@agent-cards/sdk 0.23.18 → 0.23.20

package/dist/hold.js

@@ -0,0 +1,264 @@
+// The card request hold (attachToCdp's `hold` mode; CARD-REQUEST-HOLD.md). A page's card request is paused in
+// the browser's network layer and HELD: no approval exists, nothing reaches the processor, and the request waits
+// for one of two answers.
+//
+//   release({ amount, currency, pageTotal })  the person confirmed this total, and the page shows it now: the
+//       approval is created only then, at that total. A live client answers the page with the device's replay; a
+//       sandbox client never sends the request on (the approval is created and read, nothing is charged).
+//   cancel(reason)                             the request fails in the page; nothing was created or sent.
+//
+// A held request that would outlive its processor's own wait (Braintree's client gives up after 60 s, Bolt's
+// tokenizer after 20 s) is cancelled first, so a hold never ends in an unknown state. One request is held at a
+// time; every other card request, and every one after a decision, fails at once.
+//
+// Beside the registry's recognisers, a hold also catches two kinds of request the SDK cannot pay:
+//   - Bolt's tokenizer: Bolt seals the card and its answer to a key pair made inside its own frame, so no device
+//     replay can answer it. Held, then only cancelled.
+//   - Any request whose body carries the placeholder card number (`placeholderNumbers`): a store's own card post or
+//     an unknown processor. The browser only ever holds the placeholder, so a body with its digits is a card request
+//     wherever it goes. In sandbox it may be released unchanged (it carries the documented test number only).
+// The hold records the processor and the endpoint (origin and path), never a body or a header.
+/**
+ * Bolt's embedded card frame (connect.bolt.com credit-card-input): a POST of `{ payload, nonce, public_key }` JSON,
+ * the card boxed to Bolt's key, to `<base>/token` or `<base>/token/cvv`, with a 20 s timeout and retries.
+ */
+export const BOLT_HOLD_RULE = {
+    psp: 'bolt',
+    match: /^[a-z]+:\/\/(?:(?:production|sandbox|staging)\.bolttk\.com|tokenizer(?:-sandbox|-staging)?\.bolt(?:app)?\.com)(?::\d+)?\/token(?:\/cvv)?(?:[?#]|$)/i,
+    patterns: [{ urlPattern: '*://*.bolttk.com*/token*' }, { urlPattern: '*://tokenizer*.bolt.com*/token*' }, { urlPattern: '*://tokenizer*.boltapp.com*/token*' }],
+    kind: 'tokenize',
+    deadlineMs: 20_000,
+};
+/** Each recogniser's own wait for its card request, where it was measured; any other gets HOLD_DEFAULT_DEADLINE_MS. */
+export const HOLD_DEADLINES_MS = { braintree: 60_000, adyen: 60_000, bolt: 20_000 };
+export const HOLD_DEFAULT_DEADLINE_MS = 30_000;
+/** How long before the processor's own wait the hold gives the request up. */
+export const HOLD_DEADLINE_MARGIN_MS = 2_000;
+/** The resource types a page can send a card in: XHR, fetch, a form post, and the rest. */
+const PLACEHOLDER_RESOURCE_TYPES = ['XHR', 'Fetch', 'Document', 'Other', 'Ping'];
+/**
+ * Any request whose body carries one of the placeholder card numbers, wherever it goes. It cannot see a card a
+ * processor's frame encrypts first (Bolt, Adyen): those need their own rule. Null without a usable number.
+ */
+export function placeholderHoldRule(numbers, deadlineMs = HOLD_DEFAULT_DEADLINE_MS) {
+    const digits = numbers.map((n) => String(n).replace(/\D/g, '')).filter((d) => d.length >= 12 && d.length <= 19);
+    if (!digits.length)
+        return null;
+    // The digits as a page may send them: plain, or grouped with spaces, dashes, '+' or '%20'.
