@agent-cards/sdk 0.23.21 → 0.23.22

package/dist/client.js

@@ -5,6 +5,7 @@ import { ACI_CAPABILITY, ACI_PSP, aciCardLegAnswer } from './aci.js';
 import { PRZELEWY24_CAPABILITY, PRZELEWY24_PSP } from './przelewy24.js';
 import { EPROTECT_CAPABILITY, EPROTECT_PSP, eprotectCheckoutRefusal, eprotectScriptAnswer, isEprotectRegistration } from './eprotect.js';
 import { COMGATE_CAPABILITY, COMGATE_PSP } from './comgate.js';
+import { EXIMBAY_CAPABILITY } from './eximbay.js';
 import { isHostedGetEntry } from './hosted-entry.js';
 import { TRANSBANK_CAPABILITY, TRANSBANK_PSP } from './transbank.js';
 import { isMercadoTokenRequest, parseMercadoCheckoutContext, validateMercadoProcessorContext } from './mercado-checkout.generated.js';
@@ -19,10 +20,12 @@ import { CONVERGE_CAPABILITY } from './elavon-converge.js';
 import { SHIJI_STS_CAPABILITY, SHIJI_STS_PSP, isShijiStsServedCompanion, isShijiStsServedSubstitution } from './shiji-sts.js';
 import { AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP } from './amadeus-checkout.generated.js';
 import { PADDLE_VGS_CAPABILITY, PADDLE_VGS_PSP, paddleVgsCardFactsOf } from './paddle-vgs.generated.js';
+import { PAYGENT_CAPABILITY, PAYGENT_PSP, paygentAnswerOutcome } from './paygent.generated.js';
 import { PADDLE_TOKENEX_CAPABILITY, PADDLE_TOKENEX_PSP, isPaddleTokenexServedFacts, isPaddleTokenexServedSubstitution } from './paddle-tokenex.js';
 import { TWOC2P_CAPABILITY, TWOC2P_PSP } from './twoc2p.js';
 import { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_PSP } from './wix-payments.generated.js';
 import { HIPAY_CAPABILITY, HIPAY_PSP } from './hipay.generated.js';
+import { TOAST_CAPABILITY, TOAST_PSP, isToastCiphertext } from './toast.generated.js';
 import { classifyStripeCheckoutRequest, encodeStripeCheckoutContext, hasStripeCheckoutMarker, parseStripeCheckoutContext, parseStripeCheckoutResponse, STRIPE_CHECKOUT_CONTEXT_HEADER, } from './stripe-checkout.generated.js';
 import { VoiceModule } from './voice.js';
 import { BuyModule } from './buy.js';
@@ -42,6 +45,7 @@ import { PRIMER_CAPABILITY, PRIMER_PSP, primerTokenAnswer } from './primer.js';
 import { PAYRAILS_CAPABILITY, isPayrailsPaymentUrl, payrailsAnswer } from './payrails.js';
 import { WSPAY_CAPABILITY, WSPAY_PSP } from './wspay.js';
 import { EbanxFollowUpError } from './ebanx.js';
+import { PAYREXX_CAPABILITY, PAYREXX_PSP, PayrexxFollowUpError } from './payrexx.js';
 import { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_FAST_POLL_MS, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REPLY_WINDOW_MS, secureAcceptanceCheckoutProfile, secureAcceptanceCheckoutRefusal, secureAcceptanceFrameAnswer, } from './cybersource-secure-acceptance.js';
 /**
  * The modes this SDK can finish. Asked for on syncRegistry (the API serves
@@ -265,6 +269,22 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * company until a reviewed change binds GoPay's payee and amount to the approval: the post names
  * neither. The API takes it only at a shop Agentcard reviewed.
  *
+ * `paygent_token`: the token request Paygent's own PaygentToken.js sends from a merchant's
+ * page (token.paygent.co.jp/n/token/request), only through a prepared checkout: the script
+ * abandons the request 35 seconds after the press that sends it, so the cardholder approves
+ * before the press. The cardholder's device sends the card itself and the page gets back
+ * Paygent's single-use token alone; the SDK refuses a second token request on the same approval.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned
+ * Paygent on for.
+ *
+ * `payrexx_card_frame`: the card request Payrexx Pay's card frame sends to its own URL
+ * (checkout.payrexx.com/?pspId=44&lang=<xx>) on a Payrexx merchant's page. This build pauses only
+ * the frame's own one-time card request and answers it with Payrexx's answer as the API recorded
+ * it: the token the merchant's page then charges, or the start of 3-D Secure, whose two later sends
+ * of the card this build hands to the cardholder's device under the same approval (payrexx.ts,
+ * pre-claim.ts payrexxPreClaim). The cardholder's device sends the card through the checkout relay.
+ * Served only to a build that lists it, for a company Agentcard turned Payrexx on for.
+ *
  * `hipay_vault_token`: the token create HiPay's hosted fields send to HiPay's Secure Vault
  * (secure2-vault.hipay-tpp.com, stage-secure2-vault for a test row), only through a prepared
  * checkout: the merchant's page gives the frame 20 seconds after Pay. The cardholder's device
@@ -364,11 +384,39 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * device sends the card itself, and the API holds the payment to a merchant Agentcard reviewed, at the
  * amount SumUp holds for the checkout. Served on the same terms: only to a build that lists it, for a
  * company Agentcard turned SumUp on for.
