@agent-cards/sdk 0.23.10 → 0.23.11

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Refuse a Worldline MyCheckout card submit whose card product is not the one its page chose. A MyCheckout page that offers several card products asks the shopper to choose one, then looks the typed number's IIN up with Worldline and switches the form to the product the answer names. With the agent's placeholder typed, that answer describes the placeholder: on 2026-10-12 CLZ's page read the Visa placeholder (411111) as Visa Electron (122) and switched the form from the Visa (1) the agent chose, and the cardholder's device, which checks only the card's network, would have submitted a Visa credit card as Visa Electron. Both adapters now remember the product each hosted checkout's select-payment-product step chose (that post carries no card and continues untouched) and abort a card submit that names another, before any create or prompt, with a `blocked` event, `worldline_mycheckout_product_changed`, or `worldline_mycheckout_product_missing` for one that names no product. Like the other per-request refusals it neither holds the attachment nor changes its state. A card-group page, and a hosted checkout whose choice the attachment never saw, are judged as before. `placeholderCard()` also takes `psp`, the processor whose card form the agent types into, so a processor can have its own placeholder for a network; none is set yet, so every processor still gets the network's default. Worldline stays dark for every company Agentcard has not turned it on for. No API or Vault release is needed.
+
+- Keep a checkout's outcome when your code cancels the attachment after the checkout ended. `cancel()` rewrote every state: a checkout with an authorization or a card request in flight read `outcome_unknown` with reason `local_cancel`, and any other read `cancelled`, so an integration that cancels at cleanup lost a definite answer. On 2026-10-12 a Rapyd checkout the processor refused read `declined` (`processor_refused`) until the runner's cleanup cancel turned it into `outcome_unknown`; a `completed` checkout would have gone the same way. A checkout that reads `completed`, `declined`, `failed`, `timed_out`, `unsupported`, `cancelled` or `outcome_unknown` now keeps its status and reason through `cancel()` once no card request is in flight, or once the request in flight has its own outcome recorded, so an application that cancels from `onStateChange` or the `failed` event after a processor refusal reads `declined`. `cancel()` still stops polling, aborts any paused request and refuses every later card request, and reports no state change. A checkout still under way is unchanged, and so is one whose card request is still in flight with no outcome of its own, such as a request the page dropped mid-approval, since that authorization can still be approved on the cardholder's device: `outcome_unknown` with reason `local_cancel` once a card request is in flight or an authorization exists, `cancelled` before. No API or Vault release is needed.
+
 - Pay IKEA US's ACI checkout as its live payment step sends it. With ACI's ReD Shield screening on, the widget posts the device fingerprint, `customer.browserFingerprint.value` alone, to the checkout's card URL on load, and 0.23.9 refused it as `aci_unsupported_request`. That refusal also failed the checkout's CVC request at once whenever it reached the SDK before the card-number request at Pay, so the widget's Pay failed. The fingerprint now continues untouched, up to the 4,096 characters ACI takes; a longer one is still refused, and a refused request that names no card number no longer fails the checkout's CVC or expiry requests, which wait for the card-number request as before. `/payment` now continues with `shopperResultTarget=_top`, the value IKEA's widget options set and ACI's own default for its final redirect, which 0.23.9 refused after the cardholder's device had already sent the card; any other target is still refused as `aci_unsupported_request`. No API or Vault release is needed.
 
 - Pay an APCOA airport drop-off entry on NMI's hosted payment page (`ekashu`). Every APCOA entry carries APCOA's own ASP.NET Core anti-forgery token, `__RequestVerificationToken`, and the API refused it as a field of NMI's card page (`hosted_form_field_refused`, reason `not_an_entry`), so an attached checkout at Heathrow's drop-off could not get past the create. The API now takes the merchant's token and still refuses an entry that carries `ekashu_stage`, `ekashu_context` or `ekashu_submission_id`. No SDK upgrade is needed: the API takes the entry once it deploys, and the cardholder's phone fills NMI's card page from the next Vault release. NMI stays off for every company Agentcard has not turned it on for.
@@ -20,9 +24,13 @@
 
 - Pay a Wyndham hotel booking through Shiji STS (MyCheck Wallet V3), for a company Agentcard turned Shiji STS on for. Wyndham's wallet sends its `getTokenId` with no `keySequence`, because its merchant records hold no `clientKey`, and the SDK refused every Shiji `getTokenId` in the browser as `shiji_sts_keep_on_file` while the API could bind none without a `keySequence`. The SDK now pauses that request for the one prompt, writes the cardholder's `pan` and `expires` over the page's own and continues it, then continues the page's `getCvvId` once with the cardholder's CVV under the key whose SHA-256 the API serves with the approval. That field is now `shiji_sts_companion.key_sequence_sha256` and replaces `key_sequences`: an approval in the old shape resolves as `PaymentOutcomeUnknownError` (`cse_substitutions_malformed`) and nothing continues. The cardholder approves with a card they stored, under a line that says the hotel can keep it on file, and the API refuses a card a company added with `409 card_not_stored`. Shiji STS stays dark for every company Agentcard has not turned on, and a payment also needs the matching API and Vault releases.
 
-- Hold a Tranzila card form to one charge that reports to the merchant or to Tranzila, read the way Tranzila's server reads it. Tranzila's own card form, on `direct.tranzila.com` and `directng.tranzila.com`, names its callbacks `success_url`, `fail_url` and `notify_url`, and the API held only the `*_url_address` names the merchant posts to Tranzila to the merchant's host. It now holds all six to the merchant's host or to Tranzila's own result page exactly (`https://direct.tranzila.com/done/`, `https://directng.tranzila.com/process/fail`) and refuses any other with `callback_host`. A form that asks for installments, credit or recurring billing (`cred_type` or `tash` other than 1, `npay` other than 0, any `fpay`, `spay` or `recur_*` value, a checked `make_recur_transaction`) is refused with `special_flow` where it passed as a plain sale. Tranzila's PHP server acts on the last copy of a repeated field and reads `cred.type` as `cred_type`, while the API read the first copy under the name as written, so a second `sum` could charge another amount than the one approved: a field posted twice with different values is now refused with `duplicate_field`, and a name PHP renames with `malformed_field`. Every Tranzila card form read on 2026-10-10 also carries Tranzila's ALTCHA field, which the API still refuses first with `hosted_form_gated`.
+- Hold a Tranzila card form to one charge that reports to the merchant or to Tranzila, read the way Tranzila's server reads it. Tranzila's own card form, on `direct.tranzila.com` and `directng.tranzila.com`, names its callbacks `success_url`, `fail_url` and `notify_url`, and the API held only the `*_url_address` names the merchant posts to Tranzila to the merchant's host. It now holds all six to the merchant's host or to Tranzila's own result page exactly (`https://direct.tranzila.com/done/`, `https://directng.tranzila.com/process/fail`) and refuses any other with `callback_host`. A form that asks for installments, credit or recurring billing (`cred_type` or `tash` other than 1, `npay` other than 0, any `fpay`, `spay` or `recur_*` value, a checked `make_recur_transaction`) is refused with `special_flow` where it passed as a plain sale. Tranzila's PHP server acts on the last copy of a repeated field and reads `cred.type` as `cred_type`, while the API read the first copy under the name as written, so a second `sum` could charge another amount than the one approved: a field posted twice with different values is now refused with `duplicate_field`, and a name PHP renames with `malformed_field`.
+
+- Pay a Tranzila card form that carries Tranzila's own ALTCHA proof of work. Every Tranzila card form read on 2026-10-10 (`iframenew.php` on `direct.tranzila.com` and `directng.tranzila.com`, the legacy `iframe.php` and the terminal page) runs an ALTCHA widget that searches for the number whose SHA-256 with the page's salt is its challenge, writes that proof into `altcha` and only then submits, and the API refused every such form with `hosted_form_gated`. The API now takes that one field, on Tranzila only, when it holds one ALTCHA proof whose hash holds, and the cardholder's device sends it once with the card, as the page wrote it. Anything else in `altcha` is refused with `hosted_form_field_refused`, reason `malformed_field`, and every other filled-in challenge field (reCAPTCHA, hCaptcha, Turnstile, or `altcha` on another processor) is still `hosted_form_gated`. No SDK or Vault release is needed: the API takes the form once it deploys.
+
+- Pause an Elavon Converge payment page opened on `www.convergepay.com`, where every Converge Buy Button and pay link sends the buyer, for a company Agentcard turned Converge on for. That page posts the card to its own origin, `https://www.convergepay.com/hosted-payments/service/payment/hpp/process`, and the SDK recognized the process call only on `api.convergepay.com` and the demo host, so the agent's placeholder card reached Converge. `www.convergepay.com` is a production host: a test row never pays there. A Buy Button's page also sends `recurring` as `"false"` in every request; that one-time sale now pauses where it was refused as `converge_recurring_refused`, and `"true"` or any other value is still refused.
 
