@agent-cards/sdk 0.23.2 → 0.23.4

package/dist/merchant-hosted.js

@@ -17,7 +17,8 @@
  * the agent's dummy card never reaches the merchant and nothing is charged;
  * 'enabled' lets a prepared checkout pay it. The API can hold a profile in
  * 'observe' for a client but never enable it past this build: a profile is
- * 'enabled' only when both say so. Every profile ships in 'observe' today.
+ * 'enabled' only when both say so. Cinemark and Dick's own storefront ship
+ * 'enabled'; every other profile ships in 'observe'.
  */
 import { MERCHANT_PROFILE_RECOGNIZERS as SHARED_PROFILES, classifyDeclaredMerchantRequest as sharedClassifyDeclared, declaredTemplatedUrl as sharedDeclaredTemplatedUrl, declaredUrlGlobs as sharedDeclaredUrlGlobs, declaredUrlRelation as sharedDeclaredUrlRelation, declaredEndpointRefusal as sharedDeclaredEndpointRefusal, classifyMerchantRequest as sharedClassify, merchantBodyKeyPathSha256 as sharedKeyPathSha256, merchantProfileEnvironment as sharedEnvironment, merchantProfileRulesMatch as sharedRulesMatch, merchantProfileTemplatedUrl as sharedTemplatedUrl, merchantProfileUrlGlobs as sharedUrlGlobs, merchantProfileUrlRelation as sharedUrlRelation, sha256Hex as sharedSha256Hex, } from './adyen-merchant-hosted.generated.js';
 import { SubstitutionError, substituteMerchantHosted as sharedSubstitute } from './substitutions.generated.js';

package/dist/merchant-total.js

@@ -12,7 +12,10 @@
  *
  * What this proves: the total is what the agent's browser session saw. It catches a
  * mistyped amount and a cart that changed under the agent; it cannot tell a merchant's
- * response from one the agent wrote, so every profile priced this way stays in observe.
+ * response from one the agent wrote. So a profile priced this way stays in observe unless
+ * Agentcard accepted that risk for it by name (Cinemark and Dick's own storefront, Oct 7,
+ * 2026), and then it pays only for the company Agentcard enables it for, and only after the
+ * cardholder approves each payment.
  *
  * What the SDK owes payment-core (the header of merchant-amount.js): every exchange of
  * the profile's shapes, projected, with the time it left; a wait for any such request

