@agent-cards/checkout 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Approve Spreedly's native hosted-card checkout with `prepare({ psp: 'spreedly', environment: 'shared' })`. The Vault tokenizes the selected card over the encrypted relay and returns the native response. Matching API, Vault, relay and database releases are required; tokenization alone does not confirm payment. Saved-card updates and other Spreedly flows remain unsupported.
+
 - Identify hosted, regional, and versioned processor variants seen on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. The Tranzila terminal-root page, the Authorize.Net hosted payment form, and Worldpay hosted payment pages identify their processor and return `unknown` with `processor_variant_unverified`. The catalog is `2026-09-15.1`; issue native profiles against it.
 
 - Report a sole script-only candidate as `psp` only when the observation is complete. On a partial scan the script stays in `candidates` as `undetermined`, so a co-loaded SDK is never presented as the selected processor.

package/PREFLIGHT.md

@@ -171,6 +171,7 @@ The catalog includes reviewed discovery rules and direct SDK implementation capa
 | Mollie | `token` |
 | Paysafe | `token` |
 | Recurly | `token` |
+| Spreedly | `token` |
 | Moneris | `token` |
 | Bambora | `token` |
 | Global Payments | `token` |

package/README.md

@@ -84,8 +84,8 @@ Agentcard derives it.
 Then let your agent click "Pay" like it always does. `attachToCdp` pauses the
 request for approval and resumes it only while the merchant request remains
 live. Merchant timeouts still apply: Square's observed tokenization deadline
-is about 10 seconds, and Braintree's native request timeout is 60 seconds, including approval and token handoff. For human approval, use
-`controller.prepare()` before the first Pay action as shown below.
+is about 10 seconds, Braintree's native request timeout is 60 seconds, and Adyen Web's own request timeout abandons its Sessions payment call 60 seconds after Pay (observed on Adyen Web 6.41 and 6.44), each including approval and handoff. These are the processors' limits, not ones the SDK enforces: the SDK's own authorization wait stays 15 minutes. For human approval, use
+`controller.prepare()` before the first Pay action as shown below. Adyen is not on the `prepare()` list yet, so an Adyen approval has to land within Adyen Web's minute.
 
 Playwright:
 
@@ -136,7 +136,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Checkout.com | supported |
 | Mercado Pago | Card tokenization and prepared checkout are implemented. Guest Checkout Pro in Mexico also corrects the issuer for one native card association when the selected card has the same brand and type. One live MXN 40 Lotería Chida purchase with published SDK 0.10.0 completed automatically through Pay; the merchant confirmed paid status and PDF fulfillment. The historical SDK result remains unknown because the private receipt adapter rejected a relative download URL; a separate read with the corrected adapter confirms that same paid receipt. Independent processor capture/settlement and other country or integration paths remain unverified. |
 | VGS Collect (Very Good Security; Wolt) | not supported: VGS's proxy aliases only submissions from its own iframe, so a replay from the cardholder's device is refused by the merchant (verified on Wolt, 2026-09-03). Not recognized, so the agent's browser is not paused there |
-| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it |
+| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow only: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts; a merchant that posts the encrypted fields to its own server is not recognized, so nothing pauses there. Approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare()` is not available for Adyen yet |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 
 The recognizer list is fetched from the API at runtime (`vault.syncRegistry()`),
@@ -514,8 +514,19 @@ await page.getByRole('button', { name: 'Pay', exact: true }).click();
 | Bambora | `shared` | `/scripts/tokenization/tokens` on `api.bam.shift4api.net` or `api.na.bambora.com` |
 | Mercado Pago | `shared` | `api.mercadopago.com/v1/card_tokens` with a fresh card body |
 | Recurly | `shared` | Form-encoded POST to `/js/v1/token` on `api.recurly.com` or `api.eu.recurly.com` |
+| Spreedly | `shared` | Native iframe JSON POST to `/v1/payment_methods/restricted.json` on `core.spreedly.com` |
 
