@agent-cards/checkout 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Approve an Adyen Sessions checkout before Pay with `prepare({ psp: 'adyen', environment: 'production' | 'sandbox' })`. The cardholder approves and picks the card first; when the merchant's Sessions `/payments` request pauses, the device encrypts the approved card under the merchant's Adyen key and the request continues from your browser, so Adyen Web's own 60-second request timeout covers only the pause, the bind and the encryption. `sandbox` is Adyen's test host with a `test_` client key; `production` is the live host families with a `live_` key. A stored-card, single-blob or store-the-card request never uses the approval. The matching API, Vault and database migration are required.
+
 - Approve Spreedly's native hosted-card checkout with `prepare({ psp: 'spreedly', environment: 'shared' })`. The Vault tokenizes the selected card over the encrypted relay and returns the native response. Matching API, Vault, relay and database releases are required; tokenization alone does not confirm payment. Saved-card updates and other Spreedly flows remain unsupported.
 
 - Identify hosted, regional, and versioned processor variants seen on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. The Tranzila terminal-root page, the Authorize.Net hosted payment form, and Worldpay hosted payment pages identify their processor and return `unknown` with `processor_variant_unverified`. The catalog is `2026-09-15.1`; issue native profiles against it.

package/README.md

@@ -85,7 +85,7 @@ Then let your agent click "Pay" like it always does. `attachToCdp` pauses the
 request for approval and resumes it only while the merchant request remains
 live. Merchant timeouts still apply: Square's observed tokenization deadline
 is about 10 seconds, Braintree's native request timeout is 60 seconds, and Adyen Web's own request timeout abandons its Sessions payment call 60 seconds after Pay (observed on Adyen Web 6.41 and 6.44), each including approval and handoff. These are the processors' limits, not ones the SDK enforces: the SDK's own authorization wait stays 15 minutes. For human approval, use
-`controller.prepare()` before the first Pay action as shown below. Adyen is not on the `prepare()` list yet, so an Adyen approval has to land within Adyen Web's minute.
+`controller.prepare()` before the first Pay action as shown below. For Adyen, `prepare()` moves the approval before Pay, so only the device-side encryption runs inside Adyen Web's minute.
 
 Playwright:
 
@@ -136,7 +136,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Checkout.com | supported |
 | Mercado Pago | Card tokenization and prepared checkout are implemented. Guest Checkout Pro in Mexico also corrects the issuer for one native card association when the selected card has the same brand and type. One live MXN 40 Lotería Chida purchase with published SDK 0.10.0 completed automatically through Pay; the merchant confirmed paid status and PDF fulfillment. The historical SDK result remains unknown because the private receipt adapter rejected a relative download URL; a separate read with the corrected adapter confirms that same paid receipt. Independent processor capture/settlement and other country or integration paths remain unverified. |
 | VGS Collect (Very Good Security; Wolt) | not supported: VGS's proxy aliases only submissions from its own iframe, so a replay from the cardholder's device is refused by the merchant (verified on Wolt, 2026-09-03). Not recognized, so the agent's browser is not paused there |
-| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow only: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts; a merchant that posts the encrypted fields to its own server is not recognized, so nothing pauses there. Approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare()` is not available for Adyen yet |
+| Adyen | supported (mode `cse`): the vault encrypts the card for Adyen on the cardholder's device and your browser sends it. Sessions flow only: the paused request is `/checkoutshopper/v1/sessions/{id}/payments` on Adyen's own hosts; a merchant that posts the encrypted fields to its own server is not recognized, so nothing pauses there. Without a preparation, approval starts at Pay and must land before Adyen Web's own request timeout (observed at 60 seconds on Adyen Web 6.41 and 6.44; not enforced by the SDK); `prepare({ psp: 'adyen' })` moves the approval before Pay |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 
 The recognizer list is fetched from the API at runtime (`vault.syncRegistry()`),
@@ -515,9 +515,18 @@ await page.getByRole('button', { name: 'Pay', exact: true }).click();
 | Mercado Pago | `shared` | `api.mercadopago.com/v1/card_tokens` with a fresh card body |
 | Recurly | `shared` | Form-encoded POST to `/js/v1/token` on `api.recurly.com` or `api.eu.recurly.com` |
 | Spreedly | `shared` | Native iframe JSON POST to `/v1/payment_methods/restricted.json` on `core.spreedly.com` |
+| Adyen | `production` or `sandbox` | The Sessions `/checkoutshopper/v1/sessions/{id}/payments` POST on the matching Adyen host family (`sandbox` is `checkoutshopper-test.adyen.com` with a `test_` client key; `production` is the live hosts with a `live_` key), carrying a fresh card's four encrypted fields |
 
 Use `environment: 'shared'` for Bambora, Mercado Pago, Recurly and Spreedly because the same endpoint serves test and live requests. Agentcard cannot establish the processor's test mode from that URL or a credential prefix. Configure test mode through the merchant's processor account when testing. Agentcard's own `sandbox` flag remains separate. Prepared Worldpay, Bambora, Mercado Pago and Recurly requests reject saved-card and recurring request bodies; a refused request retires the local preparation. Reconcile any existing merchant attempt before creating a new attachment.
