@agent-cards/sdk 0.22.0 → 0.23.0

package/dist/pre-claim.d.ts

@@ -42,6 +42,7 @@ export type PreClaimDecision = {
     cybersourceFlex?: CybersourceFlexPause;
     cardEndpoint?: CardEndpointProfile;
     payrails?: PayrailsSidecar;
+    navigation?: 'top' | 'frame';
 };
 /** The adapter mechanics a gate performs. Each is awaited where the inline code
  * awaited it; none swallow their own transport failure (a gate adds a .catch
@@ -78,6 +79,13 @@ export interface PreClaimContext {
         /** The request is a frame's navigation (CDP resourceType Document, Playwright isNavigationRequest). Only the ACI gate reads it. */
         navigation?: boolean;
     };
+    /**
+     * What the browser said the paused request is: a navigation of the page ('top'), of an
+     * iframe ('frame'), or neither (null: a fetch, an XHR, a subresource). Read only for a
+     * card endpoint whose page submits its form as a navigation; an adapter that cannot
+     * tell answers null, which refuses such a card post.
+     */
+    navigation?: () => Promise<'top' | 'frame' | null>;
     /** cardOnFilePolicy: the policy the API served with the request's recognizer (VaultClient); absent reads as none.
      * withoutCard is VaultClient's own (card-fields.js requestWithoutCard); optional so a test double may omit it. */
     vault: {
@@ -191,6 +199,7 @@ export type PreClaimGate = (ctx: PreClaimContext) => PreClaimDecision | undefine
 export declare const MERCHANT_BODY_UNREADABLE = "the paused request carries no body the SDK could read, so Agentcard cannot tell whether it carries a card";
 export declare const verifonePreClaim: PreClaimGate;
 export declare const fiservPreClaim: PreClaimGate;
+export declare const ekashuPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -68,9 +68,11 @@ import { isShijiStsHost, shijiStsVerdict } from './shiji-sts.js';
 import { classifyProfileRequest, merchantBodyKeyPathSha256, profileTemplatedUrl } from './merchant-hosted.js';
 import { isFiservCaptureHost, isFiservPausableBody } from './fiserv.js';
 import { CYBERSOURCE_FLEX_PSP, isCybersourceFlexHost } from './cybersource-flex.js';
-import { cardEndpointDetail, cardEndpointFor, cardEndpointLive } from './card-endpoint.js';
+import { cardEndpointCarriesCard, cardEndpointDetail, cardEndpointFor, cardEndpointLive, cardEndpointPasses, cardEndpointResendFor, cardEndpointReviewed, } from './card-endpoint.js';
+import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
 import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsStaticHost, payrailsKeyRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
+import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -98,25 +100,158 @@ export function eventUrl(vault, url) {
 }
 // A reviewed merchant's own card endpoint (card-endpoint.ts). It runs first: its URLs
 // are merchant origins no processor gate claims, and one never reaches another gate. A
-// POST that is exactly a profile's card request pauses for the claim flow, carrying the
-// profile, when this build's copy of the profile takes payments. In any other status
-// (observe, a fact only a HAR can pin, no reviewed HAR, a recurring charge) it aborts as
-// an unsupported checkout, synchronously and before any create, so the placeholder card
-// never reaches the merchant; the event names the profile and the endpoint origin, never
-// the URL's path or query, which carry the merchant's cart and booking ids. Anything
-// else, a GET or a CORS preflight to the same URL included, defers.
+// POST to exactly a profile's card request URL is held only when it carries a card
+// (cardEndpointCarriesCard: anything at the profile's card number field, or a Luhn-valid
+// number anywhere in the body). Several of these URLs also take requests with no card,
+// such as an IHG stay paid with points, a LookFantastic order whose card a processor's
+// own fields tokenized, a saved card or a SynXis room guaranteed with a token: those
+// defer, and continue untouched as before any profile existed. A body the profile reads as
+// a card-free payment (its payment_method names another method: FastSpring's PayPal and
+// wallets post the same URL) also continues untouched, in every status, with an event that
+// says so, since no approval could cover it; one that names another method but carries a
+// card is held like any card request. A body the adapter could
+// not read, or an empty one, counts as carrying a card. A card request pauses for the claim flow,
+// carrying the profile, when this build's copy of the profile takes payments. In any
+// other status (observe, a fact only a HAR can pin, no reviewed HAR, a recurring
+// charge) it aborts as an unsupported checkout, synchronously and before any create, so
+// the placeholder card never reaches the merchant. The event names the profile only
+// when the body is the request the profile reviewed (its body rules, which never read
+// the status); a card in any other body is refused as an unrecognized payment endpoint
+// naming the endpoint origin alone. No event names the URL's path or query, which carry
+// the merchant's cart and booking ids. Anything else, a GET or a CORS preflight to the
+// same URL included, defers. A profile whose page submits its form as a navigation is
+// judged by cardEndpointNavigationPreClaim instead (below).