-- Pause an Elavon Converge payment page opened on `www.convergepay.com`, where every Converge Buy Button and pay link sends the buyer, for a company Agentcard turned Converge on for. That page posts the card to its own origin, `https://www.convergepay.com/hosted-payments/service/payment/hpp/process`, and the SDK recognized the process call only on `api.convergepay.com` and the demo host, so the agent's placeholder card reached Converge. `www.convergepay.com` is a production host: a test row never pays there. A Buy Button's page also sends `recurring` as `"false"` in every request; that one-time sale now pauses where it was refused as `converge_recurring_refused`, and `"true"` or any other value is still refused. A page with its CAPTCHA on still stops with `converge_captcha_refused`, and every Buy Button page read so far has one.
+- Pause an Elavon Converge payment page with its CAPTCHA on once a person solved it, for a company Agentcard turned Converge on for. Every Buy Button and pay link page read so far shows a reCAPTCHA and sends its card request only after it is solved, with the answer in `captchaToken`, and earlier releases refused every such request as `converge_captcha_refused` before any create. The request now pauses like any other, and the cardholder's device sends the answer to Converge unchanged beside the card. A person solves the CAPTCHA in the browser, never your agent, and Google takes the answer once, for two minutes after the solve, so the cardholder approves inside that window. A `captchaToken` that is empty, not text, longer than 4,096 characters, or holds a character other than `A-Z`, `a-z`, `0-9`, `_` and `-` is still refused as `converge_captcha_refused`. A payment also needs the matching API and Vault releases.
 
 - Answer a prepared Bambora checkout inside Custom Checkout's 5 seconds. The card frame fails its tokenization request 5 seconds after Pay, and 0.23.9 read a prepared Bambora approval every 2 seconds, so a cardholder's answer that missed the first read waited for the read 4 seconds after the bind, at or past the frame's timer. The SDK now reads it every 100 ms for its first 10 seconds, and the API's bind names that interval on the row, so no read is refused with `slow_down`. When the frame gives up first anyway, the approval now outlives it, as an unprepared one does: once the device answers, the controller reads `ready_to_submit` with reason `awaiting_merchant_retry`, and when the merchant's next Pay click sends the same request again from the same card frame, the SDK answers it from the same approval with no second prompt. The approval stays with that card frame: the SDK refuses the same request from any other frame, and the page removing the card frame stops the attachment, as it does while the request is still paused, so a replacement frame never receives the token. 0.23.9 ended that checkout `outcome_unknown` and needed a new attachment and a second approval. Every other prepared checkout still answers only the request it was bound to. A payment also needs the matching API release.
 

package/README.md

@@ -260,7 +260,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | ACI Worldwide COPYandPAY (Halfords) | dark launch: served only after `syncRegistry()` and only for an org Agentcard enabled; prepared checkout only. The card-number request is replayed from the cardholder's device, the page's own CVC and expiry requests are answered locally, and `/payment` continues once. See [Pay an ACI COPYandPAY checkout](#pay-an-aci-copyandpay-checkout) |
 | Tranzila | supported (mode `hosted_form`): the cardholder finishes on Tranzila's own page; the paused form navigation resolves to a synthetic page, and you poll the merchant's order state |
 | Fiserv Commerce Hub | implemented (mode `cse`, prepared checkout only) and off until Agentcard turns it on for your company: the card frame's card capture on `connect.fiservapis.com` (or `connect-cert.fiservapis.com` in the sandbox), with the approved card encrypted on the cardholder's device under a key Agentcard reviewed for the merchant. A merchant whose frame posts to Fiserv's `payment-link` endpoint is not recognized. No live merchant purchase is verified yet |
-| Worldline MyCheckout | implemented (mode `hosted_form`) and off until Agentcard turns it on for your company: the card form on Worldline's hosted payment page, a top-level form POST to `/checkout` on `payment.pay1` or `payment.pay2` under `checkout.worldline-solutions.com` (pre-production: `payment.pay1.preprod` and `payment.pay2.preprod`). The cardholder's device submits Worldline's form with the approved card; the paused navigation resolves to the synthetic page, and you poll the merchant's order state. The form names no amount, so pass `amount` and `currency`, above zero: that is what the cardholder approves. A card submit with a checked "remember" box, a Google Pay token or a Click to Pay answer is refused. Google Pay and Click to Pay payments that carry no card number continue untouched, as the page's cancel and its other payment methods do: no authorization, no prompt. A MyCheckout page on a merchant's own subdomain is not recognized. No live merchant purchase is verified yet |
+| Worldline MyCheckout | implemented (mode `hosted_form`) and off until Agentcard turns it on for your company: the card form on Worldline's hosted payment page, a top-level form POST to `/checkout` on `payment.pay1` or `payment.pay2` under `checkout.worldline-solutions.com` (pre-production: `payment.pay1.preprod` and `payment.pay2.preprod`). The cardholder's device submits Worldline's form with the approved card; the paused navigation resolves to the synthetic page, and you poll the merchant's order state. The form names no amount, so pass `amount` and `currency`, above zero: that is what the cardholder approves. A card submit with a checked "remember" box, a Google Pay token or a Click to Pay answer is refused. Google Pay and Click to Pay payments that carry no card number continue untouched, as the page's cancel and its other payment methods do: no authorization, no prompt. A MyCheckout page on a merchant's own subdomain is not recognized. On a page that asks the shopper to choose a card product first, the adapters hold the card submit to that product: Worldline's IIN lookup on the agent's placeholder can switch the form to another product of the same network (CLZ's page read the Visa placeholder as Visa Electron), and a submit whose `paymentProductId` is not the product chosen is aborted before any create, with a `blocked` event, `worldline_mycheckout_product_changed` (`worldline_mycheckout_product_missing` when it names none), without holding the attachment. `placeholderCard({ psp })` returns a processor's own placeholder for the card's network where one is reviewed; none is yet for Worldline, so its Visa placeholder can still be read as Visa Electron, and that submit is then refused. No live merchant purchase is verified yet |
 | Verifone eCommerce (verifone.js) | implemented (mode `cse`, prepared checkout only) and off until Agentcard turns it on for your company: the SDK pauses a request at a merchant whose page encrypts the card with verifone.js and posts it to the merchant's own server only when Agentcard reviewed that merchant as a Verifone profile. The Container Store is the one profile, in `observe`, and Agentcard has reviewed its card request but not its key yet, so the SDK reports and aborts a request there that carries a verifone.js blob, and nothing pays (see "Verifone merchants that encrypt the card in the page"). Agentcard has not verified a live merchant purchase yet |
 | Gravy (Gr4vy) Secure Fields | dark launch: for an org Agentcard has enabled, after `vault.syncRegistry()`, which declares `gravy_session_fields_put`; for any other org the SDK leaves Gravy's requests alone and the request continues to Gravy untouched. The card request is Secure Fields' update of a checkout session: a JSON `PUT` to `/checkout/sessions/<session id>/fields` on the merchant's own host `api.<merchant>.gr4vy.app` (sandbox: `api.sandbox.<merchant>.gr4vy.app`), sent from Gravy's hidden controller frame and carrying `payment_method.number`, `payment_method.expiration_date` as one `MM/YY` value and `payment_method.security_code`. The SDK pauses that `PUT`, never a `POST` to the same URL; the cardholder's device sends the card as the same `PUT`, and the frame receives Gravy's answer, a `204` with no body. The request names no amount, so pass `amount` and `currency`. Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment. Gravy Embed, the hosted frame on `embed.<merchant>.gr4vy.app`, is not covered |
 | GMO Payment Gateway | dark launch (mode `token`): only for an org Agentcard has enabled; see [Pay a GMO Payment Gateway checkout](#pay-a-gmo-payment-gateway-checkout) |
@@ -707,8 +707,11 @@ is gone resolves as `PaymentOutcomeUnknownError` with reason
   callback URLs); all three are terminal for that page. A Tranzila form is
   also refused with `duplicate_field` (a field posted twice with different
   values: Tranzila acts on the last copy) or `malformed_field` (a field name
-  Tranzila's server reads as another name, such as `cred.type`), terminal
-  the same way. An Authorize.Net DPM or SIM form adds more reasons
+  Tranzila's server reads as another name, such as `cred.type`, or an
+  `altcha` field holding anything but the ALTCHA proof of work Tranzila's
+  own page writes there before it submits), terminal the same way. That
+  proof is the only filled-in challenge field the cardholder's device sends
+  with the card. An Authorize.Net DPM or SIM form adds more reasons
   (`duplicate_field`, `not_a_card_payment`, `relay_response_off`,
   `form_step`, `merchant_credential`, `test_request_on_live_host`,
   `malformed_field`), terminal the same way,
@@ -1279,8 +1282,15 @@ Lost authorization polling, local approval timeouts, or interrupted browser
 handoffs produce `outcome_unknown` and block automatic retry. The thrown
 `PaymentOutcomeUnknownError` carries `authorizationId` when creation was
 acknowledged. `checkout.cancel()` stops the local attachment and polling; it
-does not revoke a pending approval link or undo a processor payment. Cancellation
-after an attempt starts is therefore unknown until reconciled. A cancelled
+does not revoke a pending approval link or undo a processor payment. Cancelling
+an attempt still under way (a card request in flight, or an authorization not
+yet settled) therefore reads `outcome_unknown` with reason `local_cancel` until
+reconciled. A checkout that already ended keeps its state and reason:
+`completed`, `declined`, `failed`, `timed_out`, `unsupported`, `cancelled` and
+`outcome_unknown` read the same after `cancel()` once no card request is in
+flight, or once the request in flight has its own outcome recorded, as when
+your code cancels from `onStateChange` or the `failed` event. A cleanup that
+cancels never hides a processor refusal or a confirmed payment. A cancelled
 attachment cannot restart.
 