+ *
+ * `clover_card_token`: the card token request Clover's card frame (the hidden frame of
+ * checkout.clover.com that Clover's iframe mounts on a merchant's page) sends to
+ * token.clover.com/v1/tokens (token-sandbox.dev.clover.com for a test row), with the number
+ * encrypted under Clover's key. This build pauses only the frame's own body at that exact URL; the
+ * cardholder's device builds the request again with the real card under the key payment-core pins
+ * and sends it to Clover itself, and the frame gets the token answer payment-core's judge rebuilt.
+ * The request names no amount, so the agent's pair, above zero, is the one the cardholder approves
+ * (CLOVER_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Clover on for.
+ *
+ * `eximbay_hosted_payment_page`: Eximbay's payment window, whose card-free signed entry
+ * (a form post to /Gateway/BasicProcessor.krp on secureapi.eximbay.com, or its test host) this
+ * build pauses for the cardholder's device, in the page or in a window it opened once attachToCdp
+ * has armed that window (eximbay.ts names the entry that can leave first), and whose
+ * step, amount query, card lookup and card post this build never lets the agent's browser send
+ * (pre-claim.ts, eximbay.ts). Served on the same terms as NMI's and Redsys's: only to a build
+ * that lists it, for a company Agentcard turned Eximbay on for.
+ *
+ * `toast_pinned_key`: the card request Toast's payments frame sends to
+ * payments.toasttab.com/v1/payment-methods on a Toast online-ordering checkout, with
+ * the card sealed in card.cardData under one key every Toast restaurant shares. The
+ * cardholder's device seals the real card under that key, which payment-core pins, and
+ * this build writes it over the agent's placeholder and nothing else before it
+ * continues the request. Served on the same terms: only to a build that lists it, for
+ * a company Agentcard turned Toast on for.
  */
 export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CYBERSOURCE_FLEX_CAPABILITY, JUSPAY_CAPABILITY, DATATRANS_CAPABILITY, 'authorize_net_dpm_form', PELECARD_CAPABILITY, ACI_CAPABILITY, 'creditguard_pps_process', PRIMER_CAPABILITY, PAYRAILS_CAPABILITY, CONVERGE_CAPABILITY, EPROTECT_CAPABILITY, WSPAY_CAPABILITY, SHIJI_STS_CAPABILITY, AMADEUS_CHECKOUT_CAPABILITY, 'worldline_mycheckout_form', 'verifone_card_capture', 'ekashu_hosted_payment_page', SECURE_ACCEPTANCE_CAPABILITY, 'gravy_session_fields_put', 'moneris_hosted_tokenization', PADDLE_VGS_CAPABILITY, PADDLE_TOKENEX_CAPABILITY,
-    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY, 'paymongo_checkout_pay', 'pay_nl_card_token', HIPAY_CAPABILITY, TWOC2P_CAPABILITY, 'quickpay_hosted_payment_page', 'revolut_card_field', 'paypal_card_fields', 'gopay_card_form', COMGATE_CAPABILITY, PRZELEWY24_CAPABILITY, 'makecommerce_card_frame', 'poynt_collect_nonce',
+    'redsys_hosted_payment_page', 'lyra_krypton_payment', 'payfast_card_pay', WIX_PAYMENTS_CAPABILITY, 'paymongo_checkout_pay', PAYGENT_CAPABILITY, 'pay_nl_card_token', HIPAY_CAPABILITY, TWOC2P_CAPABILITY, 'quickpay_hosted_payment_page', 'revolut_card_field', 'paypal_card_fields', 'gopay_card_form', PAYREXX_CAPABILITY, COMGATE_CAPABILITY, PRZELEWY24_CAPABILITY, 'makecommerce_card_frame', 'poynt_collect_nonce',
     TOKENEX_IFRAME_CAPABILITY, TRANSBANK_CAPABILITY,
-    'sumup_checkout_process'];
+    'sumup_checkout_process',
+    'clover_card_token',
+    EXIMBAY_CAPABILITY, TOAST_CAPABILITY];
 /**
  * Processors whose paused request names no amount at all, so the pair the
  * agent passes is the amount the cardholder approves: authorize() refuses one
@@ -396,13 +444,21 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * so the agent sends the total Payfast's page shows, above zero (PAYFAST_PSP below),
  * and the API holds it to the payment Payfast itself reports. Wix's tokenize request
  * carries none either: the merchant's page charges Wix's token for its own order, so the
- * agent's pair, which the prepared checkout carries, is the total the cardholder approves.
+ * agent's pair, which the prepared checkout carries, is the total the cardholder approves. Toast's
+ * card request carries none either: the page's card-free confirm of its payment intent
+ * charges whatever the intent says, so the agent's pair, above zero (as Moneris's), is
+ * the one figure the approval shows.
  * PayMongo's card attach carries none either: the merchant bound the total, always in
  * Philippine pesos, to the checkout session when it created it, so the agent sends that
  * total, above zero (PAYMONGO_PSP below), and the API holds it to the session PayMongo's
  * own page shows. GoPay's card post carries none either: the shop's server set the amount
  * when it created the payment at GoPay, and GoPay's gateway shows it only inside its own
  * session, so the agent sends the total the gateway shows, above zero (GOPAY_PSP below).
+ * Paygent's token request carries none either: the merchant's server charges the token later, so
+ * the agent's pair, which the prepared checkout carries, is the total the cardholder approves.
+ * Payrexx's card request names the page's total, but it only mints a token: the merchant's page
+ * charges its own total later, at its validateForm, so the agent sends the total that page shows,
+ * above zero (PAYREXX_PSP), and the API holds it to the frame's figure exactly.
  * 2C2P's Payment carries none either: the merchant bound the total to the
  * payment token when it created it, so the agent sends the total 2C2P's page shows, above
  * zero (TWOC2P_PSP), and the API holds it to the amount 2C2P's own PaymentOption answer names.
