@agent-cards/sdk 0.23.24 → 0.23.25

package/CHANGELOG.md

@@ -4,6 +4,10 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.25
+
+- Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.
+
 ## 0.23.24
 
 - Continue Tap Payments' card form with the card the cardholder's device encrypts, for a company Agentcard turned Tap on for (dark launch). Merchants in Kuwait, Saudi Arabia, the UAE, Bahrain, Qatar and Oman take cards on Tap's hosted checkout at `checkout.tap.company`, whose card frame encrypts the card under the merchant's own key and sends it to `https://sdk.tap.company/v2/card/token`. This build declares `tap_card_sdk_token` on every sync, and the API serves Tap's recognizer only for a company Agentcard listed for it, so every other company's Tap payments go through untouched, as for an unsupported processor. The token request does not decide the charge: Tap's checkout charges the order the merchant holds, so `authorize()` refuses a Tap request without `amount` above zero and `currency` (`AmountRequiredError`). Send the total Tap's page shows. Before it creates anything, the API refuses a request that asks Tap to keep the card (`invalid_tap_payments_request`), a merchant Agentcard has not reviewed for the checkout page (`unsupported_checkout`), a live merchant's card form on a test-mode client or the reverse (`tap_payments_environment_mismatch`), and a request whose order names your currency at another total (`amount_mismatch`). After the approval the SDK writes the device's ciphertext over the one your agent's page wrote, in that request alone, moves no other byte, and continues the page's own request. 3-D Secure and the merchant's charge then run in the agent's browser, where a challenge needs a person at that browser. The SDK refuses a request that is not byte for byte the one the cardholder approved, or that names another merchant key. The API serves the device's ciphertext only in the 10 minutes after the approval and deletes it once that window passes. A Tap payment also needs the matching API and Vault releases.
@@ -14,6 +18,8 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 - `attachToCdp` and `attachToPlaywright` record the answers Paddle's checkout service gives its frame (`POST /transaction-checkout`, `PATCH /transaction-checkout/<id>/`, `POST .../customer`), read-only and cut to the checkout's terms, and send the newest eight with a Paddle TokenEx create as `paddle_checkout`. The API holds `amount` to the total they state for today, so an agent that reports a free trial's renewal as today's price is refused with `amount_mismatch`. A free trial's create sends `amount: 0` with its currency; the approval then shows the renewal those answers state. A /pay that pauses before the newest answer's text is read waits up to a second for it, and a /pay that leaves while an answer is still loading sends no answers, so the API never reads an older answer's terms in place of the newest. No customer, address or seller detail from those answers leaves the browser. A runtime that intercepts on its own can build the same capture with the exported `PaddleCheckoutWatch`: it reports each answer to the watch as `sent`, `answered`, `finished` and `read`, awaits `capture(pausedAt, payUrl)` when the /pay pauses, and passes the result to `authorize()` as `paddleCheckout`.
 
+- Recognize Amazon Payment Services' custom merchant page behind a dark launch. `syncRegistry()` now declares the `aps_custom_merchant_page` capability (`SUPPORTED_CAPABILITIES`), and the API serves the recognizer only to an org Agentcard has enabled, so no other org's APS checkout changes. For an enabled org, the merchant page's own card form, posted top-level to `https://checkout.payfort.com/FortAPI/paymentPage` (`sbcheckout.payfort.com` on APS's sandbox), pauses for the cardholder's approval, and the page navigates on with APS's own answer: APS's page, which posts APS's fields to the form's return page, or APS's redirect to that page. `authorize()` hands over only an answer payment-core's judge reads as a token for the form it paused, and throws `PaymentOutcomeUnknownError` with reason `aps_answer_unconfirmed` for any other. The form names no amount, so `authorize()` throws `AmountRequiredError` unless you pass `amount` and `currency`, above zero. A payment also needs the matching API, checkout relay and Vault releases.
+
 ## 0.23.23
 
 - Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -375,6 +375,11 @@ Eximbay's window in a new window gets the pause only under `attachToCdp`, and
 only once the SDK has armed that window: an entry posted into a window the page
 opens in the same moment can leave first, and the SDK then fails the window's
 next post, so the checkout reads `unsupported` with no card sent.
+Barion's Smart Gateway (`barion_hosted_payment_page`) is served the same way:
+this build pauses the gateway link `secure.barion.com/Pay?Id=<payment id>` for
+the cardholder's device and fails every post a page it watches makes to the
+gateway. A merchant's server often sends the buyer to that link with a
+redirect, and only `attachToCdp` pauses a redirect.
 Revolut Business's card field (`revolut_card_field`) is served on the same
 terms: this build pauses the frame's card payment on `merchant.revolut.com`,
 the cardholder's device sends it to Revolut itself, and the frame gets

