@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/pre-claim.js

@@ -7,7 +7,8 @@
 // the vault can never pay, CyberSource Flex Microform's field iframes (whose
 // capture context rides into the pause), Datatrans Secure Fields, whose
 // card URL also carries card posts the device could never fill and card posts
-// it already answered, and Pelecard's card submission URL, which also carries
+// it already answered, the TokenEx hosted iframe v3, whose card path carries the
+// same two, and Pelecard's card submission URL, which also carries
 // saved-token, wallet and keep-on-file bodies, Primer's
 // /payment-instruments, which also carries requests the vault can never pay,
 // Payrails, whose save needs the session key the page captured and whose
@@ -63,6 +64,7 @@ import { gmoRequestRefusal, isGmoTokenHost, isGmoTokenV1Request, recognizesGmo }
 import { JUSPAY_PSP } from './juspay-gate.js';
 import { datatransPauseDecision, isDatatransHost } from './datatrans.js';
 import { DATATRANS_INVALID_REQUEST } from './datatrans.generated.js';
+import { INVALID_TOKENEX_IFRAME_REQUEST, TOKENEX_IFRAME_PSP, isTokenexIframePath, servesTokenexIframe, tokenexIframePauseDecision, } from './tokenex-iframe.js';
 import { isPelecardHost, pelecardRefusal } from './pelecard.js';
 import { ACI_CHECKOUT_REUSED } from './aci.js';
 import { ACI_EXPIRY_UNSTRIPPABLE } from './aci.generated.js';
@@ -79,12 +81,17 @@ import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoi
 import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsPaymentUrl, isPayrailsStaticHost, payrailsKeyRefusal, payrailsPaymentRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
+import { isArmedTransbankUrl } from './transbank.js';
 import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
+import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
+import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
+import { isArmedComgateUrl } from './comgate.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { PAYPAL_CARD_FIELDS_REASON, PAYPAL_GUEST_CHECKOUT_REASON, isPaypalCardFieldsConfirm, isPaypalGraphql, paypalCardFieldsBody, paypalGraphqlCard, paypalGraphqlNamesCardOperation, } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
 import { isWorldlineMyCheckoutEndpoint } from './worldline-mycheckout.js';
 import { paddleVgsPayEventUrl } from './paddle-vgs-pay.js';
+import { HIPAY_PSP, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayNumberOnlyRequest } from './hipay.generated.js';
 import { EBANX_RESEND_REASON, EbanxFollowUpError, ebanxResendRefusalOf, isEbanxResendUrl, } from './ebanx.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
@@ -815,10 +822,10 @@ async function juspayUnsupported(ctx, reason) {
 // card-on-file policy the API served with the recognizer (VaultClient.cardOnFilePolicy):
 //   - a sound TOKENIZE card post defers, and the arbiter pauses it for approval, unless the same
 //     frame's same form was already answered with an approved token (the repeat rule) and that
-//     approval is still the one being handed off (datatransRepeatApproval): then that stored answer
+//     approval is still the one being handed off (handoffRepeatApproval): then that stored answer
 //     is fulfilled here, with no claim, create or prompt. Once the answer reached the page, the
 //     application's merchant resolver must first report the order still pending
-//     (datatransRepeatAfterHandoff);
+//     (repeatAfterHandoff);
 //   - a card post the API would refuse at create aborts with a `blocked` event that names the
 //     API's own code, `invalid_datatrans_request` or `datatrans_card_on_file_refused` (the latter
 //     only while the served policy refuses card on file), before anything is claimed, created or
@@ -846,25 +853,26 @@ const datatransPreClaim = (ctx) => {
         return undefined;
     if (decision !== 'card')
         return datatransBlock(ctx, decision);
-    const approval = datatransRepeatApproval(ctx);
+    const approval = handoffRepeatApproval(ctx);
     const repeat = approval === null ? null : ctx.datatrans?.answerFor(ctx.frame, url, ctx.request.body, approval) ?? null;
     if (!repeat)
         return undefined;
-    return ctx.lifecycle.getState().status === 'awaiting_merchant' ? datatransRepeatAfterHandoff(ctx, repeat) : datatransRepeat(ctx, repeat);
+    return ctx.lifecycle.getState().status === 'awaiting_merchant' ? repeatAfterHandoff(ctx, repeat, 'datatrans') : answerRepeat(ctx, repeat, 'datatrans');
 };
 /**
- * The approval whose stored Datatrans answer a repeat may still receive, or null. A stored token
+ * The approval whose stored Datatrans or TokenEx answer a repeat may still receive, or null. A stored token
  * answers a re-submit only while the approval it came from is still being handed off: the lifecycle
  * names it and reads awaiting_approval (its answer is being delivered) or awaiting_merchant (the
  * merchant has not confirmed yet), and nothing latched, tore down or cancelled the attachment. The
  * order completing or failing, an unknown outcome, a decline, a hold for the cardholder, a retry
  * after a merchant failure and a new authorization all end it, and the re-submit is then a new
- * question for the terminal arbiter, which holds or pauses it like any card post: TOKENIZE binds no
- * amount, so one approval never answers for a later purchase. Once the answer reached the page
- * (awaiting_merchant), the gate also reconciles before it answers (datatransRepeatAfterHandoff), and
- * the stored answer itself ends once its form goes quiet (DatatransRepeats, DATATRANS_REPEAT_IDLE_MS).