 ### Adyen merchants that take the card on their own server
@@ -1931,16 +1941,26 @@ const checkout = await attachToPlaywright(page, {
 - A Buy Button's page sends `recurring` as `"false"` in every request unless the
   buyer ticked the button's recurring box. That request is a one-time sale and
   pauses like any other; `"true"`, or any other value, is refused as recurring.
+- A page with its CAPTCHA on, as every Buy Button page read so far has it,
+  sends its card request only after the CAPTCHA is solved, with the answer in
+  `captchaToken`. A person solves it in the browser, never your agent, so a
+  browser that solves CAPTCHAs itself, such as Kernel with stealth on, must not
+  run a Converge page. The SDK
+  pauses that request like any other, and the cardholder's device sends the
+  answer to Converge unchanged beside the card. Google takes the answer once,
+  for two minutes after the solve, so the cardholder approves inside that
+  window.
 - Before any prompt, the SDK refuses every other shape on that URL with
   payment-core's own code (`ConvergeRefusalReason`, listed in
   `CONVERGE_REFUSAL_REASONS`), the one the API and the cardholder's device
   would answer: a wallet, the debit, gift card and push-to-card tabs, a
-  follow-up after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA, a
-  public-sector service fee, recurring or installment fields, card saving, a
-  tip or cash back, another currency, no amount, no page session, and anything
-  that is not the page's own request. The page's request is aborted, nothing is
-  created, and the attachment is not held, so the page's next payment is judged
-  afresh. The table below gives each code's meaning and the next step.
+  follow-up after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA
+  answer Google never issued, a public-sector service fee, recurring or
+  installment fields, card saving, a tip or cash back, another currency, no
+  amount, no page session, and anything that is not the page's own request.
+  The page's request is aborted, nothing is created, and the attachment is not
+  held, so the page's next payment is judged afresh. The table below gives each
+  code's meaning and the next step.
 - A terminal with 3-D Secure 2, Pay Defense or a surcharge answers the first
   request with a step instead of a result. The Vault never hands that answer to
   the page: the authorization ends declined as a processor refusal with
@@ -1983,7 +2003,7 @@ of the same code. `converge_step_unsupported`, `converge_declined` and
 | `converge_gift_card_refused` | The payment came from the page's gift card tab. | Pay with the credit card form. |
 | `converge_push_to_card_refused` | The payment would send money to the card instead of charging it. | None: an Agentcard card never receives money. |
 | `converge_payment_type_refused` | The body names a payment type other than a credit card sale, or an electronic check or financing payment carries a card number. | Pay with the credit card form. |
-| `converge_captcha_refused` | The page sent a CAPTCHA answer with the payment. | The buyer pays this merchant without Agentcard: the cardholder's device cannot answer a CAPTCHA. |
+| `converge_captcha_refused` | The request's `captchaToken` is not a solved reCAPTCHA answer: it is empty, not text, longer than 4,096 characters, or holds a character other than `A-Z`, `a-z`, `0-9`, `_` and `-`. | Have a person solve the page's CAPTCHA, then let the page send its own request. |
 | `converge_service_fee_refused` | The merchant adds a public-sector service fee, which Converge charges as a second payment. | The buyer pays this merchant without Agentcard: a one-time card cannot pay the second charge. |
 | `converge_3ds_follow_up_refused` | The body follows a 3-D Secure or Pay Defense step the page already ran. | Start a new checkout from the merchant's page. A terminal that runs the step on every payment cannot be paid through Agentcard yet. |
 | `converge_surcharge_refused` | The body follows a surcharge quote, or skips it with the debit bypass. | Start a new checkout from the merchant's page. A surcharging terminal cannot be paid through Agentcard yet. |

