@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/cdp.js

@@ -1,5 +1,5 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns } from './registry.js';
-import { AdyenTestPlatformRefusedError, AmountRequiredError, ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, CheckoutCancelledError, CheckoutPreparationError, MerchantTotalError, PaymentOutcomeUnknownError, PreparationRequiredError, ProcessorRefusedError, UnsupportedCapabilityError, UnsupportedModeError, } from './client.js';
+import { AdyenTestPlatformRefusedError, AmountRequiredError, ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, CheckoutCancelledError, CheckoutPreparationError, MerchantTotalError, PaymentOutcomeUnknownError, PreparationRequiredError, ProcessorRefusedError, UnsupportedCapabilityError, UnsupportedModeError, redactUrl, } from './client.js';
 import { PreparationGate } from './preparation.js';
 import { preparedApprovalAnswersRetry } from './prepared-processor.js';
 import { StripeCheckoutGate } from './stripe-checkout.js';
@@ -11,16 +11,23 @@ import { EprotectGate, classifyEprotectRequest, eprotectScriptAnswer } from './e
 import { dispatchPreClaim, eventUrl, isArmedCreditguardCall, routesHipayVault } from './pre-claim.js';
 import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesGmo } from './gmo.js';
 import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
+import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
 import { PADDLE_VGS_PAY_PATTERNS, PaddleVgsPayGate, isPaddleCheckoutService, recognizesPaddleVgs } from './paddle-vgs-pay.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenexIframeRepeats, isArmedTokenexIframeUrl } from './tokenex-iframe.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
 import { paddleTokenexTokenContinuation } from './paddle-tokenex.js';
 import { twoC2pContinuation, twoC2pRetire } from './twoc2p.js';
 import { isArmedEkashuUrl } from './ekashu.js';
+import { isArmedTransbankUrl } from './transbank.js';
 import { isArmedRedsysUrl } from './redsys.js';
+import { isArmedPrzelewy24Url } from './przelewy24.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
+import { COMGATE_CARD_PATTERNS, isArmedComgateUrl, servesComgate } from './comgate.js';
+import { isArmedEximbayUrl } from './eximbay.js';
 import { PAYPAL_HOSTED_FIELDS_PATTERNS, isPaypalHostedFieldsConfirm } from './paypal-hosted-fields.js';
 import { EBANX_RESEND_PATTERNS, EbanxFollowUps, isEbanxResendUrl } from './ebanx.js';
+import { PayrexxFollowUps } from './payrexx.js';
 import { PAYPAL_CARD_FORM_PATTERNS, isPaypalCardFormUrl } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, SecureAcceptanceFollowUpWatch, isCybersourceSecureAcceptanceUrl, secureAcceptanceFollowUp, secureAcceptanceFrameAnswer, secureAcceptanceReplyLast4, } from './cybersource-secure-acceptance.js';
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
@@ -1284,9 +1291,23 @@ function requestIdentity(opts, url, method, body, documentUrl, pageAmount, flexS
     // out, so the shop joins the identity: a retry that names another shop needs its own approval.
     const shop = gmoRequestShop(url, body);
     const identity = shop === undefined ? shaped.shape : `${shaped.shape};gmo_shop:${JSON.stringify(shop)}`;
-    return { url, method, documentUrl, pageAmount, body: `${identity}${paddleVgsRetryKey(url, body, headers)}`,
+    return { url, method, documentUrl, pageAmount, body: `${identity}${paddleVgsRetryKey(url, body, headers)}${toastRetryKey(url, body)}`,
         amountEvidence: opts.amount != null || pageAmount !== undefined || shaped.namesAmount };
 }
+/**
+ * What a Toast card request's retry must repeat, beyond its shape: the sealed card opens at any Toast
+ * restaurant whose payment intent names it, and the frame seals the ZIP inside it, so the payment session
+ * and the ZIP join the identity. A request under another session or with another ZIP never receives the
+ * card the cardholder approved for the first, while the frame's retry, its placeholder sealed afresh, still
+ * does. A body Toast's reader refuses joins whole, so it matches nothing but itself. Empty for every other
+ * request.
