@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/cdp.js

@@ -1,15 +1,15 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns } from './registry.js';
-import { AdyenTestPlatformRefusedError, AmountRequiredError, ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, CheckoutCancelledError, CheckoutPreparationError, MerchantTotalError, PaymentOutcomeUnknownError, PreparationRequiredError, ProcessorRefusedError, UnsupportedCapabilityError, UnsupportedModeError, redactUrl, } from './client.js';
+import { AdyenTestPlatformRefusedError, AmountRequiredError, ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, CheckoutPreparationError, MerchantTotalError, PaymentOutcomeUnknownError, PreparationRequiredError, ProcessorRefusedError, UnsupportedCapabilityError, UnsupportedModeError, redactUrl, } from './client.js';
 import { PreparationGate } from './preparation.js';
 import { preparedApprovalAnswersRetry } from './prepared-processor.js';
 import { StripeCheckoutGate } from './stripe-checkout.js';
 import { MercadoCheckoutGate } from './mercado-checkout.js';
 import { MERCADO_CHECKOUT_PATTERN } from './mercado-checkout.generated.js';
 import { JuspayCheckoutGate } from './juspay-gate.js';
-import { ACI_CHECKOUT_REUSED, AciGate, playwrightReplacesNavigationBody } from './aci.js';
-import { EprotectGate, classifyEprotectRequest, eprotectScriptAnswer } from './eprotect.js';
-import { SbpsGate, classifySbpsRequest, sbpsScriptAnswer } from './sbps.js';
-import { dispatchPreClaim, eventUrl, isArmedCreditguardCall, routesHipayVault } from './pre-claim.js';
+import { AciGate, playwrightReplacesNavigationBody } from './aci.js';
+import { EprotectGate } from './eprotect.js';
+import { SbpsGate } from './sbps.js';
+import { dispatchPreClaim, eventUrl, isArmedCreditguardCall, nikeOrderGate, routesHipayVault } from './pre-claim.js';
 import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesGmo } from './gmo.js';
 import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
 import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
@@ -26,12 +26,18 @@ import { isArmedTransbankUrl, transbankMerchantReturn, transbankMerchantReturnAn
 import { isArmedRedsysUrl } from './redsys.js';
 import { isArmedPrzelewy24Url } from './przelewy24.js';
 import { isArmedBarionUrl } from './barion.js';
+import { isArmedPayplugUrl } from './payplug.js';
+import { isArmedCardlinkVposUrl } from './cardlink-vpos.js';
+import { isArmedEghlUrl } from './eghl.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
 import { COMGATE_CARD_PATTERNS, isArmedComgateUrl, servesComgate } from './comgate.js';
 import { isArmedEximbayUrl } from './eximbay.js';
+import { isArmedOceanpaymentUrl } from './oceanpayment.js';
 import { PAYPAL_HOSTED_FIELDS_PATTERNS, isPaypalHostedFieldsConfirm } from './paypal-hosted-fields.js';
 import { EBANX_RESEND_PATTERNS, EbanxFollowUps, isEbanxResendUrl } from './ebanx.js';
 import { PayrexxFollowUps } from './payrexx.js';
+import { NIKE_ORDER_PATTERNS, NikeOrders, nikeOrderRouted } from './nike-order.js';
+import { nikeOrderRequest as sharedNikeOrderRequest } from './merchant-card-endpoints.generated.js';
 import { PAYPAL_CARD_FORM_PATTERNS, isPaypalCardFormUrl } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, SecureAcceptanceFollowUpWatch, isCybersourceSecureAcceptanceUrl, secureAcceptanceFollowUp, secureAcceptanceFrameAnswer, secureAcceptanceReplyLast4, } from './cybersource-secure-acceptance.js';
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
@@ -94,6 +100,18 @@ const HOSTED_FORM_REPEAT_REASON = 'already submitted on the cardholder\'s device
 function targetRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
+/**
+ * Per CDP connection, the attachment holding Nike's order at the browser target for each browser context: every one sees
+ * each pause there, and only the holder of the context that sent a request answers it (attachToCdp nikeOrderAtRoot). Each
+ * time an attachment asks through Nike's profile in a context, it takes the context over from whichever one held it.
