@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 527edb8fd48229e7404d5fda8d1f8e243b5694c350eee105bec8815a0e848df0
+// artifact-sha256: 7b5770020fc598b9f1fdfc842ef761812943269a1bd368d4751f99c1ffad7a17
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -644,7 +644,6 @@ var NAVIGATION_HEADERS = /* @__PURE__ */ Object.freeze([
     "sec-fetch-site",
     "sec-fetch-user"
 ]);
-var GUARANTEE_RATES = "a policy for guarantee rates: the hotel charges the card at the stay, by when a single-use card may have closed";
 var ATT_SESSION = /* @__PURE__ */ deepFreeze({
     cookies: true,
     cookie_names: null,
@@ -2108,7 +2107,9 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "secure-hotel-booking.com sits behind DataDome. The same card frame serves every D-EDGE hotel, so the profile names D-EDGE rather than one hotel; its currency is HUMA's.",
             "HUMA's own payment step, read live Oct 6, 2026 (live-checks-oct6/huma_kotor_bay): the frame's cleanCardNumber rewrites CardNumber on every keypress and on blur into groups of four with one space between them for a Visa or Mastercard number (4242 4242 4242 4242; 4-6-5 for an Amex, 4-6-4 for a Diners), so the post carries the spaces.",
             "cleanCardNumber strips every non-digit and writes the number in the format of the first CARD_TYPES row whose pattern it matches (the frame's inline script, the same in the archive.org copies and live on Oct 6): amex /^3[47]/ format_465, the first 15 digits as 4-6-5; diners_club_international /^36/ and diners_club_carte_blanche /^30[0-5]/ format_464, the first 14 digits as 4-6-4; every other row (visa, master, jcb, maestro, discover, instapayment, diners_club /^54/), and a number no row matches, format_4444, groups of four with the rest last. card.pan is grouped_by_type: the rules take the number grouped that way or as plain digits, and write the real number the way the placeholder was written, a grouped one in its own network's grouping, so a real American Express card behind a placeholder grouped in fours still goes out 4-6-5. Behind a grouped placeholder, a real 34 or 37 number of any length but 15, or a 36 or 300 to 305 number of any length but 14, is refused: the frame has no grouping for it and cuts a longer one short.",
-            "The same check read when HUMA charges: its Non Refundable rate charges the whole stay at this post (the hub shows Due to pay now and its button reads PAY), while its flexible rate only guarantees the booking with the card, which the hotel charges on a late cancellation or a no-show."
+            "The same check read when HUMA charges: its Non Refundable rate charges the whole stay at this post (the hub shows Due to pay now and its button reads PAY), while its flexible rate only guarantees the booking with the card, which the hotel charges on a late cancellation or a no-show.",
+            "The hub loads the booking it takes a payment for with POST /load/<session uuid> on pay.secure-hotel-booking.com and spreads the answer into its state (main.bundle.js v=1.0.3573, sha256 eb06043d...51897c9, the payment reducer; read live Oct 6, 2026 as a POST answered 200). It also sends 3-D Secure browser data to /setDevice/<session uuid>, which changes nothing the record holds, and calls /Voucher/add, /Voucher/remove, /Loyalty/set, /Loyalty/remove and /Issuer/set/<session uuid> only when the guest applies a voucher, points or a bank, each answer replacing the record. Every hub URL ends in the session uuid the card post's path carries.",
+            "The /load answer (archive.org copies from other D-EDGE hotels, Dec 2025 to Sep 2026): deposit (due now), total and balance (the room and the part left for the stay, both without the stay tax the basket lines add), hasOriginalDeposit (false at a rate that only guarantees the booking), hasScheduledPayment, isFullDiscount, vouchers and status (New while unpaid), amounts written in the booking's language ('€ 1,609.36', '116,10 €'). facts reads it with the dedge_pay_hub reader, so the agent's amount is held to the deposit, and a guarantee, a scheduled charge or part of the room left for the stay is refused (Felipe's rule of Oct 7, 2026: a hotel is paid only at a rate charged in full at booking)."