+ */
+function toastRetryKey(url, body) {
+    if (!isToastPaymentMethodsUrl(url))
+        return '';
+    const read = readToastBody(body);
+    return `;toast:${JSON.stringify(read.ok ? [read.sessionSecret, read.postalCode] : body)}`;
+}
 /**
  * What a Paddle VGS card request's retry must repeat byte for byte, beyond its shape: Paddle's frame
  * sends its second request with the same body under the same bearer, and the bearer names the
@@ -1750,6 +1771,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     let setupFailureReported = false;
     const ownedSessions = new Set([pageSessionId]);
     const sessionTypes = new Map([[pageSessionId, 'page']]);
+    // Each window this attachment adopted (adoptOpenedWindow): its session, and its target's id, which is its main frame's.
+    const windowTargets = new Map();
     const sessionParents = new Map();
     // The frame in its parent session that a child target hangs from (TargetInfo.parentFrameId), so a
     // frame lookup can climb from a cross-origin frame into the document that frames it.
@@ -1861,6 +1884,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     const juspayCheckout = new JuspayCheckoutGate(opts.vault);
     // The approved EBANX token request on this attachment and the sends claimed under it (ebanx.ts).
     const ebanxFollowUps = new EbanxFollowUps();
+    // The approved Payrexx card request on this attachment and the 3-D Secure sends claimed under it (payrexx.ts).
+    const payrexxFollowUps = new PayrexxFollowUps();
     const aci = new AciGate(opts.vault);
     const eprotect = new EprotectGate(opts.vault);
     // The merchant's follow-up request after a delivered Secure Acceptance reply (cybersource-secure-acceptance.ts).
@@ -1874,6 +1899,20 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         preparationFrameId = tree.frameTree.frame.id;
         return tree.frameTree.frame.url;
     };
+    // The URL the page's main frame last committed: its target's URL when the attachment is set up, then kept from
+    // Page.frameNavigated and Page.navigatedWithinDocument, and from the page target's own reports (notePageTarget),
+    // which name a document the page commits before this attachment has enabled its Page events. Chromium leaves
+    // Page.getFrameTree unanswered on the page's session while that session's own top-level navigation is paused (a
+    // hosted page entry the page sends this window to, by script or through the merchant's redirect), so
+    // readDocumentUrl would wait out its bound and the create would name no checkout page. For that one paused request
+    // the page is still the document it last committed.
+    let committedTopUrl;
+    /** A TargetInfo of the page's own target names the URL the page last committed: the target list, and each report. */
+    const notePageTarget = (info) => {
+        if (pageTargetId !== undefined && info?.targetId === pageTargetId && info?.type === 'page' && typeof info.url === 'string' && info.url) {
+            committedTopUrl = info.url.split('#')[0];
+        }
+    };
     // prepare({ tokenizeBeforePay: true }) sends the card Microform whose field documents are committed
     // now. A field's commit can come before this attachment enabled its session, so no event reports
     // it; each iframe session's own frame tree, and the page's, is read once first (as rereadMicroforms
@@ -1908,7 +1947,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         const frame = find(tree?.frameTree, 0);
         if (!frame)
             return null;
-        return { navigation: frame.parentId || sessionId !== pageSessionId ? 'frame' : 'top', url: typeof frame.url === 'string' ? frame.url : undefined };
+        return { navigation: frame.parentId || (sessionId !== pageSessionId && !(sessionId && windowTargets.has(sessionId))) ? 'frame' : 'top',
+            url: typeof frame.url === 'string' ? frame.url : undefined };
     };
     /**
      * Which frame a paused document request navigates, as documentFrame reads it, without the frame tree where
@@ -1924,6 +1964,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             return 'frame';
         if (sessionId === pageSessionId && pageTargetId !== undefined && frameId === pageTargetId)
             return 'top';
+        // An adopted window's main frame is that window's own top-level document, and its frame tree is as unanswered.
+        if (sessionId && windowTargets.get(sessionId) === frameId)
+            return 'top';
         return (await documentFrame(sessionId, frameId))?.navigation ?? null;
     };
     /**
@@ -2117,6 +2160,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     let lastSubmitted = null;
     // The approved Datatrans answers, per frameId: the repeat rule (datatrans.ts).
     const datatransRepeats = new DatatransRepeats();
+    // The approved TokenEx iframe answers, per frameId (the card-number frame is an out-of-process iframe whose own
+    // session pauses its post; its frameId names it): the repeat rule (tokenex-iframe.ts).
+    const tokenexIframeRepeats = new TokenexIframeRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     // The Shiji STS getCvvId companion of the getTokenId this attachment last continued (shiji-sts.ts).