 const cardEndpointPreClaim = (ctx) => {
     const profile = cardEndpointFor(ctx.request.url, ctx.request.method);
     if (!profile)
         return undefined;
+    if (profile.navigation !== null)
+        return cardEndpointNavigationPreClaim(ctx, profile);
+    const { body, contentType } = cardEndpointPausedBody(ctx);
+    if (!cardEndpointCarriesCard(profile, body, contentType)) {
+        // A card-free payment the profile names (payment_method) continues untouched, and says so.
+        return profile.payment_method && cardEndpointPasses(profile, body, contentType) ? cardEndpointContinue(ctx, profile) : undefined;
+    }
     if (cardEndpointLive(profile))
         return { kind: 'pause', stripeStep: null, cardEndpoint: profile };
-    return cardEndpointUnsupported(ctx, profile);
+    return cardEndpointUnsupported(ctx, profile, cardEndpointReviewed(profile, body, contentType));
 };
-async function cardEndpointUnsupported(ctx, profile) {
+/** The paused body and its content type, as the adapter reports them. A reader that throws reads as no body. */
+function cardEndpointPausedBody(ctx) {
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        body = null;
+    }
+    let contentType;
+    try {
+        for (const [name, value] of Object.entries(ctx.request.headers ?? {})) {
+            if (name.toLowerCase() === 'content-type' && typeof value === 'string') {
+                contentType = value;
+                break;
+            }
+        }
+    }
+    catch {
+        contentType = undefined;
+    }
+    return { body, contentType };
+}
+/**
+ * Answer a paused card form navigation with the page that says Agentcard stopped it before
+ * its card left. While an approval is outstanding, or once a payment for this checkout may
+ * already exist, the page says a payment is in progress instead of that nothing was sent
+ * (card-endpoint-page.ts refusedNavigationOutcome), and names that payment's authorization.
+ */
+async function stopNavigationBeforeSend(ctx, profile, reason) {
+    const state = ctx.lifecycle.getState();
+    const outcome = refusedNavigationOutcome({ awaitingApproval: ctx.awaitingApproval(), status: state.status });
+    await ctx.effects.answer(cardEndpointStoppedPage({ outcome, reason, merchant: profile.merchant,
+        authorizationId: outcome === 'payment_in_progress' ? state.authorizationId : null }));
+    return { kind: 'answer' };
+}
+// A card endpoint whose page submits its form as a navigation (profile.navigation 'top'
+// or 'frame'). The same URL takes the page's other posts: a post that carries no card (a
+// cancel, another payment method) continues untouched, in any status. A card post that is
+// not a document navigation is a script's, not the form the review read: it is aborted,
+// since no page waits on it. A card post that navigates the wrong frame, or reaches a
+// profile this build does not pay, is answered with the page that says the payment was
+// stopped before the card left, never aborted: an aborted page load renders nothing and
+// invites another click on Pay. Only the reviewed navigation to a live profile pauses.