+    const sep = '(?:\\s|-|\\+|%20)?';
+    const body = new RegExp(digits.map((d) => d.split('').join(sep)).join('|'));
+    return {
+        psp: 'placeholder_card', match: /^[a-z]+:\/\//i, body, kind: 'store_card_post', deadlineMs, methods: ['POST', 'PUT', 'PATCH'],
+        patterns: PLACEHOLDER_RESOURCE_TYPES.map((resourceType) => ({ urlPattern: '*', resourceType })),
+    };
+}
+/** The hold-only rule a request is a card request under, or null. */
+export function matchHoldOnlyRule(request, rules) {
+    for (const rule of rules) {
+        if (!(rule.methods ?? ['POST']).includes(String(request.method).toUpperCase()))
+            continue;
+        if (!rule.match.test(request.url))
+            continue;
+        if (rule.body && !rule.body.test(request.body ?? ''))
+            continue;
+        return rule;
+    }
+    return null;
+}
+/** A hold ended without a release: the paused request fails, and every later card request fails at once. */
+export class HoldEndedError extends Error {
+    reason;
+    constructor(reason) {
+        super(`card request hold ended: ${reason}`);
+        this.reason = reason;
+        this.name = 'HoldEndedError';
+    }
+}
+/** A second card request while one is held: this request alone fails, the held one and the checkout are untouched. */
+export class HoldRefusedError extends Error {
+    constructor() { super('another card request is held'); this.name = 'HoldRefusedError'; }
+}
+/** A sandbox release answered: the approval was created and read, and the request was never sent on. */
+export class HoldAnsweredError extends Error {
+    outcome;
+    constructor(outcome) {
+        super(`card request hold answered without sending: ${outcome.outcome}`);
+        this.outcome = outcome;
+        this.name = 'HoldAnsweredError';
+    }
+}
+function endpointOf(url) {
+    try {
+        const u = new URL(url);
+        return `${u.origin}${u.pathname}`;
+    }
+    catch {
+        return String(url).slice(0, 120);
+    }
+}
+function validTotal(t) {
+    const v = t;
+    return !!v && Number.isSafeInteger(v.amount) && v.amount > 0 && typeof v.currency === 'string' && /^[A-Za-z]{3}$/.test(v.currency);
+}
+/**
+ * The hold's state, shared by the transport and the caller. The transport calls `hold` when a card request pauses
+ * and awaits the decision; the caller calls `release` or `cancel`. Not exported from the package: the caller sees
+ * the CardRequestHold face.
+ */
+export class HoldGate {
+    options;
+    sandbox;
+    emit;
+    _state = 'watching';
+    _held = null;
+    _refused = 0;
+    timer = null;
+    waiters = [];
+    pending = null;
+    rules;
+    constructor(options, sandbox, emit) {
+        this.options = options;
+        this.sandbox = sandbox;
+        this.emit = emit;
+        const placeholder = options.placeholderNumbers?.length ? placeholderHoldRule(options.placeholderNumbers) : null;
+        this.rules = [BOLT_HOLD_RULE, ...(placeholder ? [placeholder] : [])];
+    }
+    get state() { return this._state; }
+    get held() { return this._held ? { ...this._held } : null; }
+    get refused() { return this._refused; }
+    /** Fetch patterns the hold-only rules need beside the registry's. */
+    patterns() { return this.rules.flatMap((r) => r.patterns); }
+    deadlineFor(psp, rule) {
+        return this.options.deadlineMs ?? rule?.deadlineMs ?? (psp ? HOLD_DEADLINES_MS[psp] : undefined) ?? HOLD_DEFAULT_DEADLINE_MS;
+    }
+    /** A card request that may not be held now (a second one, or one after a decision): counted, and failed by the caller. */
+    refuse(psp, url) {
+        if (this._state === 'watching')
+            return false;
+        this._refused++;
+        this.emit('card_request_refused', { psp, endpoint: endpointOf(url), state: this._state });
+        return true;
+    }
+    /**
+     * Hold a card request: resolves with the person's decision, or rejects with HoldEndedError when the hold is
+     * cancelled, expires, loses its request or closes. The caller (the transport) answers or fails the request.
+     */
+    hold(input) {
+        if (this._state !== 'watching')
+            return Promise.reject(new HoldEndedError(`not_watching:${this._state}`));
+        const deadlineMs = this.deadlineFor(input.psp, input.rule);
+        this._held = { psp: input.psp, endpoint: endpointOf(input.url), kind: input.kind, replayable: input.replayable, heldAt: Date.now(), deadlineMs };
+        this._state = 'held';
+        const decision = new Promise((resolve, reject) => { this.pending = { resolve, reject }; });
+        decision.catch(() => undefined);
+        const margin = this.options.deadlineMarginMs ?? HOLD_DEADLINE_MARGIN_MS;
+        this.timer = setTimeout(() => {
+            if (this._state !== 'held')
+                return;
+            this.end('expired', 'expired');
+            this.emit('card_request_expired', { endpoint: this._held?.endpoint, afterMs: Date.now() - (this._held?.heldAt ?? Date.now()) });