@@ -2161,11 +2207,14 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // EBANX's 3-D Secure calls and hosted confirm, which send the typed card again
     // after its token: the cardholder's device sends one the approved token request
     // covers, and any other is refused (see ebanx.ts).
+    // ComGate's card hosts are armed only for an org the API served ComGate to, so the
+    // gate can fail every card post there while the gateway link pauses (see comgate.ts).
     const urlPatterns = [...new Set([...(derived.length > 0 ? derived : FALLBACK_CARD_PATTERNS), ...guards.patterns,
             ...(stripeCheckout.isEnabled() ? ['https://api.stripe.com/*'] : []), MERCADO_CHECKOUT_PATTERN, ...merchantPatterns,
             ...(recognizesGmo(opts.vault) ? GMO_TOKEN_V1_PATTERNS : []), ...juspayCheckout.urlPatterns(), ...cardEndpointPatterns(),
             ...(payrails ? PAYRAILS_GUARD_PATTERNS : []), ...PAYPAL_HOSTED_FIELDS_PATTERNS, ...PAYPAL_CARD_FORM_PATTERNS,
-            ...CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, ...(recognizesPaddleVgs(opts.vault) ? PADDLE_VGS_PAY_PATTERNS : []), ...EBANX_RESEND_PATTERNS])];
+            ...CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, ...(recognizesPaddleVgs(opts.vault) ? PADDLE_VGS_PAY_PATTERNS : []), ...EBANX_RESEND_PATTERNS,
+            ...(servesComgate(opts.vault) ? COMGATE_CARD_PATTERNS : [])])];
     // The hold-only rules' patterns (Bolt's tokenizer; every request a placeholder card can ride, by resource type).
     const fetchPatterns = [...urlPatterns.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
         ...(holdGate ? holdGate.patterns().map((p) => ({ ...p, requestStage: 'Request' })) : [])];
@@ -2294,6 +2343,55 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         lifecycle.failed(new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, 'browser_interception_unavailable'));
         opts.onEvent?.({ type: 'failed', detail: 'browser_interception_unavailable' });
     };
+    /**
+     * A window the merchant's page opened (window.open, or a form or link aimed at a new window), or one such a window
+     * opened in turn, in the merchant's own browser context: it belongs to this checkout, so it is attached and armed
+     * as the page is, and its requests reach the same gates. Chromium reports the window (Target.targetCreated, with its
+     * openerId) as it starts, and the page session's auto-attach never covers a new page target. The attach races the
+     * window's first request: a window that opens on the merchant's page and is sent on to a hosted page by script or
+     * by the merchant's redirect is armed before that entry; a window opened straight onto a hosted page can load it
+     * first, as every window did before. A window reported while this attachment still arms the page waits in
+     * pendingWindows and is adopted once the page is armed, inside the setup deadline and before the attachment reports
+     * ready, its opener judged then, so a window that window opened is adopted after it. A window that is gone before it
+     * could be attached was never armed, as before; one attached but not armed fails the attachment, as a frame does.
+     */
+    const openedWindows = new Set();
+    const pendingWindows = [];
+    const adoptOpenedWindow = async (info, duringSetup = false) => {
+        if (!info || info.type !== 'page' || typeof info.targetId !== 'string' || !info.targetId || info.targetId === pageTargetId
+            || openedWindows.has(info.targetId) || info.browserContextId !== merchantContext)
+            return;
+        if (setupStop.signal.aborted)
+            return;
+        if (!attachmentReady && !duringSetup) {
+            pendingWindows.push(info);
+            return;
+        }
+        if (typeof info.openerId !== 'string' || !(info.openerId === pageTargetId || openedWindows.has(info.openerId)))
+            return;
+        openedWindows.add(info.targetId);
+        let child;
+        try {
+            child = (await cdp.send('Target.attachToTarget', { targetId: info.targetId, flatten: true }))?.sessionId;
+        }
+        catch {
+            return;
+        }
+        try {
+            if (typeof child !== 'string' || !child || ownedSessions.has(child) || detachedSessions.has(child) || rejectedSessions.has(child)) {
+                throw new CheckoutAttachmentError('unavailable');
+            }
+            ownedSessions.add(child);
+            sessionTypes.set(child, 'page');
+            sessionParents.set(child, pageSessionId);
+            windowTargets.set(child, info.targetId);
+            await arm(child);
+            opts.onEvent?.({ type: 'window_armed', detail: {} });
+        }
+        catch (error) {
+            failInterception(error);
+        }
+    };
     cdp.on(async (method, params, sessionId) => {
         // A frame that committed a new document drops the companion binding made for the getTokenId its
         // old document sent, with the device's CVV ciphertext: the document that replaced it never
@@ -2304,6 +2402,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             shijiCompanions.releasePage((page) => page === replaced);
         }
         if ((method === 'Target.targetCreated' || method === 'Target.targetInfoChanged') && targetContextKnown) {
+            // The page's own target reports each document it commits from discovery on, Page events or not.