+async function cardEndpointNavigationPreClaim(ctx, profile) {
+    let body = null;
+    let contentType;
+    try {
+        body = ctx.request.body;
+        contentType = Object.entries(ctx.request.headers ?? {}).find(([name]) => name.toLowerCase() === 'content-type')?.[1];
+    }
+    catch {
+        body = null;
+    }
+    if (!cardEndpointCarriesCard(profile, body, contentType)) {
+        await ctx.effects.continueRequest();
+        return { kind: 'continue' };
+    }
+    let navigation = null;
+    try {
+        navigation = ctx.navigation ? await ctx.navigation() : null;
+    }
+    catch {
+        navigation = null;
+    }
+    if (navigation === null) {
+        ctx.onEvent?.({ type: 'card_endpoint_refused', detail: { ...cardEndpointDetail(profile), reason: 'request_unsupported', refusal: 'the card post is not a page navigation' } });
+        await ctx.effects.abort();
+        return { kind: 'abort' };
+    }
+    if (navigation !== profile.navigation) {
+        ctx.onEvent?.({ type: 'card_endpoint_refused', detail: { ...cardEndpointDetail(profile), reason: 'request_unsupported', refusal: `the card post navigates ${navigation === 'top' ? 'the page' : 'an iframe'}` } });
+        return stopNavigationBeforeSend(ctx, profile, 'request_unsupported');
+    }
+    if (!cardEndpointLive(profile)) {
+        ctx.preparationGate.invalidate('unsupported_checkout');
+        ctx.lifecycle.unsupported('merchant_card_endpoint_not_enabled');
+        ctx.onEvent?.({ type: 'unsupported_checkout', detail: { ...cardEndpointDetail(profile), reason: 'merchant_card_endpoint_not_enabled' } });
+        return stopNavigationBeforeSend(ctx, profile, 'not_enabled');
+    }
+    return { kind: 'pause', stripeStep: null, cardEndpoint: profile, navigation };
+}
+async function cardEndpointContinue(ctx, profile) {
+    ctx.onEvent?.({ type: 'card_endpoint_passed', detail: { ...cardEndpointDetail(profile), reason: 'card_free_payment' } });
+    await ctx.effects.continueRequest().catch(() => { });
+    return { kind: 'continue' };
+}
+// A request in which a reviewed merchant's page sends the typed card again outside its
+// card request (the profile's resends: FastSpring's EBANX step posts the number, code
+// and expiry it reads back from its form). It is aborted in every status, before any
+// other gate: the card it carries is the agent's placeholder, which the merchant must
+// never take for a payment, and no approval covers a second card request. The Vault's
+// device withholds the answer that starts that step, so this only fires when something
+// else started it.
+const cardEndpointResendPreClaim = (ctx) => {
+    const profile = cardEndpointResendFor(ctx.request.url, ctx.request.method);
+    if (!profile)
+        return undefined;
+    return cardEndpointResendRefused(ctx, profile);
+};
+async function cardEndpointResendRefused(ctx, profile) {
+    ctx.lifecycle.unsupported('merchant_card_endpoint_resend_refused');
+    ctx.onEvent?.({ type: 'card_endpoint_refused', detail: { ...cardEndpointDetail(profile), reason: 'card_resend' } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
+async function cardEndpointUnsupported(ctx, profile, reviewed) {
     ctx.preparationGate.invalidate('unsupported_checkout');
-    ctx.lifecycle.unsupported('merchant_card_endpoint_not_enabled');
-    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { ...cardEndpointDetail(profile), reason: 'merchant_card_endpoint_not_enabled' } });
+    if (reviewed) {
+        ctx.lifecycle.unsupported('merchant_card_endpoint_not_enabled');
+        ctx.onEvent?.({ type: 'unsupported_checkout', detail: { ...cardEndpointDetail(profile), reason: 'merchant_card_endpoint_not_enabled' } });
+    }
+    else {
+        ctx.lifecycle.unsupported();
+        ctx.onEvent?.({ type: 'unsupported_checkout', detail: { endpoint: profile.endpoint, method: ctx.request.method } });
+    }
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
@@ -1311,6 +1446,37 @@ async function shijiStsCompanion(ctx, body) {
     ctx.onEvent?.({ type: 'companion_continued', detail: { url: redactUrl(url), psp: 'shiji_sts', fields: ['cvv'] } });
     return { kind: 'continue' };
 }
+// NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
+// capability the API serves only to a company Agentcard turned NMI on for), every request to
+// NMI's two hosts pauses, and this gate judges the POSTs:
+//   - the merchant's entry (the host's root, no query) defers, and the terminal arbiter pauses it
+//     for the claim flow like any card request: the cardholder's device pays it;
+//   - every other POST to NMI (the card page's own post, its 3-D Secure calls) carries the card
+//     the agent typed, so it aborts as an unsupported checkout, and NMI never sees that card. The
+//     agent's browser only reaches NMI's card page when the entry was not paused (an attachment
+//     made too late, say), and then only the cardholder's device can pay.
+// A GET (the card page's images, its help page) is not this gate's and continues. With NMI not
+// served, the entry is no card request, the gate defers, and every request continues as before.