+        }, Math.max(0, deadlineMs - margin));
+        this.timer.unref?.();
+        const held = this.held;
+        this.emit('card_request_held', held);
+        try {
+            this.options.onHeld?.(held);
+        }
+        catch { /* observer only */ }
+        for (const w of this.waiters.splice(0))
+            w(held);
+        return decision;
+    }
+    /** The page gave up the held request, or its frame went away: nothing was sent. */
+    lost() {
+        if (this._state !== 'held')
+            return;
+        this.end('lost', 'request_lost');
+        this.emit('card_request_lost', { endpoint: this._held?.endpoint });
+    }
+    /** The attachment ended. */
+    close() {
+        if (this._state === 'held')
+            this.end('closed', 'closed');
+        else if (this._state === 'watching')
+            this._state = 'closed';
+        for (const w of this.waiters.splice(0))
+            w(null);
+    }
+    end(state, reason) {
+        this._state = state;
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        const p = this.pending;
+        this.pending = null;
+        p?.reject(new HoldEndedError(reason));
+        for (const w of this.waiters.splice(0))
+            w(null);
+    }
+    whenHeld(timeoutMs = 30_000) {
+        if (this._state === 'held')
+            return Promise.resolve(this.held);
+        if (this._state !== 'watching')
+            return Promise.resolve(null);
+        return new Promise((resolve) => {
+            const t = setTimeout(() => resolve(null), timeoutMs);
+            t.unref?.();
+            this.waiters.push((h) => { clearTimeout(t); resolve(h); });
+        });
+    }
+    async cancel(reason = 'cancelled') {
+        if (this._state === 'watching') {
+            this._state = 'cancelled';
+            this.emit('card_request_hold_cancelled', { reason, held: false });
+            for (const w of this.waiters.splice(0))
+                w(null);
+            return;
+        }
+        if (this._state !== 'held')
+            return;
+        this.end('cancelled', reason);
+        this.emit('card_request_cancelled', { reason });
+    }
+    async release(input) {
+        if (this._state !== 'held' || !this.pending || !this._held)
+            return { outcome: 'failed', detail: `not_held:${this._state}` };
+        const fail = async (detail) => { await this.cancel(detail); return { outcome: 'failed', detail }; };
+        if (!validTotal(input))
+            return fail('invalid_amount');
+        // The exact total, or nothing: a page that moved (tax, shipping) after the person confirmed is not released.
+        const page = input.pageTotal;
+        if (!validTotal(page))
+            return fail('total_unread');
+        if (page.currency.toLowerCase() !== input.currency.toLowerCase())
+            return fail('total_changed');
+        if (input.upTo ? page.amount > input.amount : page.amount !== input.amount)
+            return fail(input.upTo ? 'total_over_ceiling' : 'total_changed');
+        const held = this._held;
+        let settle;
+        const settled = new Promise((resolve) => { settle = resolve; });
+        if (!held.replayable) {
+            if (held.kind === 'store_card_post' && input.continuePlaceholder && this.sandbox) {
+                this.decide({ kind: 'continue', settle });
+                this.emit('card_request_released', { psp: held.psp, continued: true, amount: input.amount, currency: input.currency.toLowerCase(), upTo: !!input.upTo });
+                return settled;
+            }
+            // Bolt's sealed tokenizer and a store's own card post have no device replay: the request is cancelled.
+            return fail(held.kind === 'store_card_post' ? (this.sandbox ? 'store_card_post_needs_continue' : 'store_card_post_unreviewed') : 'not_replayable');
+        }
+        this.decide({ kind: 'release', amount: input.amount, currency: input.currency.toLowerCase(), settle });
+        this.emit('card_request_released', { psp: held.psp, amount: input.amount, currency: input.currency.toLowerCase(), upTo: !!input.upTo });
+        return settled;
+    }
+    decide(decision) {
+        this._state = 'released';
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        const p = this.pending;
+        this.pending = null;
+        p?.resolve(decision);
+    }
+}

package/dist/index.d.ts

@@ -13,6 +13,8 @@ export type { SecureAcceptanceCheckoutRefusal, SecureAcceptanceUnknownReason } f
 export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, VerifoneReplay, HostedFormReplay, CardEndpointReplay, DeviceEncryptReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AgentcardOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, PlaceholderCard, } from './client.js';
 export type { MicroformField, MicroformSidecar } from './cybersource-flex.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