 
+Prepare an Adyen Sessions checkout before the agent clicks Pay:
+
+```ts
+await controller.prepare({ psp: 'adyen', environment: 'production' }); // 'sandbox' for Adyen's test host
+```
+
+After approval, click Pay once. adyen-web encrypts the agent's placeholder digits and posts its Sessions `/payments` request; the SDK pauses it and binds it to the approval, the cardholder's device (still on the approval page) encrypts the approved card under the merchant's Adyen key, and the request continues from your browser with only the four encrypted fields swapped and `brand` dropped. Adyen answers your browser, so the merchant's order state is the outcome to poll. The bound request must be a fresh `scheme` card on the approved host family with a client key of that environment; a stored-card, single-blob or store-the-card request never uses the approval. Adyen Web's own 60-second request timeout then covers only the pause, the bind and the device's encryption.
+
 Prepare a Spreedly checkout before submitting the merchant's card form:
 
 ```ts

package/dist/adyen.generated.d.ts

@@ -0,0 +1,24 @@
+/** Adyen Web Sessions payments request, before it consumes an approval.
+ * adyen-web (Drop-in and the Card component in the Sessions flow) posts one
+ * JSON body to /checkoutshopper/v1/sessions/{id}/payments on the merchant's
+ * Adyen host, with `clientKey` as its only query parameter, and carries the
+ * card as four JWE blobs under paymentMethod. Those four blobs are what the
+ * cardholder's device replaces; nothing else in the body is rewritten. Test
+ * and live are separate host families AND separate client-key prefixes, so a
+ * preparation names one of them and the request must agree on both. A body
+ * that pays with a stored card, carries a single encrypted blob, or asks
+ * Adyen to store the card is not the purchase the person approved and never
+ * consumes readiness. This module never rewrites a body.
+ */
+export type AdyenPreparationEnvironment = 'production' | 'sandbox';
+export declare const ADYEN_ENCRYPTED_CARD_FIELDS: readonly ["encryptedCardNumber", "encryptedExpiryMonth", "encryptedExpiryYear", "encryptedSecurityCode"];
+/** Which preparation environment a hostname belongs to: Adyen's test host, one of its live host families, or neither. */
+export declare function adyenPreparationEnvironment(hostname: string): AdyenPreparationEnvironment | null;
+/** The URL a preparation advertises for the approved host family: every registry recognizes it, and it is never a real session. */
+export declare function adyenPreparationUrl(environment: AdyenPreparationEnvironment): string;
+/** A Sessions payments URL on the approved host family whose only query is a client key of that same environment. */
+export declare function isPreparedAdyenUrl(rawUrl: string, environment: AdyenPreparationEnvironment): boolean;
+/** A fresh scheme card carrying the four encrypted fields the device replaces; stored cards, single-blob encryption and store requests never consume consent. */
+export declare function isPreparedAdyenBody(body: string | null | undefined): boolean;
+/** Processor identity, environment and request shape are part of the device's prior consent. */
+export declare function isPreparedAdyenRequest(rawUrl: string, method: string, body: string | null | undefined, environment: AdyenPreparationEnvironment): boolean;

package/dist/adyen.generated.js

@@ -0,0 +1,64 @@
+export const ADYEN_ENCRYPTED_CARD_FIELDS = ['encryptedCardNumber', 'encryptedExpiryMonth', 'encryptedExpiryYear', 'encryptedSecurityCode'];
+const SESSIONS_PAYMENTS = /^\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]{1,256}\/payments$/;
+const TEST_HOST = /^checkoutshopper-test\.adyen\.com$/;
+const LIVE_HOST = /^(?:checkoutshopper-live(?:-[a-z]+)?\.adyen\.com|(?:[a-z0-9-]+\.)*adyenpayments\.com)$/;
+const CLIENT_KEY = /^(test|live)_[A-Za-z0-9]{32}$/;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const text = (value, max = 4096) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+/** Which preparation environment a hostname belongs to: Adyen's test host, one of its live host families, or neither. */