+// Synchronous until it must abort, like every gate. Exported for the gate registry's tests.
+export const ekashuPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isEkashuHost(url))
+        return undefined;
+    const entry = ekashuEntryUrl(url);
+    if (!entry || !ctx.vault.isCardRequest(entry, 'POST'))
+        return undefined;
+    if (isEkashuEntry(url, method))
+        return undefined;
+    return ekashuAbort(ctx);
+};
+async function ekashuAbort(ctx) {
+    const { url, method } = ctx.request;
+    ctx.preparationGate.invalidate('unsupported_checkout');
+    ctx.lifecycle.unsupported('processor_card_page');
+    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { url: eventUrl(ctx.vault, url), method, reason: 'processor_card_page' } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1344,7 +1510,7 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -2203,6 +2203,30 @@
       "hostname_pattern": "^commercehub-secure-data-capture\\.fiservapps\\.com$",
       "pathname_pattern": "^\\/sdk-secure\\/[0-9]+\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "ekashu-hosted-payment-page",
+      "psp": "ekashu",
+      "kinds": [
+        "form",
+        "document"
+      ],
+      "origin": "https://live.ekashu.com",
+      "path_pattern": "/",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.nmi.com/wp-content/uploads/2024/06/Version-AE-eKashu-Hosted-payment-page-Integration-Guide.pdf",
+          "reviewed_on": "2026-09-30"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://web.archive.org/web/20260307103902/https://live.ekashu.com/",
+          "reviewed_on": "2026-09-30"
+        }
+      ],
+      "hostname_pattern": "^live\\.ekashu\\.com$",
+      "pathname_pattern": "^\\/(?:index\\.php)?$"
+    },
     {
       "id": "verifone-secure-card-capture-script",
       "psp": "verifone",
@@ -4257,6 +4281,30 @@
       "hostname_pattern": "^commercehub-secure-data-capture-cert\\.fiservapps\\.com$",
       "pathname_pattern": "^\\/sdk-secure\\/[0-9]+\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "ekashu-hosted-payment-page-test",
+      "psp": "ekashu",
+      "kinds": [
+        "form",
+        "document"
+      ],
+      "origin": "https://test.ekashu.com",
+      "path_pattern": "/",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.nmi.com/wp-content/uploads/2024/06/Version-AE-eKashu-Hosted-payment-page-Integration-Guide.pdf",
+          "reviewed_on": "2026-09-30"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://web.archive.org/web/20260307103902/https://live.ekashu.com/",
+          "reviewed_on": "2026-09-30"
+        }
+      ],
+      "hostname_pattern": "^test\\.ekashu\\.com$",
+      "pathname_pattern": "^\\/(?:index\\.php)?$"
+    },
     {
       "id": "verifone-secure-card-capture-script-emea",
       "psp": "verifone",

package/dist/preflight-schemas.json

@@ -471,6 +471,7 @@
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
                 "fiserv-secure-data-capture-frame",
+                "ekashu-hosted-payment-page",
                 "verifone-secure-card-capture-script",
                 "gmo-mp-token-script",
                 "gmo-token-v1-script",
@@ -558,6 +559,7 @@
                 "fiserv-commercehub-payment-fields-cert",
                 "fiserv-commercehub-checkout-script-cert",
                 "fiserv-secure-data-capture-frame-cert",
+                "ekashu-hosted-payment-page-test",
                 "verifone-secure-card-capture-script-emea",
                 "verifone-secure-card-capture-script-uscst",
                 "verifone-secure-card-capture-script-cst",
@@ -1099,6 +1101,7 @@
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",
                       "fiserv-secure-data-capture-frame",
+                      "ekashu-hosted-payment-page",
                       "verifone-secure-card-capture-script",
                       "gmo-mp-token-script",
                       "gmo-token-v1-script",
@@ -1186,6 +1189,7 @@