+ */
+const nikeRootHolders = new WeakMap();
+/**
+ * Per Playwright browser context, the attachment whose route judges Nike's order there: the last one whose route was on
+ * when it asked through Nike's profile (attachToPlaywright holdNikeOrdersInContext). Every other attachment's route
+ * hands the order to the next route.
+ */
+const nikeContextHolders = new WeakMap();
 function contextId(value) {
     return typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\u0000-\u0020\u007f]/.test(value);
 }
@@ -130,6 +148,11 @@ function assertContextTarget(target, merchantContext, allow = {}) {
     // reports are read, and a card request seen there ends the checkout before anything is approved (sharedWorkers).
     if (allow.sharedWorkers && target.type === 'shared_worker' && knownContext)
         return;
+    // A worklet (CDP type 'worklet': an audio, paint, animation or layout worklet) has no fetch, XHR, WebSocket or
+    // beacon in its global scope, so it can never send a card request; the module it loads is fetched by its owning
+    // frame, through that frame's interception. Shopify's checkout runs one in its web-pixel sandbox frames.
+    if (target.type === 'worklet' && knownContext)
+        return;
     if (!['page', 'iframe', 'worker', 'browser_ui'].includes(target.type)
         || (target.browserContextId !== undefined && !contextId(target.browserContextId))) {
         throw new CheckoutAttachmentError('unavailable');
@@ -1447,6 +1470,8 @@ function merchantAttempt(lifecycle, survives) {
     // prepare again. Every other stop leaves the outcome unknown.
     const error = () => reason === 'amadeus_send_window_closed' || reason === 'secure_acceptance_send_window_closed'
         || reason === 'wix_payments_send_window_closed' || reason === 'hipay_send_window_closed' || reason === 'openpay_send_window_closed'
+        || reason === 'vtex_payments_send_window_closed'
+        || reason === 'processout_send_window_closed'
         ? new CheckoutPreparationError(lifecycle.getState().preparationId ?? null, reason)
         : new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, reason);
     const attempt = {
@@ -1560,53 +1585,6 @@ async function retireUnusedApproval(opts, lifecycle, authorizationId) {
         opts.onEvent?.({ type: 'failed', detail: 'PaymentOutcomeUnknownError' });
     }
 }
-/**
- * The business's read, as a replay this transport can deliver. An approved `token` read carries
- * the processor's answer; `cse` the ciphertext; `hosted_form` the device's stamp. A terminal read is thrown as
- * the error the create path would have thrown for the same outcome, so the request is failed with nothing
- * charged and the page's next request is quieted as after any decline. A read that is not final, or an
- * approval without a usable answer, is refused here and leaves the request paused.
- */
-function replayOf(result, timeoutMs) {
-    const status = result.status;
-    if (status === 'awaiting_approval')
-        throw new Error('The purchase still awaits the person: resume takes a final read (voice.awaitResult), not an open one.');
-    if (status === 'declined')
-        throw new ApprovalDeclinedError(result.terminal_reason ?? 'declined');
-    if (status === 'cancelled')
-        throw new ApprovalDeclinedError(result.terminal_reason ?? 'cancelled');
-    if (status === 'expired' || status === 'timeout')
-        throw new ApprovalTimeoutError(timeoutMs);
-    if (status !== 'approved' && status !== 'completed')
-        throw new PaymentOutcomeUnknownError(result.id ?? null, 'authorization_status_unrecognized');
-    const authorizationId = result.id;
-    if (typeof authorizationId !== 'string' || !/^cauth_[A-Za-z0-9_-]{1,128}$/.test(authorizationId))
-        throw new Error('resume needs the authorization\'s id on the read (voice.awaitResult carries it).');
-    const execution = result.execution_mode === 'autopilot' || result.execution_mode === 'user_approval' ? { executionMode: result.execution_mode } : {};
-    const mode = result.mode ?? (result.response ? 'token' : result.substitutions ? 'cse' : result.submitted_at ? 'hosted_form' : 'token');
-    if (mode === 'hosted_form') {
-        if (typeof result.submitted_at !== 'string' || !result.submitted_at)
-            throw new Error('A hosted-form read resumes with submitted_at, the device\'s stamp.');
-        return { mode: 'hosted_form', kind: 'submitted_on_device', outcome: 'unverified', authorizationId, submittedAt: result.submitted_at, ...execution };
-    }
-    if (mode === 'cse') {
-        const sub = result.substitutions;
-        if (!sub || sub.encoding !== 'json' || typeof sub.at !== 'string' || !sub.fields || typeof sub.fields !== 'object')
-            throw new Error('A cse read resumes with substitutions, the ciphertext the device produced.');
-        return { mode: 'cse', authorizationId, substitutions: { encoding: 'json', at: sub.at, fields: { ...sub.fields }, ...(sub.remove ? { remove: [...sub.remove] } : {}) }, ...execution };
-    }
-    if (mode !== 'token')
-        throw new PaymentOutcomeUnknownError(authorizationId, 'approved_mode_unsupported');
-    const response = result.response;
-    if (!response || !Number.isInteger(response.status) || response.status < 100 || response.status > 599 || typeof response.body !== 'string'
-        || !response.headers || typeof response.headers !== 'object' || Array.isArray(response.headers)) {
-        throw new Error('An approved token read resumes with response, the processor\'s answer (voice.awaitResult carries it once the purchase finished).');
-    }
-    // The read's processor_context rides as it came: a Paddle VGS answer is handed to the page only with the
-    // approved card's details its /pay names (paddle-vgs-pay.ts checks them before the hand-over).