+            notePageTarget(params?.targetInfo);
             try {
                 assertContextTarget(params?.targetInfo, merchantContext, targetAllowance);
                 if (params?.targetInfo?.type === 'shared_worker')
@@ -2312,8 +2412,18 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             catch (error) {
                 failInterception(error);
             }
+            if (method === 'Target.targetCreated')
+                await adoptOpenedWindow(params?.targetInfo);
             return;
         }
+        // The page's main frame committed a document, or moved within it: the URL a held top-level navigation leaves.
+        if (sessionId === pageSessionId && method === 'Page.frameNavigated' && !params.frame?.parentId && typeof params.frame?.url === 'string') {
+            committedTopUrl = params.frame.url;
+        }
+        if (sessionId === pageSessionId && method === 'Page.navigatedWithinDocument' && pageTargetId !== undefined
+            && params?.frameId === pageTargetId && typeof params?.url === 'string') {
+            committedTopUrl = params.url.split('#')[0];
+        }
         if (((method === 'Page.frameNavigated' && !params.frame?.parentId) || (method === 'Page.navigatedWithinDocument' && preparationFrameId && params.frameId === preparationFrameId)) && sessionId === pageSessionId) {
             preparationGate.invalidate('merchant_document_changed');
             mercadoCheckout.invalidate();
@@ -2353,10 +2463,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         }
         // A watched shared worker sent a card request: it went out unpaused, so nothing is approved from here on.
         if (method === 'Network.requestWillBeSent' && sessionId && watchedWorkerSessions.has(sessionId) && sharedWorkerCardRequest(params?.request)) {
+            // Origin and path as redactUrl reads them, so a credential a processor writes into the path never shows.
             let endpoint = '';
             try {
-                const u = new URL(params.request.url);
-                endpoint = `${u.origin}${u.pathname}`;
+                new URL(params.request.url);
+                endpoint = redactUrl(params.request.url);
             }
             catch { /* unreadable */ }
             opts.onEvent?.({ type: 'card_request_unwatched', detail: { endpoint, from: 'shared_worker' } });
@@ -2641,6 +2752,10 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         const { requestId, request, resourceType, networkId, frameId } = params;
         // When this request paused: the merchant's total is read as of this moment.
         const pausedAt = Date.now();
+        // The page's own top-level navigation, paused: its frame tree cannot be read until this request is decided, so its
+        // document is the one it last committed (committedTopUrl). Every other request reads the frame tree as before.
+        const readPausedDocument = resourceType === 'Document' && sessionId === pageSessionId && pageTargetId !== undefined
+            && frameId === pageTargetId && committedTopUrl !== undefined ? async () => committedTopUrl : readDocumentUrl;
         // A paused document request has not committed either: it only starts the context's check.
         if (resourceType === 'Document')
             microforms.warm(withFragment(request));
@@ -2723,7 +2838,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             cybersourceFlex: { judge: (flexRequest) => microforms.judge(flexRequest, frameId, () => rereadMicroforms(sessionId, frameId)) },
             juspay: juspayCheckout,
             datatrans: datatransRepeats,
+            tokenexIframe: tokenexIframeRepeats,
             ebanx: ebanxFollowUps,
+            payrexx: payrexxFollowUps,
             frame: typeof frameId === 'string' && frameId ? frameId : undefined,
             payrails,
             shijiSts: { companions: shijiCompanions, page: () => cdpShijiPage(sessionId, frameId) },
@@ -2794,7 +2911,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         if (awaitingApproval && activeRequest?.attempt.lost && !terminal && !setupStop.signal.aborted && !lifecycle.isCancelled()
             && typeof networkId === 'string' && networkId) {
             const retryBody = pausedBody(request);
-            const retry = retryBody === null ? null : requestIdentity(opts, request.url, request.method, retryBody, documentKey(await documentUrlOf(readDocumentUrl, lifecycle.abort.signal)), await pageAmountOf(opts), flexPause?.shape, request.headers);
+            const retry = retryBody === null ? null : requestIdentity(opts, request.url, request.method, retryBody, documentKey(await documentUrlOf(readPausedDocument, lifecycle.abort.signal)), await pageAmountOf(opts), flexPause?.shape, request.headers);
             // A prepared approval is answered only in the card frame it was bound in: the same request from
             // another frame (a replacement for a removed one, or a second card frame) is refused below.