@@ -442,6 +498,9 @@ export const SUPPORTED_CAPABILITIES = ['fiserv_card_capture', GMO_CAPABILITY, CY
  * total and its currency to the checkout when it created it, so the agent sends the total the
  * payment page shows, above zero (SUMUP_PSP below), and the API holds it to the checkout SumUp
  * itself reports.
+ * Clover's card token request carries none either: the merchant's server charges the token
+ * later for its own order, so the agent's pair, above zero (CLOVER_PSP below), is the one figure
+ * the approval shows.
  */
 const MONERIS_PSP = 'moneris';
 const PAYFAST_PSP = 'payfast';
@@ -453,15 +512,18 @@ const GOPAY_PSP = 'gopay';
 const MAKECOMMERCE_PSP = 'makecommerce';
 const POYNT_PSP = 'poynt';
 const SUMUP_PSP = 'sumup';
-const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP, PAYMONGO_PSP, PAY_NL_PSP, HIPAY_PSP, TWOC2P_PSP, REVOLUT_PSP, PAYPAL_PSP, GOPAY_PSP, COMGATE_PSP,
-    PRZELEWY24_PSP, MAKECOMMERCE_PSP, POYNT_PSP, TOKENEX_IFRAME_PSP, TRANSBANK_PSP, SUMUP_PSP];
+const CLOVER_PSP = 'clover';
+const AGENT_AMOUNT_PROCESSORS = [GMO_PSP, PELECARD_PSP, WSPAY_PSP, SECURE_ACCEPTANCE_PSP, MONERIS_PSP, PADDLE_VGS_PSP, PAYFAST_PSP, WIX_PAYMENTS_PSP, PAYMONGO_PSP, PAYGENT_PSP, PAY_NL_PSP, HIPAY_PSP, TWOC2P_PSP, REVOLUT_PSP, PAYPAL_PSP, GOPAY_PSP, PAYREXX_PSP, COMGATE_PSP,
+    PRZELEWY24_PSP, MAKECOMMERCE_PSP, POYNT_PSP, TOKENEX_IFRAME_PSP, TRANSBANK_PSP, SUMUP_PSP,
+    CLOVER_PSP, TOAST_PSP];
 /** How AmountRequiredError names a processor. */
 const PROCESSOR_NAMES = { [GMO_PSP]: 'GMO', [PELECARD_PSP]: 'Pelecard', [WSPAY_PSP]: 'WSPay',
-    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix', [PAYMONGO_PSP]: 'PayMongo', [PAY_NL_PSP]: 'Pay.', [HIPAY_PSP]: 'HiPay', [TWOC2P_PSP]: '2C2P',
-    [REVOLUT_PSP]: 'Revolut', [PAYPAL_PSP]: 'PayPal', [GOPAY_PSP]: 'GoPay',
+    [SECURE_ACCEPTANCE_PSP]: 'CyberSource Secure Acceptance', [MONERIS_PSP]: 'Moneris', [PADDLE_VGS_PSP]: 'Paddle', [PAYFAST_PSP]: 'Payfast', [WIX_PAYMENTS_PSP]: 'Wix', [PAYMONGO_PSP]: 'PayMongo', [PAYGENT_PSP]: 'Paygent', [PAY_NL_PSP]: 'Pay.', [HIPAY_PSP]: 'HiPay', [TWOC2P_PSP]: '2C2P',
+    [REVOLUT_PSP]: 'Revolut', [PAYPAL_PSP]: 'PayPal', [GOPAY_PSP]: 'GoPay', [PAYREXX_PSP]: 'Payrexx',
     [COMGATE_PSP]: 'ComGate', [PRZELEWY24_PSP]: 'Przelewy24',
     [MAKECOMMERCE_PSP]: 'MakeCommerce', [POYNT_PSP]: 'GoDaddy Payments', [TOKENEX_IFRAME_PSP]: 'TokenEx', [TRANSBANK_PSP]: 'Webpay',
-    [SUMUP_PSP]: 'SumUp' };
+    [SUMUP_PSP]: 'SumUp',
+    [CLOVER_PSP]: 'Clover', [TOAST_PSP]: 'Toast' };
 /**
  * Processors whose request and answer name no amount at all, so the total the
  * payment page shows (`pageAmount`) is the one figure that ties the agent's pair
@@ -741,7 +803,9 @@ export class AmountRequiredError extends Error {
     code = 'amount_required';
     constructor(psp) {
         const processor = PROCESSOR_NAMES[psp] ?? psp;
-        const lacks = psp === REVOLUT_PSP ? 'names its amount but not its currency' : 'names no amount';
+        // A Payrexx card request names the frame's total, but the merchant's page charges its own total after the token.
+        const lacks = psp === REVOLUT_PSP ? 'names its amount but not its currency'
+            : psp === PAYREXX_PSP ? "only mints a token the merchant's page charges later" : 'names no amount';
         super(`A ${processor} payment request ${lacks}, so pass amount and currency: that is the amount the cardholder approves. Nothing was created and nothing was charged.`);
         this.psp = psp;
         this.name = 'AmountRequiredError';
@@ -1086,12 +1150,12 @@ function refusalsOf(v) {
     return out;
 }
 /**
- * How often sendEbanxFollowUp reads a send back while the cardholder's device has it: every half second, whatever the
- * client's own `pollIntervalMs`. One send is out at a time per approval, so this is 120 reads a minute, inside the
- * API's 240 a minute per caller and authorization (routes/api/v2/checkout-follow-ups.ts).