+export { BOLT_HOLD_RULE, HOLD_DEADLINES_MS, HOLD_DEFAULT_DEADLINE_MS, HOLD_DEADLINE_MARGIN_MS, HoldAnsweredError, HoldEndedError, matchHoldOnlyRule, placeholderHoldRule } from './hold.js';
+export type { CardRequestHold, HeldCardRequest, HoldOnlyRule, HoldOptions, HoldReleaseInput, HoldReleaseOutcome, HoldState } from './hold.js';
 export { CheckoutAttachmentError } from './attachment.js';
 export { EbanxFollowUpError } from './ebanx.js';
 export { CardEndpointRefusedError, cardEndpointPatterns } from './card-endpoint.js';
@@ -42,7 +44,7 @@ export { VoiceModule, checkoutOriginOf, CANCEL_REASONS, bundleOf, streamAddress,
 export type { VoiceOptions, VoiceTransport } from './voice.js';
 export type { ApiTransport } from './api-module.js';
 export { BuyModule, BuyError, isBuyDeclined, isBuyNeedsApproval, isBuyVoiceUnsupported, BUY_TURN_TIMEOUT_MS, VOICE_EXECUTION_UNSUPPORTED } from './buy.js';
-export type { BuyStatus, BuyApproval, BuyVoiceDeclineCode, BuyCart, BuyCartLine, BuyDeliveryAddress, BuyPaymentSource, BuyOutcome, BuyPlacement, BuyCatalog, BuyUnmatched, BuyTurn, BuyDeclined, BuyNeedsApproval, BuyVoiceUnsupported, BuyVoiceTurn, BuyOrder, BuyLastCheckout, BuyConversation, BuyAskInput, BuyConfirmInput, BuyApproveByVoiceInput, BuyConversationInput, } from './buy.js';
+export type { BuyStatus, BuyApproval, BuyVoiceDeclineCode, BuyCart, BuyCartLine, BuyDeliveryAddress, BuyPaymentSource, BuyOutcome, BuyPlacement, BuyCatalog, BuyUnmatched, BuyTurn, BuyDeclined, BuyNeedsApproval, BuyVoiceUnsupported, BuyVoiceTurn, BuyOrder, BuyLastCheckout, BuyConversation, BuyAskInput, BuyConfirmInput, BuyApproveByVoiceInput, BuyConversationInput, BuyCheckoutHandoff, BuyOpenOffer, BuyBrowserCheckout, BuyApiAmount, } from './buy.js';
 export { Languages } from './languages.js';
 export type { Language, LanguageInfo } from './languages.js';
 export { verifyWebhook, signWebhook, parseWebhookEvent, parseSignatureHeader, isCheckoutAuthorizationEvent, isVaultEvent, CHECKOUT_AUTHORIZATION_EVENT_TYPES, VAULT_EVENT_TYPES } from './webhooks.js';

package/dist/index.js

@@ -4,6 +4,7 @@ export { Agentcard, Agentcard as VaultClient, CheckoutModule } from './agentcard
 export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
 export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
+export { BOLT_HOLD_RULE, HOLD_DEADLINES_MS, HOLD_DEFAULT_DEADLINE_MS, HOLD_DEADLINE_MARGIN_MS, HoldAnsweredError, HoldEndedError, matchHoldOnlyRule, placeholderHoldRule } from './hold.js';
 export { CheckoutAttachmentError } from './attachment.js';
 // EBANX after its card token: why a send an approved token request covers got no answer from the cardholder's device.
 export { EbanxFollowUpError } from './ebanx.js';

package/dist/lifecycle.d.ts

@@ -6,6 +6,7 @@ import type { GmoUnsupportedReason } from './gmo.js';
 import type { ShijiStsUnsupportedReason } from './shiji-sts.js';
 import type { PaddleVgsPayRefusal } from './paddle-vgs-pay.js';
 import type { PaypalCardFormReason } from './paypal-card-forms.js';
+import { type CardRequestHold, type HoldReleaseInput, type HoldReleaseOutcome } from './hold.js';
 /** The application's resolver confirmed the payment for this checkout authorization. */
 export interface MerchantPaymentConfirmation {
     kind: 'merchant_payment';
@@ -130,6 +131,10 @@ export interface CheckoutController {
     retryAfterMerchantFailure(result: {
         status: 'failed';
     }): void;
+    /** Hold mode (`attachToCdp(…, { hold: true })`): the held card request and its answers; null otherwise. */
+    readonly hold?: CardRequestHold | null;
+    /** Hold mode: `controller.hold.release(input)`. Rejects on an attachment without a hold. */
+    release?(input: HoldReleaseInput): Promise<HoldReleaseOutcome>;
 }
 /** How many times one approval's card-free Stripe confirmation may be checked before it is simply held. */
 export declare const MAX_STRIPE_CONTINUATION_CHECKS = 3;
@@ -167,11 +172,16 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private preparationHandler?;
     private preparationUsed;
     private resumeHandler;
+    private holdHandle;
     readonly abort: AbortController;
     constructor(options: LifecycleOptions);
     getState(): Readonly<CheckoutState>;
     setPreparationHandler(handler: (options: PrepareCheckoutOptions) => Promise<PreparedCheckout>): void;
     prepare(options: PrepareCheckoutOptions): Promise<PreparedCheckout>;
+    /** Hold mode: the attachment's hold (hold.ts). */
+    setHold(hold: CardRequestHold): void;
+    get hold(): CardRequestHold | null;
+    release(input: HoldReleaseInput): Promise<HoldReleaseOutcome>;
     /** The transport's hand while one request is paused for the business; null once it is answered. */
     setResumeHandler(handler: ((result: ResumeResult) => Promise<void>) | null): void;
     resume(result: ResumeResult): Promise<void>;

package/dist/lifecycle.js

@@ -2,6 +2,7 @@ import { AdyenTestPlatformRefusedError, ApprovalDeclinedError, ApprovalTimeoutEr
 import { CardEndpointRefusedError } from './card-endpoint.js';