-    return { mode: 'token', authorizationId, status: response.status, headers: { ...response.headers }, body: response.body, amountVerified: null,
-        ...(result.processor_context !== undefined ? { processorContext: result.processor_context } : {}), ...execution };
-}
 /** A CDP Fetch url pattern (`*` any run of characters, `?` one, `\\` escapes) against a URL. */
 function urlPatternMatches(pattern, url) {
     let re = '';
@@ -1636,39 +1614,6 @@ function holdUntilDecided(decision, signal, lost) {
         signal.addEventListener('abort', lost, { once: true });
     return decision.finally(() => signal.removeEventListener('abort', lost));
 }
-/**
- * Worldpay eProtect's registration, resumed by the business. The read carries the registration as the API
- * stored it, bare JSON, and the paused request is the vendor's JSONP <script>, which runs its answer and reads
- * the registration only through the callback the paused URL named. So it gets the answer authorize() gives on
- * the create path (client.ts): the registration inside that callback, under Worldpay's script type, and only a
- * registration payment-core's judge accepts for that URL. A read in any other mode never answers it either. The
- * paused URL alone decides, whatever recognizer claimed it. Any other request's replay passes as it came, and a
- * create's replay never comes here, so no answer is wrapped twice.
- */
-function eprotectResumedReplay(replay, request) {
-    if (classifyEprotectRequest(request.url, request.method)?.kind !== 'registration')
-        return replay;
-    const answer = replay.mode === 'token' ? eprotectScriptAnswer(request.url, replay) : null;
-    if (replay.mode !== 'token' || !answer)
-        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'eprotect_registration_unconfirmed');
-    return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
-}
-/**
- * SB Payment Service's token request, resumed by the business, on the same terms as eProtect's above. The read
- * carries the token as the API stored it, which the paused <script> cannot run, so it gets the answer authorize()
- * gives on the create path (client.ts): the token inside the callback the paused URL named, under a script type,
- * and only a token payment-core's judge accepts for that URL. A read in any other mode never answers it either.
- * The paused URL alone decides, whatever recognizer claimed it. Any other request's replay passes as it came, and
- * a create's replay never comes here, so no answer is wrapped twice.
