@agent-cards/sdk 0.23.11 → 0.23.13

package/dist/pre-claim.js

@@ -79,6 +79,7 @@ import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
 import { isWorldlineMyCheckoutEndpoint } from './worldline-mycheckout.js';
+import { paddleVgsPayEventUrl } from './paddle-vgs-pay.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -1737,6 +1738,52 @@ async function worldlineMyCheckoutBlock(ctx, reason) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// Paddle's /pay (paddle-vgs-pay.ts), held only on an attachment the API served Paddle VGS to: a POST to /pay
+// that names a stored card continues with the approved card's first six, last four, expiry and brand written
+// over the ones the frame read from the agent's placeholder, when this attachment handed that frame the stored
+// card's id within the minute and this is its first /pay; otherwise it aborts as an unsupported checkout, with
+// the gate's reason, so Paddle never receives the real card's id beside the placeholder's facts. Anything else
+// on Paddle's checkout services (its create, the buyer's first step, 3-D Secure's follow-up, a PayPal or wallet
+// /pay naming no stored card) defers, and the terminal arbiter continues it untouched. Synchronous until the
+// continue or the abort.
+export const paddleVgsPayPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.paddleVgsPay?.holds(url, method))
+        return undefined;
+    let body;
+    // A reader that throws (Playwright's postData() can) proves nothing: judged as a body that is not the frame's.
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        body = null;
+    }
+    const judged = ctx.paddleVgsPay.judge(ctx.frame, url, method, body);
+    if (judged === null)
+        return undefined;
+    return 'reason' in judged ? paddleVgsPayRefused(ctx, judged.reason) : paddleVgsPayContinued(ctx, judged.body);
+};
+async function paddleVgsPayRefused(ctx, reason) {
+    const { url, method } = ctx.request;
+    ctx.preparationGate.invalidate('unsupported_checkout');
+    ctx.lifecycle.unsupported(reason);
+    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { url: paddleVgsPayEventUrl(url), method, reason } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
+async function paddleVgsPayContinued(ctx, body) {
+    try {
+        await ctx.effects.continueRequest(body);
+    }
+    catch (error) {
+        ctx.onEvent?.({ type: 'failed', detail: ctx.failureSummary(error) });
+        await ctx.effects.abort().catch(() => { });
+        return { kind: 'abort' };
+    }
+    ctx.onEvent?.({ type: 'companion_continued', detail: { url: paddleVgsPayEventUrl(ctx.request.url), psp: 'paddle_vgs',
+            fields: ['card_first_six', 'card_last_four', 'expiry_month', 'expiry_year', 'card_brand'] } });
+    return { kind: 'continue' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1771,7 +1818,7 @@ async function unsupportedContinue(ctx) {
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
 export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim,
-    cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim];
+    cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/prepared-processor.d.ts

@@ -16,8 +16,12 @@
  * CyberSource's reply 30 times, a second apart, from Save (Arrow Electronics), too soon for an
  * approval after Save. Its environments are its two hosts: secureacceptance (production) and
  * testsecureacceptance (sandbox).
+ *
+ * paddle_vgs: prepared only. Paddle's checkout frame aborts its card request to its VGS card vault 10
+ * seconds after Pay and sends it once more, too soon for an approval after Pay. Its environments are its
+ * two card URLs: vault.paddle.com (production) and sandbox-vault.paddle.com (sandbox).
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -39,8 +43,11 @@ export declare function preparationRequestMethod(psp: string): 'GET' | 'POST';
  * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
  * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
  * clicked again). The cardholder's device answers with a token that pays nothing until the
- * merchant's server charges it. Every other prepared checkout still answers only the request it
- * was bound to.
+ * merchant's server charges it. Paddle VGS too: Paddle's frame aborts its card request to its VGS
+ * card vault 10 seconds after sending it and sends the same body under the same bearer once more, and
+ * the device's answer is the stored card's id, which pays nothing until Paddle's /pay names it. Only
+ * that repeat, byte for byte under the same bearer, is answered (cdp.ts paddleVgsRetryKey).
+ * Every other prepared checkout still answers only the request it was bound to.
  */
 export declare function preparedApprovalAnswersRetry(psp: string): boolean;
 /**
@@ -50,7 +57,8 @@ export declare function preparedApprovalAnswersRetry(psp: string): boolean;
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
- * live, testsecureacceptance is test.
+ * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
+ * sandbox-vault is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**

package/dist/prepared-processor.js

@@ -13,6 +13,7 @@ import { eprotectPreparationUrl, isPreparedEprotectRequest } from './eprotect.ge
 import { amadeusEnvironment, amadeusPreparationUrls, amadeusRequestRefusal, isPreparedAmadeusRequest } from './amadeus-checkout.generated.js';
 import { isPreparedVerifoneRequest } from './verifone.js';
 import { isPreparedSecureAcceptanceRequest, secureAcceptanceEnvironment, secureAcceptancePreparationUrl, secureAcceptanceRequestRefusal, } from './cybersource-secure-acceptance.generated.js';
+import { PADDLE_VGS_CARDS_URLS, isPreparedPaddleVgsRequest } from './paddle-vgs.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -30,11 +31,14 @@ export function preparationRequestMethod(psp) {
  * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
  * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
  * clicked again). The cardholder's device answers with a token that pays nothing until the
- * merchant's server charges it. Every other prepared checkout still answers only the request it
- * was bound to.
+ * merchant's server charges it. Paddle VGS too: Paddle's frame aborts its card request to its VGS
+ * card vault 10 seconds after sending it and sends the same body under the same bearer once more, and
+ * the device's answer is the stored card's id, which pays nothing until Paddle's /pay names it. Only
+ * that repeat, byte for byte under the same bearer, is answered (cdp.ts paddleVgsRetryKey).
+ * Every other prepared checkout still answers only the request it was bound to.
  */
 export function preparedApprovalAnswersRetry(psp) {
-    return psp === 'bambora';
+    return psp === 'bambora' || psp === 'paddle_vgs';
 }
 /**
  * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
@@ -43,13 +47,14 @@ export function preparedApprovalAnswersRetry(psp) {
  * Flex's: flex.cybersource.com is live, testflex.cybersource.com is test, and each has
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
- * live, testsecureacceptance is test.
+ * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
+ * sandbox-vault is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
     return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
-        'cybersource_secure_acceptance'].includes(psp) && ['production', 'sandbox'].includes(environment);
+        'cybersource_secure_acceptance', 'paddle_vgs'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -91,6 +96,9 @@ export function preparationEndpoint(psp, environment) {
     // The token-create URL on the environment's host, as the API names it: the one request the claim binds.
     if (psp === 'cybersource_secure_acceptance')
         return secureAcceptancePreparationUrl(environment);
+    // Paddle VGS: the environment's one card URL, the only URL the claim takes for it.
+    if (psp === 'paddle_vgs')
+        return PADDLE_VGS_CARDS_URLS[environment];
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -236,6 +244,10 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     // Flex gate verified the issuing field iframe's capture context against that JWE's key.
     if (psp === 'cybersource_flex')
         return isPreparedCybersourceFlexRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers);
+    // Paddle VGS: the environment's own card URL and payment-core's whole request rule (the checkout's bearer,
+    // the JSON:API content type and the frame's body), the rule the API and the Vault bind with too.
+    if (psp === 'paddle_vgs')
+        return isPreparedPaddleVgsRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers ?? {});
     if (psp === 'creditguard')
         return matchesPreparedCreditguard(environment, requestUrl, body, headers, binding);
     // A Verifone request is judged only through the profile its preparation names (matchesPreparation).

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 3f5ac5b4125cab96cc0851e9b1fe705aa96635e1df05b9216e951140fb47cd43
+// artifact-sha256: 80af165492668e00d651e9a039d3f24fe336bc3601dd5d2ab937a4b79bbb7ad8
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -348,8 +348,81 @@ function amadeusBodyKind(body) {
         return record2(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
     return "other";
 }
+// src/paddle-vgs.js
+var PADDLE_VGS_PSP = "paddle_vgs";
+var PADDLE_VGS_CARDS_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://vault.paddle.com/cards",
+    sandbox: "https://sandbox-vault.paddle.com/cards"
+});
+var BODY_LIMIT2 = 4096;
+var ROOT_KEYS2 = /* @__PURE__ */ Object.freeze(["data"]);
+var DATA_KEYS = /* @__PURE__ */ Object.freeze(["type", "attributes"]);
+var ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["pan", "cvc", "exp_month", "exp_year", "cardholder"]);
+var CARD_NUMBER4 = /^[0-9]{12,19}$/;
+var SECURITY_CODE2 = /^[0-9]{3,4}$/;
+var NAME_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
+var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paddleVgsEnvironment(url) {
+    if (url === PADDLE_VGS_CARDS_URLS.production)
+        return "production";
+    if (url === PADDLE_VGS_CARDS_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isPaddleVgsCardsUrl(url) {
+    return paddleVgsEnvironment(url) !== null;
+}
+function readBody2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record3(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function paddleVgsBodyVerdict(body) {
+    const value = readBody2(body);
+    if (value === null || !sameKeys(value, ROOT_KEYS2) || !record3(value.data) || !sameKeys(value.data, DATA_KEYS) || value.data.type !== "cards" || !record3(value.data.attributes) || !sameKeys(value.data.attributes, ATTRIBUTE_KEYS)) {