 import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 import { isWspayChallenge } from './wspay.js';
+import { HoldAnsweredError, HoldEndedError } from './hold.js';
 /**
  * The statuses that end an attempt: its outcome is known (`completed`, `declined`, `failed`,
  * `timed_out`, `unsupported`, `cancelled`), or the SDK already reported it unknown with its own
@@ -72,6 +73,7 @@ export class CheckoutLifecycle {
     preparationHandler;
     preparationUsed = false;
     resumeHandler = null;
+    holdHandle = null;
     abort = new AbortController();
     constructor(options) {
         this.options = options;
@@ -85,6 +87,14 @@ export class CheckoutLifecycle {
             return Promise.reject(new CheckoutPreparationError(null, 'transport_unavailable'));
         return this.preparationHandler(options);
     }
+    /** Hold mode: the attachment's hold (hold.ts). */
+    setHold(hold) { this.holdHandle = hold; }
+    get hold() { return this.holdHandle; }
+    release(input) {
+        if (!this.holdHandle)
+            return Promise.reject(new Error('No card request hold: attach with hold: true.'));
+        return this.holdHandle.release(input);
+    }
     /** The transport's hand while one request is paused for the business; null once it is answered. */
     setResumeHandler(handler) { this.resumeHandler = handler; }
     resume(result) {
@@ -450,6 +460,17 @@ export class CheckoutLifecycle {
                 this.held = true;
             this.set({ ...this.state, status: error.reason === 'not_enabled' ? 'unsupported' : 'failed', reason: `merchant_card_endpoint_${error.reason}` });
         }
+        else if (error instanceof HoldEndedError) {
+            // Nothing was created or sent; the hold refuses every later card request.
+            this.held = true;
+            this.set({ ...this.state, status: error.reason === 'expired' ? 'timed_out' : 'cancelled', reason: `hold_${error.reason}` });
+        }
+        else if (error instanceof HoldAnsweredError) {
+            // Sandbox: the approval was created and read, and the held request was never sent on.
+            const o = error.outcome.outcome;
+            this.held = true;
+            this.set({ ...this.state, status: o === 'declined' ? 'declined' : o === 'expired' ? 'timed_out' : o === 'approved_not_charged' ? 'cancelled' : 'failed', reason: `hold_${o}` });
+        }
         else if (error instanceof CheckoutCancelledError) {
             this.cancel();
         }

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 527edb8fd48229e7404d5fda8d1f8e243b5694c350eee105bec8815a0e848df0
+// artifact-sha256: 7b5770020fc598b9f1fdfc842ef761812943269a1bd368d4751f99c1ffad7a17
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -644,7 +644,6 @@ var NAVIGATION_HEADERS = /* @__PURE__ */ Object.freeze([
     "sec-fetch-site",
     "sec-fetch-user"
 ]);
-var GUARANTEE_RATES = "a policy for guarantee rates: the hotel charges the card at the stay, by when a single-use card may have closed";
 var ATT_SESSION = /* @__PURE__ */ deepFreeze({
     cookies: true,
     cookie_names: null,
@@ -2108,7 +2107,9 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "secure-hotel-booking.com sits behind DataDome. The same card frame serves every D-EDGE hotel, so the profile names D-EDGE rather than one hotel; its currency is HUMA's.",
             "HUMA's own payment step, read live Oct 6, 2026 (live-checks-oct6/huma_kotor_bay): the frame's cleanCardNumber rewrites CardNumber on every keypress and on blur into groups of four with one space between them for a Visa or Mastercard number (4242 4242 4242 4242; 4-6-5 for an Amex, 4-6-4 for a Diners), so the post carries the spaces.",
             "cleanCardNumber strips every non-digit and writes the number in the format of the first CARD_TYPES row whose pattern it matches (the frame's inline script, the same in the archive.org copies and live on Oct 6): amex /^3[47]/ format_465, the first 15 digits as 4-6-5; diners_club_international /^36/ and diners_club_carte_blanche /^30[0-5]/ format_464, the first 14 digits as 4-6-4; every other row (visa, master, jcb, maestro, discover, instapayment, diners_club /^54/), and a number no row matches, format_4444, groups of four with the rest last. card.pan is grouped_by_type: the rules take the number grouped that way or as plain digits, and write the real number the way the placeholder was written, a grouped one in its own network's grouping, so a real American Express card behind a placeholder grouped in fours still goes out 4-6-5. Behind a grouped placeholder, a real 34 or 37 number of any length but 15, or a 36 or 300 to 305 number of any length but 14, is refused: the frame has no grouping for it and cuts a longer one short.",
-            "The same check read when HUMA charges: its Non Refundable rate charges the whole stay at this post (the hub shows Due to pay now and its button reads PAY), while its flexible rate only guarantees the booking with the card, which the hotel charges on a late cancellation or a no-show."