         ],
         har: null,
         checkout: "https://card.secure-hotel-booking.com",
@@ -2146,7 +2147,15 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         response: { headers: ["content-type", "location", "set-cookie"], withhold: [] },
         resends: [],
         challenge: null,
-        facts: null,
+        // The booking the hub takes the payment for lives on the hub's own host, not the card frame's.
+        facts: {
+            reader: "dedge_pay_hub",
+            origin: "https://pay.secure-hotel-booking.com",
+            responses: [{ method: "POST", path: "/load/:session", query: {}, format: "json" }],
+            // 3-D Secure browser data, sent beside /load when the hub loads: the record does not change.
+            inert: [{ method: "POST", path: "/setDevice/:session", query: {} }],
+            bind: "session"
+        },
         bootstrap: "/robots.txt",
         timeout_ms: 6e4,
         charge_timing: "at_request",
@@ -2155,7 +2164,7 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
             "HUMA's own payment step: whether its pay hub offers this card frame or a WSPay redirect (a HAR of one real booking's payment step)",
             "which cookies the card post needs, with DataDome in front of the host",
             "the answer to the card post (a redirect, a 3DS step or a page), and whether a 3DS step sends the card again",
-            GUARANTEE_RATES,
+            "HUMA's /load answer for its prepaid rate, as a recorded purchase shows it: the deposit, total and balance strings, a zero balance beside the stay tax, and the status of an unpaid booking that facts reads",
             "that the bootstrap path answers without a server error"
         ]
     },
@@ -2321,6 +2330,8 @@ var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
         challenge: { at: ["captcha", "token"], ttl_ms: 24e4 },
         facts: {
             reader: "fastspring_session",
+            // The record's answers come from the popup's own store host, the endpoint.
+            origin: null,
             // Every answer FastSpring's page reads its order from (refreshPageResponse and
             // refreshOrderResponse): the popup document, the one-segment calls (/tax, /coupons,
             // /locale, /exempt), an item's quantity, renewal or add-on change, and a verified discount.
@@ -3019,10 +3030,73 @@ function fastspringFacts(state, merchant) {
         return fail(unreadable);
     }
     const recurring = projection.hasRecurring || projection.forceFuture || anySelectedRenewal(groups);
-    return { ok: true, facts: { amount: { amountCents, currency: currency.toLowerCase() }, live: projection.production, recurring } };
+    return { ok: true, facts: { amount: { amountCents, currency: currency.toLowerCase() }, live: projection.production, recurring, deferred: null } };
+}
+var DEDGE_MAX_VOUCHERS = 8;
+var EURO_FIRST = /^\u20ac (\d{1,3}(?:,\d{3}){0,2})(?:\.(\d{2}))?$/;
+var EURO_LAST = /^(\d{1,3}(?:[ .\u00a0\u202f]\d{3}){0,2})(?:,(\d{2}))? \u20ac$/;
+function hubAmount(text) {
+    if (typeof text !== "string")
+        return null;
+    const match = EURO_FIRST.exec(text) ?? EURO_LAST.exec(text);
+    if (!match)
+        return /\d/.test(text) && !/\u20ac|EUR/i.test(text) ? { other: true } : null;
+    if (new Set(match[1].replace(/\d/g, "")).size > 1)
+        return null;
+    return { cents: Number(match[1].replace(/\D/g, "")) * 100 + Number(match[2] ?? "0") };
+}
+function dedgeState(format, text) {
+    const state = format === "json" ? parseJson(text) : void 0;
+    return isPlainObject(state) ? { state } : { refusal: "the payment page's booking record is not a JSON object" };
+}
+function dedgeProjection(state) {
+    if (!isPlainObject(state))
+        return null;
+    const vouchers = state.vouchers === void 0 ? [] : state.vouchers;
+    if (!Array.isArray(vouchers) || vouchers.length > DEDGE_MAX_VOUCHERS)
