@agent-cards/sdk 0.23.24 → 0.23.26

package/CHANGELOG.md

@@ -4,6 +4,18 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.23.26
+
+- Pause Paymob's card payment for the cardholder's device. Paymob's own checkout in Egypt, the UAE, Saudi Arabia and Oman, Unified Checkout on `<country>.checkout.paymob.com` (where Paymob's payment links and its WooCommerce redirects land) and the Pixel card frame a merchant's page embeds, posts the card as JSON to `https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay` with the merchant's payment key. The sync now also asks for `capabilities=paymob_checkout_pay`, and the API serves Paymob's recognizer only for a company Agentcard turned Paymob on for. The SDK pauses only the card form's own payment at that exact URL: a card Paymob saved, a payment that keeps the card, pays in installments, splits the amount, converts its currency or names a Paymob account, and a payment key that enrolls a subscription or names no amount are refused at the pause, and another method's payment with no card (a wallet, Apple Pay, cash) continues to Paymob untouched. The cardholder's device sends the payment to Paymob itself with the real card, and the checkout gets Paymob's answer and runs 3-D Secure in the agent's browser. The payment key names the amount and currency, so `amount` and `currency` are optional; a pair you pass must match the key's. The API and the Vault already carry Paymob's side. Paymob stays off for every company Agentcard has not turned it on for.
+
+- Pay a PayU Latam WebCheckout card payment from the cardholder's device, for a company Agentcard turns PayU Latam on for (dark launch). The SDK declares `payu_latam_webcheckout_card` and pauses the card submit PayU's checkout page posts to `checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`; the cardholder's device writes the real card into it and sends it to PayU, and the page gets PayU's answer. The submit names no price PayU charges, so pass `amount` and `currency`, above zero: the total PayU's page shows. Without them, `authorize()` throws `AmountRequiredError` and nothing is created.
+
+- Stop continuing Tap Payments' card token request for any merchant. Casefilegame, the Bahrain store that was the one Tap merchant Agentcard had reviewed, is no longer listed: since 2026-10-22 every page of that store shows a fake security check that tells a Mac visitor to open Terminal and paste a command. This build's copy of Agentcard's checkout rules lists no Tap merchant, so the SDK writes the device's ciphertext into no Tap token request, and an approved one fails in the agent's browser instead of continuing. The API already refuses the create for a Tap card form with `unsupported_checkout` (reason `tap_payments_merchant_unreviewed`) before anyone is asked, whatever SDK version sends it. Every other processor is unchanged.
+
+## 0.23.25
+
+- Pause Barion's Smart Gateway (where Hungarian, Czech and Slovak shops send a buyer who pays by card) for the cardholder's device. The sync now also asks for `capabilities=barion_hosted_payment_page`, and the API serves Barion's recognizer only for a company Agentcard turned Barion on for. The SDK pauses the gateway link, `https://secure.barion.com/Pay?Id=<payment id>` (or `secure.test.barion.com` for a test payment), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The API takes a Barion entry only from the checkout page of a shop Agentcard reviewed, the page the SDK names as `checkout_origin`. The link names no amount, so send the total Barion's gateway shows, with its currency: `authorize()` throws `AmountRequiredError` without it, and the API refuses a create without one (`amount_required`). A merchant's server usually sends the buyer to the gateway with a redirect, and only `attachToCdp` pauses a redirect, so attach to a Barion checkout with `attachToCdp`. Every post a page the SDK watches makes to the gateway, such as its email check and its card posts, leads to a card: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required, and no Barion shop is reviewed yet. Barion stays off for every company Agentcard has not turned it on for.
+
 ## 0.23.24
 