+ * question for the terminal arbiter, which holds or pauses it like any card post: neither card post
+ * binds an amount, so one approval never answers for a later purchase. Once the answer reached the
+ * page (awaiting_merchant), the gate also reconciles before it answers (repeatAfterHandoff). A stored
+ * Datatrans answer also ends once its form goes quiet (DatatransRepeats, DATATRANS_REPEAT_IDLE_MS), and
+ * a stored TokenEx answer once its iframe key expires (TokenexIframeRepeats).
  */
-function datatransRepeatApproval(ctx) {
+function handoffRepeatApproval(ctx) {
     if (ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
         return null;
     const { status, authorizationId } = ctx.lifecycle.getState();
@@ -881,36 +889,82 @@ function datatransRepeatApproval(ctx) {
  * arbiter, and so does every re-submit on an attachment with no resolver: a later purchase never
  * receives an earlier token without the cardholder, and the paused post never waits on a stalled read.
  */
-function datatransRepeatAfterHandoff(ctx, repeat) {
+function repeatAfterHandoff(ctx, repeat, psp) {
     if (!ctx.lifecycle.hasMerchantResolver())
         return undefined;
-    return datatransPendingRepeat(ctx, repeat);
+    return pendingRepeat(ctx, repeat, psp);
 }
-async function datatransPendingRepeat(ctx, repeat) {
+async function pendingRepeat(ctx, repeat, psp) {
     if (!await ctx.lifecycle.merchantOrderPending())
         return undefined;
     // The resolver answered asynchronously: the checkout must still be handing off this approval.
-    if (ctx.lifecycle.getState().status !== 'awaiting_merchant' || datatransRepeatApproval(ctx) !== repeat.authorizationId)
+    if (ctx.lifecycle.getState().status !== 'awaiting_merchant' || handoffRepeatApproval(ctx) !== repeat.authorizationId)
         return undefined;
-    return datatransRepeat(ctx, repeat);
+    return answerRepeat(ctx, repeat, psp);
 }
 async function datatransBlock(ctx, reason) {
     ctx.onEvent?.({ type: 'blocked', detail: reason });
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
-async function datatransRepeat(ctx, repeat) {
+/** Fulfill a repeat with the stored answer (`repeat_answered`), or abort it when the browser cannot take it (`<psp>_repeat_unanswered`). */
+async function answerRepeat(ctx, repeat, psp) {
     try {
         await ctx.effects.answer(repeat.response);
     }
     catch {
-        ctx.onEvent?.({ type: 'blocked', detail: 'datatrans_repeat_unanswered' });
+        ctx.onEvent?.({ type: 'blocked', detail: `${psp}_repeat_unanswered` });
         await ctx.effects.abort();
         return { kind: 'abort' };
     }
-    ctx.onEvent?.({ type: 'repeat_answered', detail: { psp: 'datatrans', authorizationId: repeat.authorizationId } });
+    ctx.onEvent?.({ type: 'repeat_answered', detail: { psp, authorizationId: repeat.authorizationId } });
     return { kind: 'answer' };
 }
+// The TokenEx hosted iframe v3 (tokenex-iframe.ts), JetBlue's card form. TokenEx's card-number frame posts the
+// whole card to its own document URL, and the same path takes posts the device could never fill (a cvvOnly frame,
+// a query this lane has not read) and, after an approval, the frame's own re-sends. The recognizer matches only the
+// exact card URL, so once the registry serves the TokenEx iframe (servesTokenexIframe), every POST on the frame's
+// /iframe/v3 path is judged here, before the terminal arbiter would pause it, by payment-core's own pause decision:
+//   - the sound card post defers, and the arbiter pauses it for approval, unless the same frame already sent the
+//     same bytes and had them answered with an approved token, and that approval is still the one being handed off
+//     (handoffRepeatApproval): then that stored answer is fulfilled here, with no claim, create or prompt. Once the