             if (retry && activeRequest?.attempt.lost && sameCheckoutRequest(activeRequest.identity, retry)
@@ -2837,8 +2954,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         // A request that skipped the spent preparation's claim and was not bound as
         // its retry (the approval ended while it was judged) is refused as that
         // claim would refuse it, never asked as a new approval.
-        // An EBANX send still out (a confirm that may pay) holds the attachment too: a new card request the page sends
-        // meanwhile, a second tap on the hosted page's Pay among them, would start another payment over it.
+        // An EBANX or Payrexx send still out (a confirm that may pay, a 3-D Secure step whose answer names the token the
+        // page charges) holds the attachment too: a new card request the page sends meanwhile, a second tap on the hosted
+        // page's Pay among them, would start another payment over it.
         const followUpOut = lifecycle.followUpsInFlight();
         if (terminal || lifecycle.isBlocked() || awaitingApproval || followUpOut || preparedRetry || Date.now() < quietUntil) {
             let repeatedAuthorizationId = null;
@@ -2849,7 +2967,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 }
             }
             const why = terminal ?? (lifecycle.isBlocked() ? lifecycle.getState().status : awaitingApproval ? 'an approval is already outstanding'
-                : followUpOut ? 'an EBANX send is in flight' : preparedRetry ? 'CheckoutPreparationError' : 'awaiting approval cooldown');
+                : followUpOut ? 'a follow-up send is in flight' : preparedRetry ? 'CheckoutPreparationError' : 'awaiting approval cooldown');
             opts.onEvent?.({ type: 'blocked', detail: why instanceof Error ? failureSummary(why) : String(why) });
             if (preparation)
                 preparationGate.retireUnboundClaim();
@@ -2890,8 +3008,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         // The approval the device gave, and whether it reached a browser request.
         let approvedId = null;
         let deliveryBegun = false;
-        // Whether this handoff kept an EBANX approval's follow-ups (ebanxFollowUps.remember), which a failed handoff stops.
-        let ebanxRemembered = false;
+        // Whether this handoff kept an approval's follow-ups (ebanxFollowUps.remember, payrexxFollowUps.remember), which a
+        // failed handoff stops.
+        let followUpsRemembered = false;
         // The business's pause, so resume resolves once the page has its answer.
         let businessPause = null;
         // Hold mode: the person's release, settled with what came of it.
@@ -2948,7 +3067,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 await preparationGate.assertDocument();
             // One bounded read of the document serves both the merchant origin and
             // the identity a retry has to repeat (see sameCheckoutRequest).
-            const documentUrl = await documentUrlOf(readDocumentUrl, attempt.signal);
+            const documentUrl = await documentUrlOf(readPausedDocument, attempt.signal);
             const pageOrigin = pageOriginFrom(documentUrl);
             // The agent's amount is a card endpoint's only authority: no page total is read.
             const pageAmount = cardEndpoint ? undefined : await pageAmountOf(opts);
@@ -3225,12 +3344,14 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                     throw new PaymentOutcomeUnknownError(replay.authorizationId, 'paddle_vgs_card_facts_unavailable');
                 }
                 // An approved EBANX token request whose read names a window covers the 3-D Secure calls and the confirm the
-                // page sends next (ebanx.ts): kept as the API stored it, the request that raised the approval. Kept before the
-                // page has the answer, since the page may send its first 3-D Secure call the moment the answer lands; a
-                // handoff that then fails stops them (the catch below).