-Use `environment: 'shared'` for Bambora, Mercado Pago and Recurly because the same endpoint serves test and live requests. Agentcard cannot establish the processor's test mode from that URL or a credential prefix. Configure test mode through the merchant's processor account when testing. Agentcard's own `sandbox` flag remains separate. Prepared Worldpay, Bambora, Mercado Pago and Recurly requests reject saved-card and recurring request bodies; a refused request retires the local preparation. Reconcile any existing merchant attempt before creating a new attachment.
+Use `environment: 'shared'` for Bambora, Mercado Pago, Recurly and Spreedly because the same endpoint serves test and live requests. Agentcard cannot establish the processor's test mode from that URL or a credential prefix. Configure test mode through the merchant's processor account when testing. Agentcard's own `sandbox` flag remains separate. Prepared Worldpay, Bambora, Mercado Pago and Recurly requests reject saved-card and recurring request bodies; a refused request retires the local preparation. Reconcile any existing merchant attempt before creating a new attachment.
+
+Prepare a Spreedly checkout before submitting the merchant's card form:
+
+```ts
+await controller.prepare({ psp: 'spreedly', environment: 'shared' });
+```
+
+After approval, submit the form once. The Vault replaces the card fields on your device and sends the native request through an encrypted connection to Spreedly. The merchant's environment and signed session stay unchanged. The API, Vault, relay and preparation migration must support Spreedly before you use this flow; the API refuses preparations while its relay rollout flag is disabled.
+
+Initial coverage includes the hosted iframe's new-card request. Saved-card CVV updates, Express, wallets, bank accounts and gateway purchase APIs require separate support. A returned card token does not confirm payment; wait for the merchant's result before reporting success. Autopilot is unavailable for Spreedly.
 
 Prepare Recurly before clicking the merchant's payment button:
 

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i] }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i] }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/preflight-capabilities.generated.d.ts

@@ -3,6 +3,69 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
     readonly scope: "processor_integration";
     readonly integration: "direct_sdk";
     readonly processors: readonly [{
+        readonly psp: "spreedly";
+        readonly status: "supported";
+        readonly mode: "token";
+        readonly operations: readonly [{
+            readonly id: "spreedly.card_request";
+            readonly effect: "processor_specific_card_request";
+            readonly amount_binding: "unestablished";
+            readonly psp: "spreedly";
+            readonly version: 1;
+            readonly mode: "token";
+            readonly autopilot_eligible: false;
+            readonly requires: "reviewed_final_payment_and_continuation_evidence";
+        }];
+        readonly scenarios: {
+            readonly one_time: {
+                readonly status: "supported";
+                readonly reason: "card_request_adapter_implemented";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
+            };
+            readonly save_card: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
+            };
+            readonly subscription_initial: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
+            };
+            readonly subscription_renewal: {
+                readonly status: "outside_vault";
+                readonly reason: "renewal_managed_by_merchant";
+                readonly requirements: readonly ["verify_merchant_billing"];
+            };
+        };
+        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.", "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.", "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."];
+        readonly unsupported_variants: readonly [{
+            readonly variant: "general_javascript_api";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "The general payment_methods.json endpoint is outside the reviewed native iframe path.";
+        }, {
+            readonly variant: "saved_card_or_recache";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Stored tokens and CVV-only recache requests are outside new-card tokenization.";
+        }, {
+            readonly variant: "click_to_pay_or_bank_account";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Click to Pay and bank-account request shapes require separate validation.";
+        }, {
+            readonly variant: "gateway_purchase_or_distribution";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Gateway transactions and payment-method distribution are outside the card tokenization adapter.";
+        }];
+        readonly processor_amount: "none";
+        readonly challenge_surface: "merchant_browser";
+        readonly merchant_confirmation_required: true;
+        readonly live_validation: "not_established_by_catalog";
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/spreedly.js", "../checkout/src/prepared-processor.ts"];
+    }, {
         readonly psp: "shopify";
         readonly status: "supported";
         readonly mode: "token";

package/dist/preflight-capabilities.generated.js

@@ -5,6 +5,103 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
     "scope": "processor_integration",
     "integration": "direct_sdk",
     "processors": [
+        {
+            "psp": "spreedly",
+            "status": "supported",
+            "mode": "token",
+            "operations": [
+                {
+                    "id": "spreedly.card_request",
+                    "effect": "processor_specific_card_request",
+                    "amount_binding": "unestablished",
+                    "psp": "spreedly",
+                    "version": 1,
+                    "mode": "token",
+                    "autopilot_eligible": false,
+                    "requires": "reviewed_final_payment_and_continuation_evidence"
+                }
+            ],
+            "scenarios": {
+                "one_time": {
+                    "status": "supported",
+                    "reason": "card_request_adapter_implemented",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation"
+                    ]
+                },
+                "save_card": {
+                    "status": "conditional",
+                    "reason": "merchant_card_storage_and_consent_required",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation",
+                        "stored_card_consent",
+                        "merchant_card_saved"
+                    ]
+                },
+                "subscription_initial": {
+                    "status": "conditional",
+                    "reason": "merchant_card_storage_and_consent_required",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation",
+                        "stored_card_consent",
+                        "merchant_subscription_confirmation"
+                    ]
+                },
+                "subscription_renewal": {
+                    "status": "outside_vault",
+                    "reason": "renewal_managed_by_merchant",
+                    "requirements": [
+                        "verify_merchant_billing"
+                    ]
+                }
+            },
+            "limitations": [
+                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
+                "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.",
+                "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.",
+                "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."
+            ],
+            "unsupported_variants": [
+                {
+                    "variant": "general_javascript_api",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "The general payment_methods.json endpoint is outside the reviewed native iframe path."
+                },
+                {
+                    "variant": "saved_card_or_recache",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Stored tokens and CVV-only recache requests are outside new-card tokenization."
+                },
+                {
+                    "variant": "click_to_pay_or_bank_account",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Click to Pay and bank-account request shapes require separate validation."
+                },
+                {
+                    "variant": "gateway_purchase_or_distribution",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Gateway transactions and payment-method distribution are outside the card tokenization adapter."
+                }
+            ],
+            "processor_amount": "none",
+            "challenge_surface": "merchant_browser",
+            "merchant_confirmation_required": true,
+            "live_validation": "not_established_by_catalog",
+            "sources": [
+                "src/definitions.js",
+                "src/operations.js",
+                "src/backend.js",
+                "src/spreedly.js",
+                "../checkout/src/prepared-processor.ts"
+            ]
+        },
         {
             "psp": "shopify",
             "status": "supported",