+//     answer reached the page, the application's merchant resolver must first report the order still pending
+//     (repeatAfterHandoff). A post with another placeholder or CVV is a new question, as for Datatrans;
+//   - any other post on that path that carries a value in Data aborts with a `blocked` event that names the API's
+//     own code, invalid_tokenex_iframe_request, before anything is claimed, created or prompted. Like Datatrans's
+//     refusal it neither holds the attachment nor changes its state;
+//   - a post with nothing in Data carries no card and defers: on the exact URL it continues untouched through the
+//     recognizer's passWithoutCard, and anywhere else it continues as an unrecognized request.
+// Nothing is decided without the registry: for an org the API did not serve the entry to, the gate defers and every
+// TokenEx request continues as before. The frame's document GETs, BinLookup and Forter never reach it as a card post.
+// Synchronous until an effect, so a card post pauses with no await. A check that throws blocks the request.
+const tokenexIframePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (method.toUpperCase() !== 'POST' || !isTokenexIframePath(url) || !servesTokenexIframe(ctx.vault))
+        return undefined;
+    let decision;
+    try {
+        decision = tokenexIframePauseDecision({ url, headers: ctx.request.headers, body: ctx.request.body });
+    }
+    catch {
+        decision = INVALID_TOKENEX_IFRAME_REQUEST;
+    }
+    if (decision === null)
+        return undefined;
+    if (decision !== 'card')
+        return tokenexIframeBlock(ctx, decision);
+    const approval = handoffRepeatApproval(ctx);
+    const repeat = approval === null ? null : ctx.tokenexIframe?.answerFor(ctx.frame, url, ctx.request.body, approval) ?? null;
+    if (!repeat)
+        return undefined;
+    return ctx.lifecycle.getState().status === 'awaiting_merchant'
+        ? repeatAfterHandoff(ctx, repeat, TOKENEX_IFRAME_PSP) : answerRepeat(ctx, repeat, TOKENEX_IFRAME_PSP);
+};
+async function tokenexIframeBlock(ctx, reason) {
+    ctx.onEvent?.({ type: 'blocked', detail: reason });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // Pelecard Iframe/Redirect 2.0 (pelecard.ts). The payment page's card URL, POST
 // /PaymentGW/Transaction on gateway21 or gateway20.pelecard.biz, also carries the wallet, Bit,
 // PIN pad and bank tabs with no card, and card-shaped bodies the device could never fill: a saved
@@ -1572,6 +1626,23 @@ async function shijiStsCompanion(ctx, body) {
     ctx.onEvent?.({ type: 'companion_continued', detail: { url: redactUrl(url), psp: 'shiji_sts', fields: ['cvv'] } });
     return { kind: 'continue' };
 }
+// Przelewy24's pay wall (przelewy24.ts). Once this build's registry serves Przelewy24's entry (a capability the
+// API serves only to a company Agentcard turned Przelewy24 on for), every request to the pay wall's two hosts
+// pauses. The merchant's entry, a GET of /trnRequest/<token> exactly, is no step of this gate's: it defers, and the
+// terminal arbiter pauses it for the claim flow like any card request, so the cardholder's device pays it. Every
+// step toward paying on the pay wall itself aborts as an unsupported checkout: every POST there (the card method's
+// post, the card form's post, a form posted to the entry's link) and the GET of the Saferpay resolver, which names
+// the typed card's type. So Przelewy24 never sees the card the agent typed. The agent's browser only reaches the
+// pay wall when the entry was not paused (an attachment made too late, say), and then only the cardholder's device
+// can pay. The pay wall's own pages, scripts and images are not this gate's and continue. With Przelewy24 not
+// served, the gate defers, and every request continues as before. Synchronous until it must abort, like every gate.