package/dist/paypal-hosted-fields.d.ts

@@ -0,0 +1,52 @@
+/**
+ * PayPal's legacy Hosted Fields, which this SDK refuses for every company.
+ *
+ * A merchant page that loads PayPal's JS SDK with `components=hosted-fields` (Planet Golf UK's X-Cart
+ * checkout, read live on 2026-10-06 with SDK 5.0.580) shows each card field as a braintree-web
+ * `-payments-sdk` frame on assets.braintreegateway.com. The agent types its placeholder card there, and
+ * at submit the 0x0 tokenization frame sends that card to PayPal as plaintext JSON:
+ *
+ *   POST https://cors.api.paypal.com/v2/checkout/orders/<order id>/confirm-payment-source
+ *   {"payment_source":{"card":{"number","expiry":"YYYY-MM","security_code","name","billing_address",
+ *     "attributes":{"verification":{"method":"SCA_ALWAYS"}}}},"application_context":{"vault":false}}
+ *
+ * (cors.api.sandbox.paypal.com in PayPal's sandbox). No Vault mode takes this request over, so no
+ * company can pay it, and an SDK without this guard let the placeholder card reach PayPal, which
+ * declined it. Both adapters arm the confirm whatever the synced registry serves, and the pre-claim
+ * gate (paypalHostedFieldsPreClaim, pre-claim.ts) judges each POST to it:
+ *   - a card number at payment_source.card.number: abort, so the confirm never carries the card to PayPal,
+ *     and the checkout reads `unsupported` with reason `unsupported_paypal_hosted_fields` and holds, as
+ *     every unsupported refusal does: another way to pay on the same page needs a new attachment;
+ *   - no card number (a PayPal wallet, a saved card, a token): continue untouched;
+ *   - a body the adapter could not read, an empty one, or one that is not a JSON object: abort that
+ *     request alone, since nothing proves it carries no card (the frame always sends JSON).
+ * A confirm the synced registry recognizes as a card request belongs to that recognizer instead; no
+ * build serves one today. The frame's XHR reports the abort to the page at once (braintree-web's request
+ * reads readyState 4 with status 0 as an error), so Hosted Fields' submit fails instead of waiting out
+ * its 60 second limit.
+ *
+ * The confirm is the only request judged here. A merchant that passes installments handlers
+ * (onInstallmentsRequested and onInstallmentsAvailable) to HostedFields.render also has the number frame
+ * post each valid typed number to v1/credit/calculated-financing-options on the same hosts, as the agent
+ * types it (braintree-web 3.32.0-payments-sdk-dev, hosted-fields-input-frame). That lookup pays and
+ * declines nothing, and neither adapter intercepts it. Planet Golf UK's card funding is not installment
+ * eligible (funding eligibility read 2026-10-06).
+ */
+export declare const PAYPAL_HOSTED_FIELDS_REASON: "unsupported_paypal_hosted_fields";
+/** The two hosts PayPal's JS SDK sends the Hosted Fields confirm to (getPayPalAPIDomain()). */
+export declare const PAYPAL_HOSTED_FIELDS_HOSTS: readonly string[];
+/**
+ * CDP Fetch patterns for the confirm on both hosts, armed on every attachment. A pattern matches the
+ * canonical URL Chrome sends, whose host is lower case, and its trailing `*` keeps a confirm with a
+ * query or a trailing slash paused. Only the confirm path is armed, never the whole host.
+ */
+export declare const PAYPAL_HOSTED_FIELDS_PATTERNS: readonly string[];
+/** Whether this URL is the Hosted Fields confirm on one of PayPal's two hosts (https, standard port, no credentials). */
+export declare function isPaypalHostedFieldsConfirm(url: string): boolean;
+/**
+ * What a confirm's body carries, read as PayPal reads it (the last of a repeated key wins in both):
+ * 'card' when payment_source.card.number holds anything but null or an empty string, 'no_card' for
+ * any other JSON object, and 'unreadable' for a body the adapter could not read (null), an empty
+ * one, or one that is not a JSON object.
+ */
+export declare function paypalHostedFieldsBody(body: string | null): 'card' | 'no_card' | 'unreadable';

