@agent-cards/checkout 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Approve an Adyen Sessions checkout before Pay with `prepare({ psp: 'adyen', environment: 'production' | 'sandbox' })`. The cardholder approves and picks the card first; when the merchant's Sessions `/payments` request pauses, the device encrypts the approved card under the merchant's Adyen key and the request continues from your browser, so Adyen Web's own 60-second request timeout covers only the pause, the bind and the encryption. `sandbox` is Adyen's test host with a `test_` client key; `production` is the live host families with a `live_` key. A stored-card, single-blob or store-the-card request never uses the approval. The matching API, Vault and database migration are required.
+
+- Approve Spreedly's native hosted-card checkout with `prepare({ psp: 'spreedly', environment: 'shared' })`. The Vault tokenizes the selected card over the encrypted relay and returns the native response. Matching API, Vault, relay and database releases are required; tokenization alone does not confirm payment. Saved-card updates and other Spreedly flows remain unsupported.
+
 - Identify hosted, regional, and versioned processor variants seen on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. The Tranzila terminal-root page, the Authorize.Net hosted payment form, and Worldpay hosted payment pages identify their processor and return `unknown` with `processor_variant_unverified`. The catalog is `2026-09-15.1`; issue native profiles against it.
 
 - Report a sole script-only candidate as `psp` only when the observation is complete. On a partial scan the script stays in `candidates` as `undetermined`, so a co-loaded SDK is never presented as the selected processor.

package/PREFLIGHT.md

@@ -171,6 +171,7 @@ The catalog includes reviewed discovery rules and direct SDK implementation capa
 | Mollie | `token` |
 | Paysafe | `token` |
 | Recurly | `token` |
+| Spreedly | `token` |
 | Moneris | `token` |
 | Bambora | `token` |
 | Global Payments | `token` |

package/README.md

@@ -84,8 +84,8 @@ Agentcard derives it.
 Then let your agent click "Pay" like it always does. `attachToCdp` pauses the
 request for approval and resumes it only while the merchant request remains
 live. Merchant timeouts still apply: Square's observed tokenization deadline
-is about 10 seconds, and Braintree's native request timeout is 60 seconds, including approval and token handoff. For human approval, use
-`controller.prepare()` before the first Pay action as shown below.
+is about 10 seconds, Braintree's native request timeout is 60 seconds, and Adyen Web's own request timeout abandons its Sessions payment call 60 seconds after Pay (observed on Adyen Web 6.41 and 6.44), each including approval and handoff. These are the processors' limits, not ones the SDK enforces: the SDK's own authorization wait stays 15 minutes. For human approval, use
+`controller.prepare()` before the first Pay action as shown below. For Adyen, `prepare()` moves the approval before Pay, so only the device-side encryption runs inside Adyen Web's minute.
 
 Playwright:
 
@@ -136,7 +136,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Checkout.com | supported |
 | Mercado Pago | Card tokenization and prepared checkout are implemented. Guest Checkout Pro in Mexico also corrects the issuer for one native card association when the selected card has the same brand and type. One live MXN 40 Lotería Chida purchase with published SDK 0.10.0 completed automatically through Pay; the merchant confirmed paid status and PDF fulfillment. The historical SDK result remains unknown because the private receipt adapter rejected a relative download URL; a separate read with the corrected adapter confirms that same paid receipt. Independent processor capture/settlement and other country or integration paths remain unverified. |
 | VGS Collect (Very Good Security; Wolt) | not supported: VGS's proxy aliases only submissions from its own iframe, so a replay from the cardholder's device is refused by the merchant (verified on Wolt, 2026-09-03). Not recognized, so the agent's browser is not paused there |
-| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it |
+| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow only: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts; a merchant that posts the encrypted fields to its own server is not recognized, so nothing pauses there. Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 
 The recognizer list is fetched from the API at runtime (`vault.syncRegistry()`),
@@ -514,8 +514,28 @@ await page.getByRole('button', { name: 'Pay', exact: true }).click();
 | Bambora | `shared` | `/scripts/tokenization/tokens` on `api.bam.shift4api.net` or `api.na.bambora.com` |
 | Mercado Pago | `shared` | `api.mercadopago.com/v1/card_tokens` with a fresh card body |
 | Recurly | `shared` | Form-encoded POST to `/js/v1/token` on `api.recurly.com` or `api.eu.recurly.com` |
+| Spreedly | `shared` | Native iframe JSON POST to `/v1/payment_methods/restricted.json` on `core.spreedly.com` |
+| Adyen | `production` or `sandbox` | The Sessions `/checkoutshopper/v1/sessions/{id}/payments` POST on the matching Adyen host family (`sandbox` is `checkoutshopper-test.adyen.com` with a `test_` client key; `production` is the live hosts with a `live_` key), carrying a fresh card's four encrypted fields |
 
-Use `environment: 'shared'` for Bambora, Mercado Pago and Recurly because the same endpoint serves test and live requests. Agentcard cannot establish the processor's test mode from that URL or a credential prefix. Configure test mode through the merchant's processor account when testing. Agentcard's own `sandbox` flag remains separate. Prepared Worldpay, Bambora, Mercado Pago and Recurly requests reject saved-card and recurring request bodies; a refused request retires the local preparation. Reconcile any existing merchant attempt before creating a new attachment.
+Use `environment: 'shared'` for Bambora, Mercado Pago, Recurly and Spreedly because the same endpoint serves test and live requests. Agentcard cannot establish the processor's test mode from that URL or a credential prefix. Configure test mode through the merchant's processor account when testing. Agentcard's own `sandbox` flag remains separate. Prepared Worldpay, Bambora, Mercado Pago and Recurly requests reject saved-card and recurring request bodies; a refused request retires the local preparation. Reconcile any existing merchant attempt before creating a new attachment.
+
+Prepare an Adyen Sessions checkout before the agent clicks Pay:
+
+```ts
+await controller.prepare({ psp: 'adyen', environment: 'production' }); // 'sandbox' for Adyen's test host
+```
+
+After approval, click Pay once. adyen-web encrypts the agent's placeholder digits and posts its Sessions `/payments` request; the SDK pauses it and binds it to the approval, the cardholder's device (still on the approval page) encrypts the approved card under the merchant's Adyen key, and the request continues from your browser with only the four encrypted fields swapped and `brand` dropped. Adyen answers your browser, so the merchant's order state is the outcome to poll. The bound request must be a fresh `scheme` card on the approved host family with a client key of that environment; a stored-card, single-blob or store-the-card request never uses the approval. Adyen Web's own 60-second request timeout then covers only the pause, the bind and the device's encryption.
+
+Prepare a Spreedly checkout before submitting the merchant's card form:
+
+```ts
+await controller.prepare({ psp: 'spreedly', environment: 'shared' });
+```
+
+After approval, submit the form once. The Vault replaces the card fields on your device and sends the native request through an encrypted connection to Spreedly. The merchant's environment and signed session stay unchanged. The API, Vault, relay and preparation migration must support Spreedly before you use this flow; the API refuses preparations while its relay rollout flag is disabled.
+
+Initial coverage includes the hosted iframe's new-card request. Saved-card CVV updates, Express, wallets, bank accounts and gateway purchase APIs require separate support. A returned card token does not confirm payment; wait for the merchant's result before reporting success. Autopilot is unavailable for Spreedly.
 