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 6a0cf6104aac41a93fb4788532c63075d6831419127b76b87228dd7839c2a106
+// artifact-sha256: 35f4549be2f1addcdcbaf1c7874a5022db72c1b74f27d85119b8c7da7757bd8c
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -75,6 +75,7 @@ var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
@@ -130,7 +131,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");

package/dist/cdp.js

@@ -30,6 +30,7 @@ import { CARD_ENDPOINT_REFUSED_STEP_ANSWER, CARD_ENDPOINT_WITHHELD_ANSWER, CardE
 import { CardEndpointFactsWatch } from './card-endpoint-facts.js';
 import { PAYRAILS_GUARD_PATTERNS, PAYRAILS_INIT_BODY_LIMIT, PayrailsSessionCapture, isPayrailsHost, payrailsInitCandidate, recognizesPayrails, } from './payrails.js';
 import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
+import { WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 /**
  * How an adapter fails a paused request it will not let through: as a network error for a
  * CyberSource Flex request (refusedRequestFailure, so the Microform field reports it to the page)
@@ -1988,6 +1989,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     let lastSubmitted = null;
     // The approved Datatrans answers, per frameId: the repeat rule (datatrans.ts).
     const datatransRepeats = new DatatransRepeats();
+    // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
+    const worldlineProducts = new WorldlineMyCheckoutProducts();
     // The Shiji STS getCvvId companion of the getTokenId this attachment last continued (shiji-sts.ts).
     // A cancelled attachment drops it, and the device's CVV ciphertext with it, at once: no getCvvId
     // can use it any more (pre-claim.ts refuses every one once the lifecycle is aborted). The page,
@@ -2455,6 +2458,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             frame: typeof frameId === 'string' && frameId ? frameId : undefined,
             payrails,
             shijiSts: { companions: shijiCompanions, page: () => cdpShijiPage(sessionId, frameId) },
+            worldlineMyCheckout: worldlineProducts,
         });
         const preClaim = preClaimResult instanceof Promise ? await preClaimResult : preClaimResult;
         if (preClaim.kind !== 'pause')
@@ -3318,6 +3322,8 @@ export async function attachToPlaywright(page, opts) {
     let lastSubmitted = null;
     // The approved Datatrans answers, per Frame: the repeat rule (datatrans.ts).
     const datatransRepeats = new DatatransRepeats();
+    // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
+    const worldlineProducts = new WorldlineMyCheckoutProducts();
     const frameOf = (request) => { try {
         return request.frame?.() ?? undefined;
     }
@@ -3457,6 +3463,7 @@ export async function attachToPlaywright(page, opts) {
                 frame: frameOf(request),
                 payrails,
                 shijiSts: { companions: shijiCompanions, page: async () => (await playwrightShijiDocumentPage(request)) ?? `pw:none:${++playwrightShijiSeq}` },
+                worldlineMyCheckout: worldlineProducts,
             });
             const preClaim = preClaimResult instanceof Promise ? await preClaimResult : preClaimResult;
             if (preClaim.kind !== 'pause')

package/dist/client.d.ts

@@ -739,6 +739,12 @@ export interface PlaceholderCard {
     /** The stored card's expiry year, four digits ("2031"). */
     readonly expiryYear: string;
 }
+/**
+ * The placeholder number for a network (lowercase, as GET /api/v2/vault_cards names it) on a
+ * processor's page: the processor's own number for that network when `overrides` names one, else
+ * the network's default, else undefined for a network with no placeholder.
+ */
+export declare function placeholderNumber(brand: string, psp?: string, overrides?: Readonly<Record<string, Readonly<Record<string, string>>>>): string | undefined;
 /**
  * The recognizer says this processor is preparation-required, and no preparation
  * was passed. Its card may be sent only after the cardholder approved a
@@ -1336,12 +1342,16 @@ export declare class VaultClient {
      * preselects that card: without a pin the page preselects its own choice (its recommended
      * card, or the first card the cardholder's device can open), which can be another card. After
      * prepare(), pass the prepared checkout's `cardId`, the card the cardholder already approved.
-     * The facts hold only while the cardholder pays with that card. Throws PlaceholderCardError
-     * when there is no such card, its network has no placeholder, or it carries no expiry.
+     * The facts hold only while the cardholder pays with that card. `psp` names the processor
+     * whose card form the agent types into (the recognizer's name, `worldline_mycheckout`): a
+     * processor that needs its own number for the card's network gets it, and every other gets the
+     * network's default. Throws PlaceholderCardError when there is no such card, its network has no
+     * placeholder, or it carries no expiry.
      */
     placeholderCard(input: {
         user: string;
         cardId?: string;
+        psp?: string;
         signal?: AbortSignal;
     }): Promise<PlaceholderCard>;
     /** Wait for real device approval before the caller starts native tokenization. */

package/dist/client.js

@@ -423,6 +423,35 @@ const PLACEHOLDER_NUMBERS = Object.freeze({
     discover: '6011000990139424',
     jcb: '3566111111111113',
 });
+/**
+ * The placeholder number a processor needs in place of its network's default above, by processor
+ * (the recognizer's `psp`) and network. A processor whose page reads the typed number's IIN to
+ * pick a card product can read the default as another product than the card that pays:
+ * Worldline MyCheckout read 4111111111111111 as Visa Electron (122), not Visa (1), on CLZ's live
+ * page on 2026-10-12, and switched its form's product. The SDK refuses that submit
+ * (worldline-mycheckout.ts), so until this table names a Visa number Worldline reads as product 1,
+ * a Visa card cannot pay on a MyCheckout page that offers Visa Electron. The default table stays
+ * as it is: CyberSource Flex's Microform rule, ACI's brand check and EBANX's eligibility guard
+ * read its Visa and Mastercard numbers.
+ *
+ * TODO(Felipe): pick worldline_mycheckout's Visa number from Worldline Connect's own test-card
+ * list, then confirm it with one production IIN check on a MyCheckout card form that offers
+ * products 1 and 122: type it, wait for the IIN answer, read paymentProductId and the logo, clear
+ * the field, never Pay. Add it here as `worldline_mycheckout: { visa: '<number>' }`, with the
+ * check's date and merchant, and to the live runner's placeholder allowlist.
+ */
+const PROCESSOR_PLACEHOLDER_NUMBERS = Object.freeze({});
+/**
+ * The placeholder number for a network (lowercase, as GET /api/v2/vault_cards names it) on a
+ * processor's page: the processor's own number for that network when `overrides` names one, else
+ * the network's default, else undefined for a network with no placeholder.
+ */
+export function placeholderNumber(brand, psp, overrides = PROCESSOR_PLACEHOLDER_NUMBERS) {
+    const own = psp !== undefined && Object.prototype.hasOwnProperty.call(overrides, psp) ? overrides[psp] : undefined;
+    if (own && Object.prototype.hasOwnProperty.call(own, brand))
+        return own[brand];
+    return Object.prototype.hasOwnProperty.call(PLACEHOLDER_NUMBERS, brand) ? PLACEHOLDER_NUMBERS[brand] : undefined;
+}
 /**
  * The recognizer says this processor is preparation-required, and no preparation
  * was passed. Its card may be sent only after the cardholder approved a
@@ -1405,12 +1434,17 @@ export class VaultClient {
      * preselects that card: without a pin the page preselects its own choice (its recommended
      * card, or the first card the cardholder's device can open), which can be another card. After
      * prepare(), pass the prepared checkout's `cardId`, the card the cardholder already approved.
-     * The facts hold only while the cardholder pays with that card. Throws PlaceholderCardError
-     * when there is no such card, its network has no placeholder, or it carries no expiry.
+     * The facts hold only while the cardholder pays with that card. `psp` names the processor
+     * whose card form the agent types into (the recognizer's name, `worldline_mycheckout`): a
+     * processor that needs its own number for the card's network gets it, and every other gets the
+     * network's default. Throws PlaceholderCardError when there is no such card, its network has no
+     * placeholder, or it carries no expiry.
      */
     async placeholderCard(input) {
         if (!input || typeof input.user !== 'string' || !input.user)
             throw new Error('placeholderCard needs the user whose stored card will pay.');
+        if (input.psp !== undefined && (typeof input.psp !== 'string' || !input.psp))
+            throw new Error('placeholderCard takes psp as the processor\'s name, such as worldline_mycheckout.');
         // The card list lives under /api/v2 only: the API aliases /v2/checkout alone without the prefix.
         const list = await this.get(`/api/v2/vault_cards?user_id=${encodeURIComponent(input.user)}`, input.signal);
         const cards = Array.isArray(list?.data) ? list.data : [];
@@ -1418,7 +1452,7 @@ export class VaultClient {
         if (!card || typeof card !== 'object' || typeof card.id !== 'string' || !card.id)
             throw new PlaceholderCardError('card_not_found');
         const brand = typeof card.brand === 'string' ? card.brand.toLowerCase() : '';
-        const number = Object.prototype.hasOwnProperty.call(PLACEHOLDER_NUMBERS, brand) ? PLACEHOLDER_NUMBERS[brand] : undefined;
+        const number = placeholderNumber(brand, input.psp);
         if (!number)
             throw new PlaceholderCardError('brand_unsupported');
         const month = card.expiry_month, year = card.expiry_year;

