@paydock/client-sdk 1.147.0 → 1.148.0

package/bundles/index.mjs

@@ -1863,7 +1863,7 @@ SDK.headerKeys = Object.freeze({
   version: 'x-sdk-version',
   type: 'x-sdk-type'
 });
-SDK._version = 'v1.147.0';
+SDK._version = 'v1.148.0';
 
 var ACCESS_HEADER_NAME = {
   accessToken: 'x-access-token',
@@ -5012,6 +5012,7 @@ var Api = /*#__PURE__*/function (_ApiBase) {
 
 var WALLET_CAPTURE_LINK = '/v1/charges/wallet/capture';
 var WALLET_CALLBACK_LINK = '/v1/charges/wallet/callback';
+var STANDALONE_3DS_PROCESS_LINK = '/v1/charges/standalone-3ds/process';
 var STANDALONE_3DS_HANDLE_LINK = '/v1/charges/standalone-3ds/handle';
 var ApiChargeInternal = /*#__PURE__*/function () {
   function ApiChargeInternal(api) {
@@ -5028,6 +5029,12 @@ var ApiChargeInternal = /*#__PURE__*/function () {
     value: function walletCallback(payload) {
       return this.api.getClientPromise('POST', WALLET_CALLBACK_LINK).send(payload);
     }
+    /** Two-step mode: runs the deferred Standalone 3DS authentication (AReq). Charge-token auth, like `standalone3dsHandle`. */
+  }, {
+    key: "standalone3dsProcess",
+    value: function standalone3dsProcess(payload) {
+      return this.api.getClientPromise('POST', STANDALONE_3DS_PROCESS_LINK).send(payload);
+    }
   }, {
     key: "standalone3dsHandle",
     value: function standalone3dsHandle() {
@@ -5388,6 +5395,51 @@ var IFRAME_STATUS;
   IFRAME_STATUS["TIMEOUT"] = "AuthTimedOut";
   IFRAME_STATUS["INVALID"] = "invalid_event";
 })(IFRAME_STATUS || (IFRAME_STATUS = {}));
+/**
+ * Maps a `/process` rejection onto the error object the one-step callback delivers for the same outcome
+ * (`{ error_code, error_description, gateway_specific_description, process_error_code }`), so `error`
+ * carries the same payload in both flows. Absent fields are left out.
+ */
+function toOutcomeError(err) {
+  var _a, _b;
+  if (err instanceof Error) {
+    // no API envelope to map (the body was not the API's JSON): report it as unreachable, so the
+    // merchant can tell this retryable case apart from a final API answer by `error_code` alone
+    return {
+      error_code: ERROR_CAUSE.SERVICE_UNREACHABLE,
+      error_description: 'Network request failed: the service did not answer with a valid response.'
+    };
+  }
+  var apiError = err !== null && err !== void 0 ? err : {};
+  var gateway = (_b = (_a = apiError.details) === null || _a === void 0 ? void 0 : _a.messages) === null || _b === void 0 ? void 0 : _b[0];
+  var fields = {
+    error_code: apiError.code,
+    error_description: apiError.message,
+    gateway_specific_description: gateway === null || gateway === void 0 ? void 0 : gateway.gateway_specific_description,
+    process_error_code: gateway === null || gateway === void 0 ? void 0 : gateway.gateway_specific_code
+  };
+  var outcomeError = {};
+  for (var _i = 0, _Object$keys = Object.keys(fields); _i < _Object$keys.length; _i++) {
+    var key = _Object$keys[_i];
+    if (fields[key]) {
+      outcomeError[key] = fields[key];
+    }
+  }
+  return outcomeError;
+}
+/**
+ * `true` when `/process` produced no API answer: the request never got a response (network, timeout, abort)
+ * or the response body was not the API's JSON (e.g. an HTML page from a proxy in between).