+export function adyenPreparationEnvironment(hostname) {
+    const host = hostname.toLowerCase();
+    if (TEST_HOST.test(host))
+        return 'sandbox';
+    if (LIVE_HOST.test(host))
+        return 'production';
+    return null;
+}
+/** The URL a preparation advertises for the approved host family: every registry recognizes it, and it is never a real session. */
+export function adyenPreparationUrl(environment) {
+    return `https://checkoutshopper-${environment === 'production' ? 'live' : 'test'}.adyen.com/checkoutshopper/v1/sessions/prepared/payments`;
+}
+/** A Sessions payments URL on the approved host family whose only query is a client key of that same environment. */
+export function isPreparedAdyenUrl(rawUrl, environment) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || url.port || url.username || url.password || url.hash)
+        return false;
+    if (adyenPreparationEnvironment(url.hostname) !== environment || !SESSIONS_PAYMENTS.test(url.pathname))
+        return false;
+    const names = [...url.searchParams.keys()];
+    if (names.length !== 1 || names[0] !== 'clientKey')
+        return false;
+    const key = url.searchParams.get('clientKey') ?? '';
+    const match = CLIENT_KEY.exec(key);
+    return !!match && match[0] === key && (match[1] === 'live') === (environment === 'production');
+}
+/** A fresh scheme card carrying the four encrypted fields the device replaces; stored cards, single-blob encryption and store requests never consume consent. */
+export function isPreparedAdyenBody(body) {
+    if (typeof body !== 'string' || !body || body.length > 65536)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    if (!record(parsed) || parsed.storePaymentMethod === true)
+        return false;
+    const method = parsed.paymentMethod;
+    if (!record(method) || method.type !== 'scheme')
+        return false;
+    if ('storedPaymentMethodId' in method || 'encryptedCard' in method || 'recurringDetailReference' in method)
+        return false;
+    return ADYEN_ENCRYPTED_CARD_FIELDS.every(field => text(method[field]));
+}
+/** Processor identity, environment and request shape are part of the device's prior consent. */
+export function isPreparedAdyenRequest(rawUrl, method, body, environment) {
+    return method.toUpperCase() === 'POST' && isPreparedAdyenUrl(rawUrl, environment) && isPreparedAdyenBody(body);
+}

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import { type CheckoutMode, type Recognizer } from './registry.js';
 import type { Substitutions } from './substitute.js';
-import { type PreparationProcessor } from './prepared-processor.js';
+import { type PreparationMode, type PreparationProcessor } from './prepared-processor.js';
 export interface PausedRequest {
     url: string;
     method: string;
@@ -147,6 +147,8 @@ export interface PreparedCheckout {
     readonly status: 'ready';
     readonly psp: PreparationProcessor;
     readonly environment: 'production' | 'sandbox' | 'shared';
+    /** How the approved card reaches the processor: ciphertext the device produces (Adyen, `cse`) or the device's own request (`token`). */
+    readonly mode: PreparationMode;
     readonly expiresAt: string;
     readonly cardId: string;
     readonly user: string;

package/dist/client.js

@@ -1,6 +1,6 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns as deriveCardUrlPatterns, findRecognizer, } from './registry.js';
 import { isMercadoTokenRequest, parseMercadoCheckoutContext, validateMercadoProcessorContext } from './mercado-checkout.generated.js';
-import { matchesPreparedRequest, validPreparationEnvironment } from './prepared-processor.js';
+import { matchesPreparedRequest, preparationMode, validPreparationEnvironment } from './prepared-processor.js';
 import { hasOwnedShopMarker, parseOwnedShopOrder, parseOwnedShopReceipt } from './owned-shop.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 /**
@@ -440,7 +440,7 @@ export class VaultClient {
             // The separate stop signal prevents dispatch after a slow OAuth exchange.