+        return null;
+    const scalar = (value) => value !== null && typeof value === "object" ? null : value;
+    return {
+        status: scalar(state.status),
+        deposit: scalar(state.deposit),
+        total: scalar(state.total),
+        balance: scalar(state.balance),
+        hasOriginalDeposit: scalar(state.hasOriginalDeposit),
+        hasScheduledPayment: scalar(state.hasScheduledPayment),
+        isFullDiscount: scalar(state.isFullDiscount),
+        paidAmount: state.paidAmount === void 0 ? "" : scalar(state.paidAmount),
+        vouchers: vouchers.map(() => ({}))
+    };
+}
+function dedgeFacts(state, merchant) {
+    const unreadable = `${merchant}'s order record is not in the layout Agentcard reviewed`;
+    const projection = isPlainObject(state) ? dedgeProjection(state) : null;
+    if (!projection || JSON.stringify(projection) !== JSON.stringify(state))
+        return fail(unreadable);
+    const { status, hasOriginalDeposit, hasScheduledPayment, isFullDiscount, paidAmount, vouchers } = projection;
+    if (typeof status !== "string" || typeof hasOriginalDeposit !== "boolean" || typeof hasScheduledPayment !== "boolean" || typeof isFullDiscount !== "boolean" || typeof paidAmount !== "string")
+        return fail(unreadable);
+    if (status !== "New")
+        return fail(`${merchant}'s order is not waiting for a payment`);
+    if (isFullDiscount)
+        return fail(`vouchers or points pay the whole of ${merchant}'s order, so the card pays nothing`);
+    if (paidAmount !== "")
+        return fail(`part of ${merchant}'s order was already paid another way`);
+    if (vouchers.length > 0)
+        return fail(`a voucher pays part of ${merchant}'s order, which Agentcard has not reviewed`);
+    const [deposit, total, balance] = [projection.deposit, projection.total, projection.balance].map(hubAmount);
+    if ([deposit, total, balance].some((amount) => amount?.other))
+        return fail(`${merchant}'s order is in a currency this build does not read`);
+    if (!deposit || !total || !balance)
+        return fail(unreadable);
+    if (deposit.cents + balance.cents !== total.cents)
+        return fail(unreadable);
+    const deferred = !hasOriginalDeposit || deposit.cents === 0 ? "guarantee" : hasScheduledPayment ? "scheduled" : balance.cents > 0 ? "balance" : null;
+    return { ok: true, facts: { amount: { amountCents: deposit.cents, currency: "eur" }, live: true, recurring: false, deferred } };
 }
 var READERS = /* @__PURE__ */ Object.freeze({
-    fastspring_session: Object.freeze({ state: fastspringState, project: fastspringProjection, facts: fastspringFacts })
+    fastspring_session: Object.freeze({ state: fastspringState, project: fastspringProjection, facts: fastspringFacts }),
+    dedge_pay_hub: Object.freeze({ state: dedgeState, project: dedgeProjection, facts: dedgeFacts })
 });
 var MERCHANT_CARD_ENDPOINT_FACT_READERS = /* @__PURE__ */ Object.freeze(Object.keys(READERS));
 function cardPlaceholders(p, cardUrl) {
@@ -3040,12 +3114,13 @@ function boundShape(p, card, shapes, exchange) {
     }
     return null;
 }
+var recordOrigin = (p) => p.facts.origin ?? p.endpoint;
 function shapeFor(p, cardUrl, exchange) {
     if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
         return null;
     const card = cardPlaceholders(p, cardUrl);
     const url = strictUrl(exchange.url);
-    if (!card || !url || url.origin !== p.endpoint)
+    if (!card || !url || url.origin !== recordOrigin(p))
         return null;
     return boundShape(p, card, p.facts.responses, exchange);
 }
@@ -3057,12 +3132,19 @@ function sessionPath(p, card) {
     const written = segments.slice(0, at + 1).map((segment) => segment.startsWith(":") ? card[segment.slice(1)] : segment);
     return written.every((segment) => typeof segment === "string") ? written.join("/") : null;
 }
+function onSession(p, card, url) {