+            "The same check read when HUMA charges: its Non Refundable rate charges the whole stay at this post (the hub shows Due to pay now and its button reads PAY), while its flexible rate only guarantees the booking with the card, which the hotel charges on a late cancellation or a no-show.",
+            "The hub loads the booking it takes a payment for with POST /load/<session uuid> on pay.secure-hotel-booking.com and spreads the answer into its state (main.bundle.js v=1.0.3573, sha256 eb06043d...51897c9, the payment reducer; read live Oct 6, 2026 as a POST answered 200). It also sends 3-D Secure browser data to /setDevice/<session uuid>, which changes nothing the record holds, and calls /Voucher/add, /Voucher/remove, /Loyalty/set, /Loyalty/remove and /Issuer/set/<session uuid> only when the guest applies a voucher, points or a bank, each answer replacing the record. Every hub URL ends in the session uuid the card post's path carries.",
+            "The /load answer (archive.org copies from other D-EDGE hotels, Dec 2025 to Sep 2026): deposit (due now), total and balance (the room and the part left for the stay, both without the stay tax the basket lines add), hasOriginalDeposit (false at a rate that only guarantees the booking), hasScheduledPayment, isFullDiscount, vouchers and status (New while unpaid), amounts written in the booking's language ('€ 1,609.36', '116,10 €'). facts reads it with the dedge_pay_hub reader, so the agent's amount is held to the deposit, and a guarantee, a scheduled charge or part of the room left for the stay is refused (Felipe's rule of Oct 7, 2026: a hotel is paid only at a rate charged in full at booking)."
         ],
         har: null,
         checkout: "https://card.secure-hotel-booking.com",
@@ -2146,7 +2147,15 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
         resends: [],
         challenge: null,
-        facts: null,
+        // The booking the hub takes the payment for lives on the hub's own host, not the card frame's.
+        facts: {
+            reader: "dedge_pay_hub",
+            origin: "https://pay.secure-hotel-booking.com",
+            responses: [{ method: "POST", path: "/load/:session", query: {}, format: "json" }],
+            // 3-D Secure browser data, sent beside /load when the hub loads: the record does not change.
+            inert: [{ method: "POST", path: "/setDevice/:session", query: {} }],
+            bind: "session"
+        },
         bootstrap: "/robots.txt",
         timeout_ms: 6e4,
         charge_timing: "at_request",
@@ -2155,7 +2164,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "HUMA's own payment step: whether its pay hub offers this card frame or a WSPay redirect (a HAR of one real booking's payment step)",
             "which cookies the card post needs, with DataDome in front of the host",
             "the answer to the card post (a redirect, a 3DS step or a page), and whether a 3DS step sends the card again",
-            GUARANTEE_RATES,
+            "HUMA's /load answer for its prepaid rate, as a recorded purchase shows it: the deposit, total and balance strings, a zero balance beside the stay tax, and the status of an unpaid booking that facts reads",
             "that the bootstrap path answers without a server error"
         ]
     },
@@ -2321,6 +2330,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         challenge: { at: ["captcha", "token"], ttl_ms: 24e4 },
         facts: {
             reader: "fastspring_session",
+            // The record's answers come from the popup's own store host, the endpoint.
+            origin: null,
             // Every answer FastSpring's page reads its order from (refreshPageResponse and
             // refreshOrderResponse): the popup document, the one-segment calls (/tax, /coupons,
             // /locale, /exempt), an item's quantity, renewal or add-on change, and a verified discount.