 Prepare Recurly before clicking the merchant's payment button:
 

package/dist/adyen.generated.d.ts

@@ -0,0 +1,24 @@
+/** Adyen Web Sessions payments request, before it consumes an approval.
+ * adyen-web (Drop-in and the Card component in the Sessions flow) posts one
+ * JSON body to /checkoutshopper/v1/sessions/{id}/payments on the merchant's
+ * Adyen host, with `clientKey` as its only query parameter, and carries the
+ * card as four JWE blobs under paymentMethod. Those four blobs are what the
+ * cardholder's device replaces; nothing else in the body is rewritten. Test
+ * and live are separate host families AND separate client-key prefixes, so a
+ * preparation names one of them and the request must agree on both. A body
+ * that pays with a stored card, carries a single encrypted blob, or asks
+ * Adyen to store the card is not the purchase the person approved and never
+ * consumes readiness. This module never rewrites a body.
+ */
+export type AdyenPreparationEnvironment = 'production' | 'sandbox';
+export declare const ADYEN_ENCRYPTED_CARD_FIELDS: readonly ["encryptedCardNumber", "encryptedExpiryMonth", "encryptedExpiryYear", "encryptedSecurityCode"];
+/** Which preparation environment a hostname belongs to: Adyen's test host, one of its live host families, or neither. */
+export declare function adyenPreparationEnvironment(hostname: string): AdyenPreparationEnvironment | null;
+/** The URL a preparation advertises for the approved host family: every registry recognizes it, and it is never a real session. */
+export declare function adyenPreparationUrl(environment: AdyenPreparationEnvironment): string;
+/** A Sessions payments URL on the approved host family whose only query is a client key of that same environment. */
+export declare function isPreparedAdyenUrl(rawUrl: string, environment: AdyenPreparationEnvironment): boolean;
+/** A fresh scheme card carrying the four encrypted fields the device replaces; stored cards, single-blob encryption and store requests never consume consent. */
+export declare function isPreparedAdyenBody(body: string | null | undefined): boolean;
+/** Processor identity, environment and request shape are part of the device's prior consent. */
+export declare function isPreparedAdyenRequest(rawUrl: string, method: string, body: string | null | undefined, environment: AdyenPreparationEnvironment): boolean;

package/dist/adyen.generated.js

@@ -0,0 +1,64 @@
+export const ADYEN_ENCRYPTED_CARD_FIELDS = ['encryptedCardNumber', 'encryptedExpiryMonth', 'encryptedExpiryYear', 'encryptedSecurityCode'];
+const SESSIONS_PAYMENTS = /^\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]{1,256}\/payments$/;
+const TEST_HOST = /^checkoutshopper-test\.adyen\.com$/;
+const LIVE_HOST = /^(?:checkoutshopper-live(?:-[a-z]+)?\.adyen\.com|(?:[a-z0-9-]+\.)*adyenpayments\.com)$/;
+const CLIENT_KEY = /^(test|live)_[A-Za-z0-9]{32}$/;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const text = (value, max = 4096) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+/** Which preparation environment a hostname belongs to: Adyen's test host, one of its live host families, or neither. */
+export function adyenPreparationEnvironment(hostname) {
+    const host = hostname.toLowerCase();
+    if (TEST_HOST.test(host))
+        return 'sandbox';
+    if (LIVE_HOST.test(host))
+        return 'production';
+    return null;
+}
+/** The URL a preparation advertises for the approved host family: every registry recognizes it, and it is never a real session. */
+export function adyenPreparationUrl(environment) {
+    return `https://checkoutshopper-${environment === 'production' ? 'live' : 'test'}.adyen.com/checkoutshopper/v1/sessions/prepared/payments`;
+}
+/** A Sessions payments URL on the approved host family whose only query is a client key of that same environment. */
+export function isPreparedAdyenUrl(rawUrl, environment) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || url.port || url.username || url.password || url.hash)
+        return false;
+    if (adyenPreparationEnvironment(url.hostname) !== environment || !SESSIONS_PAYMENTS.test(url.pathname))
+        return false;
+    const names = [...url.searchParams.keys()];
+    if (names.length !== 1 || names[0] !== 'clientKey')
+        return false;
+    const key = url.searchParams.get('clientKey') ?? '';
+    const match = CLIENT_KEY.exec(key);
+    return !!match && match[0] === key && (match[1] === 'live') === (environment === 'production');
+}
+/** A fresh scheme card carrying the four encrypted fields the device replaces; stored cards, single-blob encryption and store requests never consume consent. */
+export function isPreparedAdyenBody(body) {
+    if (typeof body !== 'string' || !body || body.length > 65536)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    if (!record(parsed) || parsed.storePaymentMethod === true)
+        return false;
+    const method = parsed.paymentMethod;
+    if (!record(method) || method.type !== 'scheme')
+        return false;
+    if ('storedPaymentMethodId' in method || 'encryptedCard' in method || 'recurringDetailReference' in method)
+        return false;
+    return ADYEN_ENCRYPTED_CARD_FIELDS.every(field => text(method[field]));
+}
+/** Processor identity, environment and request shape are part of the device's prior consent. */
+export function isPreparedAdyenRequest(rawUrl, method, body, environment) {
+    return method.toUpperCase() === 'POST' && isPreparedAdyenUrl(rawUrl, environment) && isPreparedAdyenBody(body);
+}