 - Continue Tap Payments' card form with the card the cardholder's device encrypts, for a company Agentcard turned Tap on for (dark launch). Merchants in Kuwait, Saudi Arabia, the UAE, Bahrain, Qatar and Oman take cards on Tap's hosted checkout at `checkout.tap.company`, whose card frame encrypts the card under the merchant's own key and sends it to `https://sdk.tap.company/v2/card/token`. This build declares `tap_card_sdk_token` on every sync, and the API serves Tap's recognizer only for a company Agentcard listed for it, so every other company's Tap payments go through untouched, as for an unsupported processor. The token request does not decide the charge: Tap's checkout charges the order the merchant holds, so `authorize()` refuses a Tap request without `amount` above zero and `currency` (`AmountRequiredError`). Send the total Tap's page shows. Before it creates anything, the API refuses a request that asks Tap to keep the card (`invalid_tap_payments_request`), a merchant Agentcard has not reviewed for the checkout page (`unsupported_checkout`), a live merchant's card form on a test-mode client or the reverse (`tap_payments_environment_mismatch`), and a request whose order names your currency at another total (`amount_mismatch`). After the approval the SDK writes the device's ciphertext over the one your agent's page wrote, in that request alone, moves no other byte, and continues the page's own request. 3-D Secure and the merchant's charge then run in the agent's browser, where a challenge needs a person at that browser. The SDK refuses a request that is not byte for byte the one the cardholder approved, or that names another merchant key. The API serves the device's ciphertext only in the 10 minutes after the approval and deletes it once that window passes. A Tap payment also needs the matching API and Vault releases.
@@ -14,6 +26,8 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 - `attachToCdp` and `attachToPlaywright` record the answers Paddle's checkout service gives its frame (`POST /transaction-checkout`, `PATCH /transaction-checkout/<id>/`, `POST .../customer`), read-only and cut to the checkout's terms, and send the newest eight with a Paddle TokenEx create as `paddle_checkout`. The API holds `amount` to the total they state for today, so an agent that reports a free trial's renewal as today's price is refused with `amount_mismatch`. A free trial's create sends `amount: 0` with its currency; the approval then shows the renewal those answers state. A /pay that pauses before the newest answer's text is read waits up to a second for it, and a /pay that leaves while an answer is still loading sends no answers, so the API never reads an older answer's terms in place of the newest. No customer, address or seller detail from those answers leaves the browser. A runtime that intercepts on its own can build the same capture with the exported `PaddleCheckoutWatch`: it reports each answer to the watch as `sent`, `answered`, `finished` and `read`, awaits `capture(pausedAt, payUrl)` when the /pay pauses, and passes the result to `authorize()` as `paddleCheckout`.
 
+- Recognize Amazon Payment Services' custom merchant page behind a dark launch. `syncRegistry()` now declares the `aps_custom_merchant_page` capability (`SUPPORTED_CAPABILITIES`), and the API serves the recognizer only to an org Agentcard has enabled, so no other org's APS checkout changes. For an enabled org, the merchant page's own card form, posted top-level to `https://checkout.payfort.com/FortAPI/paymentPage` (`sbcheckout.payfort.com` on APS's sandbox), pauses for the cardholder's approval, and the page navigates on with APS's own answer: APS's page, which posts APS's fields to the form's return page, or APS's redirect to that page. `authorize()` hands over only an answer payment-core's judge reads as a token for the form it paused, and throws `PaymentOutcomeUnknownError` with reason `aps_answer_unconfirmed` for any other. The form names no amount, so `authorize()` throws `AmountRequiredError` unless you pass `amount` and `currency`, above zero. A payment also needs the matching API, checkout relay and Vault releases.
+
 ## 0.23.23
 
 - Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.