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/barion.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Barion's Smart Gateway (secure.barion.com, where Hungarian, Czech and Slovak shops send a buyer who pays by card), as
+ * this SDK reads it.
+ *
+ * The merchant's server starts the payment with Barion and sends the buyer's browser to the gateway URL Barion answered
+ * with, https://secure.barion.com/Pay?Id=<payment id>, by a redirect or by setting the page's location. That GET carries
+ * no card, no amount and no merchant, and it is the one request a build that declares Barion's capability pauses
+ * (hosted-entry.ts): the cardholder's device repeats it over the end-to-end TLS relay and makes the gateway's own posts
+ * in the session Barion opens (payment-core processors/barion.js). Every post the agent's browser would send the gateway
+ * to pay follows that entry and leads to a card: the email check, the card's 3-D Secure version post, the 3-D Secure
+ * post and the charge post (/Pay/CheckEmailAddress, /Pay/PrepareCardPaymentForGuest, /ThreeDs/Authenticate,
+ * /Pay/CompletePaymentAsGuestWithCard). A build that declares Barion aborts every one of them (pre-claim.ts), so a
+ * placeholder card never reaches Barion.
+ *
+ * BARION_HOSTS is payment-core's BARION_HOSTS, and isBarionEntryUrl is payment-core's isBarionEntryUrl; barion.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const BARION_PSP = "barion";
+/** The dark-launch capability the API serves Barion's recognizer behind (payment-core definitions.js). */
+export declare const BARION_CAPABILITY = "barion_hosted_payment_page";
+/** The gateway's two hosts: live, and Barion's test gateway, which runs the same gateway for Barion's test shops. */
+export declare const BARION_HOSTS: readonly string[];
+/**
+ * Whether a URL is the gateway URL exactly as the merchant's redirect writes it: https, one of the two gateway hosts in
+ * lowercase, the default port, no credentials or fragment, the path /Pay, and one query parameter, Id or id, holding the
+ * payment's id. The gateway acts on other parameters (its script starts a bank transfer by itself for a DefaultBankId),
+ * so a URL carrying any is not the entry, and neither is any other page or post of the gateway's host.
+ */
+export declare function isBarionEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on the gateway's hosts is a step toward paying there: any POST (the email check, the card's two
+ * posts, the 3-D Secure post, and any other form the gateway posts). The gateway's own pages, scripts and images, its
+ * 3-D Secure frames among them, are GETs of no card and are not one.
+ */
+export declare function isBarionPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a gateway host and this build's registry
+ * serves Barion's entry there. The gateway's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route
+ * predicate asks this, so both adapters show the gates every request to the gateway once Barion is armed.
+ */
+export declare function isArmedBarionUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/barion.js