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i] }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i] }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import { type CheckoutMode, type Recognizer } from './registry.js';
 import type { Substitutions } from './substitute.js';
-import { type PreparationProcessor } from './prepared-processor.js';
+import { type PreparationMode, type PreparationProcessor } from './prepared-processor.js';
 export interface PausedRequest {
     url: string;
     method: string;
@@ -147,6 +147,8 @@ export interface PreparedCheckout {
     readonly status: 'ready';
     readonly psp: PreparationProcessor;
     readonly environment: 'production' | 'sandbox' | 'shared';
+    /** How the approved card reaches the processor: ciphertext the device produces (Adyen, `cse`) or the device's own request (`token`). */
+    readonly mode: PreparationMode;
     readonly expiresAt: string;
     readonly cardId: string;
     readonly user: string;

package/dist/client.js

@@ -1,6 +1,6 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns as deriveCardUrlPatterns, findRecognizer, } from './registry.js';
 import { isMercadoTokenRequest, parseMercadoCheckoutContext, validateMercadoProcessorContext } from './mercado-checkout.generated.js';
-import { matchesPreparedRequest, validPreparationEnvironment } from './prepared-processor.js';
+import { matchesPreparedRequest, preparationMode, validPreparationEnvironment } from './prepared-processor.js';
 import { hasOwnedShopMarker, parseOwnedShopOrder, parseOwnedShopReceipt } from './owned-shop.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 /**
@@ -440,7 +440,7 @@ export class VaultClient {
             // The separate stop signal prevents dispatch after a slow OAuth exchange.
             const created = await this.post('/v2/checkout/preparations', {
                 user: input.user, merchant: input.merchant, amount: input.amount, currency: input.currency.toLowerCase(),
-                ...(input.cardId ? { card_id: input.cardId } : {}), psp: input.psp, mode: 'token',
+                ...(input.cardId ? { card_id: input.cardId } : {}), psp: input.psp, mode: preparationMode(input.psp),
                 environment: input.environment, checkout_key: input.checkoutKey, merchant_origin: input.merchantOrigin,
             }, AbortSignal.timeout(30_000), signal);
             if (!created || typeof created.id !== 'string' || !/^cprep_[A-Za-z0-9_-]{1,128}$/.test(created.id))
@@ -471,11 +471,11 @@ export class VaultClient {
                         || state.payment_status !== 'not_started' || state.amount_authority !== 'agent'
                         || state.user !== input.user || state.merchant !== input.merchant || state.merchant_origin !== input.merchantOrigin
                         || !Number.isSafeInteger(state.amount) || (typeof input.amount === 'number' && state.amount !== input.amount) || state.currency !== input.currency.toLowerCase()
-                        || state.psp !== input.psp || state.mode !== 'token' || state.environment !== input.environment
+                        || state.psp !== input.psp || state.mode !== preparationMode(input.psp) || state.environment !== input.environment
                         || state.checkout_key !== input.checkoutKey)
                         throw fail('ready_unconfirmed', id);
                     const prepared = Object.freeze({
-                        id: preparationId, status: 'ready', psp: input.psp, environment: input.environment, expiresAt: state.ready_expires_at,
+                        id: preparationId, status: 'ready', psp: input.psp, environment: input.environment, mode: preparationMode(input.psp), expiresAt: state.ready_expires_at,
                         cardId: state.card_id, user: input.user, merchant: input.merchant, amount: state.amount,
                         amountDisplay: typeof state.amount_display === 'string' ? state.amount_display : null,
                         currency: input.currency.toLowerCase(), merchantOrigin: input.merchantOrigin, checkoutKey: input.checkoutKey,
@@ -582,7 +582,7 @@ export class VaultClient {
         // clientSideEncrypted entry (an older registry, a hand-built one) still
         // refuses here, exactly as before.
         const mode = rec.mode ?? 'token';
-        if (preparation && (rec.psp !== preparation.psp || mode !== 'token'))
+        if (preparation && (rec.psp !== preparation.psp || mode !== preparationMode(preparation.psp)))
             throw new CheckoutPreparationError(preparation.id, 'checkout_changed');
         if (rec.clientSideEncrypted && mode !== 'cse')
             throw new CardEncryptedError(rec.psp);