package/dist/paypal-hosted-fields.js

@@ -0,0 +1,80 @@
+/**
+ * PayPal's legacy Hosted Fields, which this SDK refuses for every company.
+ *
+ * A merchant page that loads PayPal's JS SDK with `components=hosted-fields` (Planet Golf UK's X-Cart
+ * checkout, read live on 2026-10-06 with SDK 5.0.580) shows each card field as a braintree-web
+ * `-payments-sdk` frame on assets.braintreegateway.com. The agent types its placeholder card there, and
+ * at submit the 0x0 tokenization frame sends that card to PayPal as plaintext JSON:
+ *
+ *   POST https://cors.api.paypal.com/v2/checkout/orders/<order id>/confirm-payment-source
+ *   {"payment_source":{"card":{"number","expiry":"YYYY-MM","security_code","name","billing_address",
+ *     "attributes":{"verification":{"method":"SCA_ALWAYS"}}}},"application_context":{"vault":false}}
+ *
+ * (cors.api.sandbox.paypal.com in PayPal's sandbox). No Vault mode takes this request over, so no
+ * company can pay it, and an SDK without this guard let the placeholder card reach PayPal, which
+ * declined it. Both adapters arm the confirm whatever the synced registry serves, and the pre-claim
+ * gate (paypalHostedFieldsPreClaim, pre-claim.ts) judges each POST to it:
+ *   - a card number at payment_source.card.number: abort, so the confirm never carries the card to PayPal,
+ *     and the checkout reads `unsupported` with reason `unsupported_paypal_hosted_fields` and holds, as
+ *     every unsupported refusal does: another way to pay on the same page needs a new attachment;
+ *   - no card number (a PayPal wallet, a saved card, a token): continue untouched;
+ *   - a body the adapter could not read, an empty one, or one that is not a JSON object: abort that
+ *     request alone, since nothing proves it carries no card (the frame always sends JSON).
+ * A confirm the synced registry recognizes as a card request belongs to that recognizer instead; no
+ * build serves one today. The frame's XHR reports the abort to the page at once (braintree-web's request
+ * reads readyState 4 with status 0 as an error), so Hosted Fields' submit fails instead of waiting out
+ * its 60 second limit.
+ *
+ * The confirm is the only request judged here. A merchant that passes installments handlers
+ * (onInstallmentsRequested and onInstallmentsAvailable) to HostedFields.render also has the number frame
+ * post each valid typed number to v1/credit/calculated-financing-options on the same hosts, as the agent
+ * types it (braintree-web 3.32.0-payments-sdk-dev, hosted-fields-input-frame). That lookup pays and
+ * declines nothing, and neither adapter intercepts it. Planet Golf UK's card funding is not installment
+ * eligible (funding eligibility read 2026-10-06).
+ */
+export const PAYPAL_HOSTED_FIELDS_REASON = 'unsupported_paypal_hosted_fields';
+/** The two hosts PayPal's JS SDK sends the Hosted Fields confirm to (getPayPalAPIDomain()). */
+export const PAYPAL_HOSTED_FIELDS_HOSTS = Object.freeze(['cors.api.paypal.com', 'cors.api.sandbox.paypal.com']);
+const CONFIRM_PATH = /^\/v2\/checkout\/orders\/[^/]+\/confirm-payment-source\/?$/;
+/**
+ * CDP Fetch patterns for the confirm on both hosts, armed on every attachment. A pattern matches the
+ * canonical URL Chrome sends, whose host is lower case, and its trailing `*` keeps a confirm with a
+ * query or a trailing slash paused. Only the confirm path is armed, never the whole host.
+ */
+export const PAYPAL_HOSTED_FIELDS_PATTERNS = Object.freeze(PAYPAL_HOSTED_FIELDS_HOSTS.map((host) => `https://${host}/v2/checkout/orders/*/confirm-payment-source*`));
+/** Whether this URL is the Hosted Fields confirm on one of PayPal's two hosts (https, standard port, no credentials). */
+export function isPaypalHostedFieldsConfirm(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.port && !parsed.username && !parsed.password
+        && PAYPAL_HOSTED_FIELDS_HOSTS.includes(parsed.hostname.toLowerCase()) && CONFIRM_PATH.test(parsed.pathname);
+}
+const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/**
+ * What a confirm's body carries, read as PayPal reads it (the last of a repeated key wins in both):
+ * 'card' when payment_source.card.number holds anything but null or an empty string, 'no_card' for
+ * any other JSON object, and 'unreadable' for a body the adapter could not read (null), an empty
+ * one, or one that is not a JSON object.
+ */
+export function paypalHostedFieldsBody(body) {
+    if (typeof body !== 'string' || body === '')
+        return 'unreadable';
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return 'unreadable';
+    }
+    if (!record(parsed))
+        return 'unreadable';
+    const source = parsed.payment_source;
+    const card = record(source) ? source.card : undefined;
+    const number = record(card) ? card.number : undefined;
+    return number === undefined || number === null || number === '' ? 'no_card' : 'card';
+}

