performAuthentication(charge3dsId) {
+        var _this3 = this;
+        if (this.authenticationStarted) {
+          return;
+        }
+        this.authenticationStarted = true;
+        this.api.charge().standalone3dsProcess({
+          charge_3ds_id: charge3dsId
+        }).then(function (authenticationResult) {
+          return _this3.handleAuthenticationOutcome(authenticationResult, charge3dsId);
+        }, function (err) {
+          if (isTransportFailure(err) && !_this3.authenticationRetryUsed) {
+            _this3.authenticationRetryUsed = true;
+            _this3.authenticateRequested = false;
+            _this3.authenticationStarted = false;
+          } else {
+            _this3.resultRead = true;
+            _this3.finishChallengeLifecycle();
+          }
+          _this3.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this3.parseError(toOutcomeError(err), charge3dsId));
+        });
+      }
       /**
        * A message carries a processed outcome only when it has `process_status` AND comes from a trusted
        * origin. Used by the result leg: an untrusted `process_status` is never acted upon — the SDK falls
@@ -5658,18 +5781,18 @@
     }, {
       key: "startChallengeLifecycle",
       value: function startChallengeLifecycle(charge3dsId) {
-        var _this3 = this;
+        var _this4 = this;
         this.clearChallengeLoadedTimer();
         this.challengeLoadedEmitted = false;
         this.challengeCompletedEmitted = false;
         this.challengeLifecycleClosed = false;
         return function () {
           var _a;
-          if (_this3.challengeLifecycleClosed || _this3.challengeLoadedEmitted || !((_a = _this3.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
+          if (_this4.challengeLifecycleClosed || _this4.challengeLoadedEmitted || !((_a = _this4.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
             return;
           }
-          _this3.clearChallengeLoadedTimer();
-          _this3.emitChallengeLoaded(charge3dsId, 'load');
+          _this4.clearChallengeLoadedTimer();
+          _this4.emitChallengeLoaded(charge3dsId, 'load');
         };
       }
       /**
@@ -5679,17 +5802,17 @@
     }, {
       key: "armChallengeLoadedFallback",
       value: function armChallengeLoadedFallback(charge3dsId) {
-        var _this4 = this;
+        var _this5 = this;
         var _a;
         if (!((_a = this.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
           return;
         }
         this.challengeLoadedTimer = setTimeout(function () {
-          _this4.challengeLoadedTimer = null;
-          if (_this4.challengeLifecycleClosed || _this4.challengeLoadedEmitted) {
+          _this5.challengeLoadedTimer = null;
+          if (_this5.challengeLifecycleClosed || _this5.challengeLoadedEmitted) {
             return;
           }
-          _this4.emitChallengeLoaded(charge3dsId, 'timeout');
+          _this5.emitChallengeLoaded(charge3dsId, 'timeout');
         }, CHALLENGE_LOADED_FALLBACK_MS);
       }
     }, {
@@ -5766,7 +5889,7 @@
     }, {
       key: "processResult",
       value: function processResult(charge3dsId) {
-        var _this5 = this;
+        var _this6 = this;
         if (this.resultRead) {
           return;
         }
@@ -5774,15 +5897,15 @@
         this.finishChallengeLifecycle();
         this.api.charge().standalone3dsHandle().then(function (result) {
           var _a;
-          _this5.iFrameAuthorization.remove();
-          (_a = _this5.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.remove();
+          _this6.iFrameAuthorization.remove();
+          (_a = _this6.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.remove();
           if (result.status === PROCESS_STANDALONE_3DS_STATUS.SUCCESS) {
-            _this5.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this5.parseResultData(result, charge3dsId));
+            _this6.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this6.parseResultData(result, charge3dsId));
           } else {
-            _this5.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this5.parseResultData(result, charge3dsId));
+            _this6.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this6.parseResultData(result, charge3dsId));
           }
         }, function (err) {
-          _this5.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this5.parseError(err, charge3dsId));
+          _this6.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this6.parseError(err, charge3dsId));
         });
       }
       /** Final (post-challenge) outcome delivered by the API through the callback message. */
@@ -5842,43 +5965,43 @@
     }, {
       key: "doPolling",
       value: function doPolling(url, charge3dsId, intervalMs) {
-        var _this6 = this;
+        var _this7 = this;
         this.stopResultPolling();
         if (this.resultRead || this.challengeLifecycleClosed) {
           return;
         }
         var schedule = function schedule() {
-          _this6.resultPollTimer = setTimeout(function () {
-            _this6.resultPollTimer = null;
-            _this6.doPolling(url, charge3dsId, intervalMs);
+          _this7.resultPollTimer = setTimeout(function () {
+            _this7.resultPollTimer = null;
+            _this7.doPolling(url, charge3dsId, intervalMs);