+ * How often sendEbanxFollowUp and sendPayrexxFollowUp read a send back while the cardholder's device has it: every
+ * half second, whatever the client's own `pollIntervalMs`. One send is out at a time per approval, so this is 120
+ * reads a minute, inside the API's 240 a minute per caller and authorization (routes/api/v2/checkout-follow-ups.ts).
  */
 export const EBANX_FOLLOW_UP_READ_MS = 500;
-/** The longest sendEbanxFollowUp waits after reads the API refused as too many (429): 1, 2, 4, 8, then 15 seconds. */
+/** The longest a follow-up send waits after reads the API refused as too many (429): 1, 2, 4, 8, then 15 seconds. */
 export const EBANX_FOLLOW_UP_BACKOFF_MAX_MS = 15_000;
 export class CheckoutApiError extends Error {
     status;
@@ -1384,6 +1448,18 @@ const SUMUP_CHECKOUT = new RegExp(`(${SLASH}checkouts${SLASH}+)[^/]*`, 'gi');
 function maskSumupCheckout(path) {
     return maskUuids(path.replace(SUMUP_CHECKOUT, '$1{checkout}'), '{checkout}');
 }
+/**
+ * FastSpring's checkout posts its card payment to <store>.onfastspring.com[/popup-<name>]/session/<id>/payment
+ * (payment-core fastspring.js), and the session id in that path is a credential: the session's own document,
+ * which anyone holding the id can read with no cookie, carries the order and the session's token. On every
+ * host under onfastspring.com the segment after /session/, in any case or after an escaped slash, reads
+ * {session}.
+ */
+const FASTSPRING_HOST = /(?:^|\.)onfastspring\.com\.?$/i;
+const FASTSPRING_SESSION = /(\/session(?:\/|%2f))[^/]*/gi;
+function maskFastspringSession(path) {
+    return path.replace(FASTSPRING_SESSION, '$1{session}');
+}
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
  * that send it, the text that names those hosts anywhere else (a string that is not a URL, or a
@@ -1558,6 +1634,7 @@ const PATH_CREDENTIALS = [
     { host: PAYMENT_HIGHWAY_HOST, named: /(?:paymenthighway\.io|sph-test-solinor\.com)/i, mask: maskPaymentHighwaySession },
     { host: TWOC2P_PAGE_HOST, named: /pgw-ui\.2c2p\.com/i, mask: maskTwoC2pToken, pathMask: maskTwoC2pPath },
     { host: QUICKPAY_HOST, named: /quickpay\.net/i, mask: maskQuickpaySession },
+    { host: FASTSPRING_HOST, named: /onfastspring\.com/i, mask: maskFastspringSession },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1595,6 +1672,8 @@ const PATH_CREDENTIALS = [
  * https://pgw-ui.2c2p.com/payment/4.1/{token}.
  * On QuickPay's host the window's session reads `{session}`:
  * https://payment.quickpay.net/{session}/3ds_auth.
+ * On FastSpring's store hosts the session id reads `{session}`:
+ * https://daisydisk.onfastspring.com/session/{session}/payment.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1703,6 +1782,18 @@ const PADDLE_VGS_PREPARATION_REFUSALS = [
  * `unsupported_checkout`, which PREPARATION_REFUSALS names for every checkout. Only for a Wix checkout.
  */
 const WIX_PAYMENTS_PREPARATION_REFUSALS = ['processor_unavailable', 'live_host_on_sandbox_row', 'merchant_profile_mismatch'];
+/**
+ * The API's refusals of a Paygent preparation, before any preparation exists, that prepareCheckout passes on
+ * by name: Paygent is off for the company (`processor_unavailable`), the environment is not the client's test
+ * or live mode, a live checkout's currency is not the one the reviewed merchant charges in
+ * (`unsupported_currency`), and the price is zero (`amount_required`): Paygent's token request names no
+ * amount, so the price the agent sends is the one the cardholder approves. A page and name no reviewed pin
+ * lists answers `unsupported_checkout`, which PREPARATION_REFUSALS names for every checkout. The API holds the
+ * pins, not this build, so a merchant a later release reviews needs no new SDK. Only for a Paygent checkout.
+ */
+const PAYGENT_PREPARATION_REFUSALS = [
+    'processor_unavailable', 'sandbox_host_on_live_row', 'live_host_on_sandbox_row', 'unsupported_currency', 'amount_required',
+];
 /**
  * The API's refusals of a HiPay preparation, before any preparation exists, that prepareCheckout surfaces by name:
  * the company is not turned on for HiPay (`processor_unavailable`), the environment is not the caller's key mode's
@@ -2293,6 +2384,8 @@ export class VaultClient {
             throw fail(secureAcceptanceRefusal);
         const secureAcceptanceProfileId = secureAcceptance ? secureAcceptanceCheckoutProfile({ environment: input.environment,
             profileId: input.secureAcceptanceProfileId, merchantOrigin: input.merchantOrigin }) : null;
+        // A live Paygent checkout's merchant is the API's to judge against the reviewed pins it holds, before anyone is
+        // asked to approve (PAYGENT_PREPARATION_REFUSALS); test mode needs no pin.
         const timeoutMs = input.timeoutMs ?? 15 * 60_000;
         if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647)
             throw fail('timeout_invalid');
@@ -2412,6 +2505,7 @@ export class VaultClient {
                     || (input.psp === EPROTECT_PSP && EPROTECT_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === PADDLE_VGS_PSP && PADDLE_VGS_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === WIX_PAYMENTS_PSP && WIX_PAYMENTS_PREPARATION_REFUSALS.includes(error.code))
+                    || (input.psp === PAYGENT_PSP && PAYGENT_PREPARATION_REFUSALS.includes(error.code))
                     || (input.psp === HIPAY_PSP && HIPAY_PREPARATION_REFUSALS.includes(error.code))
                     || (!!flexContext && CYBERSOURCE_FLEX_PREPARATION_REFUSALS.includes(error.code))))
                     || (input.psp === 'fiserv' && error.status === 502 && error.code === 'cse_key_unavailable')))
@@ -2709,17 +2803,21 @@ export class VaultClient {
         // the total GoPay's payment already holds, so a zero pair would show the cardholder no price at all: it is refused
         // like a missing one.