+    if (p.facts.origin) {
+        const value = card[p.facts.bind];
+        return url.origin === p.facts.origin && typeof value === "string" && url.pathname.split("/").at(-1) === value;
+    }
+    const session = sessionPath(p, card);
+    return !!session && url.origin === p.endpoint && (url.pathname === session || url.pathname.startsWith(`${session}/`));
+}
 function merchantCardEndpointFactsRole(profile, cardUrl, exchange) {
     const p = trustedMerchantCardEndpoint(profile);
     if (!p.facts || !isPlainObject(exchange) || typeof exchange.method !== "string" || typeof exchange.url !== "string")
         return null;
     const card = cardPlaceholders(p, cardUrl);
-    const session = card ? sessionPath(p, card) : null;
     let url;
     try {
         url = new URL(exchange.url);
@@ -3070,10 +3152,12 @@ function merchantCardEndpointFactsRole(profile, cardUrl, exchange) {
     catch {
         return null;
     }
-    if (!session || url.origin !== p.endpoint || url.pathname !== session && !url.pathname.startsWith(`${session}/`))
+    if (!card)
         return null;
     if (exchange.method.toUpperCase() === p.method && exchange.url === cardUrl)
         return "card";
+    if (!onSession(p, card, url))
+        return null;
     if (shapeFor(p, cardUrl, exchange))
         return "record";
     if (boundShape(p, card, p.facts.inert, exchange))
@@ -3110,13 +3194,20 @@ function readMerchantCardEndpointFacts(profile, cardUrl, record) {
         return fail(`the order record is not ${p.merchant}'s record of this checkout`);
     return READERS[p.facts.reader].facts(record.state, p.merchant);
 }
+var DEFERRED_REASONS = /* @__PURE__ */ Object.freeze({
+    guarantee: (merchant) => `${merchant} only holds the card as a guarantee for this order and charges it later, when a single-use card may have closed; choose a rate paid in full now`,
+    scheduled: (merchant) => `${merchant} charges this order on a later date, when a single-use card may have closed; choose a rate paid in full now`,
+    balance: (merchant) => `${merchant} leaves part of this order to pay at the stay, when a single-use card may have closed; choose a rate paid in full now`
+});
 function merchantCardEndpointFactsRefusal(profile, facts, agent) {
     const p = trustedMerchantCardEndpoint(profile);
     const refuse2 = (code, reason) => ({ code, reason });
-    if (!isPlainObject(facts) || !isPlainObject(facts.amount) || !isPlainObject(agent))
+    if (!isPlainObject(facts) || !isPlainObject(facts.amount) || !isPlainObject(agent) || facts.deferred !== null && !Object.hasOwn(DEFERRED_REASONS, facts.deferred))
         return refuse2("malformed", `the order record for ${p.merchant} is malformed`);
     if (facts.recurring !== false)
         return refuse2("recurring", `${p.merchant}'s order renews on a schedule, and each renewal would charge the card with no approval of its own`);
+    if (facts.deferred !== null)
+        return refuse2("deferred", DEFERRED_REASONS[facts.deferred](p.merchant));
     if (facts.live !== agent.live)
         return agent.live ? refuse2("test_checkout", `${p.merchant}'s checkout is in test mode`) : refuse2("live_checkout", `${p.merchant}'s checkout is live`);
     if (typeof agent.currency !== "string" || facts.amount.currency !== agent.currency.toLowerCase()) {

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c9116965f8802329701f18adf6519c9111857dfc4329e4f59d7666de150fb5a4
+// artifact-sha256: 4289a22922e08251b579e9aadc396c8cff5d1a95b99ce35dd9a4618b43a33db5
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin2 = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/dist/paddle-vgs.generated.d.ts

@@ -17,9 +17,10 @@ declare function paddleVgsBodyVerdict(body: any): Readonly<{
 }>;
 declare function paddleVgsRequestRefusal(request: any): any;
 declare function isPreparedPaddleVgsRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare var PADDLE_VGS_ANY_SELLER: boolean;