+ */
+function isTransportFailure(err) {
+  if (err instanceof Error) {
+    return true;
+  }
+  var code = err === null || err === void 0 ? void 0 : err.code;
+  return code === ERROR_CAUSE.SERVICE_UNREACHABLE || code === ERROR_CAUSE.ABORTED;
+}
+/** Callback `process_status` of a two-step charge: fingerprint done, authentication not started. */
+var PROCESS_STATUS_DEFERRED = 'deferred';
 /**
  * Event name constants emitted during the Standalone 3DS (GPayments) flow.
  * Used internally by `GPaymentsService` and re-exported publicly as `CANVAS_3DS_EVENT`.
@@ -5401,6 +5453,11 @@ var GPAYMENTS_EVENT = {
   DECOUPLED: 'chargeAuthDecoupled',
   /** Challenge required — issuer demands user interaction. Payload: `Canvas3dsAuthPayload`. */
   CHALLENGE: 'chargeAuthChallenge',
+  /**
+   * Two-step mode only: fingerprint done, SDK waiting for `Canvas3ds.authenticate()`. Emitted once, before any
+   * outcome event (`INFO` may precede it); never for a one-step charge. Payload: `Canvas3dsReadyPayload`.
+   */
+  READY: 'chargeAuthReady',
   /**
    * The challenge iframe fired its FIRST `load` after `chargeAuthChallenge` (the ACS page has painted),
    * or the `CHALLENGE_LOADED_FALLBACK_MS` safety fallback elapsed without one. Emitted exactly once per
@@ -5476,6 +5533,14 @@ var GPaymentsService = /*#__PURE__*/function () {
     this.resultPollTimer = null;
     /** One-shot guard for the `chargeAuth` leg — the callback message may be delivered more than once. */
     this.authHandled = false;
+    /** Two-step mode: `charge_3ds_id` of the deferred callback message; `null` until it arrives (always for one-step). */
+    this.deferredCharge3dsId = null;
+    /** `authenticate()` latch; consumed when the deferred message arrives, reset only after a `/process` transport failure. */
+    this.authenticateRequested = false;
+    /** One `/process` call per widget instance (a transport failure allows one more `authenticate()`). */
+    this.authenticationStarted = false;
+    /** The single `/process` retry after a transport failure has been granted; the next failure is final. */
+    this.authenticationRetryUsed = false;
     this.iFrameEvent = new IFrameEvent(window);
   }
   return _createClass(GPaymentsService, [{
@@ -5561,7 +5626,16 @@ var GPaymentsService = /*#__PURE__*/function () {
             });
           }
           _this2.removeIframes();
-          if (typeof data.process_status === 'string') {
+          if (data.process_status === PROCESS_STATUS_DEFERRED) {
+            // two-step: announce readiness; authenticate now only if `authenticate()` was already called
+            _this2.deferredCharge3dsId = data.charge_3ds_id;
+            _this2.eventEmitter.emit(GPAYMENTS_EVENT.READY, {
+              charge_3ds_id: data.charge_3ds_id
+            });
+            if (_this2.authenticateRequested) {
+              _this2.performAuthentication(data.charge_3ds_id);
+            }
+          } else if (typeof data.process_status === 'string') {
             // the API already ran the authentication inside the callback: no /process call needed
             _this2.handleAuthenticationOutcome({
               status: data.process_status,
@@ -5599,6 +5673,55 @@ var GPaymentsService = /*#__PURE__*/function () {
         }
       });
     }
+    /**
+     * Two-step mode: run the deferred authentication (`POST /standalone-3ds/process`). Never throws: runs now if
+     * the deferred message already arrived, otherwise as soon as it does; a no-op on one-step charges, repeated
+     * calls or after a terminal outcome. The outcome flows through the usual events.