                       "fiserv-commercehub-payment-fields-cert",
                       "fiserv-commercehub-checkout-script-cert",
                       "fiserv-secure-data-capture-frame-cert",
+                      "ekashu-hosted-payment-page-test",
                       "verifone-secure-card-capture-script-emea",
                       "verifone-secure-card-capture-script-uscst",
                       "verifone-secure-card-capture-script-cst",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: ed01cf8d69fe6aa9e1be54dfd1a9b1e20cdfcb3a498f4b8a934726e38a1639ba
+// source-sha256: 3adb75196b940ea807d3290f096e585d6519543d18ec6426daf8b0031acbacb8
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -68,6 +68,14 @@ RULES.push({ id: 'fiserv-commercehub-payment-fields', psp: 'fiserv', kinds: ['sc
     sources: [fiservSource('https://commercehub-checkout.fiservapps.com/sdk/3.8.14/payment-fields.js'), fiservSource('https://orangepay-ecommerce.hdpayments.homedepot.com/env.js')] }, { id: 'fiserv-commercehub-checkout-script', psp: 'fiserv', kinds: ['script'], hostname: /^commercehub-checkout\.fiservapps\.com$/, pathname: /^\/sdk\/[0-9]+\.[0-9]+\.[0-9]+\/checkout\.js$/, origin: 'https://commercehub-checkout.fiservapps.com', path_pattern: '/sdk/:version/checkout.js',
     sources: [fiservSource('https://developer.fiserv.com/product/CommerceHub/docs/Online-Commerce/Integration-Options/Hosted-Checkout/Hosted-Checkout-Version-Release')] }, { id: 'fiserv-secure-data-capture-frame', psp: 'fiserv', kinds: ['frame', 'iframe', 'document'], hostname: /^commercehub-secure-data-capture\.fiservapps\.com$/, pathname: /^\/sdk-secure\/[0-9]+\.[0-9]+\.[0-9]+\/iframe\.html$/, origin: 'https://commercehub-secure-data-capture.fiservapps.com', path_pattern: '/sdk-secure/:version/iframe.html',
     sources: [fiservSource('https://commercehub-checkout.fiservapps.com/sdk/3.8.14/payment-fields.js'), fiservSource('https://commercehub-secure-data-capture.fiservapps.com/sdk-secure/3.8.14/iframe.html')] });
+// NMI Hosted Payment Page (formerly eKashu): the merchant's own entry form posts top-level to
+// live.ekashu.com, and NMI's card page is that host's root document (integration guide AE; the
+// archived card pages in test/fixtures/ekashu). NMI ships dark (its definition names a
+// capability), so the bundled catalog declares no support for it: these identify ekashu and the
+// result stays unknown.
+const ekashuSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-09-30' });
+RULES.push({ id: 'ekashu-hosted-payment-page', psp: 'ekashu', kinds: ['form', 'document'], hostname: /^live\.ekashu\.com$/, pathname: /^\/(?:index\.php)?$/, origin: 'https://live.ekashu.com', path_pattern: '/',
+    sources: [ekashuSource('https://www.nmi.com/wp-content/uploads/2024/06/Version-AE-eKashu-Hosted-payment-page-Integration-Guide.pdf'), ekashuSource('https://web.archive.org/web/20260307103902/https://live.ekashu.com/')] });
 // Verifone eCommerce, read 2026-09-25 from Verifone's own hosts and docs: a merchant page
 // that encrypts the card itself (Secure Card Capture) loads verifone.js from Verifone's
 // jsclient host for its region, byte-identical on every host. Verifone ships dark (its
@@ -322,6 +330,8 @@ for (const [baseId, suffix, hostname, origin] of [
     ['fiserv-commercehub-payment-fields', 'cert', /^commercehub-checkout-cert\.fiservapps\.com$/, 'https://commercehub-checkout-cert.fiservapps.com'],
     ['fiserv-commercehub-checkout-script', 'cert', /^commercehub-checkout-cert\.fiservapps\.com$/, 'https://commercehub-checkout-cert.fiservapps.com'],
     ['fiserv-secure-data-capture-frame', 'cert', /^commercehub-secure-data-capture-cert\.fiservapps\.com$/, 'https://commercehub-secure-data-capture-cert.fiservapps.com'],
+    // NMI's test platform (integration guide AE, "Form creation").
+    ['ekashu-hosted-payment-page', 'test', /^test\.ekashu\.com$/, 'https://test.ekashu.com'],
     // Verifone's other regions and its two sandboxes serve the same verifone.js.