 declare var PADDLE_VGS_MERCHANT_PINS: readonly any[];
 declare function paddleVgsMerchantPin(merchantOrigin: any, pins?: readonly any[]): any;
-declare function paddleVgsMerchantRefusal(environment: any, merchantOrigin: any, authorization: any, pins?: readonly any[]): "unsupported_environment" | "paddle_vgs_merchant_unreviewed" | "paddle_vgs_seller_unreviewed" | null;
+declare function paddleVgsMerchantRefusal(environment: any, merchantOrigin: any, authorization: any, pins?: readonly any[], anySeller?: boolean): "unsupported_environment" | "paddle_vgs_merchant_unreviewed" | "paddle_vgs_seller_unreviewed" | null;
 declare function paddleVgsSellerClaimsPinned(pins?: readonly any[]): boolean;
 declare function paddleVgsRefusalMessage(code: any): any;
 declare var PADDLE_VGS_CARD_NETWORKS: readonly string[];
@@ -75,4 +76,4 @@ declare function paddleVgsPayVerdict(request: any, approved: any): Readonly<{
     verdict: "continue";
     body: string;
 }>;
-export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };
+export { PADDLE_VGS_ANY_SELLER, PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };

package/dist/paddle-vgs.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: f3437a15e11b72b9958179cc9610fdafb411cc5db76be536af62c08360a45575
+// artifact-sha256: 20dc16205adc94410b425b342c7c54fce24ec95960fb8a0ee2a1558ba9d96dea
 // src/paddle-vgs.js
 var PADDLE_VGS_PSP = "paddle_vgs";
 var PADDLE_VGS_CAPABILITY = "paddle_vgs_cards";
@@ -135,6 +135,7 @@ var pin = (fields) => Object.freeze({
     origins: Object.freeze([...fields.origins]),
     sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
 });
+var PADDLE_VGS_ANY_SELLER = true;
 var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
 ]);
@@ -143,14 +144,17 @@ function paddleVgsMerchantPin(merchantOrigin, pins = PADDLE_VGS_MERCHANT_PINS) {
         return null;
     return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin)) ?? null;
 }
-function paddleVgsMerchantRefusal(environment, merchantOrigin, authorization, pins = PADDLE_VGS_MERCHANT_PINS) {
+var SELLER_ORIGIN = /^https:\/\/(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var SELLER_ORIGIN_LIMIT = 261;
+function paddleVgsMerchantRefusal(environment, merchantOrigin, authorization, pins = PADDLE_VGS_MERCHANT_PINS, anySeller = PADDLE_VGS_ANY_SELLER) {
     if (environment === "sandbox")
         return null;
     if (environment !== "production")
         return "unsupported_environment";
     const found = paddleVgsMerchantPin(merchantOrigin, pins);
-    if (!found)
-        return "paddle_vgs_merchant_unreviewed";
+    if (!found) {
+        return anySeller === true && typeof merchantOrigin === "string" && merchantOrigin.length <= SELLER_ORIGIN_LIMIT && SELLER_ORIGIN.test(merchantOrigin) ? null : "paddle_vgs_merchant_unreviewed";
+    }
     if (found.sellerClaim && authorization !== void 0) {
         const claims = bearerClaims(authorization);
         if (!claims || claims[found.sellerClaim.name] !== found.sellerClaim.value)
@@ -405,4 +409,4 @@ function paddleVgsPayVerdict(request, approved) {
         card.metadata[key] = facts[key];
     return Object.freeze({ verdict: "continue", body: JSON.stringify(value) });
 }
-export { PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };
+export { PADDLE_VGS_ANY_SELLER, PADDLE_VGS_CAPABILITY, PADDLE_VGS_CARDS_URLS, PADDLE_VGS_CARD_ID_WINDOW_MS, PADDLE_VGS_CARD_NETWORKS, PADDLE_VGS_CONTENT_TYPE, PADDLE_VGS_MERCHANT_PINS, PADDLE_VGS_OPERATION, PADDLE_VGS_PSP, PADDLE_VGS_REFUSAL_CODES, injectPaddleVgsCard, isPaddleVgsCardsUrl, isPreparedPaddleVgsRequest, paddleVgsAnswerOutcome, paddleVgsBodyVerdict, paddleVgsCardFacts, paddleVgsCardFactsAgree, paddleVgsCardFactsOf, paddleVgsCardRefusal, paddleVgsEnvironment, paddleVgsMerchantPin, paddleVgsMerchantRefusal, paddleVgsPayCarriesStoredCard, paddleVgsPayTarget, paddleVgsPayVerdict, paddleVgsRefusalCode, paddleVgsRefusalMessage, paddleVgsRequestRefusal, paddleVgsSellerClaimsPinned, paddleVgsStoredCardRefusal, paddleVgsTypedCardRefusal };