package/dist/preflight-capabilities.generated.d.ts

@@ -3,6 +3,69 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
     readonly scope: "processor_integration";
     readonly integration: "direct_sdk";
     readonly processors: readonly [{
+        readonly psp: "spreedly";
+        readonly status: "supported";
+        readonly mode: "token";
+        readonly operations: readonly [{
+            readonly id: "spreedly.card_request";
+            readonly effect: "processor_specific_card_request";
+            readonly amount_binding: "unestablished";
+            readonly psp: "spreedly";
+            readonly version: 1;
+            readonly mode: "token";
+            readonly autopilot_eligible: false;
+            readonly requires: "reviewed_final_payment_and_continuation_evidence";
+        }];
+        readonly scenarios: {
+            readonly one_time: {
+                readonly status: "supported";
+                readonly reason: "card_request_adapter_implemented";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
+            };
+            readonly save_card: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
+            };
+            readonly subscription_initial: {
+                readonly status: "conditional";
+                readonly reason: "merchant_card_storage_and_consent_required";
+                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
+            };
+            readonly subscription_renewal: {
+                readonly status: "outside_vault";
+                readonly reason: "renewal_managed_by_merchant";
+                readonly requirements: readonly ["verify_merchant_billing"];
+            };
+        };
+        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.", "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.", "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."];
+        readonly unsupported_variants: readonly [{
+            readonly variant: "general_javascript_api";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "The general payment_methods.json endpoint is outside the reviewed native iframe path.";
+        }, {
+            readonly variant: "saved_card_or_recache";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Stored tokens and CVV-only recache requests are outside new-card tokenization.";
+        }, {
+            readonly variant: "click_to_pay_or_bank_account";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Click to Pay and bank-account request shapes require separate validation.";
+        }, {
+            readonly variant: "gateway_purchase_or_distribution";
+            readonly status: "unsupported";
+            readonly constraint: "direct_sdk";
+            readonly reason: "Gateway transactions and payment-method distribution are outside the card tokenization adapter.";
+        }];
+        readonly processor_amount: "none";
+        readonly challenge_surface: "merchant_browser";
+        readonly merchant_confirmation_required: true;
+        readonly live_validation: "not_established_by_catalog";
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/spreedly.js", "../checkout/src/prepared-processor.ts"];
+    }, {
         readonly psp: "shopify";
         readonly status: "supported";
         readonly mode: "token";
@@ -287,7 +350,7 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
                 readonly requirements: readonly ["verify_merchant_billing"];
             };
         };
-        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered."];
+        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered.", "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."];
         readonly unsupported_variants: readonly [{
             readonly variant: "single_blob_encryption";
             readonly status: "unsupported";
@@ -308,7 +371,7 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly challenge_surface: "merchant_browser";
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/adyen.ts", "../checkout/src/prepared-processor.ts"];
     }, {
         readonly psp: "tranzila";
         readonly status: "supported";