     ['verifone-secure-card-capture-script', 'emea', /^emea\.jsclient\.verifone\.cloud$/, 'https://emea.jsclient.verifone.cloud'],
     ['verifone-secure-card-capture-script', 'uscst', /^uscst\.jsclient\.vficloud\.net$/, 'https://uscst.jsclient.vficloud.net'],

package/dist/preparation.d.ts

@@ -1,18 +1,24 @@
 import { type PreparedCheckout } from './client.js';
 import type { AttachOptions } from './cdp.js';
 import type { CheckoutLifecycle } from './lifecycle.js';
+import type { LoadedCardMicroform } from './cybersource-flex.js';
 /** A local, one-use rendezvous. It never starts or retries a merchant request. */
 export declare class PreparationGate {
     private readonly opts;
     private readonly lifecycle;
     private readonly readDocumentUrl;
+    private readonly readMicroform?;
     private state;
     private observedRequest;
     private documentUrl;
     private prepared?;
     private stop;
     private expiryTimer?;
-    constructor(opts: AttachOptions, lifecycle: CheckoutLifecycle, readDocumentUrl: () => Promise<string>);
+    /**
+     * `readMicroform`: the adapter's read of the card Microform the page loaded (cybersource-flex.ts
+     * loadedCardMicroform), for prepare({ psp: 'cybersource_flex', tokenizeBeforePay: true }).
+     */
+    constructor(opts: AttachOptions, lifecycle: CheckoutLifecycle, readDocumentUrl: () => Promise<string>, readMicroform?: (() => LoadedCardMicroform | Promise<LoadedCardMicroform>) | undefined);
     private prepare;
     /**
      * Called for every recognized card request, before any await or local retry guard. The request's

package/dist/preparation.js

@@ -6,16 +6,22 @@ export class PreparationGate {
     opts;
     lifecycle;
     readDocumentUrl;
+    readMicroform;
     state = 'unused';
     observedRequest = false;
     documentUrl = '';
     prepared;
     stop = new AbortController();
     expiryTimer;
-    constructor(opts, lifecycle, readDocumentUrl) {
+    /**
+     * `readMicroform`: the adapter's read of the card Microform the page loaded (cybersource-flex.ts
+     * loadedCardMicroform), for prepare({ psp: 'cybersource_flex', tokenizeBeforePay: true }).
+     */
+    constructor(opts, lifecycle, readDocumentUrl, readMicroform) {
         this.opts = opts;
         this.lifecycle = lifecycle;
         this.readDocumentUrl = readDocumentUrl;
+        this.readMicroform = readMicroform;
         lifecycle.setPreparationHandler(options => this.prepare(options));
         lifecycle.abort.signal.addEventListener('abort', () => this.invalidate('cancelled'), { once: true });
     }
@@ -39,6 +45,22 @@ export class PreparationGate {
         try {
             if (!options || !validPreparationEnvironment(options.psp, options.environment))
                 throw new CheckoutPreparationError(null, 'unsupported_processor');
+            // CyberSource Flex, tokenized before Pay: the preparation carries the capture context and the
+            // fields of the card Microform this page loaded, so the cardholder's device seals the card and
+            // gets CyberSource's token when it approves. A page that races createToken against seconds
+            // (Alaska Airlines' flight checkout gives it three) is then answered at once after Pay.
+            let cybersourceFlex;
+            if (options.tokenizeBeforePay !== undefined && typeof options.tokenizeBeforePay !== 'boolean') {
+                throw new CheckoutPreparationError(null, 'tokenize_before_pay_invalid');
+            }
+            if (options.tokenizeBeforePay) {
+                if (options.psp !== 'cybersource_flex')
+                    throw new CheckoutPreparationError(null, 'unsupported_processor');
+                const loaded = (await this.readMicroform?.()) ?? { ok: false, reason: 'microform_not_loaded' };
+                if (!loaded.ok)
+                    throw new CheckoutPreparationError(null, loaded.reason);
+                cybersourceFlex = { captureContext: loaded.captureContext, microform: { version: loaded.microform.version, fields: [...loaded.microform.fields] } };
+            }
             // A Fiserv checkout's merchantProfile names a key pin, which prepareCheckout checks: its
             // capture endpoint is checked below like any processor-hosted checkout's.
             if (options.psp === 'verifone') {
@@ -88,6 +110,7 @@ export class PreparationGate {
                 ...options, user: this.opts.user, merchant: this.opts.merchant,
                 amount: this.opts.amount, currency: this.opts.currency, cardId: this.opts.cardId,
                 merchantOrigin: page.origin, checkoutKey: crypto.randomUUID(), timeoutMs: this.opts.timeoutMs, signal,
+                ...(cybersourceFlex ? { cybersourceFlex } : {}),
                 onPreparationCreated: id => this.lifecycle.preparationCreated(id),
                 onApprovalUrl: url => {
                     if (!signal.aborted) {
@@ -101,8 +124,10 @@ export class PreparationGate {
             });
             this.prepared = prepared;
             // A Fiserv preparation also names the key pin the cardholder approves (merchantProfile).