@@ -3019,10 +3030,73 @@ function fastspringFacts(state, merchant) {
         return fail(unreadable);
     }
     const recurring = projection.hasRecurring || projection.forceFuture || anySelectedRenewal(groups);
-    return { ok: true, facts: { amount: { amountCents, currency: currency.toLowerCase() }, live: projection.production, recurring } };
+    return { ok: true, facts: { amount: { amountCents, currency: currency.toLowerCase() }, live: projection.production, recurring, deferred: null } };
+}
+var DEDGE_MAX_VOUCHERS = 8;
+var EURO_FIRST = /^\u20ac (\d{1,3}(?:,\d{3}){0,2})(?:\.(\d{2}))?$/;
+var EURO_LAST = /^(\d{1,3}(?:[ .\u00a0\u202f]\d{3}){0,2})(?:,(\d{2}))? \u20ac$/;
+function hubAmount(text) {
+    if (typeof text !== "string")
+        return null;
+    const match = EURO_FIRST.exec(text) ?? EURO_LAST.exec(text);
+    if (!match)
+        return /\d/.test(text) && !/\u20ac|EUR/i.test(text) ? { other: true } : null;
+    if (new Set(match[1].replace(/\d/g, "")).size > 1)
+        return null;
+    return { cents: Number(match[1].replace(/\D/g, "")) * 100 + Number(match[2] ?? "0") };
+}
+function dedgeState(format, text) {
+    const state = format === "json" ? parseJson(text) : void 0;
+    return isPlainObject(state) ? { state } : { refusal: "the payment page's booking record is not a JSON object" };
+}
+function dedgeProjection(state) {
+    if (!isPlainObject(state))
+        return null;
+    const vouchers = state.vouchers === void 0 ? [] : state.vouchers;
+    if (!Array.isArray(vouchers) || vouchers.length > DEDGE_MAX_VOUCHERS)
+        return null;
+    const scalar = (value) => value !== null && typeof value === "object" ? null : value;
+    return {
+        status: scalar(state.status),
+        deposit: scalar(state.deposit),
+        total: scalar(state.total),
+        balance: scalar(state.balance),
+        hasOriginalDeposit: scalar(state.hasOriginalDeposit),
+        hasScheduledPayment: scalar(state.hasScheduledPayment),
+        isFullDiscount: scalar(state.isFullDiscount),
+        paidAmount: state.paidAmount === void 0 ? "" : scalar(state.paidAmount),
+        vouchers: vouchers.map(() => ({}))
+    };
+}
+function dedgeFacts(state, merchant) {
+    const unreadable = `${merchant}'s order record is not in the layout Agentcard reviewed`;
+    const projection = isPlainObject(state) ? dedgeProjection(state) : null;
+    if (!projection || JSON.stringify(projection) !== JSON.stringify(state))
+        return fail(unreadable);
+    const { status, hasOriginalDeposit, hasScheduledPayment, isFullDiscount, paidAmount, vouchers } = projection;
+    if (typeof status !== "string" || typeof hasOriginalDeposit !== "boolean" || typeof hasScheduledPayment !== "boolean" || typeof isFullDiscount !== "boolean" || typeof paidAmount !== "string")
+        return fail(unreadable);
+    if (status !== "New")
+        return fail(`${merchant}'s order is not waiting for a payment`);
+    if (isFullDiscount)
+        return fail(`vouchers or points pay the whole of ${merchant}'s order, so the card pays nothing`);
+    if (paidAmount !== "")
+        return fail(`part of ${merchant}'s order was already paid another way`);
+    if (vouchers.length > 0)
+        return fail(`a voucher pays part of ${merchant}'s order, which Agentcard has not reviewed`);
+    const [deposit, total, balance] = [projection.deposit, projection.total, projection.balance].map(hubAmount);
+    if ([deposit, total, balance].some((amount) => amount?.other))
+        return fail(`${merchant}'s order is in a currency this build does not read`);
+    if (!deposit || !total || !balance)
+        return fail(unreadable);
+    if (deposit.cents + balance.cents !== total.cents)
+        return fail(unreadable);
+    const deferred = !hasOriginalDeposit || deposit.cents === 0 ? "guarantee" : hasScheduledPayment ? "scheduled" : balance.cents > 0 ? "balance" : null;
+    return { ok: true, facts: { amount: { amountCents: deposit.cents, currency: "eur" }, live: true, recurring: false, deferred } };
 }
 var READERS = /* @__PURE__ */ Object.freeze({
-    fastspring_session: Object.freeze({ state: fastspringState, project: fastspringProjection, facts: fastspringFacts })
+    fastspring_session: Object.freeze({ state: fastspringState, project: fastspringProjection, facts: fastspringFacts }),
+    dedge_pay_hub: Object.freeze({ state: dedgeState, project: dedgeProjection, facts: dedgeFacts })
 });
 var MERCHANT_CARD_ENDPOINT_FACT_READERS = /* @__PURE__ */ Object.freeze(Object.keys(READERS));
 function cardPlaceholders(p, cardUrl) {
@@ -3040,12 +3114,13 @@ function boundShape(p, card, shapes, exchange) {
     }
     return null;
 }
+var recordOrigin = (p) => p.facts.origin ?? p.endpoint;
 function shapeFor(p, cardUrl, exchange) {
     if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
         return null;
     const card = cardPlaceholders(p, cardUrl);
     const url = strictUrl(exchange.url);
-    if (!card || !url || url.origin !== p.endpoint)
+    if (!card || !url || url.origin !== recordOrigin(p))
         return null;