@@ -0,0 +1,84 @@
+/**
+ * Barion's Smart Gateway (secure.barion.com, where Hungarian, Czech and Slovak shops send a buyer who pays by card), as
+ * this SDK reads it.
+ *
+ * The merchant's server starts the payment with Barion and sends the buyer's browser to the gateway URL Barion answered
+ * with, https://secure.barion.com/Pay?Id=<payment id>, by a redirect or by setting the page's location. That GET carries
+ * no card, no amount and no merchant, and it is the one request a build that declares Barion's capability pauses
+ * (hosted-entry.ts): the cardholder's device repeats it over the end-to-end TLS relay and makes the gateway's own posts
+ * in the session Barion opens (payment-core processors/barion.js). Every post the agent's browser would send the gateway
+ * to pay follows that entry and leads to a card: the email check, the card's 3-D Secure version post, the 3-D Secure
+ * post and the charge post (/Pay/CheckEmailAddress, /Pay/PrepareCardPaymentForGuest, /ThreeDs/Authenticate,
+ * /Pay/CompletePaymentAsGuestWithCard). A build that declares Barion aborts every one of them (pre-claim.ts), so a
+ * placeholder card never reaches Barion.
+ *
+ * BARION_HOSTS is payment-core's BARION_HOSTS, and isBarionEntryUrl is payment-core's isBarionEntryUrl; barion.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export const BARION_PSP = 'barion';
+/** The dark-launch capability the API serves Barion's recognizer behind (payment-core definitions.js). */
+export const BARION_CAPABILITY = 'barion_hosted_payment_page';
+/** The gateway's two hosts: live, and Barion's test gateway, which runs the same gateway for Barion's test shops. */
+export const BARION_HOSTS = Object.freeze(['secure.barion.com', 'secure.test.barion.com']);
+const ENTRY_PATH = '/Pay';
+// The payment's id, a GUID: 32 hexadecimal digits as the gateway URL writes it, or with its four dashes as Barion's PHP
+// library writes it, in either letter case.
+const PAYMENT_ID = /^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+// The entry's whole query: the one parameter Barion's GatewayUrl names (Id) or its PHP library names (id).
+const ENTRY_QUERY = /^\?(?:Id|id)=([^&=]{1,64})$/;
+// An id of that shape, for asking whether this build's registry serves the entry on a host.
+const PROBE_ID = '00000000000000000000000000000000';
+/**
+ * Whether a URL is the gateway URL exactly as the merchant's redirect writes it: https, one of the two gateway hosts in
+ * lowercase, the default port, no credentials or fragment, the path /Pay, and one query parameter, Id or id, holding the
+ * payment's id. The gateway acts on other parameters (its script starts a bank transfer by itself for a DefaultBankId),
+ * so a URL carrying any is not the entry, and neither is any other page or post of the gateway's host.
+ */
+export function isBarionEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256)
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || !BARION_HOSTS.includes(url.hostname) || url.pathname !== ENTRY_PATH
+        || url.port || url.username || url.password || url.href !== raw || raw.includes('#'))
+        return false;
+    const match = ENTRY_QUERY.exec(url.search);
+    return !!match && PAYMENT_ID.test(match[1]);
+}
+/** The gateway host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function barionHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return BARION_HOSTS.includes(host) ? host : null;
+}
+/**
+ * Whether a request on the gateway's hosts is a step toward paying there: any POST (the email check, the card's two
+ * posts, the 3-D Secure post, and any other form the gateway posts). The gateway's own pages, scripts and images, its
+ * 3-D Secure frames among them, are GETs of no card and are not one.
+ */
+export function isBarionPayStep(url, method) {
+    return barionHost(url) !== null && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a gateway host and this build's registry
+ * serves Barion's entry there. The gateway's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route
+ * predicate asks this, so both adapters show the gates every request to the gateway once Barion is armed.
+ */
+export function isArmedBarionUrl(vault, url) {
+    const host = barionHost(url);
+    return host !== null && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(`https://${host}${ENTRY_PATH}?Id=${PROBE_ID}`, 'GET');
+}

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 30277fd34048f75e9f6b6252d783092c471aca03a64462bb4f458f9417b8cc82
+// artifact-sha256: e6f7697efcf41d051189ca331d0d99f5a701e50cb0b7d3a3f967178bf87d7df1
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -3561,11 +3561,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var BODY_LIMIT22 = 8192;

package/dist/cdp.js

@@ -25,6 +25,7 @@ import { isArmedEkashuUrl } from './ekashu.js';
 import { isArmedTransbankUrl, transbankMerchantReturn, transbankMerchantReturnAnswer } from './transbank.js';
 import { isArmedRedsysUrl } from './redsys.js';
 import { isArmedPrzelewy24Url } from './przelewy24.js';
+import { isArmedBarionUrl } from './barion.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
 import { COMGATE_CARD_PATTERNS, isArmedComgateUrl, servesComgate } from './comgate.js';
 import { isArmedEximbayUrl } from './eximbay.js';
@@ -3980,6 +3981,9 @@ export async function attachToPlaywright(page, opts) {
             // the hosts: the card method's post, the card form's post and the Saferpay resolver reach the Przelewy24
             // gate and fail.
             || isArmedPrzelewy24Url(opts.vault, url.toString())
+            // Every request to Barion's gateway hosts once its entry is served (barion.ts), as attachToCdp arms the hosts:
+            // the gateway's email check, card posts and 3-D Secure post reach the Barion gate and fail.
+            || isArmedBarionUrl(opts.vault, url.toString())
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
             || isArmedEkashuUrl(opts.vault, url.toString())

package/dist/client.d.ts

@@ -499,6 +499,13 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
+ * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose email check, card posts and 3-D Secure post this build never lets the agent's browser
+ * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
+ * lists it, for a company Agentcard turned Barion on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];

package/dist/client.js

@@ -492,6 +492,13 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * amount, so the agent's pair, above zero, is the one the cardholder approves.
  * Served on the same terms: only to a build that lists it, for a company Agentcard turned APS on for.
  *
+ * `barion_hosted_payment_page`: Barion's Smart Gateway, whose card-free link
+ * (secure.barion.com/Pay?Id=<payment id>, a plain GET the merchant's redirect or script sends
+ * the buyer to) this build pauses for the cardholder's device by its exact link (hosted-entry.ts),
+ * and whose email check, card posts and 3-D Secure post this build never lets the agent's browser
+ * send (pre-claim.ts, barion.ts). Served on the same terms as Przelewy24's: only to a build that
+ * lists it, for a company Agentcard turned Barion on for.
+ *
  * The list itself is capabilities.json, sorted, one per line (scripts/generate-capabilities.mjs).
  */
 export const SUPPORTED_CAPABILITIES = DECLARED_CAPABILITIES;

package/dist/hosted-entry.js

@@ -17,10 +17,12 @@
 import { PRZELEWY24_PSP, isPrzelewy24EntryUrl } from './przelewy24.js';
 import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
 import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
+import { BARION_PSP, isBarionEntryUrl } from './barion.js';
 const HOSTED_GET_ENTRIES = new Map([
     [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
     [COMGATE_PSP, isComgateEntryUrl],
     [TRANSBANK_PSP, isTransbankEntryUrl],
+    [BARION_PSP, isBarionEntryUrl],
 ]);
 /** Whether this processor's hosted page is entered with a GET this build reads exactly. */
 export function hasHostedGetEntry(psp) {

package/dist/pre-claim.d.ts

@@ -279,6 +279,7 @@ export declare function isArmedCreditguardCall(vault: {
     recognizesProcessor?(psp: string): boolean;
 } | undefined, url: string): boolean;
 export declare const przelewy24PreClaim: PreClaimGate;
+export declare const barionPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const transbankPreClaim: PreClaimGate;
 export declare const paytrailPreClaim: PreClaimGate;

package/dist/pre-claim.js

@@ -85,6 +85,7 @@ import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { isArmedTransbankUrl } from './transbank.js';
 import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
 import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
+import { isArmedBarionUrl, isBarionPayStep } from './barion.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
 import { isArmedComgateUrl } from './comgate.js';
 import { isArmedEximbayUrl, isEximbayEntry } from './eximbay.js';
@@ -1663,6 +1664,22 @@ export const przelewy24PreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// Barion's Smart Gateway (barion.ts). Once this build's registry serves Barion's entry (a capability the API serves
+// only to a company Agentcard turned Barion on for), every request to the gateway's two hosts pauses. The merchant's
+// entry, a GET of /Pay?Id=<payment id> exactly, is no step of this gate's: it defers, and the terminal arbiter pauses
+// it for the claim flow like any card request, so the cardholder's device pays it. Every step toward paying on the
+// gateway itself aborts as an unsupported checkout: every POST there (the email check, the card's two posts, the 3-D
+// Secure post, any form the gateway posts). So Barion never sees the card the agent typed. The agent's browser only
+// reaches the gateway when the entry was not paused (an attachment made too late, say), and then only the cardholder's
+// device can pay. The gateway's own pages, scripts, images and 3-D Secure frames are GETs this gate leaves to
+// continue. With Barion not served, the gate defers, and every request continues as before. Synchronous until it
+// must abort, like every gate. Exported for the gate registry's tests.
+export const barionPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isBarionPayStep(url, method) || !isArmedBarionUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -2482,7 +2499,7 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, paypalHostedFieldsPreClaim,
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: edc05559c1ac8275ddd2aa2eef090ce7700c26b6f0c69a601c136bd19881cedf
+// artifact-sha256: 12785bf93affbf72e1c0f5b4a8b3dedecab36a87d1bfa2c16405bffa841432c6
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -3569,11 +3569,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var BODY_LIMIT22 = 8192;