package/dist/preflight-catalog.json

@@ -11,6 +11,10 @@
     "raw_url_length": 65536
   },
   "known_psps": [
+    {
+      "psp": "spreedly",
+      "detection": "reviewed_rules"
+    },
     {
       "psp": "shopify",
       "detection": "reviewed_rules"
@@ -1524,6 +1528,44 @@
       "hostname_pattern": "^hosted\\.test\\.paysafe\\.com$",
       "pathname_pattern": "^\\/js\\/v1\\/latest\\/index\\.html$"
     },
+    {
+      "id": "spreedly-iframe-v1-script",
+      "psp": "spreedly",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://core.spreedly.com",
+      "path_pattern": "^/iframe/iframe-v1\\.min\\.js$",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://core.spreedly.com/iframe/iframe-v1.min.js",
+          "reviewed_on": "2026-09-16"
+        }
+      ],
+      "hostname_pattern": "^core\\.spreedly\\.com$",
+      "pathname_pattern": "^\\/iframe\\/iframe-v1\\.min\\.js$"
+    },
+    {
+      "id": "spreedly-native-card-frame",
+      "psp": "spreedly",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://core.spreedly.com",
+      "path_pattern": "^/v1/embedded/(?:number|cvv)-frame-1\\.[0-9]{1,4}\\.html$",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://core.spreedly.com/iframe/iframe-v1.min.js",
+          "reviewed_on": "2026-09-16"
+        }
+      ],
+      "hostname_pattern": "^core\\.spreedly\\.com$",
+      "pathname_pattern": "^\\/v1\\/embedded\\/(?:number|cvv)-frame-1\\.[0-9]{1,4}\\.html$"
+    },
     {
       "id": "recurly-js-v4",
       "psp": "recurly",
@@ -2415,6 +2457,103 @@
     }
   ],
   "processors": [
+    {
+      "psp": "spreedly",
+      "status": "supported",
+      "mode": "token",
+      "operations": [
+        {
+          "id": "spreedly.card_request",
+          "effect": "processor_specific_card_request",
+          "amount_binding": "unestablished",
+          "psp": "spreedly",
+          "version": 1,
+          "mode": "token",
+          "autopilot_eligible": false,
+          "requires": "reviewed_final_payment_and_continuation_evidence"
+        }
+      ],
+      "scenarios": {
+        "one_time": {
+          "status": "supported",
+          "reason": "card_request_adapter_implemented",
+          "requirements": [
+            "actual_payment_request_validation",
+            "merchant_confirmation"
+          ]
+        },
+        "save_card": {
+          "status": "conditional",
+          "reason": "merchant_card_storage_and_consent_required",
+          "requirements": [
+            "actual_payment_request_validation",
+            "merchant_confirmation",
+            "stored_card_consent",
+            "merchant_card_saved"
+          ]
+        },
+        "subscription_initial": {
+          "status": "conditional",
+          "reason": "merchant_card_storage_and_consent_required",
+          "requirements": [
+            "actual_payment_request_validation",
+            "merchant_confirmation",
+            "stored_card_consent",
+            "merchant_subscription_confirmation"
+          ]
+        },
+        "subscription_renewal": {
+          "status": "outside_vault",
+          "reason": "renewal_managed_by_merchant",
+          "requirements": [
+            "verify_merchant_billing"
+          ]
+        }
+      },
+      "limitations": [
+        "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
+        "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.",
+        "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.",
+        "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."
+      ],
+      "unsupported_variants": [
+        {
+          "variant": "general_javascript_api",
+          "status": "unsupported",
+          "constraint": "direct_sdk",
+          "reason": "The general payment_methods.json endpoint is outside the reviewed native iframe path."
+        },
+        {
+          "variant": "saved_card_or_recache",
+          "status": "unsupported",
+          "constraint": "direct_sdk",
+          "reason": "Stored tokens and CVV-only recache requests are outside new-card tokenization."
+        },
+        {
+          "variant": "click_to_pay_or_bank_account",
+          "status": "unsupported",
+          "constraint": "direct_sdk",
+          "reason": "Click to Pay and bank-account request shapes require separate validation."
+        },
+        {
+          "variant": "gateway_purchase_or_distribution",
+          "status": "unsupported",
+          "constraint": "direct_sdk",
+          "reason": "Gateway transactions and payment-method distribution are outside the card tokenization adapter."
+        }
+      ],
+      "processor_amount": "none",
+      "challenge_surface": "merchant_browser",
+      "merchant_confirmation_required": true,
+      "live_validation": "not_established_by_catalog",
+      "sources": [
+        "src/definitions.js",
+        "src/operations.js",
+        "src/backend.js",
+        "src/spreedly.js",
+        "../checkout/src/prepared-processor.ts"
+      ]
+    },
     {
       "psp": "shopify",
       "status": "supported",
@@ -4271,6 +4410,12 @@
       "version": "bundled"
     },
     "processor_entries": [
+      {
+        "psp": "spreedly",
+        "mode": "token",
+        "scenario": "one_time",
+        "status": "supported"
+      },
       {
         "psp": "shopify",
         "mode": "token",