- */
-function sbpsResumedReplay(replay, request) {
-    if (classifySbpsRequest(request.url, request.method)?.kind !== 'token_request')
-        return replay;
-    const answer = replay.mode === 'token' ? sbpsScriptAnswer(request.url, replay) : null;
-    if (replay.mode !== 'token' || !answer)
-        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'sbps_token_unconfirmed');
-    return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
-}
 /** The recogniser that claimed a paused request, by processor name, so a caller never re-matches the URL; null on a duck-typed vault without the read. */
 function recognizerNameOf(opts, url, method) {
     const read = opts.vault.recognizerOf;
@@ -1681,61 +1626,6 @@ function recognizerNameOf(opts, url, method) {
         return null;
     }
 }
-function pauseForBusiness(opts, lifecycle, attemptSignal, request, pageOrigin) {
-    const timeoutMs = opts.timeoutMs ?? 15 * 60_000;
-    let deliveredResolve = () => { }, deliveredReject = () => { };
-    const delivered = new Promise((resolve, reject) => { deliveredResolve = resolve; deliveredReject = reject; });
-    delivered.catch(() => { });
-    const replay = new Promise((resolve, reject) => {
-        let settled = false;
-        const signals = [lifecycle.abort.signal, attemptSignal];
-        let timer;
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            for (const signal of signals)
-                signal.removeEventListener('abort', onAbort);
-            lifecycle.setResumeHandler(null);
-            fn();
-        };
-        const onAbort = () => finish(() => reject(attemptSignal.aborted ? (attemptSignal.reason ?? new PaymentOutcomeUnknownError(null, 'merchant_request_aborted')) : new CheckoutCancelledError()));
-        timer = setTimeout(() => finish(() => reject(new ApprovalTimeoutError(timeoutMs))), timeoutMs);
-        timer.unref?.();
-        for (const signal of signals)
-            signal.addEventListener('abort', onAbort, { once: true });
-        if (signals.some((signal) => signal.aborted)) {
-            onAbort();
-            return;
-        }
-        lifecycle.setResumeHandler((result) => {
-            if (typeof result.id === 'string' && result.id)
-                lifecycle.approvalCreated(result.id);
-            let outcome;
-            try {
-                outcome = replayOf(result, timeoutMs);
-            }
-            catch (err) {
-                // A terminal outcome answers the request (failed, nothing charged); a read that is not final leaves it paused.
-                if (err instanceof ApprovalDeclinedError || err instanceof ApprovalTimeoutError || err instanceof PaymentOutcomeUnknownError) {
-                    finish(() => reject(err));
-                    return delivered;
-                }
-                return Promise.reject(err);
-            }
-            finish(() => resolve(outcome));
-            return delivered;
-        });
-        try {
-            Promise.resolve(opts.onPaused({ request, recognizer: recognizerNameOf(opts, request.url, request.method), ...(pageOrigin ? { page_origin: pageOrigin } : {}), controller: lifecycle })).catch((err) => finish(() => reject(err)));
-        }
-        catch (err) {
-            finish(() => reject(err));
-        }
-    });
-    return { replay, delivered: { resolve: deliveredResolve, reject: deliveredReject } };
-}
 /**
  * Arm the send window of a request paused under a preparation, when its processor sets one: a
  * prepared Amadeus SDK add, a prepared Secure Acceptance token create and a prepared Wix tokenize
@@ -1789,10 +1679,6 @@ function watchSecureAcceptanceFollowUp(watch, preparation, replay) {
  */
 export async function attachToCdp(cdp, pageSessionId, opts) {
     opts = safeOptions(opts);
-    if (opts.pauseOnly && typeof opts.onPaused !== 'function')
-        throw new Error('pauseOnly needs onPaused: the business receives the paused request there and answers it with controller.resume.');
-    if (opts.pauseOnly && opts.hold)
-        throw new Error('hold and pauseOnly are two different pauses: attach with one of them.');
     const setupTimeoutMs = attachmentDeadline(opts.attachmentTimeoutMs);
     const setupStop = new AbortController();
     let attachmentReady = false;
@@ -1801,6 +1687,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     const sessionTypes = new Map([[pageSessionId, 'page']]);
     // Each window this attachment adopted (adoptOpenedWindow): its session, and its target's id, which is its main frame's.
     const windowTargets = new Map();
+    // The id of every target this attachment armed besides its page: each adopted window and each child it attached.
+    const armedTargets = new Set();
     const sessionParents = new Map();
     // The frame in its parent session that a child target hangs from (TargetInfo.parentFrameId), so a
     // frame lookup can climb from a cross-origin frame into the document that frames it.
@@ -1914,6 +1802,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     const ebanxFollowUps = new EbanxFollowUps();
     // The approved Payrexx card request on this attachment and the 3-D Secure sends claimed under it (payrexx.ts).
     const payrexxFollowUps = new PayrexxFollowUps();
+    // The approval Nike's order is held to once a card went through Nike's profile (nike-order.ts).