             const created = await this.post('/v2/checkout/preparations', {
                 user: input.user, merchant: input.merchant, amount: input.amount, currency: input.currency.toLowerCase(),
-                ...(input.cardId ? { card_id: input.cardId } : {}), psp: input.psp, mode: 'token',
+                ...(input.cardId ? { card_id: input.cardId } : {}), psp: input.psp, mode: preparationMode(input.psp),
                 environment: input.environment, checkout_key: input.checkoutKey, merchant_origin: input.merchantOrigin,
             }, AbortSignal.timeout(30_000), signal);
             if (!created || typeof created.id !== 'string' || !/^cprep_[A-Za-z0-9_-]{1,128}$/.test(created.id))
@@ -471,11 +471,11 @@ export class VaultClient {
                         || state.payment_status !== 'not_started' || state.amount_authority !== 'agent'
                         || state.user !== input.user || state.merchant !== input.merchant || state.merchant_origin !== input.merchantOrigin
                         || !Number.isSafeInteger(state.amount) || (typeof input.amount === 'number' && state.amount !== input.amount) || state.currency !== input.currency.toLowerCase()
-                        || state.psp !== input.psp || state.mode !== 'token' || state.environment !== input.environment
+                        || state.psp !== input.psp || state.mode !== preparationMode(input.psp) || state.environment !== input.environment
                         || state.checkout_key !== input.checkoutKey)
                         throw fail('ready_unconfirmed', id);
                     const prepared = Object.freeze({
-                        id: preparationId, status: 'ready', psp: input.psp, environment: input.environment, expiresAt: state.ready_expires_at,
+                        id: preparationId, status: 'ready', psp: input.psp, environment: input.environment, mode: preparationMode(input.psp), expiresAt: state.ready_expires_at,
                         cardId: state.card_id, user: input.user, merchant: input.merchant, amount: state.amount,
                         amountDisplay: typeof state.amount_display === 'string' ? state.amount_display : null,
                         currency: input.currency.toLowerCase(), merchantOrigin: input.merchantOrigin, checkoutKey: input.checkoutKey,
@@ -582,7 +582,7 @@ export class VaultClient {
         // clientSideEncrypted entry (an older registry, a hand-built one) still
         // refuses here, exactly as before.
         const mode = rec.mode ?? 'token';
-        if (preparation && (rec.psp !== preparation.psp || mode !== 'token'))
+        if (preparation && (rec.psp !== preparation.psp || mode !== preparationMode(preparation.psp)))
             throw new CheckoutPreparationError(preparation.id, 'checkout_changed');
         if (rec.clientSideEncrypted && mode !== 'cse')
             throw new CardEncryptedError(rec.psp);

package/dist/preflight-capabilities.generated.d.ts

@@ -350,7 +350,7 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
                 readonly requirements: readonly ["verify_merchant_billing"];
             };
         };
-        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered."];
+        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered.", "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."];
         readonly unsupported_variants: readonly [{
             readonly variant: "single_blob_encryption";
             readonly status: "unsupported";
@@ -371,7 +371,7 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly challenge_surface: "merchant_browser";
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/adyen.ts", "../checkout/src/prepared-processor.ts"];
     }, {
         readonly psp: "tranzila";
         readonly status: "supported";

package/dist/preflight-capabilities.generated.js

@@ -532,7 +532,8 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             },
             "limitations": [
                 "Four encrypted card fields in the Adyen Sessions payments body are required.",
-                "Single-blob encryption, wallets, and stored-card variants are not covered."
+                "Single-blob encryption, wallets, and stored-card variants are not covered.",
+                "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."
             ],
             "unsupported_variants": [
                 {
@@ -561,7 +562,9 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             "sources": [
                 "src/definitions.js",
                 "src/operations.js",
-                "src/backend.js"
+                "src/backend.js",
+                "src/adyen.ts",
+                "../checkout/src/prepared-processor.ts"
             ]
         },
         {

package/dist/preflight-catalog.json

@@ -2984,7 +2984,8 @@
       },
       "limitations": [
         "Four encrypted card fields in the Adyen Sessions payments body are required.",
-        "Single-blob encryption, wallets, and stored-card variants are not covered."