package/README.md

@@ -301,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -375,6 +375,11 @@ Eximbay's window in a new window gets the pause only under `attachToCdp`, and
 only once the SDK has armed that window: an entry posted into a window the page
 opens in the same moment can leave first, and the SDK then fails the window's
 next post, so the checkout reads `unsupported` with no card sent.
+Barion's Smart Gateway (`barion_hosted_payment_page`) is served the same way:
+this build pauses the gateway link `secure.barion.com/Pay?Id=<payment id>` for
+the cardholder's device and fails every post a page it watches makes to the
+gateway. A merchant's server often sends the buyer to that link with a
+redirect, and only `attachToCdp` pauses a redirect.
 Revolut Business's card field (`revolut_card_field`) is served on the same
 terms: this build pauses the frame's card payment on `merchant.revolut.com`,
 the cardholder's device sends it to Revolut itself, and the frame gets
@@ -431,6 +436,34 @@ writes the real card into it and sends it through Agentcard's checkout relay to
 a store Agentcard reviewed, and the checkout gets FastSpring's answer. The
 payment names no price, so pass `amount` and `currency`, above zero: the total
 the checkout shows, tax included, which the API holds to FastSpring's own figure.
+Paymob's checkout (`paymob_checkout_pay`) is served on the same terms: this
+build pauses the card payment that Paymob's Unified Checkout, or the Pixel card
+frame a merchant's page embeds, posts to
+`<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay`, the
+cardholder's device sends it to Paymob itself with the real card, and the
+checkout gets Paymob's answer and runs 3-D Secure. A wallet's or another
+method's payment on the same URL carries no card and continues to Paymob. The
+payment key names the amount, so `amount` and `currency` are optional; a pair
+you pass must match the key's.
+PayU Latam's WebCheckout (`payu_latam_webcheckout_card`) is served on the same
+terms: this build pauses the card submit PayU's checkout page posts to
+`checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>`,
+the cardholder's device writes the real card into it and sends it to PayU, and
+the page gets PayU's answer. The API pays only a PayU account Agentcard
+reviewed. The submit's copy of the order is the page's, so pass `amount` and
+`currency`, above zero: the total PayU's page shows, which the API holds to
+the order PayU reads back.
+Nexi Checkout's card frame (`nexi_checkout_pay`, formerly Nets Easy) is served on
+the same terms: this build pauses the card payment the frame posts to
+`https://checkout.dibspayment.eu/api/v1/pay`, the cardholder's device reads
+Nexi's own record of the payment and sends the card through Agentcard's
+checkout relay to a merchant Agentcard reviewed for the checkout page, and the
+frame gets Nexi's answer. The payment names its amount in minor units but not
+its currency, so pass `amount` and `currency`, above zero: the total the
+checkout shows, which the API holds to the payment's own amount and the device
+holds to Nexi's record. The SDK sends the checkout page's origin as
+`checkout_origin`, which for Nexi's hosted page is `https://checkout.dibspayment.eu`,
+and the API pays only a merchant reviewed for that page.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "payu_latam", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "clover", "comgate", "fastspring", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "nexi_checkout", "omise", "openpay_bbva", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "payu_latam", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/barion.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Barion's Smart Gateway (secure.barion.com, where Hungarian, Czech and Slovak shops send a buyer who pays by card), as
+ * this SDK reads it.
+ *
+ * The merchant's server starts the payment with Barion and sends the buyer's browser to the gateway URL Barion answered
+ * with, https://secure.barion.com/Pay?Id=<payment id>, by a redirect or by setting the page's location. That GET carries
+ * no card, no amount and no merchant, and it is the one request a build that declares Barion's capability pauses
+ * (hosted-entry.ts): the cardholder's device repeats it over the end-to-end TLS relay and makes the gateway's own posts
+ * in the session Barion opens (payment-core processors/barion.js). Every post the agent's browser would send the gateway
+ * to pay follows that entry and leads to a card: the email check, the card's 3-D Secure version post, the 3-D Secure
+ * post and the charge post (/Pay/CheckEmailAddress, /Pay/PrepareCardPaymentForGuest, /ThreeDs/Authenticate,
+ * /Pay/CompletePaymentAsGuestWithCard). A build that declares Barion aborts every one of them (pre-claim.ts), so a
+ * placeholder card never reaches Barion.
+ *
+ * BARION_HOSTS is payment-core's BARION_HOSTS, and isBarionEntryUrl is payment-core's isBarionEntryUrl; barion.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export declare const BARION_PSP = "barion";
+/** The dark-launch capability the API serves Barion's recognizer behind (payment-core definitions.js). */
+export declare const BARION_CAPABILITY = "barion_hosted_payment_page";
+/** The gateway's two hosts: live, and Barion's test gateway, which runs the same gateway for Barion's test shops. */
+export declare const BARION_HOSTS: readonly string[];
+/**
+ * Whether a URL is the gateway URL exactly as the merchant's redirect writes it: https, one of the two gateway hosts in
+ * lowercase, the default port, no credentials or fragment, the path /Pay, and one query parameter, Id or id, holding the
+ * payment's id. The gateway acts on other parameters (its script starts a bank transfer by itself for a DefaultBankId),
+ * so a URL carrying any is not the entry, and neither is any other page or post of the gateway's host.
+ */
+export declare function isBarionEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on the gateway's hosts is a step toward paying there: any POST (the email check, the card's two
+ * posts, the 3-D Secure post, and any other form the gateway posts). The gateway's own pages, scripts and images, its
+ * 3-D Secure frames among them, are GETs of no card and are not one.
+ */
+export declare function isBarionPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a gateway host and this build's registry
+ * serves Barion's entry there. The gateway's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route
+ * predicate asks this, so both adapters show the gates every request to the gateway once Barion is armed.
+ */
+export declare function isArmedBarionUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/barion.js

@@ -0,0 +1,84 @@
+/**
+ * Barion's Smart Gateway (secure.barion.com, where Hungarian, Czech and Slovak shops send a buyer who pays by card), as
+ * this SDK reads it.
+ *
+ * The merchant's server starts the payment with Barion and sends the buyer's browser to the gateway URL Barion answered
+ * with, https://secure.barion.com/Pay?Id=<payment id>, by a redirect or by setting the page's location. That GET carries
+ * no card, no amount and no merchant, and it is the one request a build that declares Barion's capability pauses
+ * (hosted-entry.ts): the cardholder's device repeats it over the end-to-end TLS relay and makes the gateway's own posts
+ * in the session Barion opens (payment-core processors/barion.js). Every post the agent's browser would send the gateway
+ * to pay follows that entry and leads to a card: the email check, the card's 3-D Secure version post, the 3-D Secure
+ * post and the charge post (/Pay/CheckEmailAddress, /Pay/PrepareCardPaymentForGuest, /ThreeDs/Authenticate,
+ * /Pay/CompletePaymentAsGuestWithCard). A build that declares Barion aborts every one of them (pre-claim.ts), so a
+ * placeholder card never reaches Barion.
+ *
+ * BARION_HOSTS is payment-core's BARION_HOSTS, and isBarionEntryUrl is payment-core's isBarionEntryUrl; barion.test.mjs
+ * pins both to payment-core on every case payment-core's own tests list.
+ */
+export const BARION_PSP = 'barion';
+/** The dark-launch capability the API serves Barion's recognizer behind (payment-core definitions.js). */
+export const BARION_CAPABILITY = 'barion_hosted_payment_page';
+/** The gateway's two hosts: live, and Barion's test gateway, which runs the same gateway for Barion's test shops. */
+export const BARION_HOSTS = Object.freeze(['secure.barion.com', 'secure.test.barion.com']);
+const ENTRY_PATH = '/Pay';
+// The payment's id, a GUID: 32 hexadecimal digits as the gateway URL writes it, or with its four dashes as Barion's PHP
+// library writes it, in either letter case.
+const PAYMENT_ID = /^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+// The entry's whole query: the one parameter Barion's GatewayUrl names (Id) or its PHP library names (id).
+const ENTRY_QUERY = /^\?(?:Id|id)=([^&=]{1,64})$/;
+// An id of that shape, for asking whether this build's registry serves the entry on a host.
+const PROBE_ID = '00000000000000000000000000000000';
+/**
+ * Whether a URL is the gateway URL exactly as the merchant's redirect writes it: https, one of the two gateway hosts in
+ * lowercase, the default port, no credentials or fragment, the path /Pay, and one query parameter, Id or id, holding the
+ * payment's id. The gateway acts on other parameters (its script starts a bank transfer by itself for a DefaultBankId),
+ * so a URL carrying any is not the entry, and neither is any other page or post of the gateway's host.
+ */
+export function isBarionEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256)
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || !BARION_HOSTS.includes(url.hostname) || url.pathname !== ENTRY_PATH
+        || url.port || url.username || url.password || url.href !== raw || raw.includes('#'))
+        return false;
+    const match = ENTRY_QUERY.exec(url.search);
+    return !!match && PAYMENT_ID.test(match[1]);
+}
+/** The gateway host a URL is on (https, no credentials, any port, any letter case, a trailing dot or not), or null. */
+function barionHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return null;
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return BARION_HOSTS.includes(host) ? host : null;
+}
+/**
+ * Whether a request on the gateway's hosts is a step toward paying there: any POST (the email check, the card's two
+ * posts, the 3-D Secure post, and any other form the gateway posts). The gateway's own pages, scripts and images, its
+ * 3-D Secure frames among them, are GETs of no card and are not one.
+ */
+export function isBarionPayStep(url, method) {
+    return barionHost(url) !== null && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on a gateway host and this build's registry
+ * serves Barion's entry there. The gateway's posts are not the entry, so the registry's card-request test does not name
+ * them; the CDP adapter still pauses them through the recognizer's host pattern, and attachToPlaywright's route
+ * predicate asks this, so both adapters show the gates every request to the gateway once Barion is armed.
+ */
+export function isArmedBarionUrl(vault, url) {
+    const host = barionHost(url);
+    return host !== null && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(`https://${host}${ENTRY_PATH}?Id=${PROBE_ID}`, 'GET');
+}

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];