         // A ComGate payment charges the total ComGate already holds for it, the same way, and a Webpay transaction the
-        // total the merchant's server bound to it.
+        // total the merchant's server bound to it, and a Payrexx page charges its own
+        // total after the frame's token.
         // A Moneris token is charged later for whatever the merchant's server decides, and a Payfast pay, a
         // PayMongo attach or a MakeCommerce card post charges the total its payment, checkout session or
         // transaction already holds, so a zero pair would show the cardholder no price at all: it is refused
         // like a missing one. So is a TokenEx iframe token, which the merchant's server charges later for its own order.
+        // A Clover token is charged later for whatever the merchant's server decides, as a Moneris one is.
+        // A Toast payment method is charged by the page's own confirm for whatever its intent says, the same way.
         if (hasAmount && rec && rec.psp === PRZELEWY24_PSP && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         if (hasAmount && rec && (rec.psp === MONERIS_PSP || rec.psp === PAYFAST_PSP || rec.psp === PAYMONGO_PSP || rec.psp === HIPAY_PSP || rec.psp === TWOC2P_PSP
             || rec.psp === REVOLUT_PSP || rec.psp === PAY_NL_PSP || rec.psp === PAYPAL_PSP
             || rec.psp === GOPAY_PSP || rec.psp === COMGATE_PSP || rec.psp === MAKECOMMERCE_PSP
-            || rec.psp === POYNT_PSP || rec.psp === TOKENEX_IFRAME_PSP || rec.psp === TRANSBANK_PSP || rec.psp === SUMUP_PSP) && Number(input.amount) <= 0)
+            || rec.psp === POYNT_PSP || rec.psp === TOKENEX_IFRAME_PSP || rec.psp === TRANSBANK_PSP || rec.psp === SUMUP_PSP
+            || rec.psp === CLOVER_PSP || rec.psp === PAYREXX_PSP || rec.psp === TOAST_PSP) && Number(input.amount) <= 0)
             throw new AmountRequiredError(rec.psp);
         // Nor is the agent's pair tied to the page by anything but the total the
         // page shows: without it the cardholder could approve one figure while the
@@ -3055,6 +3153,10 @@ export class VaultClient {
                         // source.encryptionData and removes nothing (fiserv.ts); any other shape is not one to act on.
                         if (rec.psp === 'fiserv' && !isFiservSubstitution(sub))
                             throw new PaymentOutcomeUnknownError(authorizationId, 'cse_substitutions_malformed');
+                        // A Toast approval carries exactly one sealed card, cardData at `card`, and removes nothing
+                        // (payment-core toast-seal.js substituteToastCardData checks the rest at the swap).
+                        if (rec.psp === TOAST_PSP && !isToastSubstitution(sub))
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'cse_substitutions_malformed');
                         // `remove`: sibling keys the API says to drop with the swap (Adyen's
                         // `brand`, stamped by adyen-web from the agent's dummy digits). Absent
                         // on an older API; anything but a list of names is refused, since a
@@ -3225,6 +3327,18 @@ export class VaultClient {
                         response.headers = answer.headers;
                         response.body = answer.body;
                     }
+                    if (rec?.psp === PAYGENT_PSP) {
+                        // Paygent's answer enters the page only as payment-core rebuilds an approved token from its members
+                        // (paygent.js paygentAnswerOutcome: HTTP 200, result 0000 and a token in shape), under a JSON content
+                        // type. Anything else, a refusal Paygent answers inside HTTP 200 included, is never handed over as an
+                        // approval; the card may have left the device, so the outcome is unknown rather than declined.
+                        const judged = paygentAnswerOutcome(response.status, response.body, null);
+                        if (judged.outcome !== 'approved' || typeof judged.body !== 'string')
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'paygent_token_unconfirmed');
+                        response.status = 200;
+                        response.headers = { 'content-type': 'application/json' };
+                        response.body = judged.body;
+                    }
                     if (rec?.psp === PRIMER_PSP) {
                         // Primer's answer enters the page only as one single-use card token rebuilt from
                         // payment-core's allow-list, under a JSON content type (primer.ts primerTokenAnswer).
@@ -3279,8 +3393,9 @@ export class VaultClient {
                         chargedAmount: typeof s.charged_amount === 'number' ? s.charged_amount : null,
                         chargedCurrency: typeof s.charged_currency === 'string' ? s.charged_currency : null,
                         chargedKind: s.charged_kind === 'captured' || s.charged_kind === 'authorized' || s.charged_kind === 'none' ? s.charged_kind : null,
-                        // An EBANX token approval that covers the sends after it names until when (ebanx.ts EbanxFollowUps).
-                        ...(rec?.psp === 'ebanx' && typeof s.follow_ups?.until === 'string' && Number.isFinite(Date.parse(s.follow_ups.until))
+                        // An EBANX token approval, or a Payrexx card request whose answer started 3-D Secure, that covers the sends
+                        // after it names until when (ebanx.ts EbanxFollowUps, payrexx.ts PayrexxFollowUps).