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 38065a5bd834d5233979a0528fde4345378914e8e8b1a63e329bff0994572da5
+// artifact-sha256: 056fa54de953be9af775505906b2fba30def2787a217a12fe2ca2a50b8614649
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -160,6 +160,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -195,9 +198,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function readElement(der, at, tag) {
     if (at + 2 > der.length || der[at] !== tag)

package/dist/pre-claim.d.ts

@@ -2,6 +2,7 @@ import { StripeCheckoutGate } from './stripe-checkout.js';
 import { MercadoCheckoutGate } from './mercado-checkout.js';
 import { type JuspayCheckoutGate } from './juspay-gate.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenexIframeRepeats } from './tokenex-iframe.js';
 import { type AciGate } from './aci.js';
 import type { EprotectGate } from './eprotect.js';
 import { type ShijiStsCompanions } from './shiji-sts.js';
@@ -99,6 +100,8 @@ export interface PreClaimContext {
         verifoneProfileOf?(url: string): VerifoneProfile | null;
         cardOnFilePolicy?(url: string, method?: string): string | null;
         withoutCard?(url: string, body: string | null | undefined): 'continue' | 'refuse' | null;
+        /** VaultClient.recognizesProcessor: whether the synced registry serves this processor (ACI, EBANX, the TokenEx iframe). */
+        recognizesProcessor?(psp: string): boolean;
         /** VaultClient.sendEbanxFollowUp: a send an approved EBANX token request covers, from the cardholder's device. */
         sendEbanxFollowUp?(authorizationId: string, request: {
             url: string;
@@ -186,6 +189,8 @@ export interface PreClaimContext {
     juspay?: JuspayCheckoutGate;
     /** The attachment's approved Datatrans answers (the repeat rule, datatrans.ts). Absent: none are kept. */
     datatrans?: DatatransRepeats;
+    /** The attachment's approved TokenEx iframe answers (the repeat rule, tokenex-iframe.ts). Absent: none are kept. */
+    tokenexIframe?: TokenexIframeRepeats;
     /** The adapter's identity for the request's frame (CDP frameId, Playwright Frame); undefined when unknown. */
     frame?: unknown;
     /**
@@ -249,13 +254,28 @@ export declare const fiservPreClaim: PreClaimGate;
 export declare function isArmedCreditguardCall(vault: {
     recognizesProcessor?(psp: string): boolean;
 } | undefined, url: string): boolean;
+export declare const przelewy24PreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
+export declare const transbankPreClaim: PreClaimGate;
 export declare const redsysPreClaim: PreClaimGate;
+export declare const quickpayPreClaim: PreClaimGate;
+export declare const comgatePreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const paypalCardFormsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
 export declare const worldlineMyCheckoutPreClaim: PreClaimGate;
 export declare const paddleVgsPayPreClaim: PreClaimGate;
+export type HipayPreClaimRefusal = 'hipay_number_only' | 'hipay_update_refused';
+export declare const hipayPreClaim: PreClaimGate;
+/**
+ * Whether attachToPlaywright routes `url` to the gates for HiPay: any request to HiPay's two vault hosts, once the
+ * synced registry serves HiPay, as attachToCdp arms both hosts from the recognizer. Playwright's route matcher sees
+ * only the URL and the recognizer takes the token create alone, so without this /update would never reach
+ * hipayPreClaim there. Any other request to those hosts goes on untouched.
+ */
+export declare function routesHipayVault(vault: {
+    recognizesProcessor?: (psp: string) => boolean;
+} | null | undefined, url: string): boolean;
 export declare const ebanxPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended