@agent-cards/sdk 0.23.22 → 0.23.24

package/dist/cdp.js

@@ -8,6 +8,7 @@ import { MERCADO_CHECKOUT_PATTERN } from './mercado-checkout.generated.js';
 import { JuspayCheckoutGate } from './juspay-gate.js';
 import { ACI_CHECKOUT_REUSED, AciGate, playwrightReplacesNavigationBody } from './aci.js';
 import { EprotectGate, classifyEprotectRequest, eprotectScriptAnswer } from './eprotect.js';
+import { SbpsGate, classifySbpsRequest, sbpsScriptAnswer } from './sbps.js';
 import { dispatchPreClaim, eventUrl, isArmedCreditguardCall, routesHipayVault } from './pre-claim.js';
 import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesGmo } from './gmo.js';
 import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
@@ -15,11 +16,13 @@ import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
 import { PADDLE_VGS_PAY_PATTERNS, PaddleVgsPayGate, isPaddleCheckoutService, recognizesPaddleVgs } from './paddle-vgs-pay.js';
 import { DatatransRepeats } from './datatrans.js';
 import { TokenexIframeRepeats, isArmedTokenexIframeUrl } from './tokenex-iframe.js';
+import { isArmedPaytrailUrl } from './paytrail.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
 import { paddleTokenexTokenContinuation } from './paddle-tokenex.js';
 import { twoC2pContinuation, twoC2pRetire } from './twoc2p.js';
+import { tapPaymentsContinuation } from './tap-payments.js';
 import { isArmedEkashuUrl } from './ekashu.js';
-import { isArmedTransbankUrl } from './transbank.js';
+import { isArmedTransbankUrl, transbankMerchantReturn, transbankMerchantReturnAnswer } from './transbank.js';
 import { isArmedRedsysUrl } from './redsys.js';
 import { isArmedPrzelewy24Url } from './przelewy24.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
@@ -37,6 +40,7 @@ import { replayTemplatedUrl, reviewedMerchantProfileUrlPatterns } from './mercha
 import { verifoneTemplatedUrl } from './verifone.js';
 import { MerchantHandoffWatch } from './merchant-handoff.js';
 import { MERCHANT_PAGE_WAIT_MS, MerchantTotalWatch } from './merchant-total-watch.js';
+import { PaddleCheckoutWatch } from './paddle-checkout-watch.js';
 import { hostedFormSubmittedPage } from './hosted-form.js';
 import { armSendWindow, failsAsNetworkError, preparedSendWindowMs, sendWindowProcessor } from './amadeus.js';
 import { HoldAnsweredError, HoldEndedError, HoldGate, HoldRefusedError, matchHoldOnlyRule } from './hold.js';
@@ -363,7 +367,7 @@ function cseAuthorizedDetail(replay, url, shijiCvv = null) {
  * processor takes cseContinuationBody (cse-body.ts cseBody), and `shijiCvv` and
  * `shijiCvvKeySequenceSha256` are null.
  */
-function cseContinuation(opts, url, body, replay, approved, preparation) {
+function cseContinuation(opts, url, body, replay, approved, preparation, headers) {
     const shiji = shijiStsTokenContinuation(url, body, replay.substitutions, approved, replay.kind === 'merchant_hosted' || replay.kind === 'verifone' ? undefined : replay.shijiStsCompanion);
     if (shiji)
         return { body: shiji.body, shijiCvv: shiji.cvv, shijiCvvKeySequenceSha256: shiji.cvvKeySequenceSha256 };
@@ -382,6 +386,13 @@ function cseContinuation(opts, url, body, replay, approved, preparation) {
         : null;
     if (twoc2p)
         return { body: twoc2p.body, shijiCvv: null, shijiCvvKeySequenceSha256: null };
+    // Tap writes one RSA ciphertext at the body root under the merchant's pinned key, which the generic Adyen swap refuses
+    // as no JWE, so it is dispatched by the token URL to substituteTapPayments (tap-payments.ts), only into the one request
+    // the approval was made for, and only while the request that continues names the merchant's publishable key the
+    // approved one named: the browser sends that request's own headers.
+    const tap = replay.kind === undefined ? tapPaymentsContinuation(url, body, headers, replay.substitutions, approved) : null;
+    if (tap)
+        return { body: tap.body, shijiCvv: null, shijiCvvKeySequenceSha256: null };
     return { body: cseContinuationBody(opts, body, replay, url, preparation), shijiCvv: null, shijiCvvKeySequenceSha256: null };
 }
 /**
@@ -1434,7 +1445,7 @@ function merchantAttempt(lifecycle, survives) {
     // known non-payment, so the prepared checkout ends failed with that reason, and a fresh attachment can
     // prepare again. Every other stop leaves the outcome unknown.
     const error = () => reason === 'amadeus_send_window_closed' || reason === 'secure_acceptance_send_window_closed'
-        || reason === 'wix_payments_send_window_closed' || reason === 'hipay_send_window_closed'
+        || reason === 'wix_payments_send_window_closed' || reason === 'hipay_send_window_closed' || reason === 'openpay_send_window_closed'
         ? new CheckoutPreparationError(lifecycle.getState().preparationId ?? null, reason)
         : new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, reason);
     const attempt = {
@@ -1641,6 +1652,22 @@ function eprotectResumedReplay(replay, request) {
         throw new PaymentOutcomeUnknownError(replay.authorizationId, 'eprotect_registration_unconfirmed');
     return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
 }
+/**
+ * SB Payment Service's token request, resumed by the business, on the same terms as eProtect's above. The read
+ * carries the token as the API stored it, which the paused <script> cannot run, so it gets the answer authorize()
+ * gives on the create path (client.ts): the token inside the callback the paused URL named, under a script type,
+ * and only a token payment-core's judge accepts for that URL. A read in any other mode never answers it either.
+ * The paused URL alone decides, whatever recognizer claimed it. Any other request's replay passes as it came, and
+ * a create's replay never comes here, so no answer is wrapped twice.
+ */
+function sbpsResumedReplay(replay, request) {
+    if (classifySbpsRequest(request.url, request.method)?.kind !== 'token_request')
+        return replay;
+    const answer = replay.mode === 'token' ? sbpsScriptAnswer(request.url, replay) : null;
+    if (replay.mode !== 'token' || !answer)
+        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'sbps_token_unconfirmed');
+    return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
+}
 /** The recogniser that claimed a paused request, by processor name, so a caller never re-matches the URL; null on a duck-typed vault without the read. */
 function recognizerNameOf(opts, url, method) {
     const read = opts.vault.recognizerOf;
@@ -1888,6 +1915,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     const payrexxFollowUps = new PayrexxFollowUps();
     const aci = new AciGate(opts.vault);
     const eprotect = new EprotectGate(opts.vault);
+    const sbps = new SbpsGate(opts.vault);
     // The merchant's follow-up request after a delivered Secure Acceptance reply (cybersource-secure-acceptance.ts).
     const secureAcceptanceFollowUpWatch = new SecureAcceptanceFollowUpWatch(opts.onEvent);
     lifecycle.abort.signal.addEventListener('abort', () => secureAcceptanceFollowUpWatch.end(), { once: true });
@@ -1997,6 +2025,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // The merchant's own total (merchant-total-watch.ts): its checkout responses, recorded
     // read-only from attach on, and the approval a hand-off answers, for the charge report.
     const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
+    // Paddle's own checkout answers (paddle-checkout-watch.ts), recorded read-only from attach on for a TokenEx /pay.
+    const paddleCheckout = new PaddleCheckoutWatch();
     // A reviewed card endpoint merchant's own record of the order (card-endpoint-facts.ts).
     const cardEndpointRecord = new CardEndpointFactsWatch();
     let handoffReplay = null;
@@ -2506,6 +2536,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 merchantTotal.sent(key, { method: params.request.method, url: params.request.url,
                     ...(typeof params.request.postData === 'string' ? { requestBody: params.request.postData } : {}),
                     ...(typeof params.loaderId === 'string' && params.loaderId ? { page: `${owner}:${params.loaderId}` } : {}) });
+                paddleCheckout.sent(key, { method: params.request.method, url: params.request.url });
                 cardEndpointRecord.sent(key, { method: params.request.method, url: params.request.url, resourceType: params.type ?? null, networkId: params.requestId });
             }
             if (matchesActive) {
@@ -2545,6 +2576,14 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((read) => merchantTotal.log.read(key, typeof read?.body === 'string'
                     ? (read.base64Encoded ? Buffer.from(read.body, 'base64').toString('utf8') : read.body) : null, completedAt), () => merchantTotal.log.read(key, null, completedAt));
             }
+            if (paddleCheckout.tracks(key)) {
+                // One of Paddle's checkout answers: stamped finished at once, so a /pay's pause waits for its text, then read
+                // and cut to the terms by the watch.
+                const completedAt = Date.now();
+                paddleCheckout.finished(key, completedAt);
+                cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((read) => paddleCheckout.read(key, typeof read?.body === 'string'
+                    ? (read.base64Encoded ? Buffer.from(read.body, 'base64').toString('utf8') : read.body) : null, completedAt), () => paddleCheckout.read(key, null, completedAt));
+            }
             if (payrails && payrailsAnswers.delete(requestKey(sessionId, params.requestId))
                 && !(Number(params.encodedDataLength) > PAYRAILS_INIT_BODY_LIMIT)) {
                 payrails.reading(cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((answer) => {
@@ -2559,6 +2598,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         }
         if (method === 'Network.responseReceived') {
             merchantTotal.log.answered(requestKey(sessionId, params.requestId), params.response?.status);
+            paddleCheckout.answered(requestKey(sessionId, params.requestId), params.response?.status);
             const recordKey = cardEndpointRecord.keyFor(requestKey(sessionId, params.requestId), params.requestId);
             if (recordKey)
                 cardEndpointRecord.answered(recordKey, params.response?.status);
@@ -2587,6 +2627,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 || (activeRequest && activeRequest.networkId === params.requestId && activeRequest.sourceSessionId === sessionId)))
                 holdGate.lost();
             merchantTotal.log.failed(requestKey(sessionId, params.requestId));
+            paddleCheckout.failed(requestKey(sessionId, params.requestId));
             const recordKey = cardEndpointRecord.keyFor(requestKey(sessionId, params.requestId), params.requestId);
             if (recordKey)
                 cardEndpointRecord.failed(recordKey);
@@ -2805,7 +2846,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // headers and body are read lazily, inside the gate that needs them (see PreClaimContext.request).
             request: { url: request.url, method: request.method, get headers() { return request.headers; }, get body() { return pausedBody(request); },
                 navigation: resourceType === 'Document' },
-            vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout, aci, eprotect,
+            vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout, aci, eprotect, sbps,
             // This adapter drives Chromium, which sends the body Fetch.continueRequest replaces on a
             // navigation (the ACI browser test's classic case, design gate G3).
             replacesNavigationBody: async () => true,
@@ -3105,6 +3146,10 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // The merchant's own record of the order, as of the pause, for a profile that reads one.
             const cardRecord = cardEndpoint ? await cardEndpointFacts(cardEndpointRecord, cardEndpoint, request.url, pausedAt, attempt.signal) : null;
             attempt.assertLive();
+            // Paddle's own checkout answers as of the pause, once the texts of those that finished before it are read
+            // (a Billing /pay only; sent only with a Paddle TokenEx create, which a pause-only business makes itself).
+            const paddleAnswers = opts.pauseOnly ? undefined : await paddleCheckout.capture(pausedAt, request.url, attempt.signal);
+            attempt.assertLive();
             // Hold mode: nothing is created until the person's total releases the request (hold.ts).
             if (holdGate) {
                 if (holdGate.state !== 'watching') {
@@ -3160,6 +3205,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // What the merchant's own checkout said its total was, as this browser recorded it
                 // (read only for a reviewed profile priced by it): the page is the card request's.
                 merchantTotal: merchantTotal.capture(pausedAt, cardPage),
+                // Paddle's own checkout answers, as this browser recorded them (sent only with a Paddle TokenEx create).
+                paddleCheckout: paddleAnswers,
                 onAuthorizationCreated: (id) => {
                     lifecycle.approvalCreated(id);
                     if (holdSandbox && !holdRequestFailed) {
@@ -3191,7 +3238,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 holdRelease.settle(outcome);
                 throw new HoldAnsweredError(outcome);
             }
-            const replay = pause ? eprotectResumedReplay(await pause.replay, request) : await authorization;
+            const replay = pause ? sbpsResumedReplay(eprotectResumedReplay(await pause.replay, request), request) : await authorization;
             attempt.assertLive();
             approvedId = replay.authorizationId;
             if (lifecycle.isCancelled())
@@ -3241,8 +3288,14 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // answered the device. The paused NAVIGATION is fulfilled with a page
                 // that says exactly that (see hosted-form.ts for why not an abort and
                 // why not a fake result page), and the same form is refused if the
-                // page posts it again.
-                const page = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
+                // page posts it again. A Webpay entry whose reviewed shop names its
+                // return page goes to that page instead, with the token of the link
+                // the approval was created from, the one the phone paid, since Webpay
+                // tells the shop of a payment only through that return (transbank.ts
+                // transbankMerchantReturn).
+                const merchantReturn = transbankMerchantReturn(request.url, pageOrigin);
+                const page = merchantReturn ? transbankMerchantReturnAnswer(merchantReturn)
+                    : hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
                 // A navigation response is never CORS-checked, so the CORS wrap is
                 // inert here; it is applied so every fulfill goes through one path.
                 await cdp.send('Fetch.fulfillRequest', {
@@ -3254,8 +3307,10 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 attempt.assertLive();
                 lastSubmitted = { url: deliverRequest.url, body: deliverBody, at: Date.now(), authorizationId: replay.authorizationId };
                 // Named for what it is: a device-attested submission with no
-                // processor evidence, never an `authorized` event.
-                opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
+                // processor evidence, never an `authorized` event. A return names the
+                // shop's host, never the URL, which carries Webpay's token.
+                opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome,
+                        ...(merchantReturn ? { merchantReturn: { host: new URL(merchantReturn).hostname } } : {}) } });
             }
             else if (replay.mode === 'cse') {
                 // The device encrypted the card for the processor; the request itself
@@ -3272,7 +3327,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // companion cannot arrive first, and dropped if the continue fails.
                 // Both go only to the request the approval was created from, from the
                 // frame that sent it (cseContinuation refuses any other body).
-                const continuation = cseContinuation(opts, deliverRequest.url, deliverBody, replay, { url: request.url, body }, preparation);
+                const continuation = cseContinuation(opts, deliverRequest.url, deliverBody, replay, { url: request.url, body, headers: request.headers }, preparation, deliverRequest.headers);
                 const postData = Buffer.from(continuation.body).toString('base64');
                 if (continuation.shijiCvv !== null) {
                     shijiCompanions.bind({ url: request.url, method: request.method, body }, cdpShijiPage(sessionId, frameId), continuation.shijiCvv, continuation.shijiCvvKeySequenceSha256 ?? []);
@@ -3572,6 +3627,7 @@ export async function attachToPlaywright(page, opts) {
     const aci = new AciGate(opts.vault);
     let navigationBodyReplaced;
     const eprotect = new EprotectGate(opts.vault);
+    const sbps = new SbpsGate(opts.vault);
     // The merchant's follow-up request after a delivered Secure Acceptance reply (cybersource-secure-acceptance.ts).
     const secureAcceptanceFollowUpWatch = new SecureAcceptanceFollowUpWatch(opts.onEvent);
     lifecycle.abort.signal.addEventListener('abort', () => secureAcceptanceFollowUpWatch.end(), { once: true });
@@ -3601,6 +3657,8 @@ export async function attachToPlaywright(page, opts) {
     // but sends no document request, so it keeps the page id, as CDP's loaderId does. Nor does
     // a document request that commits nothing: one that failed, or one answered 204 or 205.
     const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
+    // Paddle's own checkout answers, as attachToCdp records them (paddle-checkout-watch.ts).
+    const paddleCheckout = new PaddleCheckoutWatch();
     // A reviewed card endpoint merchant's own record of the order (card-endpoint-facts.ts).
     const cardEndpointRecord = new CardEndpointFactsWatch();
     let documentSerial = 1;
@@ -3662,6 +3720,10 @@ export async function attachToPlaywright(page, opts) {
                 ...(typeof body === 'string' ? { requestBody: body } : {}), page: `doc:${documentSerial}` });
         }
         catch { /* a request the page already dropped */ }
+        try {
+            paddleCheckout.sent(keyOf(request), { method: request.method(), url: request.url() });
+        }
+        catch { /* a request the page already dropped */ }
         try {
             cardEndpointRecord.sent(keyOf(request), { method: request.method(), url: request.url(),
                 resourceType: typeof request.resourceType === 'function' ? request.resourceType() : null });
@@ -3703,6 +3765,28 @@ export async function attachToPlaywright(page, opts) {
                 cardEndpointRecord.read(key, text, finishedAt);
             }).catch(() => cardEndpointRecord.failed(key));
         }
+        if (paddleCheckout.tracks(key)) {
+            // One of Paddle's checkout answers: stamped finished at once, so a /pay's pause waits for its text, then its
+            // status and its text, cut to the terms by the watch.
+            const answeredAt = Date.now();
+            paddleCheckout.finished(key, answeredAt);
+            Promise.resolve().then(async () => {
+                const response = await request.response();
+                if (!response) {
+                    paddleCheckout.failed(key);
+                    return;
+                }
+                paddleCheckout.answered(key, response.status());
+                let text = null;
+                try {
+                    text = await response.text();
+                }
+                catch {
+                    text = null;
+                }
+                paddleCheckout.read(key, text, answeredAt);
+            }).catch(() => paddleCheckout.failed(key));
+        }
         if (!merchantTotal.log.tracks(key))
             return;
         const completedAt = Date.now();
@@ -3772,6 +3856,7 @@ export async function attachToPlaywright(page, opts) {
         if (request === documentRequest)
             documentRequest = null;
         merchantTotal.log.failed(keyOf(request));
+        paddleCheckout.failed(keyOf(request));
         cardEndpointRecord.failed(keyOf(request));
         if (activeRequest && activeRequest.request === request && activeRequest.attempt.lose()) {
             // The page's own script gave up on its request; the cardholder's
@@ -3873,6 +3958,9 @@ export async function attachToPlaywright(page, opts) {
             || opts.vault.isCardRequest(url.toString(), 'GET')
             || guards.matches(url.toString()) || stripeCheckout.matches(url.toString()) || mercadoCheckout.matches(url.toString())
             || eprotect.matches(url.toString())
+            // SB Payment Service's token request is a GET too, so its family is routed by the SBPS gate (never
+            // its scripts or the 3-D Secure info request).
+            || sbps.matches(url.toString())
             // An armed merchant profile's endpoint or a sibling of it (merchant-hosted.ts), as attachToCdp arms it.
             || (typeof opts.vault.merchantProfileOf === 'function' && opts.vault.merchantProfileOf(url.toString()) !== null)
             // An armed Verifone merchant's origin (verifone.ts), as attachToCdp arms it.
@@ -3898,6 +3986,10 @@ export async function attachToPlaywright(page, opts) {
             // Every request to a Webpay host once its entry is served (transbank.ts), as attachToCdp arms the hosts: the
             // token's submit and Webpay's card steps reach the Webpay gate and fail, and the entry pauses.
             || isArmedTransbankUrl(opts.vault, url.toString())
+            // Every request to Paytrail's entry host and Payment Highway's card page host once Paytrail's entry is served
+            // (paytrail.ts), as attachToCdp arms the recognizer's host and its abort host: the loading page's post and the
+            // card page's card requests reach the Paytrail gate and fail.
+            || isArmedPaytrailUrl(opts.vault, url.toString())
             // A CreditGuard page's own calls beside its submit (its card lookup and its 3-D Secure calls), for an
             // org the API served CreditGuard to, as attachToCdp arms its hosts: the CreditGuard gate answers them
             // under a ready preparation and lets them go on with none (pre-claim.ts isArmedCreditguardCall).
@@ -3965,7 +4057,7 @@ export async function attachToPlaywright(page, opts) {
                     catch {
                         return false;
                     } } },
-                vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout, aci, eprotect,
+                vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout, aci, eprotect, sbps,
                 // Asked once, and only for ACI's classic-mode /payment: whether this page's engine sends
                 // the body route.continue replaces on a navigation (aci.ts playwrightReplacesNavigationBody).
                 replacesNavigationBody: () => (navigationBodyReplaced ??= playwrightReplacesNavigationBody(page)),
@@ -4257,6 +4349,9 @@ export async function attachToPlaywright(page, opts) {
                 // The merchant's own record of the order, as of the pause (see attachToCdp).
                 const cardRecord = cardEndpoint ? await cardEndpointFacts(cardEndpointRecord, cardEndpoint, request.url(), pausedAt, attempt.signal) : null;
                 assertRequestLive();
+                // Paddle's own checkout answers as of the pause, once their texts are read (see attachToCdp).
+                const paddleAnswers = await paddleCheckout.capture(pausedAt, request.url(), attempt.signal);
+                assertRequestLive();
                 const replay = await opts.vault.authorize({
                     user: opts.user,
                     merchant: opts.merchant,
@@ -4276,6 +4371,8 @@ export async function attachToPlaywright(page, opts) {
                     merchantSignal: attempt.signal,
                     // Same as the CDP path: the merchant's total as this browser recorded it.
                     merchantTotal: merchantTotal.capture(pausedAt, pausedPage),
+                    // And Paddle's own checkout answers, as this browser recorded them.
+                    paddleCheckout: paddleAnswers,
                     onAuthorizationCreated: (id) => lifecycle.approvalCreated(id),
                     onApprovalUrl: (url) => { if (!preparation && !attempt.signal.aborted) {
                         lifecycle.approvalUrl(url);
@@ -4323,13 +4420,17 @@ export async function attachToPlaywright(page, opts) {
                 }
                 else if (replay.mode === 'hosted_form') {
                     // Same as the CDP path: the paused navigation resolves to the
-                    // synthetic page, and a re-post of this form is refused.
-                    const synthetic = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
+                    // synthetic page, or a reviewed Webpay shop's return page, and a
+                    // re-post of this form is refused.
+                    const merchantReturn = transbankMerchantReturn(request.url(), pageOrigin);
+                    const synthetic = merchantReturn ? transbankMerchantReturnAnswer(merchantReturn)
+                        : hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
                     // Inert on a navigation (never CORS-checked); one path for every fulfill.
                     await deliverTo.fulfill({ status: synthetic.status, headers: withCorsHeaders(synthetic.headers, corsHeadersFor(deliverRequest.url(), deliverRequest.headers())), body: synthetic.body });
                     assertRequestLive();
                     lastSubmitted = { url: deliverRequest.url(), body: deliverBody, at: Date.now(), authorizationId: replay.authorizationId };
-                    opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
+                    opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome,
+                            ...(merchantReturn ? { merchantReturn: { host: new URL(merchantReturn).hostname } } : {}) } });
                 }
                 else if (replay.mode === 'cse') {
                     // Same as the CDP path: the request continues from this browser
@@ -4342,7 +4443,7 @@ export async function attachToPlaywright(page, opts) {
                     // A Shiji STS getTokenId binds the device's cvv to its companion
                     // first, exactly as in attachToCdp: only for the request the
                     // approval was created from, and its frame.
-                    const continuation = cseContinuation(opts, deliverRequest.url(), deliverBody, replay, { url: request.url(), body }, preparation);
+                    const continuation = cseContinuation(opts, deliverRequest.url(), deliverBody, replay, { url: request.url(), body, headers: request.headers() }, preparation, deliverRequest.headers());
                     if (continuation.shijiCvv !== null) {
                         // The document the getTokenId paused in. One that cannot be read leaves the CVV nowhere to
                         // go, so the card is not tokenized either.

package/dist/client.d.ts

@@ -6,6 +6,7 @@ import { type PreparationMode, type PreparationProcessor } from './prepared-proc
 import { type VerifoneProfile, type VerifoneSubstitutions } from './verifone.js';
 import { type MerchantSessionCapture } from './merchant-session-probe.js';
 import { type PaddleTokenexServedFacts } from './paddle-tokenex.js';
+import type { PaddleCheckoutCapture } from './paddle-checkout-watch.js';
 import { VoiceModule, type VoiceOptions } from './voice.js';
 import { BuyModule } from './buy.js';
 import { RequestRegistry } from './requests.js';
@@ -211,6 +212,12 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * never lets the agent's browser post to (pre-claim.ts, redsys.ts). Served on the same terms as NMI's: only
  * to a build that lists it, for a company Agentcard turned Redsys on for.
  *
+ * `paytrail_hosted_payment_page`: Paytrail's card method, whose card-free signed Visa and Mastercard
+ * entry this build pauses for the cardholder's device, and whose loading page post, card page posts and
+ * card-number lookup on Payment Highway's host this build never lets the agent's browser send
+ * (pre-claim.ts, paytrail.ts). Served on the same terms as NMI's and Redsys's: only to a build that lists
+ * it, for a company Agentcard turned Paytrail on for.
+ *
  * `paddle_vgs_cards`: the card request Paddle's checkout frame sends to its VGS card
  * vault (vault.paddle.com/cards) on a checkout that names VGS, only through a prepared
  * checkout: the frame aborts the request 10 seconds after Pay and sends it once more,
@@ -327,8 +334,8 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * This build pauses only the form's own multipart body at that exact URL; the cardholder's
  * device sends the card through the checkout relay, and the frame gets the token answer
  * payment-core's judge rebuilt, with the CORS answer for the frame's own origin, null. The
- * request names no amount, so the agent's pair, above zero, is the one the cardholder approves
- * (PAY_NL_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * request names no amount, so the agent's pair, above zero, is the one the cardholder approves.
+ * Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Pay. on for.
  *
  * `paypal_card_fields`: PayPal Card Fields' confirm, the POST its v5 frame sends to
@@ -396,8 +403,8 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * encrypted under Clover's key. This build pauses only the frame's own body at that exact URL; the
  * cardholder's device builds the request again with the real card under the key payment-core pins
  * and sends it to Clover itself, and the frame gets the token answer payment-core's judge rebuilt.
- * The request names no amount, so the agent's pair, above zero, is the one the cardholder approves
- * (CLOVER_PSP below). Served on the same terms: only to a build that lists it, for a company
+ * The request names no amount, so the agent's pair, above zero, is the one the cardholder approves.
+ * Served on the same terms: only to a build that lists it, for a company
  * Agentcard turned Clover on for.
  *
  * `eximbay_hosted_payment_page`: Eximbay's payment window, whose card-free signed entry
@@ -415,6 +422,84 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * this build writes it over the agent's placeholder and nothing else before it
  * continues the request. Served on the same terms: only to a build that lists it, for
  * a company Agentcard turned Toast on for.
+ *
+ * `xendit_card_token`: the card token request Xendit's hosted invoice checkout
+ * (checkout.xendit.co/web/<invoice id>, where Xendit's payment and donation links land) sends
+ * when the payer presses Pay Now: Xendit.js posts the card as JSON to
+ * https://api.xendit.co/v2/credit_card_tokens from the page itself, under the business's
+ * publishable key. This build pauses only the card form's single-use token body at that exact URL
+ * (payment-core xendit.js); a token that keeps the card on file, Xendit.js's code-only storeCVN post
+ * and any other body there fail in the browser before anything is created. The cardholder's device
+ * sends the request itself with the real card, and the page gets the token answer payment-core's
+ * judge rebuilt, after which the page runs 3-D Secure and charges the token without the card. The
+ * token names the invoice's amount and currency, so no agent pair is needed: the API reads the
+ * token's and holds an agent's pair to it. Served on the same terms: only to a build that lists it,
+ * for a company Agentcard turned Xendit on for.
+ *
+ * `omise_card_token`: the card token request every Omise card form sends, Omise.js's pay.html frame
+ * or a merchant's own page calling Omise.js or Omise's Node library: a JSON POST to
+ * https://vault.omise.co/tokens under the merchant's public key. This build pauses only the card
+ * form's token body at that exact URL (payment-core omise.js); a wallet's tokenization and any other
+ * body there fail in the browser before anything is created. The cardholder's device sends the
+ * request itself with the real card, and the page gets the token answer payment-core's judge
+ * rebuilt. The request names no amount, so the agent's pair, above zero, is the one the cardholder
+ * approves, and the API pays only a merchant payment-core pins for the checkout
+ * page the create names. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned Omise on for.
+ *
+ * `sbps_token_jsonp`: SB Payment Service's card token request, the JSONP <script>
+ * GET its token script sends to /token/generateToken on token.sps-system.com. This
+ * build pauses it only as the browser writes it, aborts any other request on that
+ * path, and answers the paused script with the token as the API recorded it, in the
+ * request's own callback. The device rebuilds the card's ciphertext and sends it
+ * through the checkout relay. Served on the same terms: only to a build that lists
+ * it, for a company Agentcard turned SB Payment Service on for.
+ *
+ * `midtrans_card_token`: the card token Midtrans' Snap popup posts as one JSON request to
+ * api.midtrans.com/v2/token (api.sandbox.midtrans.com in test), under the business's
+ * publishable client key. The cardholder's device sends it and the page gets back Midtrans'
+ * token, which the merchant's own server charges afterwards, card free, running 3-D Secure
+ * there. The token names no amount, so authorize() needs the agent's pair.
+ * Served on the same terms, and the API holds the lane to Agentcard's own company
+ * until a reviewed change binds the client key to the merchant.
+ *
+ * `tap_card_sdk_token`: the token request Tap Payments' card frame sends to sdk.tap.company, carrying
+ * the card only as one ciphertext the frame writes under the merchant's own RSA key. This build pauses
+ * it and writes over the placeholder's ciphertext the one the cardholder's device wrote under the key
+ * payment-core pins for the request's publishable key (tap-payments.ts), into that request alone; 3-D
+ * Secure and the merchant's charge then run in the agent's browser. Served on the same terms: only to
+ * a build that lists it, for a company Agentcard turned Tap on for.