package/dist/preflight-schemas.json

@@ -209,6 +209,7 @@
               "properties": {
                 "psp": {
                   "enum": [
+                    "spreedly",
                     "shopify",
                     "stripe",
                     "braintree",
@@ -441,6 +442,8 @@
                 "paysafe-js-v1-latest",
                 "paysafe-js-v1-fields",
                 "paysafe-js-v1-fields-host-2",
+                "spreedly-iframe-v1-script",
+                "spreedly-native-card-frame",
                 "recurly-js-v4",
                 "recurly-hosted-field-v1",
                 "recurly-hosted-field-v1-host-2",
@@ -617,6 +620,7 @@
           "properties": {
             "psp": {
               "enum": [
+                "spreedly",
                 "shopify",
                 "stripe",
                 "braintree",
@@ -958,6 +962,8 @@
                       "paysafe-js-v1-latest",
                       "paysafe-js-v1-fields",
                       "paysafe-js-v1-fields-host-2",
+                      "spreedly-iframe-v1-script",
+                      "spreedly-native-card-frame",
                       "recurly-js-v4",
                       "recurly-hosted-field-v1",
                       "recurly-hosted-field-v1-host-2",

package/dist/preflight.generated.d.ts

@@ -150,6 +150,69 @@ export declare function getCheckoutPreflightCatalog(): {
         variant_unverified?: string;
     }[];
     processors: readonly [{
+        readonly psp: "spreedly";
+        readonly status: "supported";
+        readonly mode: "token";
+        readonly operations: readonly [{
+            readonly id: "spreedly.card_request";
+            readonly effect: "processor_specific_card_request";
+            readonly amount_binding: "unestablished";
+            readonly psp: "spreedly";
+            readonly version: 1;
+            readonly mode: "token";
+            readonly autopilot_eligible: false;
+            readonly requires: "reviewed_final_payment_and_continuation_evidence";
+        }];
+        readonly scenarios: {
+            readonly one_time: {
+                readonly status: "supported";
+                readonly reason: "card_request_adapter_implemented";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
+            };
+            readonly save_card: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
+            };
+            readonly subscription_initial: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
+            };
+            readonly subscription_renewal: {
+                readonly status: "outside_vault";
+                readonly reason: "renewal_managed_by_merchant";
+                readonly requirements: readonly ["verify_merchant_billing"];
+            };
+        };
+        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.", "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.", "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."];
+        readonly unsupported_variants: readonly [{
+            readonly variant: "general_javascript_api";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "The general payment_methods.json endpoint is outside the reviewed native iframe path.";
+        }, {
+            readonly variant: "saved_card_or_recache";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Stored tokens and CVV-only recache requests are outside new-card tokenization.";
+        }, {
+            readonly variant: "click_to_pay_or_bank_account";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Click to Pay and bank-account request shapes require separate validation.";
+        }, {
+            readonly variant: "gateway_purchase_or_distribution";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Gateway transactions and payment-method distribution are outside the card tokenization adapter.";
+        }];
+        readonly processor_amount: "none";
+        readonly challenge_surface: "merchant_browser";
+        readonly merchant_confirmation_required: true;
+        readonly live_validation: "not_established_by_catalog";
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/spreedly.js", "../checkout/src/prepared-processor.ts"];
+    }, {
         readonly psp: "shopify";
         readonly status: "supported";
         readonly mode: "token";