+// Exported for the gate registry's tests.
+export const przelewy24PreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isPrzelewy24PayStep(url, method) || !isArmedPrzelewy24Url(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -1595,7 +1666,8 @@ export const ekashuPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
-// The stop for a card post into a processor's own page that only the cardholder's device may pay (NMI's, Redsys's).
+// The stop for a card post into a processor's own page that only the cardholder's device may pay (NMI's, Redsys's,
+// QuickPay's).
 async function processorPageAbort(ctx) {
     const { url, method } = ctx.request;
     ctx.preparationGate.invalidate('unsupported_checkout');
@@ -1604,6 +1676,27 @@ async function processorPageAbort(ctx) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// Transbank's Webpay Plus (transbank.ts). Once this build's registry serves Webpay's entry (a capability the API
+// serves only to a company Agentcard turned Webpay on for), every request to Webpay's two hosts pauses, and this gate
+// judges them:
+//   - the merchant's entry, the GET of initTransaction?token_ws=<token> exactly as the redirect writes it, is a GET
+//     and not this gate's: the terminal arbiter pauses it for the claim flow like any card request, and the
+//     cardholder's device pays it;
+//   - every other request there but a GET (the token's one submit to init_transaction.cgi, Webpay's card lookup and
+//     card check, the card post to bp_control.cgi, and an entry posted as a form) aborts as an unsupported checkout,
+//     so the token is never spent in the agent's browser and Webpay never sees the card the agent typed. The agent's
+//     browser only reaches Webpay's pages when the entry was not paused (an attachment made too late, an entry with
+//     another parameter), and then only the cardholder's device can pay;
+//   - another GET there (Webpay's scripts and images, or an entry written another way, whose page then submits the
+//     token, which this gate aborts) continues.
+// With Webpay not served, the gate defers and every request continues as before. Synchronous until it must abort,
+// like every gate. Exported for the gate registry's tests.
+export const transbankPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() === 'GET' || !isArmedTransbankUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // Redsys's hosted payment page (redsys.ts). Once this build's registry serves Redsys's entry (a
 // capability the API serves only to a company Agentcard turned Redsys on for), every request to
 // Redsys's hosts pauses, and this gate judges the POSTs:
@@ -1628,6 +1721,47 @@ export const redsysPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// QuickPay's hosted payment window (quickpay.ts). Once this build's registry serves QuickPay's entry (a capability
+// the API serves only to a company Agentcard turned QuickPay on for), every request to QuickPay's host pauses, and
+// this gate judges the POSTs and the window's card lookup:
+//   - the merchant's entry (the host's root, no query) defers, and the terminal arbiter pauses it for the claim
+//     flow like any card request: the cardholder's device pays it;
+//   - every other POST to QuickPay (the window's card post, its fee lookup, its wallet token post, its 3-D Secure
+//     step, and the framed twin of the entry, whose window asks for a card) aborts as an unsupported checkout,
+//     and so does the window's GET that looks up the typed card's first digits, so QuickPay never sees the card
+//     the agent typed. The agent's browser only reaches QuickPay's window when the entry was not paused (an
+//     attachment made too late, say), and then only the cardholder's device can pay.
+// Any other GET (the window itself, its scripts and images) is not this gate's and continues. With QuickPay not
+// served, the entry is no card request, the gate defers, and every request continues as before. Synchronous
+// until it must abort, like every gate. Exported for the gate registry's tests.
+export const quickpayPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' && !isQuickpayCardLookup(url, method))
+        return undefined;
+    const entry = quickpayEntryUrl(url);
+    if (!entry || !ctx.vault.isCardRequest(entry, 'POST'))
+        return undefined;
+    if (isQuickpayEntry(url, method))
+        return undefined;
+    return processorPageAbort(ctx);
+};
+// ComGate's payment gateway (comgate.ts). Once this build's registry serves ComGate's entry (a capability the API serves
+// only to a company Agentcard turned ComGate on for), the gateway link pauses for the cardholder's device and every
+// request to ComGate's card hosts pauses too, and this gate judges those:
+//   - every request but a GET (the gateway's card post and card check, the Web Checkout SDK's provider calls and card
+//     check, the card frames' BIN lookup and their log) aborts as an unsupported checkout, so ComGate never sees the
+//     card the agent typed. The agent's browser only reaches ComGate's card form when the link was not paused (an
+//     attachment made too late, a link with another parameter, a shop on ComGate's Web Checkout SDK), and then only the
+//     cardholder's device can pay;
+//   - a GET there (the gateway's reads of the payment, the card frames' pages and scripts) is not this gate's and continues.