+        return refuse4("paddle_vgs_body_unsupported");
+    }
+    const card = value.data.attributes;
+    const holder = card.cardholder;
+    if (typeof card.pan !== "string" || !CARD_NUMBER4.test(card.pan) || typeof card.cvc !== "string" || !SECURITY_CODE2.test(card.cvc) || !Number.isInteger(card.exp_month) || card.exp_month < 1 || card.exp_month > 12 || !Number.isInteger(card.exp_year) || card.exp_year < 0 || card.exp_year > 99 || !record3(holder) || !sameKeys(holder, ["name"]) || typeof holder.name !== "string" || holder.name.length > NAME_LIMIT || CONTROL.test(holder.name) || cardLikeName(holder.name)) {
+        return refuse4("paddle_vgs_body_unsupported");
+    }
+    return CARD4;
+}
+var pin2 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin2({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
+var FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
+var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
+    if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
+        if (url !== void 0 && !isPaddleVgsCardsUrl(url))
+            return { verdict: "refuse", code: "paddle_vgs_url_refused" };
+        return paddleVgsBodyVerdict(body);
+    }
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -470,12 +543,12 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT2 = 16384;
+var BODY_LIMIT3 = 16384;
 var RESPONSE_LIMIT = 32768;
-var ROOT_KEYS2 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
+var ROOT_KEYS3 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns4 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -498,7 +571,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT3)
         return null;
     let value;
     try {
@@ -507,12 +580,12 @@ function judgeBody(body) {
     catch {
         return null;
     }
-    if (!record3(value) || !roundTrips(value, body))
+    if (!record4(value) || !roundTrips(value, body))
         return null;
-    if (!Object.keys(value).every((key) => ROOT_KEYS2.includes(key)) || !owns4(value, "paymentInstrument"))
+    if (!Object.keys(value).every((key) => ROOT_KEYS3.includes(key)) || !owns4(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record3(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns4(instrument, key)))
+    if (!record4(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns4(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH, instrument.expirationMonth) || !exact(YEAR, instrument.expirationYear))
         return null;
@@ -540,7 +613,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record3(headers))
+    if (!record4(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -587,7 +660,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record3(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record4(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -602,7 +675,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record3(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record4(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -686,7 +759,7 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record3(value) ? value : null;
+        return record4(value) ? value : null;
     }
     catch {
         return null;
@@ -695,16 +768,16 @@ function readAnswer(body) {
 var tokenValue = (value) => exact(TOKEN, value) && !panLike(value);
 var optional = (value, key, check) => !owns4(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record3(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record4(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record3))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record4))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns4(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record3(data.binData)) {
+    if (record4(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns4(data.binData, key) || data.binData[key] === null)
@@ -720,7 +793,7 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record3(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record4(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -748,7 +821,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record3(value.error) ? value.error.errorId : null;
+    const id = value && record4(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0abf1d62c20303c4496e1d26b64b1c36ad517919d23f2d14e3f0b6763694551f
+// artifact-sha256: 7e7a9b515128df56d149df50e0c275c7f6e8e522945ed818ca714ccac7eb1cd7
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -583,13 +583,26 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // Verified from https://hosted.test.paysafe.com/checkout/1.8.0/main.bundle.js
         // and its byte-identical production sibling (SHA-256 e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c).
         // Its native LIVE/TEST environment map selects exactly hosted[.test].paysafe.com.
+        // Checkout v1 latest (loader version 1.16.1; checkout/v1/latest/main.js SHA-256
+        // 328c6443da930f3648826248afa3c342cdd07d04e49a78b0878dda187772bf80) posts the same body to
+        // checkout/api/v1/tokenize on api[.test].paysafe.com, the hosts its vendor.js maps LIVE/TEST to.
+        // It and Paysafe.js latest set X-Internal-Correlation-Id, X-App-Version and X-TransactionSource
+        // on every card request, and Paysafe's CORS answer on all three API card paths allows them for
+        // any origin (2026-10-15), so a replay keeps them as the native request sends them.
         // Keep host/path pairs separate: details/log are not card requests;
         // card/tokenize uses a saved paymentToken, and 3DS-specific paths are unverified.