package/dist/elavon-converge.d.ts

@@ -7,9 +7,12 @@ export declare const CONVERGE_CAPABILITY = "converge_hpp_process";
  * the device refuses with, so an integrator reads one code whichever of them refused.
  *   - A shape the Vault never pays: `converge_wallet_refused`, `converge_debit_card_refused`,
  *     `converge_push_to_card_refused`, `converge_gift_card_refused`, `converge_payment_type_refused`,
- *     `converge_captcha_refused`, `converge_service_fee_refused`, `converge_recurring_refused`,
+ *     `converge_service_fee_refused`, `converge_recurring_refused`,
  *     `converge_card_saving_refused` (ssl_get_token or ssl_add_token), `converge_amount_add_on_refused`
  *     (a tip or cash back) and `converge_currency_refused` (anything but US dollars).
+ *   - A CAPTCHA answer Google never issued: `converge_captcha_refused` (a captchaToken that is not a
+ *     non-empty string of at most 4,096 URL-safe characters). A page with its CAPTCHA on pauses like
+ *     any other once a person solved it, and the answer rides to Converge unchanged.
  *   - A follow-up after a step the Vault cannot complete: `converge_3ds_follow_up_refused` (3-D
  *     Secure or Pay Defense) and `converge_surcharge_refused`.
  *   - A body the cardholder has nothing to approve on: `converge_amount_missing` and

package/dist/elavon-converge.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 009a8b902de51c4dadddae592b32d2edbd5b394f130938e1a41cd62a06a234a8
+// artifact-sha256: 136e1c2b0fd2bdee0cfbf5efbbfaf1a92ace7d1cc52e17a3fd5a4584370e5e53
 // src/elavon-converge.js
 var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com", "www.convergepay.com"]);
 var CONVERGE_DEMO_HOST = "api.demo.convergepay.com";
@@ -77,6 +77,7 @@ var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
@@ -132,7 +133,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");

package/dist/elavon-converge.js

@@ -25,9 +25,12 @@ export const CONVERGE_CAPABILITY = 'converge_hpp_process';
  * the device refuses with, so an integrator reads one code whichever of them refused.
  *   - A shape the Vault never pays: `converge_wallet_refused`, `converge_debit_card_refused`,
  *     `converge_push_to_card_refused`, `converge_gift_card_refused`, `converge_payment_type_refused`,
- *     `converge_captcha_refused`, `converge_service_fee_refused`, `converge_recurring_refused`,
+ *     `converge_service_fee_refused`, `converge_recurring_refused`,
  *     `converge_card_saving_refused` (ssl_get_token or ssl_add_token), `converge_amount_add_on_refused`
  *     (a tip or cash back) and `converge_currency_refused` (anything but US dollars).
+ *   - A CAPTCHA answer Google never issued: `converge_captcha_refused` (a captchaToken that is not a
+ *     non-empty string of at most 4,096 URL-safe characters). A page with its CAPTCHA on pauses like
+ *     any other once a person solved it, and the answer rides to Converge unchanged.
  *   - A follow-up after a step the Vault cannot complete: `converge_3ds_follow_up_refused` (3-D
  *     Secure or Pay Defense) and `converge_surcharge_refused`.
  *   - A body the cardholder has nothing to approve on: `converge_amount_missing` and

package/dist/lifecycle.d.ts

@@ -106,7 +106,14 @@ export interface CheckoutController {
     resume(result: ResumeResult): Promise<void>;
     /** Await device consent before the caller starts the first native Pay action. One use per attachment. */
     prepare(options: PrepareCheckoutOptions): Promise<PreparedCheckout>;
-    /** Stop locally and best-effort retire an unbound preparation. Does not cancel a processor payment. */
+    /**
+     * Stop locally and best-effort retire an unbound preparation. Does not cancel a processor payment.
+     * A checkout that already ended keeps its state and reason (`completed`, `declined`, `failed`,
+     * `timed_out`, `unsupported`, `cancelled`, `outcome_unknown`) once no card request is in flight, or
+     * once the request in flight has its own outcome recorded (a cancel from onStateChange or the `failed` event).
+     * Any other reads `outcome_unknown` once a card request is in flight or an authorization exists,
+     * and `cancelled` before, with reason `local_cancel`.
+     */
     cancel(): void;
     /** Ask the application's merchant resolver. A rejection records unknown; never automatically retries payment. */
     reconcile(): Promise<Readonly<CheckoutState>>;
@@ -131,6 +138,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private state;
     private held;
     private active;
+    private settled;
     private cancelled;
     private merchantAborted;
     private unboundStripeToken;