+// With ComGate not served, the gate defers and every request continues as before. Synchronous until it must abort, like
+// every gate. Exported for the gate registry's tests.
+export const comgatePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() === 'GET' || !isArmedComgateUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // PayPal's legacy Hosted Fields (paypal-hosted-fields.ts). Its tokenization frame posts the card the
 // agent typed to the Orders v2 confirm-payment-source on cors.api.paypal.com (or its sandbox), which
 // no Vault mode takes over, so every company's adapters hand each POST there to this gate:
@@ -1952,6 +2086,52 @@ async function paddleVgsPayContinued(ctx, body) {
             fields: ['card_first_six', 'card_last_four', 'expiry_month', 'expiry_year', 'card_brand'] } });
     return { kind: 'continue' };
 }
+// HiPay's hosted fields (payment-core hipay.js). The controller frame posts the card number alone as soon as the typed
+// number is valid, before Pay, and posts /rest/v2/token/update with a token once it holds one. Neither is this lane's
+// card request. The number-only post fails here as a network error, so the frame keeps the number and Pay sends one
+// complete create, the request a preparation binds. /update fails the same way, so the page's placeholder code and
+// expiry never ride under a token HiPay minted for the real card (the frame holds one only when an answer reached it
+// after the page gave up). Both fail before the preparation claim reads them: a ready preparation is neither spent
+// nor invalidated, and nothing reaches the API. Only while the synced registry serves HiPay (a build that declared
+// hipay_vault_token, for a company Agentcard turned HiPay on for); for anyone else HiPay's traffic is left as it was.
+const HIPAY_UPDATE_URLS = Object.values(HIPAY_TOKEN_URLS).map((url) => `${new URL(url).origin}${HIPAY_UPDATE_PATH}`);
+export const hipayPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (typeof method !== 'string' || method.toUpperCase() !== 'POST' || ctx.vault.recognizesProcessor?.(HIPAY_PSP) !== true)
+        return undefined;
+    if (HIPAY_UPDATE_URLS.includes(url))
+        return hipayRefused(ctx, 'hipay_update_refused');
+    let body;
+    // A reader that throws (Playwright's postData() can) proves nothing: the request is judged later, as any other.
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return undefined;
+    }
+    return hipayNumberOnlyRequest(url, method, body) ? hipayRefused(ctx, 'hipay_number_only') : undefined;
+};
+/**
+ * Whether attachToPlaywright routes `url` to the gates for HiPay: any request to HiPay's two vault hosts, once the
+ * synced registry serves HiPay, as attachToCdp arms both hosts from the recognizer. Playwright's route matcher sees
+ * only the URL and the recognizer takes the token create alone, so without this /update would never reach
+ * hipayPreClaim there. Any other request to those hosts goes on untouched.