+                        ...((rec?.psp === 'ebanx' || rec?.psp === PAYREXX_PSP) && typeof s.follow_ups?.until === 'string' && Number.isFinite(Date.parse(s.follow_ups.until))
                             ? { followUpsUntil: s.follow_ups.until } : {}),
                         ...amountAuthority,
                         ...execution,
@@ -3493,6 +3608,20 @@ export class VaultClient {
      * an answer that carried the card, or `options.until` (the approval's window, plus the API's own clocks) passed.
      */
     async sendEbanxFollowUp(authorizationId, request, options = {}) {
+        return this.sendFollowUp(authorizationId, request, options, (reason, cardSent) => new EbanxFollowUpError(reason, cardSent, authorizationId));
+    }
+    /**
+     * Send one of Payrexx's 3-D Secure sends an approved Payrexx card request covers (payrexx.ts says which: the card
+     * frame's authentication after the ACS method and its post-authentication after the bank's challenge, bound to that
+     * approval) from the cardholder's device, and resolve with Payrexx's answer for the paused request, exactly as
+     * sendEbanxFollowUp does for EBANX: the same create, reads and clocks, and no prompt. Rejects with a
+     * PayrexxFollowUpError naming why there is no answer and whether the card may have reached Payrexx.
+     */
+    async sendPayrexxFollowUp(authorizationId, request, options = {}) {
+        return this.sendFollowUp(authorizationId, request, options, (reason, cardSent) => new PayrexxFollowUpError(reason, cardSent, authorizationId));
+    }
+    /** The send behind sendEbanxFollowUp and sendPayrexxFollowUp; `fail` builds the processor's error for a send with no answer. */
+    async sendFollowUp(authorizationId, request, options, fail) {
         if (!/^cauth_[A-Za-z0-9_-]{1,128}$/.test(authorizationId))
             throw new Error('Invalid authorization ID.');
         const base = `/v2/checkout/authorizations/${authorizationId}/follow_ups`;
@@ -3506,16 +3635,16 @@ export class VaultClient {
         catch (error) {
             // A refusal (a 4xx answer) stored no send, so nothing left. Any other failure (a 5xx, a timeout, a dropped
             // connection, an unreadable 201) may have come after the API stored the send, which the device then sends:
-            // the card may reach EBANX, and for a confirm that is a payment whose outcome is unknown.
+            // the card may reach the processor, and for an EBANX confirm that is a payment whose outcome is unknown.
             const refused = error instanceof CheckoutApiError && error.status >= 400 && error.status < 500;
             const reason = error instanceof CheckoutApiError
                 ? (typeof error.details.reason === 'string' && /^[a-z_]{1,64}$/.test(error.details.reason) ? error.details.reason : error.code ?? `http_${error.status}`)
                 : 'follow_up_unavailable';
-            throw new EbanxFollowUpError(reason, !refused, authorizationId);
+            throw fail(reason, !refused);
         }
         const id = created?.id;
         if (typeof id !== 'string' || !/^cfu_[0-9a-f]{24}$/.test(id) || created.authorization !== authorizationId) {
-            throw new EbanxFollowUpError('follow_up_unrecognized', true, authorizationId);
+            throw fail('follow_up_unrecognized', true);
         }
         // Reads the API refused in a row as too many (429): each waits twice as long as the last before the next read.
         let limited = 0;
@@ -3527,14 +3656,14 @@ export class VaultClient {
             }
             catch (error) {
                 if (signal.aborted)
-                    throw new EbanxFollowUpError('answer_late', true, authorizationId);
+                    throw fail('answer_late', true);
                 if (error instanceof CheckoutApiError && error.status === 429)
                     limited += 1;
             }
             if (read?.status === 'answered') {
                 const r = read.response;
                 if (!r || !Number.isInteger(r.status) || r.status < 200 || r.status > 599 || typeof r.body !== 'string' || !r.headers || typeof r.headers !== 'object') {
-                    throw new EbanxFollowUpError('follow_up_unrecognized', true, authorizationId);
+                    throw fail('follow_up_unrecognized', true);
                 }
                 const headers = {};
                 for (const [name, value] of Object.entries(r.headers))
@@ -3544,10 +3673,10 @@ export class VaultClient {
             }
             if (read?.status === 'failed' || read?.status === 'expired') {
                 const reason = typeof read.failure_reason === 'string' && /^[a-z_]{1,64}$/.test(read.failure_reason) ? read.failure_reason : read.status;
-                throw new EbanxFollowUpError(reason, read.card_sent !== false, authorizationId);
+                throw fail(reason, read.card_sent !== false);
             }
             if (signal.aborted || Date.now() >= deadline)
-                throw new EbanxFollowUpError('answer_late', true, authorizationId);
+                throw fail('answer_late', true);
             const wait = limited === 0 ? EBANX_FOLLOW_UP_READ_MS : Math.min(EBANX_FOLLOW_UP_BACKOFF_MAX_MS, 1000 * 2 ** (limited - 1));
             await interruptibleSleep(Math.max(1, Math.min(wait, deadline - Date.now())), signal);
         }
@@ -4108,3 +4237,14 @@ function interruptibleSleep(ms, signal) {
         signal?.addEventListener('abort', done, { once: true });
     });
 }
+/** A served Toast set: exactly { cardData } at `card`, a 256-byte base64 value, with nothing to remove. */
+function isToastSubstitution(sub) {
+    if (!sub || typeof sub !== 'object')
+        return false;
+    const { at, fields, remove } = sub;
+    if (at !== 'card' || !fields || typeof fields !== 'object' || Array.isArray(fields))
+        return false;
+    const keys = Object.keys(fields);
+    return keys.length === 1 && keys[0] === 'cardData' && isToastCiphertext(fields.cardData)