           }, intervalMs);
         };
         this.externalAPI('GET', url).then(function (data) {
-          if (_this6.resultRead || _this6.challengeLifecycleClosed) {
+          if (_this7.resultRead || _this7.challengeLifecycleClosed) {
             return;
           }
           if (!data.event || data.event === 'AuthResultNotReady') {
             schedule();
           } else if (data.event === 'AuthResultReady') {
-            _this6.emitChallengeCompleted(charge3dsId, 'poll');
-            _this6.processResult(charge3dsId);
+            _this7.emitChallengeCompleted(charge3dsId, 'poll');
+            _this7.processResult(charge3dsId);
           } else {
             throw new Error('Event not supported');
           }
         })["catch"](function (err) {
           if (err instanceof ResultMonitorTransportError) {
-            if (!_this6.resultRead && !_this6.challengeLifecycleClosed) {
+            if (!_this7.resultRead && !_this7.challengeLifecycleClosed) {
               schedule();
             }
             return;
           }
-          _this6.finishChallengeLifecycle();
-          _this6.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this6.parseError(err, charge3dsId));
+          _this7.finishChallengeLifecycle();
+          _this7.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this7.parseError(err, charge3dsId));
         });
       }
       /**
-       * Branches on the authentication outcome delivered by the API through the callback message
-       * (`process_status` → `status`; same shape as the `/process` response body).
+       * Branches on the authentication outcome — delivered by the API through the callback message
+       * (`process_status` → `status`) or, in two-step mode, returned by `/process` (same shape).
        */
     }, {
       key: "handleAuthenticationOutcome",
@@ -5948,17 +6071,38 @@
         api.setEnv(this.env, this.alias);
         switch (tokenData.service_type) {
           case STANDALONE_3DS_GATEWAYS.GPAYMENTS:
-            new GPaymentsService(this.container, api, this.eventEmitter, this.getTrustedMessageOrigins(api)).load(tokenData, options.title);
+            this.gpaymentsService = new GPaymentsService(this.container, api, this.eventEmitter, this.getTrustedMessageOrigins(api));
+            this.gpaymentsService.load(tokenData, options.title);
             break;
         }
       }
       /**
-       * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
-       * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+       * Two-step mode: forwards `Canvas3ds.authenticate()` to the provider flow. Calling it before `load()` is an
+       * integration bug (nothing to authenticate yet): it emits `error` and is not remembered.
        */
+    }, {
+      key: "authenticate",
+      value: function authenticate(token) {
+        if (!this.gpaymentsService) {
+          this.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, {
+            charge_3ds_id: Standalone3dsService.readCharge3dsId(token),
+            error: {
+              message: 'Canvas3ds.authenticate() called before load()'
+            }
+          });
+          return;
+        }
+        this.gpaymentsService.authenticate();
+      }
+      /** `charge_3ds_id` from the standalone 3DS charge token, `undefined` when it cannot be decoded. */
     }, {
       key: "getTrustedMessageOrigins",
-      value: function getTrustedMessageOrigins(api) {
+      value:
+      /**
+       * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
+       * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+       */
+      function getTrustedMessageOrigins(api) {
         var origins = [api.getApiOrigin()];
         try {
           var widgetEnv = new Env(WIDGET_URL, this.env);
@@ -5975,6 +6119,13 @@
         this.env = env;
         this.alias = alias;
       }
+    }], [{
+      key: "readCharge3dsId",
+      value: function readCharge3dsId(token) {
+        var _a;
+        var parsedToken = AccessToken.validateJWT(token);
+        return parsedToken ? (_a = AccessToken.extractData(parsedToken.body)) === null || _a === void 0 ? void 0 : _a.charge_3ds_id : undefined;
+      }
     }]);
   }();
 
@@ -6141,6 +6292,7 @@
    * @param {string} AUTH_ERROR=chargeAuthReject
    * @param {string} DECOUPLED=chargeAuthDecoupled
    * @param {string} CHALLENGE=chargeAuthChallenge
+   * @param {string} READY=chargeAuthReady - two-step mode only: fingerprint done, waiting for `authenticate()`
    * @param {string} CHALLENGE_LOADED=chargeAuthChallengeLoaded - challenge iframe painted (first `load`, or 2.5 s fallback); reveal your challenge UI here
    * @param {string} CHALLENGE_COMPLETED=chargeAuthChallengeCompleted - the shopper finished the challenge (issuer result delivered to the 3DS Server); cover the challenge iframe with your own loader until the terminal event
    * @param {string} INFO=chargeAuthInfo
@@ -6270,6 +6422,39 @@
           });
         }
       }
+      /**
+       * Two-step mode only (`_3ds.authentication_flow: 'two_step'`): runs the authentication the API deferred after the
+       * fingerprint. Call it when the shopper confirms (e.g. presses "Pay"); the outcome arrives through the
+       * usual events (`chargeAuthChallenge`, `chargeAuthSuccess`, `chargeAuthReject`, `error`).