+ */
+export function routesHipayVault(vault, url) {
+    let host;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        return false;
+    }
+    return Object.keys(HIPAY_VAULT_HOSTS).includes(host) && vault?.recognizesProcessor?.(HIPAY_PSP) === true;
+}
+async function hipayRefused(ctx, reason) {
+    ctx.onEvent?.({ type: 'blocked', detail: reason });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // EBANX after its card token (ebanx.ts, payment-core ebanx.js). Once the cardholder's device has sent the card to
 // /ws/token, EBANX's hosted payment page and EBANX.js send the card the page holds again: its 3-D Secure calls post
 // the card, and the hosted page's confirm posts its code beside EBANX's token. On a page this SDK is attached to that
@@ -2147,8 +2327,8 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, paypalHostedFieldsPreClaim,
-    paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, paypalHostedFieldsPreClaim,
+    paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, hipayPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -2174,6 +2174,64 @@
       "hostname_pattern": "^assets\\.braintreegateway\\.com$",
       "pathname_pattern": "^\\/web\\/[0-9]+\\.[0-9]+\\.[0-9]+-payments-sdk(?:-[a-z]+)?\\/html\\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\\.min)?\\.html$"
     },
+    {
+      "id": "paypal-card-fields-v5",
+      "psp": "paypal",
+      "kinds": [
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://www.paypal.com",
+      "path_pattern": "/smart/card-field",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.paypal.com/sdk/js?components=card-fields",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://developer.paypal.com/docs/checkout/advanced/integrate/",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "lake-antoine-park-2026-10-15:paypal-card-field-frames",
+          "reviewed_on": "2026-10-15"
+        }
+      ],
+      "hostname_pattern": "^www\\.paypal\\.com$",
+      "pathname_pattern": "^\\/smart\\/card-field$"
+    },
+    {
+      "id": "paypal-card-fields-v6",
+      "psp": "paypal",
+      "kinds": [
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://www.paypal.com",
+      "path_pattern": "/web-sdk/v6/card-fields-content",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.paypal.com/sdk/js?components=card-fields",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://developer.paypal.com/docs/checkout/advanced/integrate/",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "lake-antoine-park-2026-10-15:paypal-card-field-frames",
+          "reviewed_on": "2026-10-15"
+        }
+      ],
+      "hostname_pattern": "^www\\.paypal\\.com$",
+      "pathname_pattern": "^\\/web-sdk\\/v6\\/card-fields-content$"
+    },
     {
       "id": "cybersource-secure-acceptance-silent-order-post",
       "psp": "cybersource_secure_acceptance",

package/dist/preflight-schemas.json

@@ -467,6 +467,8 @@
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
                 "paypal-hosted-fields-payments-sdk",
+                "paypal-card-fields-v5",
+                "paypal-card-fields-v6",
                 "cybersource-secure-acceptance-silent-order-post",
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
@@ -1101,6 +1103,8 @@
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
                       "paypal-hosted-fields-payments-sdk",
+                      "paypal-card-fields-v5",
+                      "paypal-card-fields-v6",
                       "cybersource-secure-acceptance-silent-order-post",
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: f0596389845388a1c6150964e576c420abb0b44a805347e4ba4d0617f3b8ea2b
+// source-sha256: 639ffa689e8dfcf093eeba7e34b86c570e53ab17970976ae462a41fd2120d753
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -87,6 +87,20 @@ RULES.push({ id: 'paypal-hosted-fields-payments-sdk', psp: 'paypal', kinds: ['fr
         paypalHostedFieldsSource('https://www.paypal.com/sdk/js?components=hosted-fields'),
         { kind: 'saved_observation', reference: 'planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames', reviewed_on: '2026-10-07' }],
     variant_unverified: 'PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.' });
+// PayPal Card Fields (its JS SDK's components=card-fields, v5, and web-sdk v6), reviewed 2026-10-15 from
+// WooCommerce PayPal Payments 4.1.3 checkouts (PayPal JS SDK 5.0.582, card-field client 1.270.0) and PayPal's
+// public web-sdk v6 6.68.0 bundles, with no card typed. v5 renders each card field as a frame on
+// www.paypal.com/smart/card-field (?type=number, expiry, cvv or name), and v6 as
+// www.paypal.com/web-sdk/v6/card-fields-content. Each sends the card to the Orders v2 confirm-payment-source,
+// which payment-core's paypal entry takes while it ships dark, so the frames name paypal and the result
+// stays unknown until the lane is served to every client.