+            // One that tokenizes before Pay names the capture context its cardholder approved under.
             if (prepared.psp !== options.psp || prepared.environment !== options.environment
-                || prepared.merchantProfile !== options.merchantProfile)
+                || prepared.merchantProfile !== options.merchantProfile
+                || (prepared.cybersourceFlex?.captureContext ?? null) !== (cybersourceFlex?.captureContext ?? null))
                 throw new CheckoutPreparationError(prepared.id, 'checkout_changed');
             if (signal.aborted || this.state !== 'preparing') {
                 void this.cancelThenObserve(prepared.id, 'cancelled');

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: f3bee23e52b029d04c67ea1b9249334bd649c09b46367ee3c8afcb841a7cb50d
+// artifact-sha256: 2a58cd64ab81d468d022c21c6f4d6be6e5be4cd29acd1ad8576b549981433afa
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -180,6 +180,70 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             callbackUrls: ["success_url_address", "fail_url_address", "notify_url_address"]
         }
     },
+    {
+        psp: "ekashu",
+        // NMI Hosted Payment Page (formerly eKashu, the Creditcall gateway): the card page
+        // London Luton's drop-off charge, and APCOA's other airport tenants, send the driver to.
+        // The merchant's page posts an ENTRY form top-level to live.ekashu.com/ (test:
+        // test.ekashu.com/) with the amount, the result URLs and a SHA256HMAC over them (hash
+        // code 2.0.0), and no card. NMI answers with its own card page under an HttpOnly session
+        // cookie and an anti-forgery token, so a card form rebuilt away from that session is
+        // refused by NMI (processors/ekashu.js has the recorded shapes). The paused request is
+        // therefore the entry, a Document navigation that carries no card: the cardholder's
+        // device repeats it over the end-to-end TLS relay, fills the card into the page NMI
+        // returns to it and posts it back in that same session, and the runtime resolves the
+        // paused navigation with the hosted_form notice. Only the entry path is matched: NMI's
+        // card post (/index.php) and its 3-D Secure calls (ajax_3d_secure_v2_*.php) carry a card,
+        // and the SDK refuses them in the agent's browser, so no dummy card ever reaches NMI.
+        // Dark: served only to a client that declares the capability, and gated off for every
+        // org the operator has not allowlisted.
+        capability: "ekashu_hosted_payment_page",
+        match: "(?:live|test)\\.ekashu\\.com/",
+        hosts: ["^live\\.ekashu\\.com$", "^test\\.ekashu\\.com$"],
+        sandboxHosts: ["^test\\.ekashu\\.com$"],
+        // A live row reaches live.ekashu.com only and a test row test.ekashu.com only, and the
+        // test host receives only documented test cards (device-replay.js).
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the page NMI returns to the device, not into the paused entry,
+            // which must carry none (processors/ekashu.js checkEkashuEntry). The device never
+            // posts a form of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The server callback too: the device never returns the buyer's browser to the merchant,
+            // so a merchant NMI tells of a payment only through that return never records it.
+            required: [
+                "ekashu_seller_id",
+                "ekashu_seller_key",
+                "ekashu_amount",
+                "ekashu_currency",
+                "ekashu_reference",
+                "ekashu_hash_code",
+                "ekashu_hash_code_type",
+                "ekashu_hash_code_version",
+                "ekashu_success_url",
+                "ekashu_failure_url",
+                "ekashu_callback_success_url"
+            ],
+            card: {
+                number: "ekashu_card_number",
+                month: "ekashu_expires_end_month",
+                year: "ekashu_expires_end_year",
+                cvc: "ekashu_verification_value",
+                firstName: "ekashu_card_first_name",
+                lastName: "ekashu_card_last_name"
+            },
+            amount: { sum: "ekashu_amount", currency: "ekashu_currency" },
+            // The terminal, the merchant's own reference and the amount name one payment; NMI's
+            // duplicate check (ekashu_duplicate_check) keys on the same reference.