package/dist/lifecycle.js

@@ -2,6 +2,20 @@ import { AdyenTestPlatformRefusedError, ApprovalDeclinedError, ApprovalTimeoutEr
 import { CardEndpointRefusedError } from './card-endpoint.js';
 import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 import { isWspayChallenge } from './wspay.js';
+/**
+ * The statuses that end an attempt: its outcome is known (`completed`, `declined`, `failed`,
+ * `timed_out`, `unsupported`, `cancelled`), or the SDK already reported it unknown with its own
+ * reason (`outcome_unknown`). cancel() stops and holds the attachment but leaves these as they are,
+ * so an application that cancels at cleanup still reads the outcome, once no card request is in
+ * flight or the request in flight has its own outcome recorded. A checkout not started (`idle`) or
+ * still under way (`awaiting_approval`, `ready_to_submit`, `awaiting_merchant`, `requires_user_action`,
+ * or any status while a request whose outcome is not recorded is in flight) has none:
+ * cancelling it reads `outcome_unknown` once a request is in flight or an authorization exists,
+ * since a card or a token may still move, and `cancelled` before.
+ */
+const FINAL_STATUSES = new Set([
+    'completed', 'declined', 'failed', 'timed_out', 'unsupported', 'cancelled', 'outcome_unknown',
+]);
 /** How many times one approval's card-free Stripe confirmation may be checked before it is simply held. */
 export const MAX_STRIPE_CONTINUATION_CHECKS = 3;
 /**
@@ -29,6 +43,10 @@ export class CheckoutLifecycle {
     state = { status: 'idle', authorizationId: null };
     held = false;
     active = false;
+    // The card request in flight has its own outcome recorded (failed(), handedOff(), merchantNeverRetried()), and
+    // the adapter has yet to call end(): it still answers the page and tidies up. An application that cancels
+    // from onStateChange or the `failed` event runs in that window, and the request waits on nothing there.
+    settled = false;
     cancelled = false;
     merchantAborted = false;
     unboundStripeToken = false;
@@ -113,6 +131,7 @@ export class CheckoutLifecycle {
     }
     begin() {
         this.active = true;
+        this.settled = false;
         this.set({ status: 'awaiting_approval', authorizationId: null, ...(this.state.preparationId ? { preparationId: this.state.preparationId } : {}) });
     }
     end() { this.active = false; }
@@ -137,9 +156,20 @@ export class CheckoutLifecycle {
         catch { /* observer only */ }
     }
     cancel() {
+        // A checkout that already ended keeps its outcome: a refusal the processor gave, a payment the
+        // merchant confirmed, an unknown the SDK already named. Stopping the attachment afterwards
+        // changes nothing that happened, so only an attempt still under way reads as stopped here.
+        // A card request still in flight is under way whatever the state says: its authorization can
+        // still be approved on the cardholder's device, so cancelling it reads outcome_unknown as before.
+        // One whose own outcome is recorded (settled) is not: the adapter only has to finish answering
+        // the page, so a cancel from onStateChange or the `failed` event keeps that outcome.
+        // Read before the abort, so the state the application saw decides.
+        const ended = FINAL_STATUSES.has(this.state.status) && (!this.active || this.settled);
         this.cancelled = true;
         this.held = true;
         this.abort.abort();
+        if (ended)
+            return;
         this.set({ ...this.state, status: this.active || this.state.authorizationId ? 'outcome_unknown' : 'cancelled', reason: 'local_cancel' });
     }
     /** The exact browser request is gone; a late approval cannot reopen it. */
@@ -180,6 +210,7 @@ export class CheckoutLifecycle {
     merchantNeverRetried(authorizationId) {
         if (this.cancelled)
             return;
+        this.settled = true;
         this.set({ ...this.state, authorizationId, status: 'declined', reason: 'merchant_never_retried' });
     }
     /**
@@ -324,6 +355,7 @@ export class CheckoutLifecycle {
     handedOff(replay) {
         if (this.merchantAborted)
             return;
+        this.settled = true;
         if (this.ownedShopOrderId) {
             this.held = true;
             this.set({ status: 'completed', authorizationId: replay.authorizationId, mode: 'token', orderId: this.ownedShopOrderId });
@@ -359,6 +391,8 @@ export class CheckoutLifecycle {
     failed(error, handoffStarted = false) {
         if (this.cancelled)
             return;
+        // Before any state is set, so an observer that cancels from onStateChange sees the outcome as recorded.
+        this.settled = true;
         if (this.merchantAborted) {
             this.merchantRequestAborted();
             return;

package/dist/pre-claim.d.ts

@@ -12,6 +12,7 @@ import { type CybersourceFlexDecision, type CybersourceFlexPause, type FlexReque
 import { type CardEndpointProfile } from './card-endpoint.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
+import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 /** The native Stripe step the gate claimed, or null when none was: exactly what StripeCheckoutGate.claim returns. */
 type StripeStep = ReturnType<StripeCheckoutGate['claim']>;
 /** A synthetic response a gate fulfills locally. The effect applies CORS and encoding. */
@@ -183,6 +184,11 @@ export interface PreClaimContext {
         companions: ShijiStsCompanions;
         page: () => string | Promise<string>;
     };
+    /**
+     * The card products this attachment saw a Worldline MyCheckout page choose (worldline-mycheckout.ts).
+     * Absent, no MyCheckout card submit is held to a product here.
+     */
+    worldlineMyCheckout?: WorldlineMyCheckoutProducts;
 }
 /**
  * The URL an event may name for a request. For an armed merchant profile's
@@ -204,6 +210,7 @@ export declare const fiservPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
+export declare const worldlineMyCheckoutPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -17,7 +17,8 @@
 // no new card, Shiji STS's getTokenId and getCvvId, which also carry
 // requests the vault must never pay, and PayPal's legacy Hosted Fields
 // confirm and CyberSource Secure Acceptance's Silent Order POST, whose card
-// no Vault mode takes over.
+// no Vault mode takes over, and Worldline MyCheckout's card form, held to the
+// card product its page chose.
 // The first three used to be
 // written inline in Fetch.requestPaused and again in the page.route handler, so
 // a decision could drift between the two adapters and a new family had to be
@@ -77,6 +78,7 @@ import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
+import { isWorldlineMyCheckoutEndpoint } from './worldline-mycheckout.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -1288,11 +1290,11 @@ async function payrailsUnsupported(ctx, reason) {
 // www.convergepay.com or api.demo.convergepay.com, also carries electronic check and financing payments
 // with no card, and card-shaped bodies the Vault never pays: a wallet with a card
 // number the server supplied, the debit, gift card and push-to-card tabs, the
-// follow-ups after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA, a
-// service fee, recurring or installment fields, card saving, a tip, another
-// currency. So a POST the registry recognizes on a Converge host that carries a
-// card is judged here, before the terminal arbiter would pause it, by the
-// whole-request check the API runs at create:
+// follow-ups after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA answer
+// that is not a solved reCAPTCHA token, a service fee, recurring or installment
+// fields, card saving, a tip, another currency. So a POST the registry recognizes
+// on a Converge host that carries a card is judged here, before the terminal
+// arbiter would pause it, by the whole-request check the API runs at create:
 //   - the page's own first credit card sale defers, and the arbiter pauses it
 //     for approval;
 //   - anything else aborts with a `blocked` event naming payment-core's code
@@ -1697,6 +1699,44 @@ async function cybersourceSecureAcceptanceStop(ctx) {
     await ctx.effects.abort().catch(() => { });
     return { kind: 'abort' };
 }
+// Worldline MyCheckout (worldline-mycheckout.ts). Once the registry serves its recognizer (a build
+// that declares worldline_mycheckout_form, for an org Agentcard turned Worldline on for), every POST
+// to its four card-form endpoints reaches this gate first:
+//   - a product selection (no card, and neither the Pay nor the cancel pair: the post of the page's
+//     select-payment-product step) is remembered for its hosted checkout and defers, and the adapter
+//     continues it untouched as before (passWithoutCard);
+//   - a card submit whose paymentProductId is another product than the one chosen for its hosted
+//     checkout aborts with a `blocked` event, `worldline_mycheckout_product_changed`, and one that
+//     names no product with `worldline_mycheckout_product_missing`, with no claim, create or prompt.
+//     The page's IIN lookup on the agent's placeholder switched the product, and the cardholder's
+//     device, which checks only the real card's network, would submit the card under that product.
+//     Like Converge's refusals it neither holds the attachment nor changes its state, so the page's
+//     next submit is judged afresh;
+//   - anything else defers: a card submit with the chosen product, one on the card group, one on a
+//     hosted checkout whose choice this attachment never saw, the page's cancel, a redirect product.
+// Synchronous until the abort, so a card submit pauses with no await. Exported for the gate
+// registry's tests.
+export const worldlineMyCheckoutPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.worldlineMyCheckout || String(method).toUpperCase() !== 'POST' || !isWorldlineMyCheckoutEndpoint(url)
+        || !ctx.vault.isCardRequest(url, method))
+        return undefined;
+    let body;
+    // A reader that throws (Playwright's postData() can) proves nothing either way.
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        body = null;
+    }
+    const refusal = ctx.worldlineMyCheckout.judge(url, body);
+    return refusal === null ? undefined : worldlineMyCheckoutBlock(ctx, refusal);
+};
+async function worldlineMyCheckoutBlock(ctx, reason) {
+    ctx.onEvent?.({ type: 'blocked', detail: reason });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1731,7 +1771,7 @@ async function unsupportedContinue(ctx) {
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
 export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim,
-    cybersourceSecureAcceptancePreClaim];
+    cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: bbfd8946fd3963bf32fe66d5c17ba50dd69e141187c1d5896ee60c33b3aa0e41
+// artifact-sha256: 3f5ac5b4125cab96cc0851e9b1fe705aa96635e1df05b9216e951140fb47cd43
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -83,6 +83,7 @@ var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
@@ -138,7 +139,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 57dffa8575e71c819c694d818e272c955303add0ed4b083d69bab1606cd6150f
+// artifact-sha256: 0abf1d62c20303c4496e1d26b64b1c36ad517919d23f2d14e3f0b6763694551f
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -211,7 +211,18 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             // The result page Tranzila's card form names when the terminal set no
             // return URL of its own (read on both hosts on 2026-10-10): the result
             // goes back to Tranzila, which already holds it. Matched exactly.
-            processorResultUrls: ["https://direct.tranzila.com/done/", "https://directng.tranzila.com/process/fail"]
+            processorResultUrls: ["https://direct.tranzila.com/done/", "https://directng.tranzila.com/process/fail"],
+            // Tranzila's own ALTCHA proof of work, on every card form read on both
+            // hosts on 2026-10-10 (altcha 1.0.7, SHA-256, searched up to 50,000):
+            // Tranzila's script hashes the page's challenge until it finds the
+            // number, writes base64 JSON {algorithm, challenge, number, salt,
+            // signature, took} into `altcha`, and only then submits the form.
+            // Nobody answers anything and the proof names no browser, cookie or
+            // address, so it rides the device's one send as the page wrote it, once
+            // the create finds it is one solved proof (backend.js isAltchaProof).
+            // Every other challenge field is still refused (hosted_form_gated).
+            // Removing this line refuses `altcha` again.
+            proofOfWork: "altcha"
         }
     },
     {