package/dist/pre-claim.d.ts

@@ -200,6 +200,7 @@ export declare const MERCHANT_BODY_UNREADABLE = "the paused request carries no b
 export declare const verifonePreClaim: PreClaimGate;
 export declare const fiservPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
+export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -14,8 +14,9 @@
 // hosts also carry card payments the vault can never pay, and Elavon
 // Converge's hpp/process URL, which also carries wallet, debit, follow-up and
 // card-saving bodies, WSPay's confirm URL, which also carries bodies with
-// no new card, and Shiji STS's getTokenId and getCvvId, which also carry
-// requests the vault must never pay.
+// no new card, Shiji STS's getTokenId and getCvvId, which also carry
+// requests the vault must never pay, and PayPal's legacy Hosted Fields
+// confirm, whose card no Vault mode takes over.
 // The first three used to be
 // written inline in Fetch.requestPaused and again in the page.route handler, so
 // a decision could drift between the two adapters and a new family had to be
@@ -73,6 +74,7 @@ import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoi
 import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsStaticHost, payrailsKeyRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
+import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -103,9 +105,15 @@ export function eventUrl(vault, url) {
 // POST to exactly a profile's card request URL is held only when it carries a card
 // (cardEndpointCarriesCard: anything at the profile's card number field, or a Luhn-valid
 // number anywhere in the body). Several of these URLs also take requests with no card,
-// such as an IHG stay paid with points, a LookFantastic order whose card a processor's
-// own fields tokenized, a saved card or a SynXis room guaranteed with a token: those
-// defer, and continue untouched as before any profile existed. A body the profile reads as
+// such as an IHG stay paid with points, a saved card or a SynXis room guaranteed with
+// a token: those defer, and continue untouched as before any profile existed.
+// LookFantastic's order after BR-DGE's hosted fields, the path its live checkout runs
+// (live check of Oct 6, 2026), is not one of them: it carries BR-DGE's masked card
+// number at the profile's card number field, so it is held like any card request, and
+// while the profile is in observe it is refused as an unrecognized payment endpoint,
+// since its body is not the one the profile reviewed. When BR-DGE's answer holds no
+// number the page sends null there, and that order continues untouched on the token
+// BR-DGE made from the card the agent typed. A body the profile reads as
 // a card-free payment (its payment_method names another method: FastSpring's PayPal and
 // wallets post the same URL) also continues untouched, in every status, with an event that
 // says so, since no approval could cover it; one that names another method but carries a
@@ -1477,6 +1485,51 @@ async function ekashuAbort(ctx) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// PayPal's legacy Hosted Fields (paypal-hosted-fields.ts). Its tokenization frame posts the card the
+// agent typed to the Orders v2 confirm-payment-source on cors.api.paypal.com (or its sandbox), which
+// no Vault mode takes over, so every company's adapters hand each POST there to this gate:
+//   - a body with a card number at payment_source.card.number aborts as an unsupported checkout,
+//     reason `unsupported_paypal_hosted_fields`, with no claim, create or prompt, so the confirm never
+//     carries the card to PayPal. The attachment then reads `unsupported` and holds: the merchant's
+//     integration decides the shape, so the page's next confirm would carry the card again;
+//   - a body the adapter could not read, an empty one, or one that is not a JSON object aborts that
+//     request alone with a `blocked` event, `unreadable_paypal_request`, and does not hold the
+//     attachment: nothing proves it carries no card;
+//   - any other body (a PayPal wallet, a saved card, a token) defers, and the arbiter continues it
+//     untouched.
+// A confirm the synced registry recognizes as a card request defers too, so the arbiter pauses it
+// for that recognizer; no build serves one today. A GET, a preflight or another path is not this
+// gate's. Synchronous until it must abort, like every gate. Exported for the gate registry's tests.
+export const paypalHostedFieldsPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isPaypalHostedFieldsConfirm(url) || ctx.vault.isCardRequest(url, method))
+        return undefined;
+    let body;
+    // A reader that throws (Playwright's postData() can) proves nothing either way.
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        body = null;
+    }
+    const carried = paypalHostedFieldsBody(body);
+    if (carried === 'no_card')
+        return undefined;
+    return carried === 'card' ? paypalHostedFieldsAbort(ctx) : paypalHostedFieldsUnreadable(ctx);
+};
+async function paypalHostedFieldsAbort(ctx) {
+    const { url, method } = ctx.request;
+    ctx.preparationGate.invalidate('unsupported_checkout');
+    ctx.lifecycle.unsupported(PAYPAL_HOSTED_FIELDS_REASON);
+    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { url: eventUrl(ctx.vault, url), method, reason: PAYPAL_HOSTED_FIELDS_REASON } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
+async function paypalHostedFieldsUnreadable(ctx) {
+    ctx.onEvent?.({ type: 'blocked', detail: 'unreadable_paypal_request' });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1510,7 +1563,7 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -219,7 +219,7 @@
       "origin": "https://js.braintreegateway.com",
       "path_pattern": "/web/:version/js/*",
       "hostname_pattern": "^js\\.braintreegateway\\.com$",
-      "pathname_pattern": "^\\/web\\/[^/]+\\/js\\/",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/",
       "sources": [
         {
           "kind": "official_documentation",
@@ -238,7 +238,7 @@
       "origin": "https://assets.braintreegateway.com",
       "path_pattern": "/web/*",
       "hostname_pattern": "^assets\\.braintreegateway\\.com$",
-      "pathname_pattern": "^\\/web\\/",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)",
       "sources": [
         {
           "kind": "official_documentation",
@@ -2137,6 +2137,41 @@
       "hostname_pattern": "^cdn\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$",
       "pathname_pattern": "^\\/secure-fields\\.js$"
     },
+    {
+      "id": "paypal-hosted-fields-payments-sdk",
+      "psp": "paypal",
+      "kinds": [
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://assets.braintreegateway.com",
+      "path_pattern": "/web/:version-payments-sdk{,-:build}/html/hosted-fields-{input-frame,payments-sdk-tokenization-frame}{,.min}.html",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://assets.braintreegateway.com/web/3.32.0-payments-sdk-dev/html/hosted-fields-input-frame.min.html",
+          "reviewed_on": "2026-10-07"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://assets.braintreegateway.com/web/3.32.0-payments-sdk-dev/html/hosted-fields-payments-sdk-tokenization-frame.min.html",
+          "reviewed_on": "2026-10-07"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://www.paypal.com/sdk/js?components=hosted-fields",
+          "reviewed_on": "2026-10-07"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames",
+          "reviewed_on": "2026-10-07"
+        }
+      ],
+      "variant_unverified": "PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.",
+      "hostname_pattern": "^assets\\.braintreegateway\\.com$",
+      "pathname_pattern": "^\\/web\\/[0-9]+\\.[0-9]+\\.[0-9]+-payments-sdk(?:-[a-z]+)?\\/html\\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\\.min)?\\.html$"
+    },
     {
       "id": "fiserv-commercehub-payment-fields",
       "psp": "fiserv",