+            dedupe: ["ekashu_seller_id", "ekashu_reference", "ekashu_amount", "ekashu_currency"],
+            sale: { key: "ekashu_request_type", values: ["AUTH"] },
+            token: "ekashu_card_reference",
+            callbackUrls: ["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1249,6 +1313,7 @@ var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
             ...definition.hostedForm.card,
             ...definition.hostedForm.optional ? { optional: definition.hostedForm.optional } : {}
         } } : {},
+    ...definition.hostedForm?.cardIn ? { formCardIn: definition.hostedForm.cardIn } : {},
     ...definition.deviceSteps ? { deviceSteps: Object.fromEntries(Object.entries(definition.deviceSteps).map(([step, source]) => [step, new RegExp(source, "i")])) } : {},
     ...definition.deviceEncrypt ? { deviceEncrypt: definition.deviceEncrypt } : {}
 })));

package/dist/verifone.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 8662ff17d627e5c2cbce96a2415983d8531f874b2d7c96a03795777a6db4bc2b
+// artifact-sha256: cf655438763f54e5d5bfea2555f76941ef80dbfd5aa7bc6342a2a75d1ac9cd39
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -231,9 +231,14 @@ var PLACEHOLDER_NAME = /^[A-Za-z][A-Za-z0-9_]{0,31}$/;
 var LITERAL_SEGMENT = /^[A-Za-z0-9._~@+-]{1,256}$/;
 var QUERY_KEY = /^[A-Za-z0-9._~-]{1,64}$/;
 var QUERY_LITERAL = /^[A-Za-z0-9._~,-]{0,256}$/;
+var QUERY_PREFIX = /^(?:[A-Za-z0-9._~,-]|%[0-9A-F]{2}){1,64}$/;
 var MAX_QUERIES = 8;
 var MAX_PAIRS = 16;
 var placeholderValue = (value) => PLACEHOLDER_VALUE.test(value) && value !== "." && !value.includes("..");
+function queryPlaceholder(value) {
+    const mark = value.lastIndexOf(":");
+    return mark === -1 ? null : { prefix: value.slice(0, mark), name: value.slice(mark + 1) };
+}
 function pathPlaceholders(template, pathname) {
     if (typeof template !== "string" || typeof pathname !== "string")
         return null;
@@ -275,10 +280,14 @@ function queryPlaceholders(query, text) {
         const written = got[i].slice(mark + 1);
         if (typeof value !== "string")
             return null;
-        if (value.startsWith(":")) {
-            if (!placeholderValue(written))
+        const placeholder = queryPlaceholder(value);
+        if (placeholder) {
+            if (!written.startsWith(placeholder.prefix))
+                return null;
+            const rest = written.slice(placeholder.prefix.length);
+            if (!placeholderValue(rest))
                 return null;
-            values[value.slice(1)] = written;
+            values[placeholder.name] = rest;
         }
         else if (written !== value) {
             return null;
@@ -327,9 +336,11 @@ function templatePlaceholders(template) {
     const queries = Array.isArray(template?.queries) ? template.queries : [template?.query];
     for (const query of queries) {
         if (query && typeof query === "object") {
-            for (const value of Object.values(query))
-                if (typeof value === "string" && value.startsWith(":"))
-                    names.push(value.slice(1));
+            for (const value of Object.values(query)) {
+                const placeholder = typeof value === "string" ? queryPlaceholder(value) : null;
+                if (placeholder)
+                    names.push(placeholder.name);
+            }
         }
     }
     return names;
@@ -364,7 +375,8 @@ function queryTemplateRefusal(query) {
             return `the query key "${key}" is not unreserved characters`;
         if (typeof value !== "string")
             return `the query value of ${key} is not text`;
-        if (value.startsWith(":") ? !PLACEHOLDER_NAME.test(value.slice(1)) : !QUERY_LITERAL.test(value)) {
+        const placeholder = queryPlaceholder(value);
+        if (placeholder ? !PLACEHOLDER_NAME.test(placeholder.name) || placeholder.prefix !== "" && !QUERY_PREFIX.test(placeholder.prefix) : !QUERY_LITERAL.test(value)) {
             return `the query value of ${key} is neither a literal nor a :name placeholder`;
         }
     }