+    const nikeOrders = new NikeOrders();
     const aci = new AciGate(opts.vault);
     const eprotect = new EprotectGate(opts.vault);
     const sbps = new SbpsGate(opts.vault);
@@ -2246,8 +2136,15 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             ...(payrails ? PAYRAILS_GUARD_PATTERNS : []), ...PAYPAL_HOSTED_FIELDS_PATTERNS, ...PAYPAL_CARD_FORM_PATTERNS,
             ...CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, ...(recognizesPaddleVgs(opts.vault) ? PADDLE_VGS_PAY_PATTERNS : []), ...EBANX_RESEND_PATTERNS,
             ...(servesComgate(opts.vault) ? COMGATE_CARD_PATTERNS : [])])];
+    // Nike's API host is armed in every frame this checkout arms, from the attach on: once a card went through Nike's
+    // profile, Nike's order gate judges each order the page sends, a document loaded before the ask included, and anything
+    // before that, or that is not the order, continues untouched (see nike-order.ts). Chrome applies the browser target's
+    // interception (holdNikeOrdersAtRoot) only to documents loaded after it is armed, so it cannot hold these. The host
+    // stays out of urlPatterns, which name what the SDK's own rules cover: in hold mode, a request to it that carries the
+    // placeholder card is still held as hold-only.
+    const armedPatterns = [...urlPatterns, ...NIKE_ORDER_PATTERNS];
     // The hold-only rules' patterns (Bolt's tokenizer; every request a placeholder card can ride, by resource type).
-    const fetchPatterns = [...urlPatterns.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
+    const fetchPatterns = [...armedPatterns.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
         ...(holdGate ? holdGate.patterns().map((p) => ({ ...p, requestStage: 'Request' })) : [])];
     const arm = async (sessionId, resume = false, worker = false) => {
         const key = sessionId ?? '__root__';
@@ -2416,6 +2313,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             sessionTypes.set(child, 'page');
             sessionParents.set(child, pageSessionId);
             windowTargets.set(child, info.targetId);
+            armedTargets.add(info.targetId);
             await arm(child);
             opts.onEvent?.({ type: 'window_armed', detail: {} });
         }
@@ -2423,6 +2321,107 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             failInterception(error);
         }
     };
+    /**
+     * Nike's order is held at the browser target too, from the moment this attachment asks the cardholder to pay through
+     * Nike's profile (nike-order.ts), for the routes this checkout's own frames do not cover (armedPatterns): Chrome applies
+     * Fetch there only to a document, worker or shared worker that loads after it is armed, and pauses a request to Nike's
+     * API host from every one of them in the browser, a tab this checkout did not open included. One that cannot be armed
+     * refuses that payment before anything is created.
+     */
+    let nikeAtRoot = null;
+    // This attachment among those holding Nike's order on the same connection (nikeRootHolders), by its browser context.
+    const nikeHolder = {};
+    const holdNikeOrdersAtRoot = () => {
+        // Every ask takes the context over, one for another attempt after a later attachment asked there included; the
+        // browser target is armed once, and the context's other pages open by then at each ask.
+        const holders = nikeRootHolders.get(cdp) ?? new Map();
+        nikeRootHolders.set(cdp, holders.set(merchantContext, nikeHolder));
+        return (nikeAtRoot ??= cdp.send('Fetch.enable', { patterns: NIKE_ORDER_PATTERNS.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })) }))
+            .then(holdNikeOrdersInPages);
+    };
+    /**
+     * Every other page of this browser context, and every frame in one, open when this attachment asks through Nike's
+     * profile: the browser target's pause never reaches a document already loaded, so each gets its own interception for
+     * Nike's API host (nikeOrderInPage), as Playwright's context route covers every page of its context. A page or frame
+     * that cannot be armed refuses the payment, as the browser target does.
+     */
+    const nikePageTargets = new Set();
+    const nikePageSessions = new Set();
+    const holdNikeOrdersInPages = async () => {
+        const { targetInfos } = await cdp.send('Target.getTargets');
+        if (!Array.isArray(targetInfos))
+            throw new Error('targets_unreadable');
+        for (const info of targetInfos) {
+            if (!targetRecord(info) || (info.type !== 'page' && info.type !== 'iframe') || info.browserContextId !== merchantContext
+                || typeof info.targetId !== 'string' || info.targetId === pageTargetId || armedTargets.has(info.targetId)
+                || nikePageTargets.has(info.targetId))
+                continue;
+            const { sessionId } = await cdp.send('Target.attachToTarget', { targetId: info.targetId, flatten: true });
+            if (typeof sessionId !== 'string' || !sessionId)
+                throw new Error('target_unattached');
+            nikePageSessions.add(sessionId);
+            await cdp.send('Fetch.enable', { patterns: NIKE_ORDER_PATTERNS.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })) }, sessionId);
+            // Recorded once its interception is on, so the next attempt after one that failed here arms it again.