package/dist/worldline-mycheckout.d.ts

@@ -0,0 +1,27 @@
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export declare function isWorldlineMyCheckoutEndpoint(url: string): boolean;
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = "worldline_mycheckout_product_changed";
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = "worldline_mycheckout_product_missing";
+export type WorldlineMyCheckoutRefusal = typeof WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED | typeof WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export declare class WorldlineMyCheckoutProducts {
+    private readonly chosen;
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url: string, body: string | null): WorldlineMyCheckoutRefusal | null;
+    private remember;
+}

package/dist/worldline-mycheckout.generated.d.ts

@@ -0,0 +1,29 @@
+declare var WORLDLINE_MYCHECKOUT_PSP: string;
+declare var WORLDLINE_MYCHECKOUT_CAPABILITY: string;
+declare var WORLDLINE_MYCHECKOUT_ENDPOINTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare function worldlineMyCheckoutEnvironment(url: any): "production" | "sandbox" | undefined;
+declare function isWorldlineMyCheckoutUrl(url: any): boolean;
+declare var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS: Readonly<{
+    visa: readonly string[];
+    mastercard: readonly string[];
+    amex: readonly string[];
+    discover: readonly string[];
+    jcb: readonly string[];
+    diners: readonly string[];
+}>;
+declare function worldlineMyCheckoutProductNetwork(productId: any): string | null;
+declare function parseWorldlineMyCheckoutForm(body: any): {
+    refusal: string;
+    pairs?: undefined;
+} | {
+    pairs: string[][];
+    refusal?: undefined;
+};
+declare function worldlineMyCheckoutCardholderName(name: any): string | null;
+declare function worldlineMyCheckoutTemplateRefusal(body: any): string | null;
+declare function worldlineMyCheckoutRequestRefusal(request: any): string | null;
+declare var WORLDLINE_MYCHECKOUT_DEDUPE: readonly string[];
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.generated.js

@@ -0,0 +1,162 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 486a32aa0f96f59666d4a43e42fee9f493cd3059b27ad3f92b97ad6b249133f5
+// src/worldline-mycheckout.js
+var WORLDLINE_MYCHECKOUT_PSP = "worldline_mycheckout";
+var WORLDLINE_MYCHECKOUT_CAPABILITY = "worldline_mycheckout_form";
+var WORLDLINE_MYCHECKOUT_ENDPOINTS = /* @__PURE__ */ Object.freeze({
+    production: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.checkout.worldline-solutions.com/checkout"
+    ]),
+    sandbox: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.preprod.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.preprod.checkout.worldline-solutions.com/checkout"
+    ])
+});
+function worldlineMyCheckoutEnvironment(url) {
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.production.includes(url))
+        return "production";
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.sandbox.includes(url))
+        return "sandbox";
+    return void 0;
+}
+function isWorldlineMyCheckoutUrl(url) {
+    return worldlineMyCheckoutEnvironment(url) !== void 0;
+}
+var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS = /* @__PURE__ */ Object.freeze({
+    visa: /* @__PURE__ */ Object.freeze(["1", "114", "122"]),
+    mastercard: /* @__PURE__ */ Object.freeze(["3", "119"]),
+    amex: /* @__PURE__ */ Object.freeze(["2"]),
+    discover: /* @__PURE__ */ Object.freeze(["128"]),
+    jcb: /* @__PURE__ */ Object.freeze(["125"]),
+    diners: /* @__PURE__ */ Object.freeze(["132"])
+});
+function worldlineMyCheckoutProductNetwork(productId) {
+    for (const [network, ids] of Object.entries(WORLDLINE_MYCHECKOUT_CARD_PRODUCTS)) {
+        if (ids.includes(productId))
+            return network;
+    }
+    return null;
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var FIELDS = {
+    publicMerchantId: /^[1-9]\d{0,9}$/,
+    variantCode: /^\d{1,10}$/,
+    locale: /^[a-z]{2}_[A-Z]{2}$/,
+    idempotenceKey: UUID,
+    // <merchant id>-<32 hex>:<hosted checkout id>:<32 hex>, the hosted checkout's own id.
+    token: /^[1-9]\d{0,9}-[0-9a-f]{32}:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}$/,
+    requestToken: UUID,
+    isPaymentProductDetailsShown: /^(?:true|false)$/,
+    isPaymentProductFiscalNumberShown: /^(?:true|false)$/,
+    jsEnabled: /^true$/,
+    isFramed: /^(?:true|false)$/,
+    paymentProductId: /^\d{1,4}$/,
+    paymentProductGroupId: /^cards$/,
+    colorDepth: /^\d{0,3}$/,
+    screenHeight: /^\d{0,5}$/,
+    screenWidth: /^\d{0,5}$/,
+    innerHeight: /^\d{0,5}$/,
+    innerWidth: /^\d{0,5}$/,
+    timezoneOffsetUtcMinutes: /^-?\d{0,4}$/,
+    browserLocale: /^[A-Za-z0-9-]{0,35}$/,
+    javaEnabled: /^(?:true|false)?$/,
+    cardNumber: /^[0-9 ]{12,23}$/,
+    // MM/YY as the page's mask writes it; the delimiter may be absent or padded.
+    expiryDate: /^(?:0[1-9]|1[0-2])(?: ?\/ ?)?\d{2}$/,
+    cvv: /^\d{3,4}$/,
+    cardholderName: /^[^\u0000-\u001f\u007f<>]{0,100}$/,
+    // The autofill helpers the page folds into expiryDate and then empties.
+    expiryDateMonth: /^$/,
+    expiryDateYear: /^$/,
+    // A checked "remember" asks Worldline to keep the card for later purchases.
+    remember: /^$/,
+    // Present, empty, on a page that offers Click to Pay; a value is a Click to Pay payment.
+    clickToPayCheckoutResponseSignature: /^$/,
+    // The Pay button's own pair. The click handler writes it into #buttonValue and appends one
+    // more copy per click, so it may repeat, always as doPayment=doPayment.
+    doPayment: /^doPayment$/
+};
+var REPEATABLE = /* @__PURE__ */ new Set(["doPayment"]);
+var REQUIRED = ["publicMerchantId", "token", "requestToken", "idempotenceKey", "doPayment", "cardNumber", "expiryDate", "cvv"];
+var NOT_A_CARD_SALE = /* @__PURE__ */ new Set(["cancelPayment", "encryptedPaymentData", "mobileCardholderName"]);
+var BODY_LIMIT = 16384;
+var VALUE_LIMIT = 2048;
+function parseWorldlineMyCheckoutForm(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT || /[^\x21-\x7e]/.test(body))
+        return { refusal: "body" };
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            return { refusal: "body" };
+        let key;
+        let value;
+        try {
+            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return { refusal: "body" };
+        }
+        if (value.length > VALUE_LIMIT || /[\u0000-\u001f\u007f]/.test(value))
+            return { refusal: "body" };
+        if (seen.has(key) && !REPEATABLE.has(key))
+            return { refusal: "body" };
+        seen.add(key);
+        pairs.push([key, value]);
+    }
+    return { pairs };
+}
+var SESSION_FIELDS = /* @__PURE__ */ new Set(["publicMerchantId", "token", "requestToken", "idempotenceKey"]);
+var CARD_FIELDS = /* @__PURE__ */ new Set(["cardNumber", "expiryDate", "cvv", "cardholderName", "expiryDateMonth", "expiryDateYear"]);
+function worldlineMyCheckoutCardholderName(name) {
+    if (typeof name !== "string")
+        return null;
+    const trimmed = name.trim();
+    return trimmed !== "" && FIELDS.cardholderName.test(trimmed) ? trimmed : null;
+}
+function worldlineMyCheckoutTemplateRefusal(body) {
+    const parsed = parseWorldlineMyCheckoutForm(body);
+    if (parsed.refusal)
+        return parsed.refusal;
+    const values = /* @__PURE__ */ new Map();
+    for (const [key, value] of parsed.pairs) {
+        if (NOT_A_CARD_SALE.has(key) || key === "clickToPayCheckoutResponseSignature" && value !== "")
+            return "not_a_card_sale";
+        if (key === "remember" && value !== "")
+            return "stored_card";
+        if (!Object.hasOwn(FIELDS, key))
+            return "unknown_field";
+        values.set(key, value);
+    }
+    for (const key of REQUIRED)
+        if (!values.has(key))
+            return "missing_field";
+    for (const [key, value] of parsed.pairs) {
+        if (FIELDS[key].test(value))
+            continue;
+        return SESSION_FIELDS.has(key) ? "session" : CARD_FIELDS.has(key) ? "card_fields" : "field_value";
+    }
+    if (values.get("token").split("-")[0] !== values.get("publicMerchantId"))
+        return "session";
+    const product = values.get("paymentProductId");
+    if (product === void 0 ? !values.has("paymentProductGroupId") : worldlineMyCheckoutProductNetwork(product) === null)
+        return "product";
+    return null;
+}
+function worldlineMyCheckoutRequestRefusal(request) {
+    if (!request || typeof request !== "object" || !isWorldlineMyCheckoutUrl(request.url))
+        return "endpoint";
+    if (request.method !== "POST")
+        return "method";
+    const headers = request.headers && typeof request.headers === "object" ? request.headers : {};
+    const types = Object.entries(headers).filter(([name]) => name.toLowerCase() === "content-type");
+    if (types.length !== 1 || typeof types[0][1] !== "string" || !/^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(types[0][1].trim()))
+        return "content_type";
+    return worldlineMyCheckoutTemplateRefusal(request.body);
+}
+var WORLDLINE_MYCHECKOUT_DEDUPE = /* @__PURE__ */ Object.freeze(["publicMerchantId", "token"]);
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.js