+        "Single-blob encryption, wallets, and stored-card variants are not covered.",
+        "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."
       ],
       "unsupported_variants": [
         {
@@ -3013,7 +3014,9 @@
       "sources": [
         "src/definitions.js",
         "src/operations.js",
-        "src/backend.js"
+        "src/backend.js",
+        "src/adyen.ts",
+        "../checkout/src/prepared-processor.ts"
       ]
     },
     {

package/dist/preflight.generated.d.ts

@@ -497,7 +497,7 @@ export declare function getCheckoutPreflightCatalog(): {
                 readonly requirements: readonly ["verify_merchant_billing"];
             };
         };
-        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered."];
+        readonly limitations: readonly ["Four encrypted card fields in the Adyen Sessions payments body are required.", "Single-blob encryption, wallets, and stored-card variants are not covered.", "Adyen Web abandons its Sessions payment request 60 seconds after Pay. A prepared checkout moves the approval before Pay, so only the device-side encryption runs inside that window."];
         readonly unsupported_variants: readonly [{
             readonly variant: "single_blob_encryption";
             readonly status: "unsupported";
@@ -518,7 +518,7 @@ export declare function getCheckoutPreflightCatalog(): {
         readonly challenge_surface: "merchant_browser";
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
+        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "src/adyen.ts", "../checkout/src/prepared-processor.ts"];
     }, {
         readonly psp: "tranzila";
         readonly status: "supported";

package/dist/prepared-processor.d.ts

@@ -1,6 +1,9 @@
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
-/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. */
+/** How the approved card reaches the processor: the device's own request (token), or ciphertext the device produces for this browser to send (cse, Adyen). */
+export type PreparationMode = 'token' | 'cse';
+export declare function preparationMode(psp: string): PreparationMode;
+/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. Adyen can: test and live are separate hosts and key prefixes. */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 export declare function preparationEndpoint(psp: PreparationProcessor, environment: PreparationEnvironment): string;
 /** Processor identity and environment are part of the device's prior consent. */

package/dist/prepared-processor.js

@@ -1,15 +1,21 @@
+import { adyenPreparationUrl, isPreparedAdyenRequest } from './adyen.generated.js';
 import { braintreeEnvironment, isPreparedBraintreeRequest, readTokenizationJson } from './braintree.js';
 import { isPreparedRecurlyRequest } from './recurly.generated.js';
 import { isPreparedSpreedlyRequest, isSpreedlyTokenRequest, SPREEDLY_TOKEN_ENDPOINT } from './spreedly.generated.js';
-/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. */
+export function preparationMode(psp) {
+    return psp === 'adyen' ? 'cse' : 'token';
+}
+/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. Adyen can: test and live are separate hosts and key prefixes. */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
-    return ['square', 'braintree', 'worldpay'].includes(psp) && ['production', 'sandbox'].includes(environment);
+    return ['square', 'braintree', 'worldpay', 'adyen'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 export function preparationEndpoint(psp, environment) {
     if (!validPreparationEnvironment(psp, environment))
         throw new Error('unsupported_preparation_processor');
+    if (psp === 'adyen')
+        return adyenPreparationUrl(environment);
     if (psp === 'bambora')
         return 'https://api.bam.shift4api.net/scripts/tokenization/tokens';
     if (psp === 'mercado_pago')
@@ -70,6 +76,8 @@ function freshCardBody(psp, body) {
 export function matchesPreparedRequest(psp, environment, requestUrl, method, body) {
     if (method.toUpperCase() !== 'POST' || !validPreparationEnvironment(psp, environment))
         return false;
+    if (psp === 'adyen')
+        return isPreparedAdyenRequest(requestUrl, method, body ?? null, environment);
     if (psp === 'braintree')
         return braintreeEnvironment(requestUrl) === environment && isPreparedBraintreeRequest(body ?? null);
     if (psp === 'spreedly')

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "d47070197ee35cf4d02493c5f6c05446f11ff29a767061aa23c9670d871da5c1",
+  "catalog_sha256": "e1bbae82b91134c8be5919fddd5d60ea56f6897b570f8ccb2f305cd5b0a1c085",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/checkout",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Let browser agents pay with the user's own card, without your infrastructure ever touching card data.",
   "type": "module",
   "main": "dist/index.js",