+            nikePageTargets.add(info.targetId);
+        }
+    };
+    // Each target's browser context, from discovery on: a page or frame of another context, the default one included,
+    // belongs to another checkout. A report that names no context never replaces one that did.
+    const targetContexts = new Map();
+    const noteTargetContext = (info) => {
+        if (typeof info?.targetId === 'string' && (contextId(info.browserContextId) || !targetContexts.has(info.targetId))) {
+            targetContexts.set(info.targetId, info.browserContextId);
+        }
+    };
+    /**
+     * A request paused at the browser target, answered by the attachment holding Nike's order in the browser context that
+     * sent it: its Nike order gate judges it, and anything else goes on untouched. Every attachment on the connection sees
+     * each pause, so the others leave it alone, an earlier attachment a later one took the context over from included. A
+     * request from a context nobody holds goes on untouched, from the first holder alone; one from a source the browser
+     * never reported as a target (a shared worker) is the holder's while one context is held, and while several are, nobody
+     * can tell whose it is, so the first holder refuses it when it is Nike's order and lets anything else go on.
+     */
+    const nikeOrderAtRoot = async (requestId, request, frameId) => {
+        // Root pauses this attachment did not arm are another attachment's to answer.
+        if (!nikeAtRoot)
+            return;
+        const holders = nikeRootHolders.get(cdp) ?? new Map();
+        // The page's own frame is this checkout's, whatever a later report named.
+        const placed = typeof frameId === 'string' && (frameId === pageTargetId || targetContexts.has(frameId));
+        const owner = placed ? holders.get(frameId === pageTargetId ? merchantContext : targetContexts.get(frameId))
+            : holders.size === 1 ? [...holders.values()][0] : null;
+        const fail = () => cdp.send('Fetch.failRequest', { requestId, errorReason: cdpFailure(request.url) }).catch(() => { });
+        if (owner !== nikeHolder) {
+            // Only an order whose owner nobody can tell is refused: anything else nobody holds goes on.
+            if ((owner === undefined || owner === null) && [...holders.values()][0] === nikeHolder) {
+                await (owner === null && sharedNikeOrderRequest(request.url, request.method) === true ? fail()
+                    : cdp.send('Fetch.continueRequest', { requestId }).catch(() => { }));
+            }
+            return;
+        }
+        await judgeNikeOrder(requestId, request);
+    };
+    /**
+     * A request paused in another page or frame of this context, armed for Nike's order at the ask (holdNikeOrdersInPages):
+     * the attachment holding the context judges it, and any other lets it go on, to the holder, which armed every page and
+     * frame of the context it does not own the same way when it asked.
+     */
+    const nikeOrderInPage = async (sessionId, requestId, request) => {
+        if (nikeRootHolders.get(cdp)?.get(merchantContext) === nikeHolder)
+            await judgeNikeOrder(requestId, request, sessionId);
+        else
+            await cdp.send('Fetch.continueRequest', { requestId }, sessionId).catch(() => { });
+    };
+    // Nike's order gate on a request paused at the browser target (no session) or in a page armed at the ask.
+    const judgeNikeOrder = async (requestId, request, sessionId) => {
+        const fail = () => cdp.send('Fetch.failRequest', { requestId, errorReason: cdpFailure(request.url) }, sessionId).catch(() => { });
+        const gate = {
+            request: { url: request.url, method: request.method, headers: request.headers ?? {}, get body() { return pausedBody(request); } },
+            nikeOrders, lifecycle, onEvent: opts.onEvent, lifecycleAborted: () => lifecycle.abort.signal.aborted, terminal: () => !!terminal,
+            effects: { continueRequest: () => cdp.send('Fetch.continueRequest', { requestId }, sessionId), answer: fail, abort: fail },
+        };
+        await (nikeOrderGate(gate) ?? cdp.send('Fetch.continueRequest', { requestId }, sessionId).catch(() => { }));
+    };
     cdp.on(async (method, params, sessionId) => {
         // A frame that committed a new document drops the companion binding made for the getTokenId its
         // old document sent, with the device's CVV ciphertext: the document that replaced it never
@@ -2435,6 +2434,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         if ((method === 'Target.targetCreated' || method === 'Target.targetInfoChanged') && targetContextKnown) {
             // The page's own target reports each document it commits from discovery on, Page events or not.