+     */
+  }, {
+    key: "authenticate",
+    value: function authenticate() {
+      if (this.authenticateRequested) {
+        return;
+      }
+      this.authenticateRequested = true;
+      if (this.deferredCharge3dsId !== null) {
+        this.performAuthentication(this.deferredCharge3dsId);
+      }
+    }
+    /**
+     * Calls `/process` once per instance (reachable from both the deferred message and `authenticate()`). The
+     * response has the callback-outcome shape, so the challenge / decoupled / result legs are shared with
+     * one-step. A rejection surfaces as `error`, with the same error object shape as the one-step callback
+     * (`toOutcomeError`). An API answer (stale session, rejected authentication…) is terminal. The first transport
+     * failure is not: the AReq may have run with its response lost, so the latches are reset and the merchant may
+     * call `authenticate()` once more — `/process` is idempotent and replays the stored outcome. A failure of that
+     * retry, of any kind, is final.
+     */
+  }, {
+    key: "performAuthentication",
+    value: function performAuthentication(charge3dsId) {
+      var _this3 = this;
+      if (this.authenticationStarted) {
+        return;
+      }
+      this.authenticationStarted = true;
+      this.api.charge().standalone3dsProcess({
+        charge_3ds_id: charge3dsId
+      }).then(function (authenticationResult) {
+        return _this3.handleAuthenticationOutcome(authenticationResult, charge3dsId);
+      }, function (err) {
+        if (isTransportFailure(err) && !_this3.authenticationRetryUsed) {
+          _this3.authenticationRetryUsed = true;
+          _this3.authenticateRequested = false;
+          _this3.authenticationStarted = false;
+        } else {
+          _this3.resultRead = true;
+          _this3.finishChallengeLifecycle();
+        }
+        _this3.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this3.parseError(toOutcomeError(err), charge3dsId));
+      });
+    }
     /**
      * A message carries a processed outcome only when it has `process_status` AND comes from a trusted
      * origin. Used by the result leg: an untrusted `process_status` is never acted upon — the SDK falls
@@ -5652,18 +5775,18 @@ var GPaymentsService = /*#__PURE__*/function () {
   }, {
     key: "startChallengeLifecycle",
     value: function startChallengeLifecycle(charge3dsId) {
-      var _this3 = this;
+      var _this4 = this;
       this.clearChallengeLoadedTimer();
       this.challengeLoadedEmitted = false;
       this.challengeCompletedEmitted = false;
       this.challengeLifecycleClosed = false;
       return function () {
         var _a;
-        if (_this3.challengeLifecycleClosed || _this3.challengeLoadedEmitted || !((_a = _this3.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
+        if (_this4.challengeLifecycleClosed || _this4.challengeLoadedEmitted || !((_a = _this4.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
           return;
         }
-        _this3.clearChallengeLoadedTimer();
-        _this3.emitChallengeLoaded(charge3dsId, 'load');
+        _this4.clearChallengeLoadedTimer();
+        _this4.emitChallengeLoaded(charge3dsId, 'load');
       };
     }
     /**
@@ -5673,17 +5796,17 @@ var GPaymentsService = /*#__PURE__*/function () {
   }, {
     key: "armChallengeLoadedFallback",
     value: function armChallengeLoadedFallback(charge3dsId) {
-      var _this4 = this;
+      var _this5 = this;
       var _a;
       if (!((_a = this.iFrameAuthorization) === null || _a === void 0 ? void 0 : _a.isExist())) {
         return;
       }
       this.challengeLoadedTimer = setTimeout(function () {
-        _this4.challengeLoadedTimer = null;
-        if (_this4.challengeLifecycleClosed || _this4.challengeLoadedEmitted) {
+        _this5.challengeLoadedTimer = null;
+        if (_this5.challengeLifecycleClosed || _this5.challengeLoadedEmitted) {
           return;
         }
-        _this4.emitChallengeLoaded(charge3dsId, 'timeout');
+        _this5.emitChallengeLoaded(charge3dsId, 'timeout');
       }, CHALLENGE_LOADED_FALLBACK_MS);