package/dist/preflight-schemas.json

@@ -468,6 +468,7 @@
                 "mercado-pago-checkout-pro-card-form",
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
+                "paypal-hosted-fields-payments-sdk",
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
                 "fiserv-secure-data-capture-frame",
@@ -1098,6 +1099,7 @@
                       "mercado-pago-checkout-pro-card-form",
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
+                      "paypal-hosted-fields-payments-sdk",
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",
                       "fiserv-secure-data-capture-frame",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 3adb75196b940ea807d3290f096e585d6519543d18ec6426daf8b0031acbacb8
+// source-sha256: 9d383b5155c791fc68947784fe3e2c16d03d3056572fb353f98305358fe75bc9
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -20,8 +20,11 @@ const RULES = [
     { id: 'mollie-components-script', psp: 'mollie', kinds: ['script'], hostname: /^js\.mollie\.com$/, pathname: /^\/v2\/mollie\.js$/, origin: 'https://js.mollie.com', path_pattern: '/v2/mollie.js' },
     { id: 'mollie-components-v1-script', psp: 'mollie', kinds: ['script'], hostname: /^js\.mollie\.com$/, pathname: /^\/v1\/mollie\.js$/, origin: 'https://js.mollie.com', path_pattern: '/v1/mollie.js' },
     { id: 'mollie-hosted-credit-card', psp: 'mollie', kinds: ['document', 'frame', 'iframe'], hostname: /^www\.mollie\.com$/, pathname: /^\/checkout\/credit-card\/session\/[A-Za-z0-9_-]+\/?$/, origin: 'https://www.mollie.com', path_pattern: '/checkout/credit-card/session/:session', flow: 'mollie.hosted_components' },
-    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/[^/]+\/js\//, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
-    { id: 'braintree-hosted-fields', psp: 'braintree', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/, pathname: /^\/web\//, origin: 'https://assets.braintreegateway.com', path_pattern: '/web/*' },
+    // A braintree-web build whose version carries -payments-sdk (3.32.0-payments-sdk-dev) is PayPal's
+    // (paypal-hosted-fields-payments-sdk below): its card goes to PayPal, never to Braintree, so neither
+    // Braintree rule takes one.
+    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\//, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    { id: 'braintree-hosted-fields', psp: 'braintree', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)/, origin: 'https://assets.braintreegateway.com', path_pattern: '/web/*' },
     { id: 'paysafe-js', psp: 'paysafe', kinds: ['script', 'frame', 'iframe'], hostname: /^hosted\.paysafe\.com$/, pathname: /^\/(?:js|checkout)\//, origin: 'https://hosted.paysafe.com', path_pattern: '/{js,checkout}/*' },
     { id: 'worldpay-checkout-sdk', psp: 'worldpay', kinds: ['script', 'frame', 'iframe'], hostname: /^access\.worldpay\.com$/, pathname: /^\/access-checkout\//, origin: 'https://access.worldpay.com', path_pattern: '/access-checkout/*' },
     { id: 'authorize-net-accept', psp: 'authorize_net', kinds: ['script'], hostname: /^js\.authorize\.net$/, pathname: /^\/v[13]\/Accept(?:UI)?\.js$/, origin: 'https://js.authorize.net', path_pattern: '/v{1,3}/Accept{UI}.js' },
@@ -58,6 +61,24 @@ RULES.push({ id: 'tranzila-terminal-hosted-page', psp: 'tranzila', kinds: ['docu
 { id: 'gravy-secure-fields-script', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.[a-z0-9-]+\.gr4vy\.app$/, pathname: /^\/secure-fields\.js$/, origin: 'https://cdn.:merchant.gr4vy.app', path_pattern: '/secure-fields.js',