+ *
+ * `fastspring_card_payment`: the card payment FastSpring's checkout posts, on every store's own
+ * host, to <store>.onfastspring.com[/popup-<name>]/session/<id>/payment under the session's
+ * X-Session-Token. This build pauses only the checkout's own card body at that exact URL (a card
+ * FastSpring saved, a renewal, a gift, a tax id's second card send and a CAPTCHA answer are refused
+ * at the pause, and another method's payment with no card continues); the cardholder's device writes
+ * the real card into the paused body and sends it through the checkout relay, and the checkout gets
+ * FastSpring's answer as payment-core's judge rebuilt it. The request names no amount, so the agent's
+ * pair, above zero, is the total the checkout shows. Served on the same terms:
+ * only to a build that lists it, for a company Agentcard turned FastSpring on for.
+ *
+ * `openpay_tokenizer`: the token create openpay.js sends from a merchant's own page to
+ * api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe; sandbox-api for a test
+ * row), only through a prepared checkout: openpay.js abandons the request 40 seconds after Pay, so
+ * the cardholder approves before Pay. The token URL names the merchant, so the claim binds the
+ * request by its host's environment and its shape, never by the prepared URL. The cardholder's
+ * device sends the card to Openpay itself and the page gets back Openpay's token alone, rebuilt by
+ * payment-core's judge. The request names no amount, so the agent's pair, above zero
+ * (agent-amount-processors.json), is the one the cardholder approves. Served on the same terms: only
+ * to a build that lists it, for a company Agentcard turned Openpay on for.
+ *
+ * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
+ * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
+ * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's
+ * phone sends the form with the real card through the checkout relay, and the paused navigation
+ * gets APS's own answer, its page or its redirect to the form's return page, only as payment-core's
+ * judge reads it for that form (amazon-payment-services.ts apsNavigationAnswer). The form names no
+ * amount, so the agent's pair, above zero, is the one the cardholder approves.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
+ *
+ * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -599,7 +684,10 @@ export interface VerifoneReplay extends ExecutionMetadata {
  * paused the navigation, so there is no response to replay and no outcome
  * here: resolve the paused navigation with hostedFormSubmittedPage() (the
  * adapters do), never resubmit the form, and confirm the order with the
- * merchant, which learns the outcome from the processor.
+ * merchant, which learns the outcome from the processor. Webpay's merchant
+ * learns it only from the buyer's browser, so the adapters send a paused
+ * Webpay entry whose reviewed shop names its return page to that page instead
+ * (transbankMerchantReturn).
  *
  * THIS IS NOT AN APPROVED PAYMENT. `kind` and `outcome` say so in words so
  * no caller mistakes it for one: the API finishes such an authorization as
@@ -913,6 +1001,13 @@ export interface AuthorizeInput extends ExecutionMetadata {
      * one from its network events, or the payment is refused before any create.
      */
     merchantTotal?: MerchantTotalCapture;
+    /**
+     * For a Paddle TokenEx /pay: when it paused and the answers Paddle's checkout service gave the frame before it,
+     * as this browser recorded them (see paddle-checkout-watch.ts). The adapters pass it, and it rides the create only
+     * for that processor. The API holds `amount` to the total they state for today, and admits a free trial's $0.00
+     * only on them; without them a $0.00 Paddle create is refused as before.
+     */
+    paddleCheckout?: PaddleCheckoutCapture;
 }
 export declare class CardEncryptedError extends Error {
     psp: string;
@@ -1363,6 +1458,9 @@ export declare class CheckoutAuthError extends Error {
  * https://payment.quickpay.net/{session}/3ds_auth.
  * On FastSpring's store hosts the session id reads `{session}`:
  * https://daisydisk.onfastspring.com/session/{session}/payment.
+ * On PayU Latam's hosts the checkout session's key reads `{key}`:
+ * https://checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/co/credit_card/{key}.
+ * Each mask in src/url-masks/ says what it reads in its own file.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked for every processor whose host it names.
  * A URL is read by its host only when the parser finds one. Text before a URL
@@ -1571,9 +1669,10 @@ export declare class VaultClient {
      * capability (syncRegistry does), so before a sync, or against an API that
      * withheld it, the adapters leave that processor's traffic exactly as they
      * found it. prepare() asks this for ACI, whose card-number request names a
-     * checkout id the merchant mints only at Pay time, and for a processor whose
-     * card request is a GET (Worldpay eProtect), since that request is recognized
-     * by a query the page has not written yet.
+     * checkout id the merchant mints only at Pay time, for Openpay, whose token
+     * URL names the merchant's own id, and for a processor whose card request is
+     * a GET (Worldpay eProtect), since that request is recognized by a query the
+     * page has not written yet.
      */
     recognizesProcessor(psp: string): boolean;
     /**