+        && (remove === undefined || (Array.isArray(remove) && remove.length === 0));
+}

package/dist/creditguard.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0110d9fe2e862aad2c1191c5927ebb98dcc4be9905554ed46e18719a0bad05fb
+// artifact-sha256: 24cac2580feefe7d273b89de8e5b84e744e561fd258252f98008801750370460
 // src/creditguard.js
 var CREDITGUARD_PPS_HOSTS = Object.freeze(["pps.creditguard.co.il", "pps2.creditguard.co.il", "ppsuat.creditguard.co.il"]);
 var CREDITGUARD_SANDBOX_HOST = "ppsuat.creditguard.co.il";
@@ -707,6 +707,7 @@ var THREE_DS_INIT_KEYS = Object.freeze([
     "cvv",
     "isGooglePayTxn",
     "isPayboxTxn",
+    "recaptchaValue",
     "useDcc",
     "acsWindowSize",
     "browserColorDepth",
@@ -837,6 +838,7 @@ function creditguardDeviceThreeDSInitRequest(processUrl, card, options = {}) {
         cvv: parts.cvc,
         isGooglePayTxn: false,
         isPayboxTxn: false,
+        recaptchaValue: "",
         useDcc: false,
         acsWindowSize: "4",
         browserColorDepth: browser.colorDepth,
@@ -887,7 +889,7 @@ function deviceStepBodyRefusal(step, txId, body) {
         return "dcc";
     if (value.txId !== txId)
         return "txid_mismatch";
-    if (value.acsWindowSize !== "4" || value.browserHeader !== BROWSER_HEADER || value.browserJavascriptEnabled !== true)
+    if (value.recaptchaValue !== "" || value.acsWindowSize !== "4" || value.browserHeader !== BROWSER_HEADER || value.browserJavascriptEnabled !== true)
         return "malformed_body";
     try {
         deviceBrowser({

package/dist/cse-body.js

@@ -4,6 +4,8 @@ import { substituteEncryptedFields } from './substitute.js';
 import { substituteMerchantHostedBody } from './merchant-hosted.js';
 import { fiservCapturePinId, isFiservCaptureHost, substituteFiservEnvelope } from './fiserv.js';
 import { substituteVerifoneBody } from './verifone.js';
+import { isToastHost } from './toast.generated.js';
+import { substituteToastCardData } from './toast-seal.generated.js';
 /**
  * The cse continuation: the paused body with the vault's ciphertext in place
  * of the dummy blobs. The adapters send it as postData ALONE. Chromium
@@ -44,6 +46,15 @@ export function cseBody(body, replay, url, preparation) {
     }
     if (isFiservCaptureHost(url))
         throw new Error('Refusing to substitute: a Fiserv capture continues only through a prepared Fiserv approval.');
+    // A request on Toast's payments host takes only Toast's own swap: the device's sealed card written over
+    // the paused card.cardData and no other byte, refused unless the paused body is still the frame's guest
+    // card request and the card is sealed under the key payment-core pins (toast-seal.js substituteToastCardData).
+    if (isToastHost(url)) {
+        if (replay.kind !== undefined || replay.substitutions.at !== 'card' || (replay.substitutions.remove ?? []).length > 0) {
+            throw new Error('Refusing to substitute: the paused request is not the Toast card request the cardholder approved.');
+        }
+        return substituteToastCardData(url, body, replay.substitutions.fields);
+    }
     // A merchant-hosted approval is written into the LIVE paused body, which must
     // still be the body the API checked at create (merchant-hosted.ts).
     if (replay.kind === 'merchant_hosted')

package/dist/ebanx.d.ts

@@ -75,7 +75,7 @@ export declare class EbanxFollowUps {
     stop(): void;
     /**
      * The approval the remembered token request went under, or null when none is remembered. The gate sends nothing
-     * unless the checkout's own state names this same approval (pre-claim.ts ebanxMaySend).
+     * unless the checkout's own state names this same approval (pre-claim.ts followUpMaySend).
      */
     get authorizationId(): string | null;
     /**

package/dist/ebanx.js

@@ -108,7 +108,7 @@ export class EbanxFollowUps {
     stop() { this.stopped = true; }
     /**
      * The approval the remembered token request went under, or null when none is remembered. The gate sends nothing
-     * unless the checkout's own state names this same approval (pre-claim.ts ebanxMaySend).
+     * unless the checkout's own state names this same approval (pre-claim.ts followUpMaySend).
      */
     get authorizationId() { return this.parent?.authorizationId ?? null; }
     /**

package/dist/eximbay.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Eximbay's payment window (secureapi.eximbay.com, the Korean gateway that takes foreign cards for Korean merchants),
+ * as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level or into a window it opens, to
+ * https://secureapi.eximbay.com/Gateway/BasicProcessor.krp (Eximbay's test host for a test merchant), and Eximbay
+ * answers with a page that posts itself, with the session's paramkey, into its window. That entry carries no card,
+ * and it is the one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and
+ * fills the card into the window Eximbay returns to it (payment-core processors/eximbay.js). Everything else the
+ * agent's browser posts to Eximbay follows the entry and leads to a card: the step that opens the window
+ * (/Gateway/BasicProcessor/230/NewGlobalStep1.jsp), the window's amount query and card lookup, which carries the
+ * card's first eight digits (controll/checkApprvJson.do, controll/checkCardBin.do), its card post
+ * (controll/checkApprv.jsp) and its other posts. This SDK aborts every one of them in a page it watches, so a
+ * placeholder card never reaches Eximbay from one. attachToCdp watches a window the merchant's page opens once it has
+ * armed that window. Eximbay's popup integration opens the window and posts the entry into it at once, so that entry
+ * can leave before the window is armed; the window's next post, the step, is then aborted like any other, and the
+ * checkout reads unsupported. attachToPlaywright routes the page alone, never a window it opens.