     }
   }, {
@@ -5760,7 +5883,7 @@ var GPaymentsService = /*#__PURE__*/function () {
   }, {
     key: "processResult",
     value: function processResult(charge3dsId) {
-      var _this5 = this;
+      var _this6 = this;
       if (this.resultRead) {
         return;
       }
@@ -5768,15 +5891,15 @@ var GPaymentsService = /*#__PURE__*/function () {
       this.finishChallengeLifecycle();
       this.api.charge().standalone3dsHandle().then(function (result) {
         var _a;
-        _this5.iFrameAuthorization.remove();
-        (_a = _this5.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.remove();
+        _this6.iFrameAuthorization.remove();
+        (_a = _this6.iFrameSecondaryUrl) === null || _a === void 0 ? void 0 : _a.remove();
         if (result.status === PROCESS_STANDALONE_3DS_STATUS.SUCCESS) {
-          _this5.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this5.parseResultData(result, charge3dsId));
+          _this6.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_SUCCESS, _this6.parseResultData(result, charge3dsId));
         } else {
-          _this5.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this5.parseResultData(result, charge3dsId));
+          _this6.eventEmitter.emit(GPAYMENTS_EVENT.AUTH_ERROR, _this6.parseResultData(result, charge3dsId));
         }
       }, function (err) {
-        _this5.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this5.parseError(err, charge3dsId));
+        _this6.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this6.parseError(err, charge3dsId));
       });
     }
     /** Final (post-challenge) outcome delivered by the API through the callback message. */
@@ -5836,43 +5959,43 @@ var GPaymentsService = /*#__PURE__*/function () {
   }, {
     key: "doPolling",
     value: function doPolling(url, charge3dsId, intervalMs) {
-      var _this6 = this;
+      var _this7 = this;
       this.stopResultPolling();
       if (this.resultRead || this.challengeLifecycleClosed) {
         return;
       }
       var schedule = function schedule() {
-        _this6.resultPollTimer = setTimeout(function () {
-          _this6.resultPollTimer = null;
-          _this6.doPolling(url, charge3dsId, intervalMs);
+        _this7.resultPollTimer = setTimeout(function () {
+          _this7.resultPollTimer = null;
+          _this7.doPolling(url, charge3dsId, intervalMs);
         }, intervalMs);
       };
       this.externalAPI('GET', url).then(function (data) {
-        if (_this6.resultRead || _this6.challengeLifecycleClosed) {
+        if (_this7.resultRead || _this7.challengeLifecycleClosed) {
           return;
         }
         if (!data.event || data.event === 'AuthResultNotReady') {
           schedule();
         } else if (data.event === 'AuthResultReady') {
-          _this6.emitChallengeCompleted(charge3dsId, 'poll');
-          _this6.processResult(charge3dsId);
+          _this7.emitChallengeCompleted(charge3dsId, 'poll');
+          _this7.processResult(charge3dsId);
         } else {
           throw new Error('Event not supported');
         }
       })["catch"](function (err) {
         if (err instanceof ResultMonitorTransportError) {
-          if (!_this6.resultRead && !_this6.challengeLifecycleClosed) {
+          if (!_this7.resultRead && !_this7.challengeLifecycleClosed) {
             schedule();
           }
           return;
         }
-        _this6.finishChallengeLifecycle();
-        _this6.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this6.parseError(err, charge3dsId));
+        _this7.finishChallengeLifecycle();
+        _this7.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, _this7.parseError(err, charge3dsId));
       });
     }
     /**
-     * Branches on the authentication outcome delivered by the API through the callback message
-     * (`process_status` → `status`; same shape as the `/process` response body).
+     * Branches on the authentication outcome — delivered by the API through the callback message
+     * (`process_status` → `status`) or, in two-step mode, returned by `/process` (same shape).