     sources: [documented('https://docs.gr4vy.com/guides/payments/secure-fields')] }, { id: 'gravy-secure-fields-script-sandbox', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.sandbox\.[a-z0-9-]+\.gr4vy\.app$/, pathname: /^\/secure-fields\.js$/, origin: 'https://cdn.sandbox.:merchant.gr4vy.app', path_pattern: '/secure-fields.js',
     sources: [documented('https://docs.gr4vy.com/guides/payments/secure-fields')] });
+// PayPal's legacy Hosted Fields (its JS SDK's components=hosted-fields), reviewed 2026-10-07 from Planet Golf
+// UK's payment step (read live 2026-10-06, SDK 5.0.580) and the two frame files it loads. The SDK renders each
+// card field as braintree-web's 3.32.0-payments-sdk-dev hosted-fields-input-frame.min.html (sha256
+// 5b6a746e...ff401b0bc) and adds a 0x0 hosted-fields-payments-sdk-tokenization-frame.min.html (sha256
+// be804070...a610a6fa6e), both on assets.braintreegateway.com. The tokenization frame posts the typed card to
+// the Orders v2 confirm-payment-source on cors.api.paypal.com, which no Vault mode takes over, and the checkout
+// SDK refuses that post (checkout/src/paypal-hosted-fields.ts). So the frames name paypal and the result stays
+// unknown through `variant_unverified`. A flow with server_constraint 'unsupported' cannot say so here: three
+// visible input frames would each count as an active flow frame and read as ambiguous_checkout.
+const paypalHostedFieldsSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-10-07' });
+RULES.push({ id: 'paypal-hosted-fields-payments-sdk', psp: 'paypal', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/,
+    pathname: /^\/web\/[0-9]+\.[0-9]+\.[0-9]+-payments-sdk(?:-[a-z]+)?\/html\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\.min)?\.html$/,
+    origin: 'https://assets.braintreegateway.com', path_pattern: '/web/:version-payments-sdk{,-:build}/html/hosted-fields-{input-frame,payments-sdk-tokenization-frame}{,.min}.html',
+    sources: [paypalHostedFieldsSource('https://assets.braintreegateway.com/web/3.32.0-payments-sdk-dev/html/hosted-fields-input-frame.min.html'),
+        paypalHostedFieldsSource('https://assets.braintreegateway.com/web/3.32.0-payments-sdk-dev/html/hosted-fields-payments-sdk-tokenization-frame.min.html'),
+        paypalHostedFieldsSource('https://www.paypal.com/sdk/js?components=hosted-fields'),
+        { kind: 'saved_observation', reference: 'planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames', reviewed_on: '2026-10-07' }],
+    variant_unverified: 'PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.' });
 // Fiserv Commerce Hub, read 2026-09-23 from Home Depot's OrangePay frame and Fiserv's
 // docs: payment-fields.js renders one Secure Data Capture iframe per card field, and
 // the Checkout JS SDK is Commerce Hub's other browser entry. Fiserv ships dark (its
@@ -755,7 +776,8 @@ export function assessCheckoutSupport(input, options = {}) {
             && (signal.kind === 'script' ? signal.visible !== false : signal.visible === true));
         if (incompatible.length) {
             result.reason_codes.push('processor_variant_unverified');
-            result.limitations.push(...incompatible.map(({ rule }) => rule.variant_unverified));
+            // Several frames of one variant (four on Planet Golf's PayPal Hosted Fields) carry one limitation.
+            result.limitations.push(...unique(incompatible.map(({ rule }) => rule.variant_unverified)));
             return result;
         }
     }