package/dist/preflight-capabilities.generated.js

@@ -5,6 +5,103 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
     "scope": "processor_integration",
     "integration": "direct_sdk",
     "processors": [
+        {
+            "psp": "spreedly",
+            "status": "supported",
+            "mode": "token",
+            "operations": [
+                {
+                    "id": "spreedly.card_request",
+                    "effect": "processor_specific_card_request",
+                    "amount_binding": "unestablished",
+                    "psp": "spreedly",
+                    "version": 1,
+                    "mode": "token",
+                    "autopilot_eligible": false,
+                    "requires": "reviewed_final_payment_and_continuation_evidence"
+                }
+            ],
+            "scenarios": {
+                "one_time": {
+                    "status": "supported",
+                    "reason": "card_request_adapter_implemented",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation"
+                    ]
+                },
+                "save_card": {
+                    "status": "conditional",
+                    "reason": "merchant_card_storage_and_consent_required",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation",
+                        "stored_card_consent",
+                        "merchant_card_saved"
+                    ]
+                },
+                "subscription_initial": {
+                    "status": "conditional",
+                    "reason": "merchant_card_storage_and_consent_required",
+                    "requirements": [
+                        "actual_payment_request_validation",
+                        "merchant_confirmation",
+                        "stored_card_consent",
+                        "merchant_subscription_confirmation"
+                    ]
+                },
+                "subscription_renewal": {
+                    "status": "outside_vault",
+                    "reason": "renewal_managed_by_merchant",
+                    "requirements": [
+                        "verify_merchant_billing"
+                    ]
+                }
+            },
+            "limitations": [
+                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
+                "The adapter handles the Spreedly iframe v1 restricted endpoint for new credit cards through the encrypted relay.",
+                "The merchant environment and optional signed iframe session must remain valid. Expired signatures require a fresh merchant checkout.",
+                "Spreedly creates a payment-method token; the merchant still completes any gateway payment and authentication."
+            ],
+            "unsupported_variants": [
+                {
+                    "variant": "general_javascript_api",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "The general payment_methods.json endpoint is outside the reviewed native iframe path."
+                },
+                {
+                    "variant": "saved_card_or_recache",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Stored tokens and CVV-only recache requests are outside new-card tokenization."
+                },
+                {
+                    "variant": "click_to_pay_or_bank_account",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Click to Pay and bank-account request shapes require separate validation."
+                },
+                {
+                    "variant": "gateway_purchase_or_distribution",
+                    "status": "unsupported",
+                    "constraint": "direct_sdk",
+                    "reason": "Gateway transactions and payment-method distribution are outside the card tokenization adapter."
+                }
+            ],
+            "processor_amount": "none",
+            "challenge_surface": "merchant_browser",
+            "merchant_confirmation_required": true,
+            "live_validation": "not_established_by_catalog",
+            "sources": [
+                "src/definitions.js",
+                "src/operations.js",
+                "src/backend.js",
+                "src/spreedly.js",
+                "../checkout/src/prepared-processor.ts"
+            ]
+        },
         {
             "psp": "shopify",
             "status": "supported",
@@ -435,7 +532,8 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             },
             "limitations": [
                 "Four encrypted card fields in the Adyen Sessions payments body are required.",
-                "Single-blob encryption, wallets, and stored-card variants are not covered."
+                "Single-blob encryption, wallets, and stored-card variants are not covered.",
+                "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."
             ],
             "unsupported_variants": [
                 {
@@ -464,7 +562,9 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             "sources": [
                 "src/definitions.js",
                 "src/operations.js",
-                "src/backend.js"
+                "src/backend.js",
+                "src/adyen.ts",
+                "../checkout/src/prepared-processor.ts"
             ]
         },
         {