+                // page sends next (ebanx.ts), and an approved Payrexx card request whose answer started 3-D Secure covers the
+                // card frame's two 3-D Secure sends (payrexx.ts): kept as the API stored it, the request that raised the
+                // approval. Kept before the page has the answer, since the page may send its first 3-D Secure call the moment
+                // the answer lands; a handoff that then fails stops them (the catch below).
                 if (replay.mode !== 'device_encrypt') {
                     ebanxFollowUps.remember({ url: request.url, body }, replay);
-                    ebanxRemembered = true;
+                    payrexxFollowUps.remember({ url: request.url, body }, replay);
+                    followUpsRemembered = true;
                 }
                 await cdp.send('Fetch.fulfillRequest', {
                     requestId: deliverTo,
@@ -3240,6 +3361,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 }, deliverOn);
                 // The frame that received it: the paused request's, or its retry's once rebound.
                 datatransRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
+                tokenexIframeRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 attempt.assertLive();
                 // An ACI card-number request answered: its checkout's held CVC and expiry requests get the
                 // same answer, and its /payment submission may continue (see AciGate).
@@ -3267,10 +3389,12 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 authorizationId: approvedId ?? lifecycle.getState().authorizationId, detail: failureSummary(err) });
             // Ignore the failure event caused by our own safe decline/error abort.
             const dead = attempt.target ?? { requestId, sessionId };
-            // An EBANX token answer this handoff kept follow-ups for and did not finish handing over: nothing after it is
-            // claimed (ebanx.ts EbanxFollowUps.stop).
-            if (ebanxRemembered)
+            // An answer this handoff kept follow-ups for and did not finish handing over: nothing after it is claimed
+            // (ebanx.ts EbanxFollowUps.stop, payrexx.ts PayrexxFollowUps.stop).
+            if (followUpsRemembered) {
                 ebanxFollowUps.stop();
+                payrexxFollowUps.stop();
+            }
             // The business's resume settles once the request is answered: a terminal read is an answer (failed, nothing charged), a lost handoff is not.
             const settlePause = () => { if (businessPause) {
                 if (isApprovalOutcome(err))
@@ -3338,6 +3462,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             targetContextKnown = true;
             // A page target's id is its main frame's id: a navigation of that frame is the page's own (pausedNavigation).
             pageTargetId = typeof targetInfo.targetId === 'string' && targetInfo.targetId ? targetInfo.targetId : undefined;
+            // The page's URL as its target reports it: the document a held top-level navigation leaves until the page commits
+            // another one (the Page.frameNavigated branch above, and notePageTarget for a commit before the Page events are on).
+            // No frame tree read: a navigation the page starts while this attachment arms would hold it.
+            if (committedTopUrl === undefined && typeof targetInfo.url === 'string' && targetInfo.url)
+                committedTopUrl = targetInfo.url.split('#')[0];
             await cdp.send('Target.setDiscoverTargets', { discover: true });
             assertActive();
             const { targetInfos } = await cdp.send('Target.getTargets');
@@ -3346,6 +3475,9 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 throw new CheckoutAttachmentError('unavailable');
             for (const target of targetInfos)
                 assertContextTarget(target, merchantContext, targetAllowance);
+            // The page may have committed another document since its TargetInfo was read; the list names the one it holds.
+            for (const target of targetInfos)
+                notePageTarget(target);
             for (const target of targetInfos)
                 if (target?.type === 'shared_worker')
                     await watchSharedWorker(target);
@@ -3354,13 +3486,24 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // but their Fetch setup finishes later. Do not invite the caller to press
             // Pay while one of those already-running frames is still unprotected, or
             // while a shared worker reported during setup is not yet watched.
-            while (arming.size || workerWatches.size)
-                await Promise.all([...arming.values(), ...workerWatches.values()]);
+            // A window the page opened while this attachment armed it is attached and armed here too, in the order Chromium
+            // reported it (adoptOpenedWindow), and the frames and workers such a window brings are waited for as the page's
+            // own are, all under the setup deadline. One that cannot be armed fails the attachment.
+            while (arming.size || workerWatches.size || pendingWindows.length) {
+                if (arming.size || workerWatches.size)
+                    await Promise.all([...arming.values(), ...workerWatches.values()]);
+                else
+                    await adoptOpenedWindow(pendingWindows.shift(), true);
+                assertActive();
+            }
             assertActive();
         }, setupTimeoutMs, setupStop.signal);
         if (setupStop.signal.aborted)
             throw attachmentFailure(setupStop.signal.reason);
         attachmentReady = true;
+        // A window reported after that drain, before this line, is adopted the way a later window is.