     return boundShape(p, card, p.facts.responses, exchange);
 }
@@ -3057,12 +3132,19 @@ function sessionPath(p, card) {
     const written = segments.slice(0, at + 1).map((segment) => segment.startsWith(":") ? card[segment.slice(1)] : segment);
     return written.every((segment) => typeof segment === "string") ? written.join("/") : null;
 }
+function onSession(p, card, url) {
+    if (p.facts.origin) {
+        const value = card[p.facts.bind];
+        return url.origin === p.facts.origin && typeof value === "string" && url.pathname.split("/").at(-1) === value;
+    }
+    const session = sessionPath(p, card);
+    return !!session && url.origin === p.endpoint && (url.pathname === session || url.pathname.startsWith(`${session}/`));
+}
 function merchantCardEndpointFactsRole(profile, cardUrl, exchange) {
     const p = trustedMerchantCardEndpoint(profile);
     if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
         return null;
     const card = cardPlaceholders(p, cardUrl);
-    const session = card ? sessionPath(p, card) : null;
     let url;
     try {
         url = new URL(exchange.url);
@@ -3070,10 +3152,12 @@ function merchantCardEndpointFactsRole(profile, cardUrl, exchange) {
     catch {
         return null;
     }
-    if (!session || url.origin !== p.endpoint || url.pathname !== session && !url.pathname.startsWith(`${session}/`))
+    if (!card)
         return null;
     if (exchange.method.toUpperCase() === p.method && exchange.url === cardUrl)
         return "card";
+    if (!onSession(p, card, url))
+        return null;
     if (shapeFor(p, cardUrl, exchange))
         return "record";
     if (boundShape(p, card, p.facts.inert, exchange))
@@ -3110,13 +3194,20 @@ function readMerchantCardEndpointFacts(profile, cardUrl, record) {
         return fail(`the order record is not ${p.merchant}'s record of this checkout`);
     return READERS[p.facts.reader].facts(record.state, p.merchant);
 }
+var DEFERRED_REASONS = /* @__PURE__ */ Object.freeze({
+    guarantee: (merchant) => `${merchant} only holds the card as a guarantee for this order and charges it later, when a single-use card may have closed; choose a rate paid in full now`,
+    scheduled: (merchant) => `${merchant} charges this order on a later date, when a single-use card may have closed; choose a rate paid in full now`,
+    balance: (merchant) => `${merchant} leaves part of this order to pay at the stay, when a single-use card may have closed; choose a rate paid in full now`
+});
 function merchantCardEndpointFactsRefusal(profile, facts, agent) {
     const p = trustedMerchantCardEndpoint(profile);
     const refuse2 = (code, reason) => ({ code, reason });
-    if (!isPlainObject(facts) || !isPlainObject(facts.amount) || !isPlainObject(agent))
+    if (!isPlainObject(facts) || !isPlainObject(facts.amount) || !isPlainObject(agent) || facts.deferred !== null && !Object.hasOwn(DEFERRED_REASONS, facts.deferred))
         return refuse2("malformed", `the order record for ${p.merchant} is malformed`);
     if (facts.recurring !== false)
         return refuse2("recurring", `${p.merchant}'s order renews on a schedule, and each renewal would charge the card with no approval of its own`);
+    if (facts.deferred !== null)
+        return refuse2("deferred", DEFERRED_REASONS[facts.deferred](p.merchant));
     if (facts.live !== agent.live)
         return agent.live ? refuse2("test_checkout", `${p.merchant}'s checkout is in test mode`) : refuse2("live_checkout", `${p.merchant}'s checkout is live`);
     if (typeof agent.currency !== "string" || facts.amount.currency !== agent.currency.toLowerCase()) {

package/dist/paddle-vgs.generated.d.ts

@@ -17,9 +17,10 @@ declare function paddleVgsBodyVerdict(body: any): Readonly<{
 }>;
 declare function paddleVgsRequestRefusal(request: any): any;
 declare function isPreparedPaddleVgsRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare var PADDLE_VGS_ANY_SELLER: boolean;
 declare var PADDLE_VGS_MERCHANT_PINS: readonly any[];
 declare function paddleVgsMerchantPin(merchantOrigin: any, pins?: readonly any[]): any;
-declare function paddleVgsMerchantRefusal(environment: any, merchantOrigin: any, authorization: any, pins?: readonly any[]): "unsupported_environment" | "paddle_vgs_merchant_unreviewed" | "paddle_vgs_seller_unreviewed" | null;
+declare function paddleVgsMerchantRefusal(environment: any, merchantOrigin: any, authorization: any, pins?: readonly any[], anySeller?: boolean): "unsupported_environment" | "paddle_vgs_merchant_unreviewed" | "paddle_vgs_seller_unreviewed" | null;
 declare function paddleVgsSellerClaimsPinned(pins?: readonly any[]): boolean;
 declare function paddleVgsRefusalMessage(code: any): any;
 declare var PADDLE_VGS_CARD_NETWORKS: readonly string[];
@@ -75,4 +76,4 @@ declare function paddleVgsPayVerdict(request: any, approved: any): Readonly<{
     verdict: "continue";
     body: string;
 }>;
-export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };
+export { PADDLE_VGS_ANY_SELLER, PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };