@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/comgate.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ComGate's payment gateway (pay1 to pay4.comgate.cz, where most Czech and Slovak e-shops send the buyer), as this
+ * SDK reads it.
+ *
+ * The merchant's server creates the payment at ComGate and sends the buyer's browser to the gateway link ComGate
+ * answered with, https://payN.comgate.cz/init?id=<transaction id>, by a redirect or by setting the page's or a
+ * frame's location. That GET carries no card and nothing but the payment's id, and it is the one request a build
+ * that declares ComGate's capability pauses for ComGate (hosted-entry.ts): the cardholder's device then makes the
+ * gateway's own calls for that payment over the end-to-end TLS relay (payment-core processors/comgate.js). Only the
+ * link exactly as ComGate writes it is the entry; any other parameter would be handed on to the gateway's own
+ * route, which these rules never see.
+ *
+ * COMGATE_GATEWAY_HOSTS is payment-core's COMGATE_GATEWAY_HOSTS, and isComgateEntryUrl is payment-core's rule of
+ * the same name; hosted-entry.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const COMGATE_PSP = "comgate";
+/** The dark-launch capability the API serves ComGate's recognizer behind (payment-core definitions.js). */
+export declare const COMGATE_CAPABILITY = "comgate_hosted_payment_page";
+/** The four gateway hosts ComGate's create answer names, each a host of its own entry. */
+export declare const COMGATE_GATEWAY_HOSTS: readonly string[];
+/**
+ * The hosts that take a card, or part of one, for ComGate: the gateway's API (payments.comgate.cz behind pay1 and pay2,
+ * payments-gcp.comgate.cz behind pay3 and pay4), where the gateway posts the card (/client/instructions/card-process,
+ * check-card) and ComGate's Web Checkout SDK posts its own (/checkout/provider/*, /checkout/card/check-card), and the
+ * card frames' hosts (sec.comgate.cz, sec-gcp.comgate.cz), which post the card's first digits to their /bin-checker.
+ * The card is already encrypted in ComGate's frame by then, so no body rule could see it: once ComGate is served, this
+ * build fails every request to these hosts but a GET, so the card the agent typed never reaches ComGate.
+ */
+export declare const COMGATE_CARD_HOSTS: readonly string[];
+/** The Fetch.enable globs attachToCdp arms for the card hosts, only while ComGate is served (cdp.ts). */
+export declare const COMGATE_CARD_PATTERNS: readonly string[];
+/** Whether this URL is on one of ComGate's card hosts (https, no credentials, any port, a trailing dot or not). */
+export declare function isComgateCardHost(url: string): boolean;
+/** Whether this build's registry serves ComGate's entry: a company Agentcard turned ComGate on for, on a build that declares it. */
+export declare function servesComgate(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of ComGate's card hosts and this
+ * build's registry serves ComGate. attachToPlaywright's route predicate asks this, as attachToCdp arms the hosts.
+ */
+export declare function isArmedComgateUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;
+/**
+ * Whether a URL is ComGate's gateway link exactly as ComGate's create answer writes it: https, one of the four
+ * gateway hosts in lowercase, the default port, no credentials or fragment, the path /init, and a query of the one
+ * `id` parameter holding a transaction id. A string that parses to another spelling is not it.
+ */
+export declare function isComgateEntryUrl(raw: unknown): boolean;

package/dist/comgate.js

@@ -0,0 +1,80 @@
+/**
+ * ComGate's payment gateway (pay1 to pay4.comgate.cz, where most Czech and Slovak e-shops send the buyer), as this
+ * SDK reads it.
+ *
+ * The merchant's server creates the payment at ComGate and sends the buyer's browser to the gateway link ComGate
+ * answered with, https://payN.comgate.cz/init?id=<transaction id>, by a redirect or by setting the page's or a
+ * frame's location. That GET carries no card and nothing but the payment's id, and it is the one request a build
+ * that declares ComGate's capability pauses for ComGate (hosted-entry.ts): the cardholder's device then makes the
+ * gateway's own calls for that payment over the end-to-end TLS relay (payment-core processors/comgate.js). Only the
+ * link exactly as ComGate writes it is the entry; any other parameter would be handed on to the gateway's own
+ * route, which these rules never see.
+ *
+ * COMGATE_GATEWAY_HOSTS is payment-core's COMGATE_GATEWAY_HOSTS, and isComgateEntryUrl is payment-core's rule of
+ * the same name; hosted-entry.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export const COMGATE_PSP = 'comgate';
+/** The dark-launch capability the API serves ComGate's recognizer behind (payment-core definitions.js). */
+export const COMGATE_CAPABILITY = 'comgate_hosted_payment_page';
+/** The four gateway hosts ComGate's create answer names, each a host of its own entry. */
+export const COMGATE_GATEWAY_HOSTS = Object.freeze(['pay1.comgate.cz', 'pay2.comgate.cz', 'pay3.comgate.cz', 'pay4.comgate.cz']);
+const COMGATE_ENTRY_PATH = '/init';
+// The id the gateway's router takes: three groups of four letters or digits.
+const TRANS_ID = /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/;
+/**
+ * The hosts that take a card, or part of one, for ComGate: the gateway's API (payments.comgate.cz behind pay1 and pay2,
+ * payments-gcp.comgate.cz behind pay3 and pay4), where the gateway posts the card (/client/instructions/card-process,
+ * check-card) and ComGate's Web Checkout SDK posts its own (/checkout/provider/*, /checkout/card/check-card), and the
+ * card frames' hosts (sec.comgate.cz, sec-gcp.comgate.cz), which post the card's first digits to their /bin-checker.
+ * The card is already encrypted in ComGate's frame by then, so no body rule could see it: once ComGate is served, this
+ * build fails every request to these hosts but a GET, so the card the agent typed never reaches ComGate.
+ */
+export const COMGATE_CARD_HOSTS = Object.freeze(['payments.comgate.cz', 'payments-gcp.comgate.cz', 'sec.comgate.cz', 'sec-gcp.comgate.cz']);
+/** The Fetch.enable globs attachToCdp arms for the card hosts, only while ComGate is served (cdp.ts). */
+export const COMGATE_CARD_PATTERNS = Object.freeze(COMGATE_CARD_HOSTS.map((host) => `*${host}*`));
+// A gateway link, as ComGate writes one: the registry reads ComGate as served when it takes this as a GET entry.
+const COMGATE_SAMPLE_ENTRY = 'https://pay1.comgate.cz/init?id=AAAA-BBBB-CCCC';
+/** Whether this URL is on one of ComGate's card hosts (https, no credentials, any port, a trailing dot or not). */
+export function isComgateCardHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && COMGATE_CARD_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/** Whether this build's registry serves ComGate's entry: a company Agentcard turned ComGate on for, on a build that declares it. */
+export function servesComgate(vault) {
+    return typeof vault?.isCardRequest === 'function' && vault.isCardRequest(COMGATE_SAMPLE_ENTRY, 'GET');
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of ComGate's card hosts and this
+ * build's registry serves ComGate. attachToPlaywright's route predicate asks this, as attachToCdp arms the hosts.
+ */
+export function isArmedComgateUrl(vault, url) {
+    return isComgateCardHost(url) && servesComgate(vault);
+}
+/**
+ * Whether a URL is ComGate's gateway link exactly as ComGate's create answer writes it: https, one of the four
+ * gateway hosts in lowercase, the default port, no credentials or fragment, the path /init, and a query of the one
+ * `id` parameter holding a transaction id. A string that parses to another spelling is not it.
+ */
+export function isComgateEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256)
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password || url.hash)
+        return false;
+    if (!COMGATE_GATEWAY_HOSTS.includes(url.hostname) || url.pathname !== COMGATE_ENTRY_PATH)
+        return false;
+    return url.search.startsWith('?id=') && TRANS_ID.test(url.search.slice(4));
+}

package/dist/creditguard.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0110d9fe2e862aad2c1191c5927ebb98dcc4be9905554ed46e18719a0bad05fb
+// artifact-sha256: 24cac2580feefe7d273b89de8e5b84e744e561fd258252f98008801750370460
 // src/creditguard.js
 var CREDITGUARD_PPS_HOSTS = Object.freeze(["pps.creditguard.co.il", "pps2.creditguard.co.il", "ppsuat.creditguard.co.il"]);
 var CREDITGUARD_SANDBOX_HOST = "ppsuat.creditguard.co.il";
@@ -707,6 +707,7 @@ var THREE_DS_INIT_KEYS = Object.freeze([
     "cvv",
     "isGooglePayTxn",
     "isPayboxTxn",
+    "recaptchaValue",
     "useDcc",
     "acsWindowSize",
     "browserColorDepth",
@@ -837,6 +838,7 @@ function creditguardDeviceThreeDSInitRequest(processUrl, card, options = {}) {
         cvv: parts.cvc,
         isGooglePayTxn: false,
         isPayboxTxn: false,
+        recaptchaValue: "",
         useDcc: false,
         acsWindowSize: "4",
         browserColorDepth: browser.colorDepth,
@@ -887,7 +889,7 @@ function deviceStepBodyRefusal(step, txId, body) {
         return "dcc";
     if (value.txId !== txId)
         return "txid_mismatch";
-    if (value.acsWindowSize !== "4" || value.browserHeader !== BROWSER_HEADER || value.browserJavascriptEnabled !== true)
+    if (value.recaptchaValue !== "" || value.acsWindowSize !== "4" || value.browserHeader !== BROWSER_HEADER || value.browserJavascriptEnabled !== true)
         return "malformed_body";
     try {
         deviceBrowser({

package/dist/cse-body.js

@@ -4,6 +4,8 @@ import { substituteEncryptedFields } from './substitute.js';
 import { substituteMerchantHostedBody } from './merchant-hosted.js';
 import { fiservCapturePinId, isFiservCaptureHost, substituteFiservEnvelope } from './fiserv.js';
 import { substituteVerifoneBody } from './verifone.js';
+import { isToastHost } from './toast.generated.js';
+import { substituteToastCardData } from './toast-seal.generated.js';
 /**
  * The cse continuation: the paused body with the vault's ciphertext in place
  * of the dummy blobs. The adapters send it as postData ALONE. Chromium
@@ -44,6 +46,15 @@ export function cseBody(body, replay, url, preparation) {
     }
     if (isFiservCaptureHost(url))
         throw new Error('Refusing to substitute: a Fiserv capture continues only through a prepared Fiserv approval.');
+    // A request on Toast's payments host takes only Toast's own swap: the device's sealed card written over
+    // the paused card.cardData and no other byte, refused unless the paused body is still the frame's guest
+    // card request and the card is sealed under the key payment-core pins (toast-seal.js substituteToastCardData).
+    if (isToastHost(url)) {
+        if (replay.kind !== undefined || replay.substitutions.at !== 'card' || (replay.substitutions.remove ?? []).length > 0) {
+            throw new Error('Refusing to substitute: the paused request is not the Toast card request the cardholder approved.');
+        }
+        return substituteToastCardData(url, body, replay.substitutions.fields);
+    }
     // A merchant-hosted approval is written into the LIVE paused body, which must
     // still be the body the API checked at create (merchant-hosted.ts).
     if (replay.kind === 'merchant_hosted')

package/dist/cybersource-secure-acceptance.generated.d.ts

@@ -38,7 +38,7 @@ declare function isPreparedSecureAcceptanceRequest(url: any, method: any, body:
 declare function secureAcceptanceMerchantEntry(profileId: any, merchantOrigin: any, entries?: any): any;
 declare function secureAcceptanceMerchantRefusal(environment: any, profileId: any, merchantOrigin: any, accessKey: any, entries?: any): "unsupported_environment" | "invalid_profile_id" | "secure_acceptance_merchant_unreviewed" | "secure_acceptance_merchant_pending" | "secure_acceptance_access_key_unreviewed" | "secure_acceptance_merchant_observe" | null;
 declare function secureAcceptanceCardType(number: any): "001" | "002" | "003" | "004" | null;
-declare function secureAcceptanceCardRefusal(environment: any, card: any): "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "invalid_card_number" | "live_host_refuses_documented_test_card" | "card_network_unsupported" | "invalid_expiry" | "invalid_cvn" | null;
+declare function secureAcceptanceCardRefusal(environment: any, card: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | "card_network_unsupported" | "invalid_expiry" | "invalid_cvn" | null;
 declare function isSecureAcceptanceDeviceRequest(templateBody: any, deviceBody: any, environment: any): boolean;
 declare function secureAcceptanceDeviceRequest(request: any, card: any, options: any): {
     url: any;

package/dist/ebanx.d.ts

@@ -75,7 +75,7 @@ export declare class EbanxFollowUps {
     stop(): void;
     /**
      * The approval the remembered token request went under, or null when none is remembered. The gate sends nothing
-     * unless the checkout's own state names this same approval (pre-claim.ts ebanxMaySend).
+     * unless the checkout's own state names this same approval (pre-claim.ts followUpMaySend).
      */
     get authorizationId(): string | null;
     /**

package/dist/ebanx.js

@@ -108,7 +108,7 @@ export class EbanxFollowUps {
     stop() { this.stopped = true; }
     /**
      * The approval the remembered token request went under, or null when none is remembered. The gate sends nothing
-     * unless the checkout's own state names this same approval (pre-claim.ts ebanxMaySend).
+     * unless the checkout's own state names this same approval (pre-claim.ts followUpMaySend).
      */
     get authorizationId() { return this.parent?.authorizationId ?? null; }
     /**

package/dist/eprotect.generated.d.ts

@@ -81,7 +81,7 @@ declare function eprotectMerchantPin(paypageId: any, merchantOrigin: any, pins?:
 declare function eprotectMerchantRefusal(environment: any, paypageId: any, merchantOrigin: any, pins?: any): "invalid_paypage_id" | "unsupported_environment" | "eprotect_merchant_unreviewed" | null;
 declare function defaultRandom(bytes: any): void;
 declare function eprotectEncrypt(text: any, key: any, random?: typeof defaultRandom): string;
-declare function eprotectCardRefusal(environment: any, cardNumber: any): "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "invalid_card_number" | "live_host_refuses_documented_test_card" | null;
+declare function eprotectCardRefusal(environment: any, cardNumber: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | null;
 declare function eprotectDeviceRequest(templateUrl: any, card: any, sessionKey: any, random?: typeof defaultRandom): {
     url: string;
     method: string;

package/dist/eximbay.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Eximbay's payment window (secureapi.eximbay.com, the Korean gateway that takes foreign cards for Korean merchants),
+ * as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level or into a window it opens, to
+ * https://secureapi.eximbay.com/Gateway/BasicProcessor.krp (Eximbay's test host for a test merchant), and Eximbay
+ * answers with a page that posts itself, with the session's paramkey, into its window. That entry carries no card,
+ * and it is the one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and
+ * fills the card into the window Eximbay returns to it (payment-core processors/eximbay.js). Everything else the
+ * agent's browser posts to Eximbay follows the entry and leads to a card: the step that opens the window
+ * (/Gateway/BasicProcessor/230/NewGlobalStep1.jsp), the window's amount query and card lookup, which carries the
+ * card's first eight digits (controll/checkApprvJson.do, controll/checkCardBin.do), its card post
+ * (controll/checkApprv.jsp) and its other posts. This SDK aborts every one of them in a page it watches, so a
+ * placeholder card never reaches Eximbay from one. attachToCdp watches a window the merchant's page opens once it has
+ * armed that window. Eximbay's popup integration opens the window and posts the entry into it at once, so that entry
+ * can leave before the window is armed; the window's next post, the step, is then aborted like any other, and the
+ * checkout reads unsupported. attachToPlaywright routes the page alone, never a window it opens.
+ *
+ * EXIMBAY_HOSTS is payment-core's EXIMBAY_HOSTS, and isEximbayEntry takes the URLs payment-core's isEximbayEntryUrl
+ * takes; eximbay.test.mjs pins both to payment-core.
+ */
+export declare const EXIMBAY_PSP = "eximbay";
+/** The dark-launch capability the API serves Eximbay's recognizer behind (payment-core definitions.js). */
+export declare const EXIMBAY_CAPABILITY = "eximbay_hosted_payment_page";
+/** The live host and Eximbay's test host, which serves the same window for a test merchant. */
+export declare const EXIMBAY_HOSTS: readonly string[];
+/** Whether this URL is on one of Eximbay's two hosts. */
+export declare function isEximbayHost(url: string): boolean;
+/**
+ * The only request on Eximbay's hosts that is the merchant's entry: a POST to the entry path, written exactly as a
+ * browser posts a form to it, with no port, query or fragment (payment-core isEximbayEntryUrl takes those two strings
+ * only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isEximbayEntry(url: string, method: string): boolean;
+/** The entry URL on the same Eximbay host, which the registry recognizes when this build is armed for Eximbay, or null. */
+export declare function eximbayEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Eximbay host and this build's registry
+ * serves Eximbay's entry there. The step, the window's lookups and its card post are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to Eximbay once
+ * Eximbay is armed.
+ */
+export declare function isArmedEximbayUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/eximbay.js

@@ -0,0 +1,69 @@
+/**
+ * Eximbay's payment window (secureapi.eximbay.com, the Korean gateway that takes foreign cards for Korean merchants),
+ * as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level or into a window it opens, to
+ * https://secureapi.eximbay.com/Gateway/BasicProcessor.krp (Eximbay's test host for a test merchant), and Eximbay
+ * answers with a page that posts itself, with the session's paramkey, into its window. That entry carries no card,
+ * and it is the one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and
+ * fills the card into the window Eximbay returns to it (payment-core processors/eximbay.js). Everything else the
+ * agent's browser posts to Eximbay follows the entry and leads to a card: the step that opens the window
+ * (/Gateway/BasicProcessor/230/NewGlobalStep1.jsp), the window's amount query and card lookup, which carries the
+ * card's first eight digits (controll/checkApprvJson.do, controll/checkCardBin.do), its card post
+ * (controll/checkApprv.jsp) and its other posts. This SDK aborts every one of them in a page it watches, so a
+ * placeholder card never reaches Eximbay from one. attachToCdp watches a window the merchant's page opens once it has
+ * armed that window. Eximbay's popup integration opens the window and posts the entry into it at once, so that entry
+ * can leave before the window is armed; the window's next post, the step, is then aborted like any other, and the
+ * checkout reads unsupported. attachToPlaywright routes the page alone, never a window it opens.
+ *
+ * EXIMBAY_HOSTS is payment-core's EXIMBAY_HOSTS, and isEximbayEntry takes the URLs payment-core's isEximbayEntryUrl
+ * takes; eximbay.test.mjs pins both to payment-core.
+ */
+export const EXIMBAY_PSP = 'eximbay';
+/** The dark-launch capability the API serves Eximbay's recognizer behind (payment-core definitions.js). */
+export const EXIMBAY_CAPABILITY = 'eximbay_hosted_payment_page';
+/** The live host and Eximbay's test host, which serves the same window for a test merchant. */
+export const EXIMBAY_HOSTS = Object.freeze(['secureapi.eximbay.com', 'secureapi.test.eximbay.com']);
+const ENTRY_PATH = '/Gateway/BasicProcessor.krp';
+/** The Eximbay host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function eximbayHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return EXIMBAY_HOSTS.includes(host) ? host : null;
+}
+/** Whether this URL is on one of Eximbay's two hosts. */
+export function isEximbayHost(url) {
+    return eximbayHost(url) !== null;
+}
+/**
+ * The only request on Eximbay's hosts that is the merchant's entry: a POST to the entry path, written exactly as a
+ * browser posts a form to it, with no port, query or fragment (payment-core isEximbayEntryUrl takes those two strings
+ * only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isEximbayEntry(url, method) {
+    return String(method).toUpperCase() === 'POST' && EXIMBAY_HOSTS.some((host) => url === `https://${host}${ENTRY_PATH}`);
+}
+/** The entry URL on the same Eximbay host, which the registry recognizes when this build is armed for Eximbay, or null. */
+export function eximbayEntryUrl(url) {
+    const host = eximbayHost(url);
+    return host === null ? null : `https://${host}${ENTRY_PATH}`;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Eximbay host and this build's registry
+ * serves Eximbay's entry there. The step, the window's lookups and its card post are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to Eximbay once
+ * Eximbay is armed.
+ */
+export function isArmedEximbayUrl(vault, url) {
+    const entry = eximbayEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}

package/dist/gmo.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 8149714daf5515a2fd3ec90d5aa0c7eb58a66d5ce79c3e3f0ba81c29d2946dc3
+// artifact-sha256: a65199bcbf0b67546130fb4f2c12ba72c8f51a2ff5b4e3054e2bfcc29b06f95d
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/dist/hipay.generated.d.ts

@@ -25,11 +25,11 @@ declare function hipayUsername(headers: any): string | null;
 declare function hipayRequestRefusal(request: any): any;
 declare function isPreparedHipayRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
 declare function hipayPinOriginUsable(origin: any): boolean;
-declare var HIPAY_MERCHANT_PINS: readonly never[];
-declare function hipayOriginPin(merchantOrigin: any, pins?: readonly never[]): null;
-declare function hipayPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly never[]): "unsupported_environment" | "hipay_merchant_unreviewed" | null;
-declare function hipayMerchantPin(merchantOrigin: any, username: any, pins?: readonly never[]): null;
-declare function hipayMerchantRefusal(environment: any, merchantOrigin: any, username: any, pins?: readonly never[]): "hipay_headers_refused" | "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare var HIPAY_MERCHANT_PINS: readonly any[];
+declare function hipayOriginPin(merchantOrigin: any, pins?: readonly any[]): any;
+declare function hipayPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly any[]): "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayMerchantPin(merchantOrigin: any, username: any, pins?: readonly any[]): any;
+declare function hipayMerchantRefusal(environment: any, merchantOrigin: any, username: any, pins?: readonly any[]): "hipay_headers_refused" | "unsupported_environment" | "hipay_merchant_unreviewed" | null;
 declare function hipayRefusalMessage(code: any): any;
 declare function injectHipayCard(body: any, card: any): {
     body: string;

package/dist/hipay.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 5773dac14c08b16588c9c36803bed4610e1be8f1cdcf6d38507cee1d35740dfc
+// artifact-sha256: e8cb1ddfc6c8937f5126197b90d8261da8b07c9c68df1decb261052e8a2fabc1
 // src/hipay.js
 var HIPAY_PSP = "hipay";
 var HIPAY_CAPABILITY = "hipay_vault_token";
@@ -168,7 +168,10 @@ function hipayPinOriginUsable(origin) {
     const host = typeof origin === "string" ? PIN_ORIGIN.exec(origin) : null;
     return !!host && !HIPAY_DOMAIN.test(host[1]);
 }
-var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([]);
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+]);
 var usablePin = (entry) => !!entry && Array.isArray(entry.origins) && Array.isArray(entry.usernames) && entry.origins.length > 0 && entry.usernames.length > 0 && entry.origins.every(hipayPinOriginUsable) && entry.usernames.every((name) => hipayUsernameEnvironment(name) === "production");
 function hipayOriginPin(merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
     if (typeof merchantOrigin !== "string" || !Array.isArray(pins) || !hipayPinOriginUsable(merchantOrigin))

package/dist/hold.d.ts

@@ -55,7 +55,7 @@ export interface HoldOptions {
 export interface HeldCardRequest {
     /** The processor, by the recogniser's name (`braintree`), `bolt`, or `placeholder_card`; null when unnamed. */
     psp: string | null;
-    /** Origin and path only. */
+    /** Origin and path only, with any credential a processor writes into the path masked (redactUrl). */
     endpoint: string;
     kind: 'tokenize' | 'store_card_post' | 'card_request';
     /** Whether a release can answer it: a recogniser the SDK pays, never Bolt or a store's own card post. */

package/dist/hold.js

@@ -17,7 +17,9 @@
 //   - Any request whose body carries the placeholder card number (`placeholderNumbers`): a store's own card post or
 //     an unknown processor. The browser only ever holds the placeholder, so a body with its digits is a card request
 //     wherever it goes. In sandbox it may be released unchanged (it carries the documented test number only).
-// The hold records the processor and the endpoint (origin and path), never a body or a header.
+// The hold records the processor and the endpoint (origin and path, any path credential masked), never a body or a
+// header.
+import { redactUrl } from './client.js';
 /**
  * Bolt's embedded card frame (connect.bolt.com credit-card-input): a POST of `{ payload, nonce, public_key }` JSON,
  * the card boxed to Bolt's key, to `<base>/token` or `<base>/token/cvv`, with a 20 s timeout and retries.
@@ -87,14 +89,18 @@ export class HoldAnsweredError extends Error {
         this.name = 'HoldAnsweredError';
     }
 }
+/**
+ * A held request's origin and path as redactUrl reads them, so a credential a processor writes into the path (GoPay's
+ * card form token, a PayMongo session) never reaches an event or onHeld.
+ */
 function endpointOf(url) {
     try {
-        const u = new URL(url);
-        return `${u.origin}${u.pathname}`;
+        new URL(url);
     }
     catch {
-        return String(url).slice(0, 120);
+        return redactUrl(String(url)).slice(0, 120);
     }
+    return redactUrl(url);
 }
 function validTotal(t) {
     const v = t;

package/dist/hosted-entry.d.ts

@@ -0,0 +1,4 @@
+/** Whether this processor's hosted page is entered with a GET this build reads exactly. */
+export declare function hasHostedGetEntry(psp: string): boolean;
+/** Whether `url` is exactly the GET entry of this processor's hosted page (false for a processor with none). */
+export declare function isHostedGetEntry(psp: string, url: string): boolean;

package/dist/hosted-entry.js

@@ -0,0 +1,32 @@
+/**
+ * Hosted payment pages whose entry is a plain GET: the processors whose merchant sends the buyer's browser to the
+ * processor's own page with a link (a redirect, or a page or frame location set by script) rather than a form post.
+ *
+ * Such an entry carries no card. The cardholder's device takes it over (mode hosted_form): it makes the processor's
+ * own calls for the payment the link names, and the paused navigation gets this SDK's submitted_on_device notice.
+ * A GET recognizer otherwise reads as a card request carried in the URL (Worldpay eProtect's registration), which
+ * this build completes only for a grammar it checks, so a hosted page joins this table with the exact link
+ * payment-core's resolveRecognizerForUrl admits for it, and nothing else: a URL the table does not admit is never
+ * paused, as the API would refuse it, and the page's own request goes on unchanged.
+ *
+ * Each rule is dark on its own: a processor is paused only once the API serves its recognizer, which it does only
+ * for a build that declares the processor's capability (client.ts SUPPORTED_CAPABILITIES) and a company Agentcard
+ * turned the processor on for. A rule listed here for a processor this build does not declare pauses nothing.
+ */
+import { PRZELEWY24_PSP, isPrzelewy24EntryUrl } from './przelewy24.js';
+import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
+import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
+const HOSTED_GET_ENTRIES = new Map([
+    [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
+    [COMGATE_PSP, isComgateEntryUrl],
+    [TRANSBANK_PSP, isTransbankEntryUrl],
+]);
+/** Whether this processor's hosted page is entered with a GET this build reads exactly. */
+export function hasHostedGetEntry(psp) {
+    return HOSTED_GET_ENTRIES.has(psp);
+}
+/** Whether `url` is exactly the GET entry of this processor's hosted page (false for a processor with none). */
+export function isHostedGetEntry(psp, url) {
+    const rule = HOSTED_GET_ENTRIES.get(psp);
+    return !!rule && typeof url === 'string' && rule(url) === true;
+}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { CheckoutAttachOptions } from './agentcard.js';
 export { CardEncryptedError, UnsupportedModeError, UnsupportedCapabilityError, PreparationRequiredError, AmountRequiredError, PageAmountRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, CheckoutAuthError, redactUrl, SUPPORTED_MODES, SUPPORTED_CAPABILITIES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, PlaceholderCardError, } from './client.js';
 export type { GmoUnsupportedReason } from './gmo.js';
 export type { DatatransRefusalReason } from './datatrans.js';
+export type { TokenexIframeRefusalReason } from './tokenex-iframe.js';
 export type { PelecardRefusalReason } from './pelecard.js';
 export type { PrimerUnsupportedReason, PrimerBlockedReason } from './primer.js';
 export { CONVERGE_REFUSAL_REASONS } from './elavon-converge.js';

package/dist/lifecycle.d.ts

@@ -159,6 +159,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private stripeContinuationChecks;
     /** The handoff in progress is WSPay's 3-D Secure step; see handedOff. */
     private wspayChallenge;
+    private heldBeforeHandoff;
     private stripeContinuedReason;
     private approvedPaymentMethod;
     private ownedShopOrderId;
@@ -191,7 +192,8 @@ export declare class CheckoutLifecycle implements CheckoutController {
     preparationFailed(error: CheckoutPreparationError): void;
     isBlocked(): boolean;
     /**
-     * An EBANX send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp). Until
+     * An EBANX or Payrexx send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp,
+     * payrexxFollowUp). Until
      * the returned function runs, once the send's answer reached the page or the send failed, reconcile() and
      * retryAfterMerchantFailure() throw, as they do while a card request is active: a confirm may still pay. The returned
      * function settles the send once, however often it runs.
@@ -200,7 +202,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     /** Whether a reconcile() is still waiting on the application's merchant resolver; pre-claim.ts claims no EBANX send then. */
     isReconciling(): boolean;
     /**
-     * Whether an EBANX send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
+     * Whether an EBANX or Payrexx send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
      * request meanwhile, as they do while an approval is outstanding: a confirm that may pay is never hidden behind
      * another payment's state.
      */
@@ -284,10 +286,13 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * paddle-vgs-pay.ts reasons), or the typed card that EBANX's 3-D Secure calls or
      * its hosted page's confirm send again after the token, when no approved token
      * request on this attachment covers that send or the cardholder's device did not
-     * send it (unsupported_ebanx_card_resend, ebanx.ts): once an approval exists the
+     * send it (unsupported_ebanx_card_resend, ebanx.ts), or the typed card Payrexx's card
+     * frame sends again for a 3-D Secure step when no approved card request on this
+     * attachment covers that send or the cardholder's device did not send it
+     * (unsupported_payrexx_card_resend, payrexx.ts): once an approval exists the
      * state keeps it, and only the hold changes.
      */
-    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | PaypalCardFormReason | 'unsupported_cybersource_secure_acceptance' | PaddleVgsPayRefusal | 'unsupported_ebanx_card_resend'): void;
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | PaypalCardFormReason | 'unsupported_cybersource_secure_acceptance' | PaddleVgsPayRefusal | 'unsupported_ebanx_card_resend' | 'unsupported_payrexx_card_resend'): void;
     /**
      * A card request that only a prepared checkout pays (an Adyen merchant
      * profile's, or a Fiserv card capture) arrived with no preparation on this

package/dist/lifecycle.js

@@ -57,6 +57,9 @@ export class CheckoutLifecycle {
     stripeContinuationChecks = 0;
     /** The handoff in progress is WSPay's 3-D Secure step; see handedOff. */
     wspayChallenge = false;
+    // Whether the attachment held when the handoff in progress began (prepareHandoff): a hold raised after that, while
+    // the answer was still landing, survives handedOff.
+    heldBeforeHandoff = false;
     // What the continuation that went through confirmed: a payment, or a card save.
     stripeContinuedReason = 'stripe_payment_continued';
     // The payment method a Stripe /v1/payment_methods approval returned: see approvedStripePaymentMethod.
@@ -120,7 +123,8 @@ export class CheckoutLifecycle {
     }
     isBlocked() { return this.held || this.cancelled; }
     /**
-     * An EBANX send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp). Until
+     * An EBANX or Payrexx send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp,
+     * payrexxFollowUp). Until
      * the returned function runs, once the send's answer reached the page or the send failed, reconcile() and
      * retryAfterMerchantFailure() throw, as they do while a card request is active: a confirm may still pay. The returned
      * function settles the send once, however often it runs.
@@ -136,7 +140,7 @@ export class CheckoutLifecycle {
     /** Whether a reconcile() is still waiting on the application's merchant resolver; pre-claim.ts claims no EBANX send then. */
     isReconciling() { return this.reconciliation !== null; }
     /**
-     * Whether an EBANX send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
+     * Whether an EBANX or Payrexx send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
      * request meanwhile, as they do while an approval is outstanding: a confirm that may pay is never hidden behind
      * another payment's state.
      */
@@ -283,7 +287,10 @@ export class CheckoutLifecycle {
      * paddle-vgs-pay.ts reasons), or the typed card that EBANX's 3-D Secure calls or
      * its hosted page's confirm send again after the token, when no approved token
      * request on this attachment covers that send or the cardholder's device did not
-     * send it (unsupported_ebanx_card_resend, ebanx.ts): once an approval exists the
+     * send it (unsupported_ebanx_card_resend, ebanx.ts), or the typed card Payrexx's card
+     * frame sends again for a 3-D Secure step when no approved card request on this
+     * attachment covers that send or the cardholder's device did not send it
+     * (unsupported_payrexx_card_resend, payrexx.ts): once an approval exists the
      * state keeps it, and only the hold changes.
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
@@ -305,6 +312,7 @@ export class CheckoutLifecycle {
         this.set({ ...this.state, status: 'failed', reason: 'preparation_required' });
     }
     prepareHandoff(replay, requestUrl) {
+        this.heldBeforeHandoff = this.held;
         this.wspayChallenge = isWspayChallenge(requestUrl, replay);
         this.handoffs.push(requestUrl);
         if (replay.mode === 'token' && replay.executionMode === 'autopilot' && replay.shopOrderId) {
@@ -422,10 +430,14 @@ export class CheckoutLifecycle {
             return;
         }
         const mismatch = (!replay.mode || replay.mode === 'token') && replay.amountVerified === false;
+        // A hold raised while the answer was still landing stands: the page may send its first follow-up the moment the
+        // answer lands, and an EBANX or Payrexx send that fails then stops the approval's follow-ups for good
+        // (pre-claim.ts), so a new card request must not reopen the checkout under an approval that cannot finish.
+        const heldDuringHandoff = this.held && !this.heldBeforeHandoff;
         // A card endpoint answer means the merchant already holds the card: its page's own
         // retry, or a step-up that sends the card again, is refused until the application
         // reconciles the order, exactly as for a hosted form the device submitted.
-        this.held = !!this.options.requireMerchantResult || replay.mode === 'hosted_form' || replay.mode === 'card_endpoint' || mismatch || this.unboundStripeToken;
+        this.held = heldDuringHandoff || !!this.options.requireMerchantResult || replay.mode === 'hosted_form' || replay.mode === 'card_endpoint' || mismatch || this.unboundStripeToken;
         if (mismatch)
             this.stripeTokenPrepared = false;
         this.set({ status: 'awaiting_merchant', authorizationId: replay.authorizationId, mode: replay.mode ?? 'token',