+        for (const info of pendingWindows.splice(0))
+            void adoptOpenedWindow(info);
         opts.onEvent?.({ type: 'fetch_armed', detail: { patterns: urlPatterns, ...(holdGate ? { hold: true, holdRules: holdGate.rules.map((r) => r.psp) } : {}), ...(bypassServiceWorkers ? { serviceWorkers: 'bypass' } : {}) } });
     }
     catch (error) {
@@ -3424,6 +3567,8 @@ export async function attachToPlaywright(page, opts) {
     const juspayCheckout = new JuspayCheckoutGate(opts.vault);
     // The approved EBANX token request on this attachment and the sends claimed under it (ebanx.ts).
     const ebanxFollowUps = new EbanxFollowUps();
+    // The approved Payrexx card request on this attachment and the 3-D Secure sends claimed under it (payrexx.ts).
+    const payrexxFollowUps = new PayrexxFollowUps();
     const aci = new AciGate(opts.vault);
     let navigationBodyReplaced;
     const eprotect = new EprotectGate(opts.vault);
@@ -3700,6 +3845,8 @@ export async function attachToPlaywright(page, opts) {
     let lastSubmitted = null;
     // The approved Datatrans answers, per Frame: the repeat rule (datatrans.ts).
     const datatransRepeats = new DatatransRepeats();
+    // The approved TokenEx iframe answers, per Frame: the repeat rule (tokenex-iframe.ts).
+    const tokenexIframeRepeats = new TokenexIframeRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     const frameOf = (request) => { try {
@@ -3720,8 +3867,10 @@ export async function attachToPlaywright(page, opts) {
         // The matcher sees only the URL. Worldpay eProtect's registration is a GET, so its family and
         // the vendor's give-up reports are routed by the eProtect gate (never its scripts).
         // Gravy's session fields are a PUT, so a URL a PUT recognizer claims is routed too; the
-        // pre-claim gates then pause only the PUT and continue the URL's other methods.
+        // pre-claim gates then pause only the PUT and continue the URL's other methods. A hosted page
+        // entered with a plain GET (hosted-entry.ts, ComGate's gateway link) is routed by its exact link.
         (url) => opts.vault.isCardRequest(url.toString()) || opts.vault.isCardRequest(url.toString(), 'PUT')
+            || opts.vault.isCardRequest(url.toString(), 'GET')
             || guards.matches(url.toString()) || stripeCheckout.matches(url.toString()) || mercadoCheckout.matches(url.toString())
             || eprotect.matches(url.toString())
             // An armed merchant profile's endpoint or a sibling of it (merchant-hosted.ts), as attachToCdp arms it.
@@ -3739,9 +3888,16 @@ export async function attachToPlaywright(page, opts) {
             || aci.matches(url.toString())
             // Every Payrails host, routed only for an org the API served Payrails to (see attachToCdp).
             || (payrails !== null && isPayrailsHost(url.toString()))
+            // Every request to Przelewy24's pay wall hosts once its entry is served (przelewy24.ts), as attachToCdp arms
+            // the hosts: the card method's post, the card form's post and the Saferpay resolver reach the Przelewy24
+            // gate and fail.
+            || isArmedPrzelewy24Url(opts.vault, url.toString())
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
             || isArmedEkashuUrl(opts.vault, url.toString())
+            // Every request to a Webpay host once its entry is served (transbank.ts), as attachToCdp arms the hosts: the
+            // token's submit and Webpay's card steps reach the Webpay gate and fail, and the entry pauses.
+            || isArmedTransbankUrl(opts.vault, url.toString())
             // A CreditGuard page's own calls beside its submit (its card lookup and its 3-D Secure calls), for an
             // org the API served CreditGuard to, as attachToCdp arms its hosts: the CreditGuard gate answers them
             // under a ready preparation and lets them go on with none (pre-claim.ts isArmedCreditguardCall).
@@ -3752,6 +3908,15 @@ export async function attachToPlaywright(page, opts) {
             // Every request to QuickPay's host once its entry is served (quickpay.ts), as attachToCdp arms the host:
             // the window's card post, its other card requests and its card lookup reach the QuickPay gate and fail.
             || isArmedQuickpayUrl(opts.vault, url.toString())
+            // Every request to one of ComGate's card hosts once its entry is served (comgate.ts), as attachToCdp arms them:
+            // the gateway's card post and every other card call there reach the ComGate gate and fail.
+            || isArmedComgateUrl(opts.vault, url.toString())
+            // Every request on the TokenEx iframe's /iframe/v3 path once its entry is served (tokenex-iframe.ts), as attachToCdp
+            // arms its hosts: a card post the recognizer's exact URL does not match reaches the TokenEx gate and fails.
+            || isArmedTokenexIframeUrl(opts.vault, url.toString())
+            // Every request to an Eximbay host once its entry is served there (eximbay.ts), as attachToCdp arms the host: the
+            // step, the window's lookups and its card post reach the Eximbay gate and fail.
+            || isArmedEximbayUrl(opts.vault, url.toString())
             // PayPal's legacy Hosted Fields confirm, for every org, as attachToCdp arms it (paypal-hosted-fields.ts).
             || isPaypalHostedFieldsConfirm(url.toString())
             // PayPal's Card Fields confirm and GraphQL on www.paypal.com, for every org, as attachToCdp arms them (paypal-card-forms.ts).
@@ -3857,7 +4022,9 @@ export async function attachToPlaywright(page, opts) {
                     } },
                 juspay: juspayCheckout,
                 datatrans: datatransRepeats,
+                tokenexIframe: tokenexIframeRepeats,
                 ebanx: ebanxFollowUps,
+                payrexx: payrexxFollowUps,
                 frame: frameOf(request),
                 payrails,
                 shijiSts: { companions: shijiCompanions, page: async () => (await playwrightShijiDocumentPage(request)) ?? `pw:none:${++playwrightShijiSeq}` },
@@ -3952,7 +4119,7 @@ export async function attachToPlaywright(page, opts) {
             // identically whichever adapter is attached. An Amadeus card request is
             // 'failed' (ERR_FAILED) in both too, see failsAsNetworkError (refusalFailure).
             // As in attachToCdp: an unbound request that skipped the spent preparation's claim is refused.
-            // As in attachToCdp: an EBANX send still out holds the attachment too.
+            // As in attachToCdp: an EBANX or Payrexx send still out holds the attachment too.
             const followUpOut = lifecycle.followUpsInFlight();
             if (terminal || lifecycle.isBlocked() || awaitingApproval || followUpOut || preparedRetry || Date.now() < quietUntil) {
                 let repeatedAuthorizationId = null;
@@ -3967,7 +4134,7 @@ export async function attachToPlaywright(page, opts) {
                     }
                 }
                 const why = terminal ?? (lifecycle.isBlocked() ? lifecycle.getState().status : awaitingApproval ? 'an approval is already outstanding'
-                    : followUpOut ? 'an EBANX send is in flight' : preparedRetry ? 'CheckoutPreparationError' : 'awaiting approval cooldown');
+                    : followUpOut ? 'a follow-up send is in flight' : preparedRetry ? 'CheckoutPreparationError' : 'awaiting approval cooldown');
                 opts.onEvent?.({ type: 'blocked', detail: why instanceof Error ? failureSummary(why) : String(why) });
                 if (preparation)
                     preparationGate.retireUnboundClaim();
@@ -4021,7 +4188,7 @@ export async function attachToPlaywright(page, opts) {
             let approvedId = null;
             let deliveryBegun = false;
             // See the same flag in attachToCdp.
-            let ebanxRemembered = false;
+            let followUpsRemembered = false;
             // A prepared Amadeus SDK add must be sent within its window (see amadeus.ts).
             let disarmSendWindow = null;
             try {
@@ -4239,10 +4406,12 @@ export async function attachToPlaywright(page, opts) {
                     // See the same step in attachToCdp: kept before the page has the answer.
                     if (replay.mode !== 'device_encrypt') {
                         ebanxFollowUps.remember({ url: request.url(), body }, replay);
-                        ebanxRemembered = true;
+                        payrexxFollowUps.remember({ url: request.url(), body }, replay);
+                        followUpsRemembered = true;
                     }
                     await deliverTo.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
                     datatransRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
+                    tokenexIframeRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     assertRequestLive();
                     // See the same step in attachToCdp.
                     aci.answered(deliverRequest.url(), { status: replay.status, headers: replay.headers, body: replay.body }, replay.authorizationId);
@@ -4257,8 +4426,10 @@ export async function attachToPlaywright(page, opts) {
             catch (err) {
                 const dead = attempt.target?.route ?? route;
                 // See the same step in attachToCdp.
-                if (ebanxRemembered)
+                if (followUpsRemembered) {
                     ebanxFollowUps.stop();
+                    payrexxFollowUps.stop();
+                }
                 if (activeRequest?.attempt === attempt)
                     activeRequest = null;
                 try {