@agent-cards/sdk 0.23.20 → 0.23.21

package/dist/hipay.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 5773dac14c08b16588c9c36803bed4610e1be8f1cdcf6d38507cee1d35740dfc
+// artifact-sha256: e8cb1ddfc6c8937f5126197b90d8261da8b07c9c68df1decb261052e8a2fabc1
 // src/hipay.js
 var HIPAY_PSP = "hipay";
 var HIPAY_CAPABILITY = "hipay_vault_token";
@@ -168,7 +168,10 @@ function hipayPinOriginUsable(origin) {
     const host = typeof origin === "string" ? PIN_ORIGIN.exec(origin) : null;
     return !!host && !HIPAY_DOMAIN.test(host[1]);
 }
-var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([]);
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+]);
 var usablePin = (entry) => !!entry && Array.isArray(entry.origins) && Array.isArray(entry.usernames) && entry.origins.length > 0 && entry.usernames.length > 0 && entry.origins.every(hipayPinOriginUsable) && entry.usernames.every((name) => hipayUsernameEnvironment(name) === "production");
 function hipayOriginPin(merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
     if (typeof merchantOrigin !== "string" || !Array.isArray(pins) || !hipayPinOriginUsable(merchantOrigin))

package/dist/hold.d.ts

@@ -55,7 +55,7 @@ export interface HoldOptions {
 export interface HeldCardRequest {
     /** The processor, by the recogniser's name (`braintree`), `bolt`, or `placeholder_card`; null when unnamed. */
     psp: string | null;
-    /** Origin and path only. */
+    /** Origin and path only, with any credential a processor writes into the path masked (redactUrl). */
     endpoint: string;
     kind: 'tokenize' | 'store_card_post' | 'card_request';
     /** Whether a release can answer it: a recogniser the SDK pays, never Bolt or a store's own card post. */

package/dist/hold.js

@@ -17,7 +17,9 @@
 //   - Any request whose body carries the placeholder card number (`placeholderNumbers`): a store's own card post or
 //     an unknown processor. The browser only ever holds the placeholder, so a body with its digits is a card request
 //     wherever it goes. In sandbox it may be released unchanged (it carries the documented test number only).
-// The hold records the processor and the endpoint (origin and path), never a body or a header.
+// The hold records the processor and the endpoint (origin and path, any path credential masked), never a body or a
+// header.
+import { redactUrl } from './client.js';
 /**
  * Bolt's embedded card frame (connect.bolt.com credit-card-input): a POST of `{ payload, nonce, public_key }` JSON,
  * the card boxed to Bolt's key, to `<base>/token` or `<base>/token/cvv`, with a 20 s timeout and retries.
@@ -87,14 +89,18 @@ export class HoldAnsweredError extends Error {
         this.name = 'HoldAnsweredError';
     }
 }
+/**
+ * A held request's origin and path as redactUrl reads them, so a credential a processor writes into the path (GoPay's
+ * card form token, a PayMongo session) never reaches an event or onHeld.
+ */
 function endpointOf(url) {
     try {
-        const u = new URL(url);
-        return `${u.origin}${u.pathname}`;
+        new URL(url);
     }
     catch {
-        return String(url).slice(0, 120);
+        return redactUrl(String(url)).slice(0, 120);
     }
+    return redactUrl(url);
 }
 function validTotal(t) {
     const v = t;

package/dist/hosted-entry.d.ts

@@ -0,0 +1,4 @@
+/** Whether this processor's hosted page is entered with a GET this build reads exactly. */
+export declare function hasHostedGetEntry(psp: string): boolean;
+/** Whether `url` is exactly the GET entry of this processor's hosted page (false for a processor with none). */
+export declare function isHostedGetEntry(psp: string, url: string): boolean;

package/dist/hosted-entry.js

@@ -0,0 +1,32 @@
+/**
+ * Hosted payment pages whose entry is a plain GET: the processors whose merchant sends the buyer's browser to the
+ * processor's own page with a link (a redirect, or a page or frame location set by script) rather than a form post.
+ *
+ * Such an entry carries no card. The cardholder's device takes it over (mode hosted_form): it makes the processor's
+ * own calls for the payment the link names, and the paused navigation gets this SDK's submitted_on_device notice.
+ * A GET recognizer otherwise reads as a card request carried in the URL (Worldpay eProtect's registration), which
+ * this build completes only for a grammar it checks, so a hosted page joins this table with the exact link
+ * payment-core's resolveRecognizerForUrl admits for it, and nothing else: a URL the table does not admit is never
+ * paused, as the API would refuse it, and the page's own request goes on unchanged.
+ *
+ * Each rule is dark on its own: a processor is paused only once the API serves its recognizer, which it does only
+ * for a build that declares the processor's capability (client.ts SUPPORTED_CAPABILITIES) and a company Agentcard
+ * turned the processor on for. A rule listed here for a processor this build does not declare pauses nothing.
+ */
+import { PRZELEWY24_PSP, isPrzelewy24EntryUrl } from './przelewy24.js';
+import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
+import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
+const HOSTED_GET_ENTRIES = new Map([
+    [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
+    [COMGATE_PSP, isComgateEntryUrl],
+    [TRANSBANK_PSP, isTransbankEntryUrl],
+]);
+/** Whether this processor's hosted page is entered with a GET this build reads exactly. */
+export function hasHostedGetEntry(psp) {
+    return HOSTED_GET_ENTRIES.has(psp);
+}
+/** Whether `url` is exactly the GET entry of this processor's hosted page (false for a processor with none). */
+export function isHostedGetEntry(psp, url) {
+    const rule = HOSTED_GET_ENTRIES.get(psp);
+    return !!rule && typeof url === 'string' && rule(url) === true;
+}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { CheckoutAttachOptions } from './agentcard.js';
 export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
 export type { GmoUnsupportedReason } from './gmo.js';
 export type { DatatransRefusalReason } from './datatrans.js';
+export type { TokenexIframeRefusalReason } from './tokenex-iframe.js';
 export type { PelecardRefusalReason } from './pelecard.js';
 export type { PrimerUnsupportedReason, PrimerBlockedReason } from './primer.js';
 export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c9116965f8802329701f18adf6519c9111857dfc4329e4f59d7666de150fb5a4
+// artifact-sha256: 4289a22922e08251b579e9aadc396c8cff5d1a95b99ce35dd9a4618b43a33db5
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin2 = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 38065a5bd834d5233979a0528fde4345378914e8e8b1a63e329bff0994572da5
+// artifact-sha256: 056fa54de953be9af775505906b2fba30def2787a217a12fe2ca2a50b8614649
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -160,6 +160,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -195,9 +198,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function readElement(der, at, tag) {
     if (at + 2 > der.length || der[at] !== tag)

package/dist/pre-claim.d.ts

@@ -2,6 +2,7 @@ import { StripeCheckoutGate } from './stripe-checkout.js';
 import { MercadoCheckoutGate } from './mercado-checkout.js';
 import { type JuspayCheckoutGate } from './juspay-gate.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenexIframeRepeats } from './tokenex-iframe.js';
 import { type AciGate } from './aci.js';
 import type { EprotectGate } from './eprotect.js';
 import { type ShijiStsCompanions } from './shiji-sts.js';
@@ -99,7 +100,7 @@ export interface PreClaimContext {
         verifoneProfileOf?(url: string): VerifoneProfile | null;
         cardOnFilePolicy?(url: string, method?: string): string | null;
         withoutCard?(url: string, body: string | null | undefined): 'continue' | 'refuse' | null;
-        /** VaultClient.recognizesProcessor: whether the synced registry serves this processor. */
+        /** VaultClient.recognizesProcessor: whether the synced registry serves this processor (ACI, EBANX, the TokenEx iframe). */
         recognizesProcessor?(psp: string): boolean;
         /** VaultClient.sendEbanxFollowUp: a send an approved EBANX token request covers, from the cardholder's device. */
         sendEbanxFollowUp?(authorizationId: string, request: {
@@ -188,6 +189,8 @@ export interface PreClaimContext {
     juspay?: JuspayCheckoutGate;
     /** The attachment's approved Datatrans answers (the repeat rule, datatrans.ts). Absent: none are kept. */
     datatrans?: DatatransRepeats;
+    /** The attachment's approved TokenEx iframe answers (the repeat rule, tokenex-iframe.ts). Absent: none are kept. */
+    tokenexIframe?: TokenexIframeRepeats;
     /** The adapter's identity for the request's frame (CDP frameId, Playwright Frame); undefined when unknown. */
     frame?: unknown;
     /**
@@ -251,9 +254,12 @@ export declare const fiservPreClaim: PreClaimGate;
 export declare function isArmedCreditguardCall(vault: {
     recognizesProcessor?(psp: string): boolean;
 } | undefined, url: string): boolean;
+export declare const przelewy24PreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
+export declare const transbankPreClaim: PreClaimGate;
 export declare const redsysPreClaim: PreClaimGate;
 export declare const quickpayPreClaim: PreClaimGate;
+export declare const comgatePreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const paypalCardFormsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;

package/dist/pre-claim.js

@@ -7,7 +7,8 @@
 // the vault can never pay, CyberSource Flex Microform's field iframes (whose
 // capture context rides into the pause), Datatrans Secure Fields, whose
 // card URL also carries card posts the device could never fill and card posts
-// it already answered, and Pelecard's card submission URL, which also carries
+// it already answered, the TokenEx hosted iframe v3, whose card path carries the
+// same two, and Pelecard's card submission URL, which also carries
 // saved-token, wallet and keep-on-file bodies, Primer's
 // /payment-instruments, which also carries requests the vault can never pay,
 // Payrails, whose save needs the session key the page captured and whose
@@ -63,6 +64,7 @@ import { gmoRequestRefusal, isGmoTokenHost, isGmoTokenV1Request, recognizesGmo }
 import { JUSPAY_PSP } from './juspay-gate.js';
 import { datatransPauseDecision, isDatatransHost } from './datatrans.js';
 import { DATATRANS_INVALID_REQUEST } from './datatrans.generated.js';
+import { INVALID_TOKENEX_IFRAME_REQUEST, TOKENEX_IFRAME_PSP, isTokenexIframePath, servesTokenexIframe, tokenexIframePauseDecision, } from './tokenex-iframe.js';
 import { isPelecardHost, pelecardRefusal } from './pelecard.js';
 import { ACI_CHECKOUT_REUSED } from './aci.js';
 import { ACI_EXPIRY_UNSTRIPPABLE } from './aci.generated.js';
@@ -79,8 +81,11 @@ import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoi
 import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsPaymentUrl, isPayrailsStaticHost, payrailsKeyRefusal, payrailsPaymentRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
+import { isArmedTransbankUrl } from './transbank.js';
 import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
+import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
+import { isArmedComgateUrl } from './comgate.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { PAYPAL_CARD_FIELDS_REASON, PAYPAL_GUEST_CHECKOUT_REASON, isPaypalCardFieldsConfirm, isPaypalGraphql, paypalCardFieldsBody, paypalGraphqlCard, paypalGraphqlNamesCardOperation, } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
@@ -817,10 +822,10 @@ async function juspayUnsupported(ctx, reason) {
 // card-on-file policy the API served with the recognizer (VaultClient.cardOnFilePolicy):
 //   - a sound TOKENIZE card post defers, and the arbiter pauses it for approval, unless the same
 //     frame's same form was already answered with an approved token (the repeat rule) and that
-//     approval is still the one being handed off (datatransRepeatApproval): then that stored answer
+//     approval is still the one being handed off (handoffRepeatApproval): then that stored answer
 //     is fulfilled here, with no claim, create or prompt. Once the answer reached the page, the
 //     application's merchant resolver must first report the order still pending
-//     (datatransRepeatAfterHandoff);
+//     (repeatAfterHandoff);
 //   - a card post the API would refuse at create aborts with a `blocked` event that names the
 //     API's own code, `invalid_datatrans_request` or `datatrans_card_on_file_refused` (the latter
 //     only while the served policy refuses card on file), before anything is claimed, created or
@@ -848,25 +853,26 @@ const datatransPreClaim = (ctx) => {
         return undefined;
     if (decision !== 'card')
         return datatransBlock(ctx, decision);
-    const approval = datatransRepeatApproval(ctx);
+    const approval = handoffRepeatApproval(ctx);
     const repeat = approval === null ? null : ctx.datatrans?.answerFor(ctx.frame, url, ctx.request.body, approval) ?? null;
     if (!repeat)
         return undefined;
-    return ctx.lifecycle.getState().status === 'awaiting_merchant' ? datatransRepeatAfterHandoff(ctx, repeat) : datatransRepeat(ctx, repeat);
+    return ctx.lifecycle.getState().status === 'awaiting_merchant' ? repeatAfterHandoff(ctx, repeat, 'datatrans') : answerRepeat(ctx, repeat, 'datatrans');
 };
 /**
- * The approval whose stored Datatrans answer a repeat may still receive, or null. A stored token
+ * The approval whose stored Datatrans or TokenEx answer a repeat may still receive, or null. A stored token
  * answers a re-submit only while the approval it came from is still being handed off: the lifecycle
  * names it and reads awaiting_approval (its answer is being delivered) or awaiting_merchant (the
  * merchant has not confirmed yet), and nothing latched, tore down or cancelled the attachment. The
  * order completing or failing, an unknown outcome, a decline, a hold for the cardholder, a retry
  * after a merchant failure and a new authorization all end it, and the re-submit is then a new
- * question for the terminal arbiter, which holds or pauses it like any card post: TOKENIZE binds no
- * amount, so one approval never answers for a later purchase. Once the answer reached the page
- * (awaiting_merchant), the gate also reconciles before it answers (datatransRepeatAfterHandoff), and
- * the stored answer itself ends once its form goes quiet (DatatransRepeats, DATATRANS_REPEAT_IDLE_MS).
+ * question for the terminal arbiter, which holds or pauses it like any card post: neither card post
+ * binds an amount, so one approval never answers for a later purchase. Once the answer reached the
+ * page (awaiting_merchant), the gate also reconciles before it answers (repeatAfterHandoff). A stored
+ * Datatrans answer also ends once its form goes quiet (DatatransRepeats, DATATRANS_REPEAT_IDLE_MS), and
+ * a stored TokenEx answer once its iframe key expires (TokenexIframeRepeats).
  */
-function datatransRepeatApproval(ctx) {
+function handoffRepeatApproval(ctx) {
     if (ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
         return null;
     const { status, authorizationId } = ctx.lifecycle.getState();
@@ -883,36 +889,82 @@ function datatransRepeatApproval(ctx) {
  * arbiter, and so does every re-submit on an attachment with no resolver: a later purchase never
  * receives an earlier token without the cardholder, and the paused post never waits on a stalled read.
  */
-function datatransRepeatAfterHandoff(ctx, repeat) {
+function repeatAfterHandoff(ctx, repeat, psp) {
     if (!ctx.lifecycle.hasMerchantResolver())
         return undefined;
-    return datatransPendingRepeat(ctx, repeat);
+    return pendingRepeat(ctx, repeat, psp);
 }
-async function datatransPendingRepeat(ctx, repeat) {
+async function pendingRepeat(ctx, repeat, psp) {
     if (!await ctx.lifecycle.merchantOrderPending())
         return undefined;
     // The resolver answered asynchronously: the checkout must still be handing off this approval.
-    if (ctx.lifecycle.getState().status !== 'awaiting_merchant' || datatransRepeatApproval(ctx) !== repeat.authorizationId)
+    if (ctx.lifecycle.getState().status !== 'awaiting_merchant' || handoffRepeatApproval(ctx) !== repeat.authorizationId)
         return undefined;
-    return datatransRepeat(ctx, repeat);
+    return answerRepeat(ctx, repeat, psp);
 }
 async function datatransBlock(ctx, reason) {
     ctx.onEvent?.({ type: 'blocked', detail: reason });
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
-async function datatransRepeat(ctx, repeat) {
+/** Fulfill a repeat with the stored answer (`repeat_answered`), or abort it when the browser cannot take it (`<psp>_repeat_unanswered`). */
+async function answerRepeat(ctx, repeat, psp) {
     try {
         await ctx.effects.answer(repeat.response);
     }
     catch {
-        ctx.onEvent?.({ type: 'blocked', detail: 'datatrans_repeat_unanswered' });
+        ctx.onEvent?.({ type: 'blocked', detail: `${psp}_repeat_unanswered` });
         await ctx.effects.abort();
         return { kind: 'abort' };
     }
-    ctx.onEvent?.({ type: 'repeat_answered', detail: { psp: 'datatrans', authorizationId: repeat.authorizationId } });
+    ctx.onEvent?.({ type: 'repeat_answered', detail: { psp, authorizationId: repeat.authorizationId } });
     return { kind: 'answer' };
 }
+// The TokenEx hosted iframe v3 (tokenex-iframe.ts), JetBlue's card form. TokenEx's card-number frame posts the
+// whole card to its own document URL, and the same path takes posts the device could never fill (a cvvOnly frame,
+// a query this lane has not read) and, after an approval, the frame's own re-sends. The recognizer matches only the
+// exact card URL, so once the registry serves the TokenEx iframe (servesTokenexIframe), every POST on the frame's
+// /iframe/v3 path is judged here, before the terminal arbiter would pause it, by payment-core's own pause decision:
+//   - the sound card post defers, and the arbiter pauses it for approval, unless the same frame already sent the
+//     same bytes and had them answered with an approved token, and that approval is still the one being handed off
+//     (handoffRepeatApproval): then that stored answer is fulfilled here, with no claim, create or prompt. Once the
+//     answer reached the page, the application's merchant resolver must first report the order still pending
+//     (repeatAfterHandoff). A post with another placeholder or CVV is a new question, as for Datatrans;
+//   - any other post on that path that carries a value in Data aborts with a `blocked` event that names the API's
+//     own code, invalid_tokenex_iframe_request, before anything is claimed, created or prompted. Like Datatrans's
+//     refusal it neither holds the attachment nor changes its state;
+//   - a post with nothing in Data carries no card and defers: on the exact URL it continues untouched through the
+//     recognizer's passWithoutCard, and anywhere else it continues as an unrecognized request.
+// Nothing is decided without the registry: for an org the API did not serve the entry to, the gate defers and every
+// TokenEx request continues as before. The frame's document GETs, BinLookup and Forter never reach it as a card post.
+// Synchronous until an effect, so a card post pauses with no await. A check that throws blocks the request.
+const tokenexIframePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (method.toUpperCase() !== 'POST' || !isTokenexIframePath(url) || !servesTokenexIframe(ctx.vault))
+        return undefined;
+    let decision;
+    try {
+        decision = tokenexIframePauseDecision({ url, headers: ctx.request.headers, body: ctx.request.body });
+    }
+    catch {
+        decision = INVALID_TOKENEX_IFRAME_REQUEST;
+    }
+    if (decision === null)
+        return undefined;
+    if (decision !== 'card')
+        return tokenexIframeBlock(ctx, decision);
+    const approval = handoffRepeatApproval(ctx);
+    const repeat = approval === null ? null : ctx.tokenexIframe?.answerFor(ctx.frame, url, ctx.request.body, approval) ?? null;
+    if (!repeat)
+        return undefined;
+    return ctx.lifecycle.getState().status === 'awaiting_merchant'
+        ? repeatAfterHandoff(ctx, repeat, TOKENEX_IFRAME_PSP) : answerRepeat(ctx, repeat, TOKENEX_IFRAME_PSP);
+};
+async function tokenexIframeBlock(ctx, reason) {
+    ctx.onEvent?.({ type: 'blocked', detail: reason });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // Pelecard Iframe/Redirect 2.0 (pelecard.ts). The payment page's card URL, POST
 // /PaymentGW/Transaction on gateway21 or gateway20.pelecard.biz, also carries the wallet, Bit,
 // PIN pad and bank tabs with no card, and card-shaped bodies the device could never fill: a saved
@@ -1574,6 +1626,23 @@ async function shijiStsCompanion(ctx, body) {
     ctx.onEvent?.({ type: 'companion_continued', detail: { url: redactUrl(url), psp: 'shiji_sts', fields: ['cvv'] } });
     return { kind: 'continue' };
 }
+// Przelewy24's pay wall (przelewy24.ts). Once this build's registry serves Przelewy24's entry (a capability the
+// API serves only to a company Agentcard turned Przelewy24 on for), every request to the pay wall's two hosts
+// pauses. The merchant's entry, a GET of /trnRequest/<token> exactly, is no step of this gate's: it defers, and the
+// terminal arbiter pauses it for the claim flow like any card request, so the cardholder's device pays it. Every
+// step toward paying on the pay wall itself aborts as an unsupported checkout: every POST there (the card method's
+// post, the card form's post, a form posted to the entry's link) and the GET of the Saferpay resolver, which names
+// the typed card's type. So Przelewy24 never sees the card the agent typed. The agent's browser only reaches the
+// pay wall when the entry was not paused (an attachment made too late, say), and then only the cardholder's device
+// can pay. The pay wall's own pages, scripts and images are not this gate's and continue. With Przelewy24 not
+// served, the gate defers, and every request continues as before. Synchronous until it must abort, like every gate.
+// Exported for the gate registry's tests.
+export const przelewy24PreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isPrzelewy24PayStep(url, method) || !isArmedPrzelewy24Url(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -1607,6 +1676,27 @@ async function processorPageAbort(ctx) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// Transbank's Webpay Plus (transbank.ts). Once this build's registry serves Webpay's entry (a capability the API
+// serves only to a company Agentcard turned Webpay on for), every request to Webpay's two hosts pauses, and this gate
+// judges them:
+//   - the merchant's entry, the GET of initTransaction?token_ws=<token> exactly as the redirect writes it, is a GET
+//     and not this gate's: the terminal arbiter pauses it for the claim flow like any card request, and the
+//     cardholder's device pays it;
+//   - every other request there but a GET (the token's one submit to init_transaction.cgi, Webpay's card lookup and
+//     card check, the card post to bp_control.cgi, and an entry posted as a form) aborts as an unsupported checkout,
+//     so the token is never spent in the agent's browser and Webpay never sees the card the agent typed. The agent's
+//     browser only reaches Webpay's pages when the entry was not paused (an attachment made too late, an entry with
+//     another parameter), and then only the cardholder's device can pay;
+//   - another GET there (Webpay's scripts and images, or an entry written another way, whose page then submits the
+//     token, which this gate aborts) continues.
+// With Webpay not served, the gate defers and every request continues as before. Synchronous until it must abort,
+// like every gate. Exported for the gate registry's tests.
+export const transbankPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() === 'GET' || !isArmedTransbankUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // Redsys's hosted payment page (redsys.ts). Once this build's registry serves Redsys's entry (a
 // capability the API serves only to a company Agentcard turned Redsys on for), every request to
 // Redsys's hosts pauses, and this gate judges the POSTs:
@@ -1655,6 +1745,23 @@ export const quickpayPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// ComGate's payment gateway (comgate.ts). Once this build's registry serves ComGate's entry (a capability the API serves
+// only to a company Agentcard turned ComGate on for), the gateway link pauses for the cardholder's device and every
+// request to ComGate's card hosts pauses too, and this gate judges those:
+//   - every request but a GET (the gateway's card post and card check, the Web Checkout SDK's provider calls and card
+//     check, the card frames' BIN lookup and their log) aborts as an unsupported checkout, so ComGate never sees the
+//     card the agent typed. The agent's browser only reaches ComGate's card form when the link was not paused (an
+//     attachment made too late, a link with another parameter, a shop on ComGate's Web Checkout SDK), and then only the
+//     cardholder's device can pay;
+//   - a GET there (the gateway's reads of the payment, the card frames' pages and scripts) is not this gate's and continues.
+// With ComGate not served, the gate defers and every request continues as before. Synchronous until it must abort, like
+// every gate. Exported for the gate registry's tests.
+export const comgatePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() === 'GET' || !isArmedComgateUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // PayPal's legacy Hosted Fields (paypal-hosted-fields.ts). Its tokenization frame posts the card the
 // agent typed to the Orders v2 confirm-payment-source on cors.api.paypal.com (or its sandbox), which
 // no Vault mode takes over, so every company's adapters hand each POST there to this gate:
@@ -2220,7 +2327,7 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, paypalHostedFieldsPreClaim,
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, hipayPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.

package/dist/preflight-catalog.json

@@ -2174,6 +2174,64 @@
       "hostname_pattern": "^assets\\.braintreegateway\\.com$",
       "pathname_pattern": "^\\/web\\/[0-9]+\\.[0-9]+\\.[0-9]+-payments-sdk(?:-[a-z]+)?\\/html\\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\\.min)?\\.html$"
     },
+    {
+      "id": "paypal-card-fields-v5",
+      "psp": "paypal",
+      "kinds": [
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://www.paypal.com",
+      "path_pattern": "/smart/card-field",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.paypal.com/sdk/js?components=card-fields",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://developer.paypal.com/docs/checkout/advanced/integrate/",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "lake-antoine-park-2026-10-15:paypal-card-field-frames",
+          "reviewed_on": "2026-10-15"
+        }
+      ],
+      "hostname_pattern": "^www\\.paypal\\.com$",
+      "pathname_pattern": "^\\/smart\\/card-field$"
+    },
+    {
+      "id": "paypal-card-fields-v6",
+      "psp": "paypal",
+      "kinds": [
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://www.paypal.com",
+      "path_pattern": "/web-sdk/v6/card-fields-content",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://www.paypal.com/sdk/js?components=card-fields",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://developer.paypal.com/docs/checkout/advanced/integrate/",
+          "reviewed_on": "2026-10-15"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "lake-antoine-park-2026-10-15:paypal-card-field-frames",
+          "reviewed_on": "2026-10-15"
+        }
+      ],
+      "hostname_pattern": "^www\\.paypal\\.com$",
+      "pathname_pattern": "^\\/web-sdk\\/v6\\/card-fields-content$"
+    },
     {
       "id": "cybersource-secure-acceptance-silent-order-post",
       "psp": "cybersource_secure_acceptance",

package/dist/preflight-schemas.json

@@ -467,6 +467,8 @@
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
                 "paypal-hosted-fields-payments-sdk",
+                "paypal-card-fields-v5",
+                "paypal-card-fields-v6",
                 "cybersource-secure-acceptance-silent-order-post",
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
@@ -1101,6 +1103,8 @@
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
                       "paypal-hosted-fields-payments-sdk",
+                      "paypal-card-fields-v5",
+                      "paypal-card-fields-v6",
                       "cybersource-secure-acceptance-silent-order-post",
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: f0596389845388a1c6150964e576c420abb0b44a805347e4ba4d0617f3b8ea2b
+// source-sha256: 639ffa689e8dfcf093eeba7e34b86c570e53ab17970976ae462a41fd2120d753
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -87,6 +87,20 @@ RULES.push({ id: 'paypal-hosted-fields-payments-sdk', psp: 'paypal', kinds: ['fr
         paypalHostedFieldsSource('https://www.paypal.com/sdk/js?components=hosted-fields'),
         { kind: 'saved_observation', reference: 'planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames', reviewed_on: '2026-10-07' }],
     variant_unverified: 'PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.' });
+// PayPal Card Fields (its JS SDK's components=card-fields, v5, and web-sdk v6), reviewed 2026-10-15 from
+// WooCommerce PayPal Payments 4.1.3 checkouts (PayPal JS SDK 5.0.582, card-field client 1.270.0) and PayPal's
+// public web-sdk v6 6.68.0 bundles, with no card typed. v5 renders each card field as a frame on
+// www.paypal.com/smart/card-field (?type=number, expiry, cvv or name), and v6 as
+// www.paypal.com/web-sdk/v6/card-fields-content. Each sends the card to the Orders v2 confirm-payment-source,
+// which payment-core's paypal entry takes while it ships dark, so the frames name paypal and the result
+// stays unknown until the lane is served to every client.
+const paypalCardFieldsSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-10-15' });
+const PAYPAL_CARD_FIELDS_SOURCES = [paypalCardFieldsSource('https://www.paypal.com/sdk/js?components=card-fields'),
+    paypalCardFieldsSource('https://developer.paypal.com/docs/checkout/advanced/integrate/'),
+    { kind: 'saved_observation', reference: 'lake-antoine-park-2026-10-15:paypal-card-field-frames', reviewed_on: '2026-10-15' }];
+RULES.push({ id: 'paypal-card-fields-v5', psp: 'paypal', kinds: ['frame', 'iframe'], hostname: /^www\.paypal\.com$/, pathname: /^\/smart\/card-field$/,
+    origin: 'https://www.paypal.com', path_pattern: '/smart/card-field', sources: PAYPAL_CARD_FIELDS_SOURCES }, { id: 'paypal-card-fields-v6', psp: 'paypal', kinds: ['frame', 'iframe'], hostname: /^www\.paypal\.com$/, pathname: /^\/web-sdk\/v6\/card-fields-content$/,
+    origin: 'https://www.paypal.com', path_pattern: '/web-sdk/v6/card-fields-content', sources: PAYPAL_CARD_FIELDS_SOURCES });
 // CyberSource Secure Acceptance's Silent Order POST (the Secure Acceptance Checkout API), reviewed 2026-10-08 from
 // CyberSource's endpoint table and Arrow Electronics' public bundles (no card was sent). The merchant's own page
 // posts the card fields, unsigned, beside the fields its server signed, to a /silent/ path on CyberSource's Secure
@@ -308,7 +322,7 @@ RULES.push({ id: 'worldline-mycheckout-page', psp: 'worldline_mycheckout', kinds
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout/{payment-product-details/}:hosted_checkout', sources: worldlineSources }, { id: 'worldline-mycheckout-card-form', psp: 'worldline_mycheckout', kinds: ['form'], hostname: /^payment\.pay1\.checkout\.worldline-solutions\.com$/, pathname: /^\/checkout$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout', sources: worldlineSources });
 // A processor that ships dark (its definition declares a capability) is left out of the bundled
-// catalog. Datatrans's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
+// catalog. Datatrans's and the TokenEx iframe's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
 // bundled catalog's processors, lists its psp. Until then its assets are not evidence, so a page
 // that loads them, alone or beside another processor's SDK, reads exactly as it did before the
 // processor existed. (The dark GMO, CyberSource Flex, Juspay, Pelecard, ACI, CreditGuard,
@@ -326,6 +340,16 @@ for (const [suffix, hostname, origin] of [['', /^pay\.datatrans\.com$/, 'https:/
         sources: [datatransSource('https://pay.datatrans.com/upp/payment/js/secure-fields-2.0.0.js'), datatransSource('https://docs.pci-proxy.com/docs/secure-fields-quick-start')] }, { id: `datatrans-secure-fields-frame${suffix}`, psp: 'datatrans', kinds: ['document', 'frame', 'iframe'], hostname, pathname: /^\/upp\/payment\/SecureFields\/paymentField$/, origin, path_pattern: '/upp/payment/SecureFields/paymentField',
         sources: [datatransSource('https://pay.datatrans.com/upp/payment/SecureFields/field.js'), datatransSource('https://docs.datatrans.ch/docs/secure-fields')] });
 }
+// TokenEx hosted iframe v3, read 2026-10-18 from JetBlue's checkout: the parent library
+// (htp.tokenex.com/Iframe/Iframe-v3.min.js) and the iframe document it loads (/iframe/v3?<query>), on the
+// live host and its test twin. Dark behind tokenex_iframe_tokenize, so it waits with Datatrans.
+const tokenexSource = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-10-18' });
+for (const [suffix, hostname, origin] of [['', /^htp\.tokenex\.com$/, 'https://htp.tokenex.com'],
+    ['-test', /^test-htp\.tokenex\.com$/, 'https://test-htp.tokenex.com']]) {
+    SERVED_ONLY_RULES.push({ id: `tokenex-iframe-v3-script${suffix}`, psp: 'tokenex_iframe', kinds: ['script'], hostname, pathname: /^\/Iframe\/Iframe-v3(?:\.min)?\.js$/, origin, path_pattern: '/Iframe/Iframe-v3{,.min}.js',
+        sources: [tokenexSource('https://htp.tokenex.com/Iframe/Iframe-v3.min.js')] }, { id: `tokenex-iframe-v3-frame${suffix}`, psp: 'tokenex_iframe', kinds: ['document', 'frame', 'iframe'], hostname, pathname: /^\/iframe\/v3$/, origin, path_pattern: '/iframe/v3',
+        sources: [tokenexSource('https://htp.tokenex.com/Iframe/v3.min.js?version=latest')] });
+}
 RULES.push(...SERVED_ONLY_RULES.filter(rule => KNOWN_PSPS.includes(rule.psp)));
 // Keep sandbox evidence truthful instead of labelling it with a production origin.
 for (const [baseId, suffix, hostname, origin] of [