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 4c352f016f43f7758a725419b405e045be30972b855e6400ae2dd3823c5265ab
+// artifact-sha256: d0cb72d4119895f1fa8110ae4048be399964c6ab62814a11527cc163b8cb70cd
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -3344,11 +3344,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;

package/dist/tokenex-iframe.generated.d.ts

@@ -7,11 +7,15 @@ declare var TOKENEX_IFRAME_REFUSAL_REASONS: readonly string[];
 declare var TOKENEX_IFRAME_BODY_KEYS: readonly string[];
 declare var TOKENEX_IFRAME_TOKEN_SCHEMES: readonly string[];
 declare var TOKENEX_IFRAME_REVIEWED_ACCOUNTS: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "https://www.jetblue.com";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>;
 declare var TOKENEX_IFRAME_ACCOUNT_NAMES: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "JetBlue";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>;
 declare function tokenexIframeTarget(url: any): {
@@ -37,20 +41,28 @@ declare function tokenexIframeAccount(request: any): {
     origin: any;
 } | null;
 declare function tokenexIframeAccountRefusal(request: any, accounts?: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "https://www.jetblue.com";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>): "unreviewed_account" | null;
 declare function tokenexIframeAccountName(request: any, accounts?: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "https://www.jetblue.com";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>, names?: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "JetBlue";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>): string | null;
 declare function tokenexIframeCardType(number: any): string | RegExp | null;
 declare function tokenexIframeBrandRefusal(body: any, card: any): "unsupported" | "brand_mismatch" | null;
 declare function tokenexIframeDeviceRefusal(request: any, card: any, accounts?: Readonly<{
-    "htp.tokenex.com": Readonly<{}>;
+    "htp.tokenex.com": Readonly<{
+        "9014311640612780": "https://www.jetblue.com";
+    }>;
     "test-htp.tokenex.com": Readonly<{}>;
 }>): "unsupported" | "brand_mismatch" | "unreviewed_account" | null;
 declare function tokenexIframeRefusalMessage(reason: any): string;

package/dist/tokenex-iframe.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 79eec39d9ea40ae7687f24e640623f854bc1c0754a2553663c0662bd6cb86218
+// artifact-sha256: 01596d96a2321c72cafdda7f9e60136ce5b46747178151f0878190aff8159ea2
 // src/tokenex-iframe.js
 var TOKENEX_IFRAME_PSP = "tokenex_iframe";
 var TOKENEX_IFRAME_CAPABILITY = "tokenex_iframe_tokenize";
@@ -32,11 +32,11 @@ var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
 ]);
 var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
 var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "https://www.jetblue.com" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
-    "htp.tokenex.com": Object.freeze({}),
+    "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
 var UNSUPPORTED_REFUSAL = "Refusing to pay: unsupported TokenEx card request.";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.24",
+  "version": "0.23.25",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "_comment_test": "check:built runs first and names the command when a file the build generates (the copies in src/, the preflight contracts in dist/, the Kernel inventory) is missing or stale; verify:pack runs last, on the same dist.",
     "check:built": "node scripts/generate-payment-core.mjs --check && node scripts/generate-voice-stream.mjs --check && node scripts/generate-url-masks.mjs --check && node scripts/generate-capabilities.mjs --check && node scripts/generate-agent-amount.mjs --check && node scripts/generate-preflight-contract.mjs --check && node scripts/generate-kernel-native-inventory.mjs --check",
     "verify:pack": "node scripts/verify-pack.mjs",
-    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
+    "test": "npm run check:built && node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs redsys.test.mjs quickpay.test.mjs paytrail.test.mjs paypal-hosted-fields.test.mjs paypal-card-forms.test.mjs cybersource-secure-acceptance.test.mjs ebanx.test.mjs payrexx.test.mjs payrexx-follow-ups.test.mjs payrexx-adapters.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs wix-payments.test.mjs hipay.test.mjs openpay.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs gravy.test.mjs paddle-vgs.test.mjs sbps.test.mjs hold.test.mjs paddle-tokenex.test.mjs lyra.test.mjs gopay.test.mjs paygent.test.mjs twoc2p.test.mjs tap-payments.test.mjs pay-nl.test.mjs toast.test.mjs redact-url.test.mjs hosted-entry.test.mjs comgate.test.mjs przelewy24.test.mjs tokenex-iframe.test.mjs transbank.test.mjs sumup.test.mjs clover.test.mjs eximbay.test.mjs xendit.test.mjs omise.test.mjs fastspring.test.mjs amazon-payment-services.test.mjs barion.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs browser-tests.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs && node scripts/verify-pack.mjs",
     "test:browser": "node browser-tests.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",