+ *
+ * EXIMBAY_HOSTS is payment-core's EXIMBAY_HOSTS, and isEximbayEntry takes the URLs payment-core's isEximbayEntryUrl
+ * takes; eximbay.test.mjs pins both to payment-core.
+ */
+export declare const EXIMBAY_PSP = "eximbay";
+/** The dark-launch capability the API serves Eximbay's recognizer behind (payment-core definitions.js). */
+export declare const EXIMBAY_CAPABILITY = "eximbay_hosted_payment_page";
+/** The live host and Eximbay's test host, which serves the same window for a test merchant. */
+export declare const EXIMBAY_HOSTS: readonly string[];
+/** Whether this URL is on one of Eximbay's two hosts. */
+export declare function isEximbayHost(url: string): boolean;
+/**
+ * The only request on Eximbay's hosts that is the merchant's entry: a POST to the entry path, written exactly as a
+ * browser posts a form to it, with no port, query or fragment (payment-core isEximbayEntryUrl takes those two strings
+ * only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isEximbayEntry(url: string, method: string): boolean;
+/** The entry URL on the same Eximbay host, which the registry recognizes when this build is armed for Eximbay, or null. */
+export declare function eximbayEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Eximbay host and this build's registry
+ * serves Eximbay's entry there. The step, the window's lookups and its card post are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to Eximbay once
+ * Eximbay is armed.
+ */
+export declare function isArmedEximbayUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/eximbay.js

@@ -0,0 +1,69 @@
+/**
+ * Eximbay's payment window (secureapi.eximbay.com, the Korean gateway that takes foreign cards for Korean merchants),
+ * as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level or into a window it opens, to
+ * https://secureapi.eximbay.com/Gateway/BasicProcessor.krp (Eximbay's test host for a test merchant), and Eximbay
+ * answers with a page that posts itself, with the session's paramkey, into its window. That entry carries no card,
+ * and it is the one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and
+ * fills the card into the window Eximbay returns to it (payment-core processors/eximbay.js). Everything else the
+ * agent's browser posts to Eximbay follows the entry and leads to a card: the step that opens the window
+ * (/Gateway/BasicProcessor/230/NewGlobalStep1.jsp), the window's amount query and card lookup, which carries the
+ * card's first eight digits (controll/checkApprvJson.do, controll/checkCardBin.do), its card post
+ * (controll/checkApprv.jsp) and its other posts. This SDK aborts every one of them in a page it watches, so a
+ * placeholder card never reaches Eximbay from one. attachToCdp watches a window the merchant's page opens once it has
+ * armed that window. Eximbay's popup integration opens the window and posts the entry into it at once, so that entry
+ * can leave before the window is armed; the window's next post, the step, is then aborted like any other, and the
+ * checkout reads unsupported. attachToPlaywright routes the page alone, never a window it opens.
+ *
+ * EXIMBAY_HOSTS is payment-core's EXIMBAY_HOSTS, and isEximbayEntry takes the URLs payment-core's isEximbayEntryUrl
+ * takes; eximbay.test.mjs pins both to payment-core.
+ */
+export const EXIMBAY_PSP = 'eximbay';
+/** The dark-launch capability the API serves Eximbay's recognizer behind (payment-core definitions.js). */
+export const EXIMBAY_CAPABILITY = 'eximbay_hosted_payment_page';
+/** The live host and Eximbay's test host, which serves the same window for a test merchant. */
+export const EXIMBAY_HOSTS = Object.freeze(['secureapi.eximbay.com', 'secureapi.test.eximbay.com']);
+const ENTRY_PATH = '/Gateway/BasicProcessor.krp';
+/** The Eximbay host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function eximbayHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return EXIMBAY_HOSTS.includes(host) ? host : null;
+}
+/** Whether this URL is on one of Eximbay's two hosts. */
+export function isEximbayHost(url) {
+    return eximbayHost(url) !== null;
+}
+/**
+ * The only request on Eximbay's hosts that is the merchant's entry: a POST to the entry path, written exactly as a
+ * browser posts a form to it, with no port, query or fragment (payment-core isEximbayEntryUrl takes those two strings
+ * only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isEximbayEntry(url, method) {
+    return String(method).toUpperCase() === 'POST' && EXIMBAY_HOSTS.some((host) => url === `https://${host}${ENTRY_PATH}`);
+}
+/** The entry URL on the same Eximbay host, which the registry recognizes when this build is armed for Eximbay, or null. */
+export function eximbayEntryUrl(url) {
+    const host = eximbayHost(url);
+    return host === null ? null : `https://${host}${ENTRY_PATH}`;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on an Eximbay host and this build's registry
+ * serves Eximbay's entry there. The step, the window's lookups and its card post are not the entry, so the registry's
+ * card-request test does not name them; the CDP adapter still pauses them through the recognizer's host pattern, and
+ * attachToPlaywright's route predicate asks this, so both adapters show the gates every request to Eximbay once
+ * Eximbay is armed.
+ */
+export function isArmedEximbayUrl(vault, url) {
+    const entry = eximbayEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}