+const paypalCardFieldsSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-10-15' });
+const PAYPAL_CARD_FIELDS_SOURCES = [paypalCardFieldsSource('https://www.paypal.com/sdk/js?components=card-fields'),
+    paypalCardFieldsSource('https://developer.paypal.com/docs/checkout/advanced/integrate/'),
+    { kind: 'saved_observation', reference: 'lake-antoine-park-2026-10-15:paypal-card-field-frames', reviewed_on: '2026-10-15' }];
+RULES.push({ id: 'paypal-card-fields-v5', psp: 'paypal', kinds: ['frame', 'iframe'], hostname: /^www\.paypal\.com$/, pathname: /^\/smart\/card-field$/,
+    origin: 'https://www.paypal.com', path_pattern: '/smart/card-field', sources: PAYPAL_CARD_FIELDS_SOURCES }, { id: 'paypal-card-fields-v6', psp: 'paypal', kinds: ['frame', 'iframe'], hostname: /^www\.paypal\.com$/, pathname: /^\/web-sdk\/v6\/card-fields-content$/,
+    origin: 'https://www.paypal.com', path_pattern: '/web-sdk/v6/card-fields-content', sources: PAYPAL_CARD_FIELDS_SOURCES });
 // CyberSource Secure Acceptance's Silent Order POST (the Secure Acceptance Checkout API), reviewed 2026-10-08 from
 // CyberSource's endpoint table and Arrow Electronics' public bundles (no card was sent). The merchant's own page
 // posts the card fields, unsigned, beside the fields its server signed, to a /silent/ path on CyberSource's Secure
@@ -308,7 +322,7 @@ RULES.push({ id: 'worldline-mycheckout-page', psp: 'worldline_mycheckout', kinds
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout/{payment-product-details/}:hosted_checkout', sources: worldlineSources }, { id: 'worldline-mycheckout-card-form', psp: 'worldline_mycheckout', kinds: ['form'], hostname: /^payment\.pay1\.checkout\.worldline-solutions\.com$/, pathname: /^\/checkout$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout', sources: worldlineSources });
 // A processor that ships dark (its definition declares a capability) is left out of the bundled
-// catalog. Datatrans's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
+// catalog. Datatrans's and the TokenEx iframe's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
 // bundled catalog's processors, lists its psp. Until then its assets are not evidence, so a page
 // that loads them, alone or beside another processor's SDK, reads exactly as it did before the
 // processor existed. (The dark GMO, CyberSource Flex, Juspay, Pelecard, ACI, CreditGuard,
@@ -326,6 +340,16 @@ for (const [suffix, hostname, origin] of [['', /^pay\.datatrans\.com$/, 'https:/
         sources: [datatransSource('https://pay.datatrans.com/upp/payment/js/secure-fields-2.0.0.js'), datatransSource('https://docs.pci-proxy.com/docs/secure-fields-quick-start')] }, { id: `datatrans-secure-fields-frame${suffix}`, psp: 'datatrans', kinds: ['document', 'frame', 'iframe'], hostname, pathname: /^\/upp\/payment\/SecureFields\/paymentField$/, origin, path_pattern: '/upp/payment/SecureFields/paymentField',
         sources: [datatransSource('https://pay.datatrans.com/upp/payment/SecureFields/field.js'), datatransSource('https://docs.datatrans.ch/docs/secure-fields')] });
 }
+// TokenEx hosted iframe v3, read 2026-10-18 from JetBlue's checkout: the parent library
+// (htp.tokenex.com/Iframe/Iframe-v3.min.js) and the iframe document it loads (/iframe/v3?<query>), on the
+// live host and its test twin. Dark behind tokenex_iframe_tokenize, so it waits with Datatrans.
+const tokenexSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-10-18' });
+for (const [suffix, hostname, origin] of [['', /^htp\.tokenex\.com$/, 'https://htp.tokenex.com'],
+    ['-test', /^test-htp\.tokenex\.com$/, 'https://test-htp.tokenex.com']]) {
+    SERVED_ONLY_RULES.push({ id: `tokenex-iframe-v3-script${suffix}`, psp: 'tokenex_iframe', kinds: ['script'], hostname, pathname: /^\/Iframe\/Iframe-v3(?:\.min)?\.js$/, origin, path_pattern: '/Iframe/Iframe-v3{,.min}.js',
+        sources: [tokenexSource('https://htp.tokenex.com/Iframe/Iframe-v3.min.js')] }, { id: `tokenex-iframe-v3-frame${suffix}`, psp: 'tokenex_iframe', kinds: ['document', 'frame', 'iframe'], hostname, pathname: /^\/iframe\/v3$/, origin, path_pattern: '/iframe/v3',
+        sources: [tokenexSource('https://htp.tokenex.com/Iframe/v3.min.js?version=latest')] });
+}
 RULES.push(...SERVED_ONLY_RULES.filter(rule => KNOWN_PSPS.includes(rule.psp)));
 // Keep sandbox evidence truthful instead of labelling it with a production origin.
 for (const [baseId, suffix, hostname, origin] of [

package/dist/prepared-processor.d.ts

@@ -24,8 +24,12 @@
  * wix_payments: prepared only. Wix's payment widget fails the payment 30 seconds after it asks Wix
  * Cashier's card frame for a token, too soon for an approval after Pay. Its one environment is
  * production: Wix's tokenizer has no test host.