-        match: "(?:api(\\.test)?\\.paysafe\\.com/(?:paymenthub/v1/singleusepaymenthandles|js/api/v1/tokenize)|hosted(\\.test)?\\.paysafe\\.com/checkout/api/v1/tokenize)(?![\\w/-])",
+        match: "(?:api(\\.test)?\\.paysafe\\.com/(?:paymenthub/v1/singleusepaymenthandles|js/api/v1/tokenize|checkout/api/v1/tokenize)|hosted(\\.test)?\\.paysafe\\.com/checkout/api/v1/tokenize)(?![\\w/-])",
         hosts: ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"],
         sandboxHosts: ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"],
         encoding: "json",
-        passthroughHeaders: ["^authorization$", "^x-paysafe-credentials$", "^correlationid$"]
+        passthroughHeaders: [
+            "^authorization$",
+            "^x-paysafe-credentials$",
+            "^correlationid$",
+            "^x-internal-correlation-id$",
+            "^x-app-version$",
+            "^x-transactionsource$"
+        ]
     },
     {
         psp: "recurly",
@@ -1418,6 +1431,33 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             // A checked "remember" asks Worldline to keep the card for later purchases.
             token: "remember"
         }
+    },
+    {
+        psp: "paddle_vgs",
+        // Paddle's checkout frame (buy.paddle.com) on a checkout whose card method names VGS as its
+        // tokenizer: one JSON:API POST to /cards on vault.paddle.com, a VGS inbound proxy Paddle runs
+        // (sandbox-vault.paddle.com in test), with the checkout's own bearer JWT. PAN@
+        // data.attributes.pan, with cvc, exp_month (1 to 12) and exp_year (two digits) beside it, all
+        // numbers but the pan and the cvc. paddle-vgs.js holds the request rule the pause decision, the
+        // API's create, the prepared bind and the device all read: exactly one of the two URLs, the
+        // frame's Content-Type and bearer, and the frame's body byte for byte. VGS answers with the
+        // stored card's id, which the frame sends on to Paddle's /pay. The frame aborts this request
+        // after 10 seconds and sends it once more, so the lane is prepared only (preparationRequired):
+        // the cardholder approves before the agent clicks Pay. The card leaves the cardholder's device
+        // by a direct fetch, since the proxy answers any origin. The checkouts that name TokenEx or
+        // Spreedly send the card elsewhere and are not this entry.
+        // Ships dark: served only to a client that declares `paddle_vgs_cards`, gated off for every org
+        // until an operator lists one (`paddle_vgs:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7):
+        // sandbox-vault only on test rows and only with documented test cards, vault only on live rows.
+        capability: "paddle_vgs_cards",
+        match: "(?:sandbox-)?vault\\.paddle\\.com/cards",
+        hosts: ["^vault\\.paddle\\.com$", "^sandbox-vault\\.paddle\\.com$"],
+        sandboxHosts: ["^sandbox-vault\\.paddle\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        passthroughHeaders: ["^authorization$"]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1520,6 +1560,17 @@ var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fiel
 var MONERIS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin({ id: "jack_org_raisin", merchant: "Jack.org", origins: ["https://jack.akaraisin.com"], profileIds: ["htL7TR9H7ICYN2B"] })
 ]);
+// src/paddle-vgs.js
+var pin2 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin2({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
+var FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
+var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -1607,6 +1658,7 @@ var ALLOWED_MEDIA_TYPES = {
     jwe: ["application/jwt"]
 };
 var JWE_CONTENT_TYPE = "application/jwt; charset=utf-8";
+var PADDLE_VGS_MEDIA_TYPE = "application/vnd.api+json";
 function contentTypeFor(pspOrEntry, headers) {
     const rec = trustedClientRecognizer(pspOrEntry);
     if (rec.encoding === "jwe") {
@@ -1616,6 +1668,13 @@ function contentTypeFor(pspOrEntry, headers) {
             throw new Error("Refusing to pay: this processor takes its sealed card only as application/jwt.");
         return JWE_CONTENT_TYPE;
     }
+    if (rec.psp === "paddle_vgs") {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        if (!captured || typeof captured[1] !== "string" || captured[1].trim().toLowerCase() !== PADDLE_VGS_MEDIA_TYPE) {
+            throw new Error("Refusing to pay: this processor takes its card only as application/vnd.api+json.");
+        }
+        return PADDLE_VGS_MEDIA_TYPE;
+    }
     const encoding = rec && rec.encoding === "form" ? "form" : "json";
     const allowed = ALLOWED_MEDIA_TYPES[encoding];
     const fallback = allowed[0];
@@ -1635,6 +1694,8 @@ function replayHeaders(pspOrEntry, captured = {}) {
     const headers = { "content-type": contentTypeFor(rec, captured) };
     if (rec.psp === "creditguard")
         headers.accept = "application/json";
+    if (rec.psp === "paddle_vgs")
+        headers.accept = PADDLE_VGS_MEDIA_TYPE;
     for (const [name, value] of Object.entries(captured)) {
         if (rec.headers.some((pattern) => pattern.test(name)) && !HEADER_NEVER_FORWARD.test(name))
             headers[name] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.11",
+  "version": "0.23.13",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,7 +27,7 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs redact-url.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
     "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs && node gravy-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
@@ -49,5 +49,5 @@
   "engines": {
     "node": ">=22"
   },
-  "license": "UNLICENSED"
+  "license": "SEE LICENSE IN LICENSE"
 }