      */
   }, {
     key: "handleAuthenticationOutcome",
@@ -5942,17 +6065,38 @@ var Standalone3dsService = /*#__PURE__*/function () {
       api.setEnv(this.env, this.alias);
       switch (tokenData.service_type) {
         case STANDALONE_3DS_GATEWAYS.GPAYMENTS:
-          new GPaymentsService(this.container, api, this.eventEmitter, this.getTrustedMessageOrigins(api)).load(tokenData, options.title);
+          this.gpaymentsService = new GPaymentsService(this.container, api, this.eventEmitter, this.getTrustedMessageOrigins(api));
+          this.gpaymentsService.load(tokenData, options.title);
           break;
       }
     }
     /**
-     * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
-     * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+     * Two-step mode: forwards `Canvas3ds.authenticate()` to the provider flow. Calling it before `load()` is an
+     * integration bug (nothing to authenticate yet): it emits `error` and is not remembered.
      */
+  }, {
+    key: "authenticate",
+    value: function authenticate(token) {
+      if (!this.gpaymentsService) {
+        this.eventEmitter.emit(GPAYMENTS_EVENT.ERROR, {
+          charge_3ds_id: Standalone3dsService.readCharge3dsId(token),
+          error: {
+            message: 'Canvas3ds.authenticate() called before load()'
+          }
+        });
+        return;
+      }
+      this.gpaymentsService.authenticate();
+    }
+    /** `charge_3ds_id` from the standalone 3DS charge token, `undefined` when it cannot be decoded. */
   }, {
     key: "getTrustedMessageOrigins",
-    value: function getTrustedMessageOrigins(api) {
+    value:
+    /**
+     * Origins allowed to deliver a processed 3DS outcome to the page via postMessage: the Paydock API
+     * (inline callback page) and the Paydock widget (remote-app landing page), for the current env/alias.
+     */
+    function getTrustedMessageOrigins(api) {
       var origins = [api.getApiOrigin()];
       try {
         var widgetEnv = new Env(WIDGET_URL, this.env);
@@ -5969,6 +6113,13 @@ var Standalone3dsService = /*#__PURE__*/function () {
       this.env = env;
       this.alias = alias;
     }
+  }], [{
+    key: "readCharge3dsId",
+    value: function readCharge3dsId(token) {
+      var _a;
+      var parsedToken = AccessToken.validateJWT(token);
+      return parsedToken ? (_a = AccessToken.extractData(parsedToken.body)) === null || _a === void 0 ? void 0 : _a.charge_3ds_id : undefined;
+    }
   }]);
 }();
 
@@ -6135,6 +6286,7 @@ var TOKEN_FORMAT$2;
  * @param {string} AUTH_ERROR=chargeAuthReject
  * @param {string} DECOUPLED=chargeAuthDecoupled
  * @param {string} CHALLENGE=chargeAuthChallenge
+ * @param {string} READY=chargeAuthReady - two-step mode only: fingerprint done, waiting for `authenticate()`
  * @param {string} CHALLENGE_LOADED=chargeAuthChallengeLoaded - challenge iframe painted (first `load`, or 2.5 s fallback); reveal your challenge UI here
  * @param {string} CHALLENGE_COMPLETED=chargeAuthChallengeCompleted - the shopper finished the challenge (issuer result delivered to the 3DS Server); cover the challenge iframe with your own loader until the terminal event
  * @param {string} INFO=chargeAuthInfo
@@ -6264,6 +6416,39 @@ var Canvas3ds = /*#__PURE__*/function () {
         });
       }
     }
+    /**
+     * Two-step mode only (`_3ds.authentication_flow: 'two_step'`): runs the authentication the API deferred after the
+     * fingerprint. Call it when the shopper confirms (e.g. presses "Pay"); the outcome arrives through the
+     * usual events (`chargeAuthChallenge`, `chargeAuthSuccess`, `chargeAuthReject`, `error`).
+     *
+     * Never throws. After `chargeAuthReady` the authentication starts at once; before it, the call is
+     * remembered and runs as soon as the fingerprint completes. One-step charges, repeated calls and calls after
+     * a terminal outcome are no-ops. For inbuilt 3DS (`html` / `url`) tokens it is a silent no-op: no event is
+     * emitted at all, so do not wait for `error` there. Calling it before `load()` is an integration error: it emits `error` and
+     * is not remembered. If `/process` could not be reached (`error` with `error_code` `service_unreachable` /
+     * `aborted`), `authenticate()` may be called once more; any other `error`, and any failure of that retry,
+     * is final.
+     * No client-side deadline: a stale 3DS Server session surfaces as `error` / `chargeAuthReject`.
+     *
+     * @example
+     * const widget = new Canvas3ds('#widget', token); // charge created with _3ds.authentication_flow: 'two_step'
+     * widget.on('chargeAuthReady', () => payButton.disabled = false);
+     * widget.on('chargeAuthChallenge', () => showChallengeModal());
+     * widget.on('chargeAuthSuccess', (data) => completePayment(data.charge_3ds_id));
+     * widget.on('chargeAuthReject', () => showDeclined());
+     * widget.on('error', () => showError());
+     * widget.load(); // fingerprint runs while the shopper reviews the order
+     *
+     * payButton.addEventListener('click', () => widget.authenticate());
+     */
+  }, {
+    key: "authenticate",
+    value: function authenticate() {
+      if (this.token.format !== TOKEN_FORMAT$2.STANDALONE_3DS) {
+        return;
+      }
+      this.standalone3dsService.authenticate(this.token.content);
+    }
     /**
      * Using this method you can hide widget after load
      * @param {boolean} [saveSize=false] - using this param you can save iframe's size
@@ -45925,14 +46110,17 @@ var dbf = function (l) { return l == 1 ? 3 : l < 6 ? 2 : l == 9 ? 1 : 0; };
 var slzh = function (d, b) { return b + 30 + b2(d, b + 26) + b2(d, b + 28); };
 // read zip header
 var zh = function (d, b, z) {
-    var fnl = b2(d, b + 28), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl, bs = b4(d, b + 20);
-    var _a = z && bs == 4294967295 ? z64e(d, es) : [bs, b4(d, b + 24), b4(d, b + 42)], sc = _a[0], su = _a[1], off = _a[2];
-    return [b2(d, b + 10), sc, su, fn, es + b2(d, b + 30) + b2(d, b + 32), off];
+    var fnl = b2(d, b + 28), efl = b2(d, b + 30), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl, bs = b4(d, b + 20);
+    var _a = z && bs == 4294967295 ? z64e(d, es, efl) : [bs, b4(d, b + 24), b4(d, b + 42)], sc = _a[0], su = _a[1], off = _a[2];
+    return [b2(d, b + 10), sc, su, fn, es + efl + b2(d, b + 32), off];
 };
 // read zip64 extra field
-var z64e = function (d, b) {
-    for (; b2(d, b) != 1; b += 4 + b2(d, b + 2))
-        ;
+var z64e = function (d, b, l) {
+    var e = b + l;
+    for (; b2(d, b) != 1; b += 4 + b2(d, b + 2)) {
+        if (b + 4 > e)
+            err(13);
+    }
     return [b8(d, b + 12), b8(d, b + 4), b8(d, b + 20)];
 };
 // extra field length
@@ -46535,7 +46723,7 @@ var Unzip = /*#__PURE__*/ (function () {
                         var sc_1 = b4(buf, i + 18), su_1 = b4(buf, i + 22);
                         var fn_1 = strFromU8(buf.subarray(i + 30, i += 30 + fnl), !u);
                         if (sc_1 == 4294967295) {
-                            _a = dd ? [-2] : z64e(buf, i), sc_1 = _a[0], su_1 = _a[1];
+                            _a = dd ? [-2] : z64e(buf, i, es), sc_1 = _a[0], su_1 = _a[1];
                         }
                         else if (dd)
                             sc_1 = -1;