+ *
+ * hipay: prepared only. The merchant's page gives HiPay's hosted fields 20 seconds after Pay, too soon for an
+ * approval after Pay. Its environments are its two vault hosts: secure2-vault (production) and
+ * stage-secure2-vault (sandbox).
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments' | 'hipay';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -62,7 +66,7 @@ export declare function preparedApprovalAnswersRetry(psp: string): boolean;
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
- * sandbox-vault is test.
+ * sandbox-vault is test. So are HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**

package/dist/prepared-processor.js

@@ -15,6 +15,7 @@ import { isPreparedVerifoneRequest } from './verifone.js';
 import { isPreparedSecureAcceptanceRequest, secureAcceptanceEnvironment, secureAcceptancePreparationUrl, secureAcceptanceRequestRefusal, } from './cybersource-secure-acceptance.generated.js';
 import { PADDLE_VGS_CARDS_URLS, isPreparedPaddleVgsRequest } from './paddle-vgs.generated.js';
 import { WIX_PAYMENTS_TOKENIZE_URL, isPreparedWixPaymentsRequest } from './wix-payments.generated.js';
+import { HIPAY_TOKEN_URLS, hipayRequestRefusal, hipayTokenEnvironment, isPreparedHipayRequest } from './hipay.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -49,7 +50,7 @@ export function preparedApprovalAnswersRetry(psp) {
  * its own signing keys. A Verifone preparation pays in the environment of the key its reviewed
  * profile pins. CyberSource Secure Acceptance's are separate hosts too: secureacceptance is
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
- * sandbox-vault is test.
+ * sandbox-vault is test. So are HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
@@ -58,7 +59,7 @@ export function validPreparationEnvironment(psp, environment) {
     if (psp === 'wix_payments')
         return environment === 'production';
     return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
-        'cybersource_secure_acceptance', 'paddle_vgs'].includes(psp) && ['production', 'sandbox'].includes(environment);
+        'cybersource_secure_acceptance', 'paddle_vgs', 'hipay'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -106,6 +107,9 @@ export function preparationEndpoint(psp, environment) {
     // Wix Payments: the tokenize URL, the only URL the claim takes for it.
     if (psp === 'wix_payments')
         return WIX_PAYMENTS_TOKENIZE_URL;
+    // HiPay: the token create on the environment's vault, the only URL the claim takes for it.
+    if (psp === 'hipay')
+        return HIPAY_TOKEN_URLS[environment];
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -263,6 +267,11 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     // site's app instance and the card frame's body), the rule the API and the Vault bind with too.
     if (psp === 'wix_payments')
         return isPreparedWixPaymentsRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers ?? {});
+    // HiPay: the environment's own vault and payment-core's whole request rule (a JSON content type, a public username of
+    // that environment and a complete create, never the hosted fields' number-only post), the rule the API and the Vault
+    // bind with too.
+    if (psp === 'hipay')
+        return isPreparedHipayRequest(requestUrl, method.toUpperCase(), body ?? null, environment, headers ?? {});
     if (psp === 'creditguard')
         return matchesPreparedCreditguard(environment, requestUrl, body, headers, binding);
     // A Verifone request is judged only through the profile its preparation names (matchesPreparation).
@@ -423,6 +432,13 @@ export function preparedRequestRefusal(psp, environment, requestUrl, body, heade
         const reason = secureAcceptanceClaimRefusal(requestUrl, body, headers, merchantOrigin, currency);
         return reason === null ? 'checkout_changed' : `secure_acceptance_${reason}`;
     }
+    // A HiPay token create on the prepared environment's vault names what payment-core's request rule refused
+    // (hipay_keeps_card, hipay_headers_refused, ...); another vault or another request is `checkout_changed`.
+    if (psp === 'hipay') {
+        if (hipayTokenEnvironment(requestUrl) !== environment)
+            return 'checkout_changed';
+        return hipayRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
+    }
     if (psp !== 'amadeus_checkout' || amadeusEnvironment(requestUrl) !== environment)
         return 'checkout_changed';
     const merchantHost = merchantHostOf(merchantOrigin);