+       *
+       * Never throws. After `chargeAuthReady` the authentication starts at once; before it, the call is
+       * remembered and runs as soon as the fingerprint completes. One-step charges, repeated calls and calls after
+       * a terminal outcome are no-ops. For inbuilt 3DS (`html` / `url`) tokens it is a silent no-op: no event is
+       * emitted at all, so do not wait for `error` there. Calling it before `load()` is an integration error: it emits `error` and
+       * is not remembered. If `/process` could not be reached (`error` with `error_code` `service_unreachable` /
+       * `aborted`), `authenticate()` may be called once more; any other `error`, and any failure of that retry,
+       * is final.
+       * No client-side deadline: a stale 3DS Server session surfaces as `error` / `chargeAuthReject`.
+       *
+       * @example
+       * const widget = new Canvas3ds('#widget', token); // charge created with _3ds.authentication_flow: 'two_step'
+       * widget.on('chargeAuthReady', () => payButton.disabled = false);
+       * widget.on('chargeAuthChallenge', () => showChallengeModal());
+       * widget.on('chargeAuthSuccess', (data) => completePayment(data.charge_3ds_id));
+       * widget.on('chargeAuthReject', () => showDeclined());
+       * widget.on('error', () => showError());
+       * widget.load(); // fingerprint runs while the shopper reviews the order
+       *
+       * payButton.addEventListener('click', () => widget.authenticate());
+       */
+    }, {
+      key: "authenticate",
+      value: function authenticate() {
+        if (this.token.format !== TOKEN_FORMAT$2.STANDALONE_3DS) {
+          return;
+        }
+        this.standalone3dsService.authenticate(this.token.content);
+      }
       /**
        * Using this method you can hide widget after load
        * @param {boolean} [saveSize=false] - using this param you can save iframe's size
@@ -45931,14 +46116,17 @@
   var slzh = function (d, b) { return b + 30 + b2(d, b + 26) + b2(d, b + 28); };
   // read zip header
   var zh = function (d, b, z) {
-      var fnl = b2(d, b + 28), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl, bs = b4(d, b + 20);
-      var _a = z && bs == 4294967295 ? z64e(d, es) : [bs, b4(d, b + 24), b4(d, b + 42)], sc = _a[0], su = _a[1], off = _a[2];
-      return [b2(d, b + 10), sc, su, fn, es + b2(d, b + 30) + b2(d, b + 32), off];
+      var fnl = b2(d, b + 28), efl = b2(d, b + 30), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl, bs = b4(d, b + 20);
+      var _a = z && bs == 4294967295 ? z64e(d, es, efl) : [bs, b4(d, b + 24), b4(d, b + 42)], sc = _a[0], su = _a[1], off = _a[2];
+      return [b2(d, b + 10), sc, su, fn, es + efl + b2(d, b + 32), off];
   };
   // read zip64 extra field
-  var z64e = function (d, b) {
-      for (; b2(d, b) != 1; b += 4 + b2(d, b + 2))
-          ;
+  var z64e = function (d, b, l) {
+      var e = b + l;
+      for (; b2(d, b) != 1; b += 4 + b2(d, b + 2)) {
+          if (b + 4 > e)
+              err(13);
+      }
       return [b8(d, b + 12), b8(d, b + 4), b8(d, b + 20)];
   };
   // extra field length
@@ -46541,7 +46729,7 @@
                           var sc_1 = b4(buf, i + 18), su_1 = b4(buf, i + 22);
                           var fn_1 = strFromU8(buf.subarray(i + 30, i += 30 + fnl), !u);
                           if (sc_1 == 4294967295) {
-                              _a = dd ? [-2] : z64e(buf, i), sc_1 = _a[0], su_1 = _a[1];
+                              _a = dd ? [-2] : z64e(buf, i, es), sc_1 = _a[0], su_1 = _a[1];
                           }
                           else if (dd)
                               sc_1 = -1;