@@ -0,0 +1,93 @@
+// Worldline Connect MyCheckout (psp `worldline_mycheckout`): the hosted payment page whose card
+// form posts the card as a top-level navigation to /checkout on Worldline's own host. The form
+// rules are payment-core's (worldline-mycheckout.generated.ts): the API applies them at create,
+// and the cardholder's device applies them again before it rebuilds the form with the real card.
+// This module holds the one thing only the SDK can decide: which card product the page chose.
+//
+// A MyCheckout page that offers several card products asks the shopper to choose one first (its
+// select-payment-product page: Visa 1, Mastercard 3, Visa Electron 122, and so on). That choice
+// posts to the same /checkout URL with no card, and continues untouched. The card form it opens
+// then looks the typed number's IIN up with Worldline and, when the answer names another product
+// the page offers, switches its own paymentProductId to that product. With the agent's placeholder
+// typed, the answer describes the placeholder, never the card that pays: on 2026-10-12 CLZ's page
+// read the SDK's Visa placeholder (411111) as Visa Electron (122) and switched the form from the
+// Visa (1) the agent chose. The cardholder's device checks only that the product belongs to the
+// real card's network (Visa takes 1, 114 and 122), so it would have submitted a Visa credit card
+// as Visa Electron. The device never sees the choice and the API stores only the card form; this
+// attachment sees both posts, so the SDK holds the card submit to the product chosen for its
+// hosted checkout.
+//
+// The processor ships dark: the API serves the recognizer only to a build that declares
+// `worldline_mycheckout_form`, for an org Agentcard turned Worldline on for. Without it no
+// MyCheckout post pauses, and none reaches this module.
+import { isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm } from './worldline-mycheckout.generated.js';
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export function isWorldlineMyCheckoutEndpoint(url) {
+    return isWorldlineMyCheckoutUrl(url) === true;
+}
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = 'worldline_mycheckout_product_changed';
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = 'worldline_mycheckout_product_missing';
+/** How many hosted checkouts one attachment remembers a choice for; the oldest is forgotten first. */
+const REMEMBERED_CHECKOUTS = 32;
+const PRODUCT_ID = /^\d{1,4}$/;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export class WorldlineMyCheckoutProducts {
+    chosen = new Map();
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url, body) {
+        if (typeof body !== 'string' || !isWorldlineMyCheckoutUrl(url))
+            return null;
+        const parsed = parseWorldlineMyCheckoutForm(body);
+        if (!parsed.pairs)
+            return null;
+        const values = new Map();
+        for (const [key, value] of parsed.pairs)
+            if (!values.has(key))
+                values.set(key, value);
+        const merchant = values.get('publicMerchantId');
+        const token = values.get('token');
+        if (!merchant || !token)
+            return null;
+        const checkout = JSON.stringify([merchant, token]);
+        const product = values.get('paymentProductId');
+        // A card is a non-empty cardNumber, as the recognizer's card fields read it (card-fields.js).
+        if (!values.get('cardNumber')) {
+            if (values.has('doPayment') || values.has('cancelPayment'))
+                return null;
+            if (product !== undefined && PRODUCT_ID.test(product))
+                this.remember(checkout, product);
+            else if (values.get('paymentProductGroupId') === 'cards')
+                this.chosen.delete(checkout);
+            return null;
+        }
+        if (values.has('paymentProductGroupId'))
+            return null;
+        const chosen = this.chosen.get(checkout);
+        if (chosen === undefined)
+            return null;
+        if (!product)
+            return WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+        return product === chosen ? null : WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED;
+    }
+    remember(checkout, product) {
+        this.chosen.delete(checkout);
+        this.chosen.set(checkout, product);
+        while (this.chosen.size > REMEMBERED_CHECKOUTS)
+            this.chosen.delete(this.chosen.keys().next().value);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.10",
+  "version": "0.23.11",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",