             notePageTarget(params?.targetInfo);
+            noteTargetContext(params?.targetInfo);
             try {
                 assertContextTarget(params?.targetInfo, merchantContext, targetAllowance);
                 if (params?.targetInfo?.type === 'shared_worker')
@@ -2455,6 +2455,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             && params?.frameId === pageTargetId && typeof params?.url === 'string') {
             committedTopUrl = params.url.split('#')[0];
         }
+        // A history update that leaves the prepared page's origin, path and query as they were (a single-page
+        // checkout's replaceState to its own URL, a hash change) is the same document, and keeps the preparation.
+        if (method === 'Page.navigatedWithinDocument' && sessionId === pageSessionId && preparationFrameId && params?.frameId === preparationFrameId
+            && preparationGate.keepsDocument(params.url))
+            return;
         if (((method === 'Page.frameNavigated' && !params.frame?.parentId) || (method === 'Page.navigatedWithinDocument' && preparationFrameId && params.frameId === preparationFrameId)) && sessionId === pageSessionId) {
             preparationGate.invalidate('merchant_document_changed');
             mercadoCheckout.invalidate();
@@ -2506,6 +2511,16 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             failInterception(new CheckoutAttachmentError('unavailable'));
             return;
         }
+        // A request paused at the browser target, which this attachment arms only for Nike's order (nikeOrderAtRoot).
+        if (method === 'Fetch.requestPaused' && sessionId === undefined) {
+            await nikeOrderAtRoot(params.requestId, params.request, params.frameId);
+            return;
+        }
+        // A request paused in another page or frame of this context that this attachment armed for Nike's order at the ask.
+        if (method === 'Fetch.requestPaused' && sessionId && nikePageSessions.has(sessionId)) {
+            await nikeOrderInPage(sessionId, params.requestId, params.request);
+            return;
+        }
         // The transport is browser-scoped. A second tab's request or child target
         // must never be authorized with this page's merchant, amount or preparation.
         if (!sessionId || !ownedSessions.has(sessionId))
@@ -2754,6 +2769,13 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 await cdp.send('Runtime.runIfWaitingForDebugger', {}, child).catch(() => { });
                 return;
             }
+            // A worklet sends no request of its own (assertContextTarget): released from its debugger wait, never owned.
+            if (params.targetInfo?.type === 'worklet' && typeof child === 'string' && child
+                && child !== pageSessionId && !ownedSessions.has(child)) {
+                rejectedSessions.add(child);
+                await cdp.send('Runtime.runIfWaitingForDebugger', {}, child).catch(() => { });
+                return;
+            }
             // CDP may omit the context ID for ordinary children; keep those attached.
             try {
                 if (typeof child !== 'string' || !child || !['page', 'iframe', 'worker'].includes(params.targetInfo?.type)) {
@@ -2764,6 +2786,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                     throw new CheckoutAttachmentError('unavailable');
                 }
                 ownedSessions.add(child);
+                if (typeof params.targetInfo.targetId === 'string')
+                    armedTargets.add(params.targetInfo.targetId);
                 sessionTypes.set(child, params.targetInfo.type);
                 sessionParents.set(child, sessionId);
                 if (typeof params.targetInfo.parentFrameId === 'string' && params.targetInfo.parentFrameId) {
@@ -2883,6 +2907,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             tokenexIframe: tokenexIframeRepeats,
             ebanx: ebanxFollowUps,
             payrexx: payrexxFollowUps,
+            nikeOrders,
             frame: typeof frameId === 'string' && frameId ? frameId : undefined,
             payrails,
             shijiSts: { companions: shijiCompanions, page: () => cdpShijiPage(sessionId, frameId) },
@@ -3053,8 +3078,6 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         // Whether this handoff kept an approval's follow-ups (ebanxFollowUps.remember, payrexxFollowUps.remember), which a
         // failed handoff stops.
         let followUpsRemembered = false;
-        // The business's pause, so resume resolves once the page has its answer.
-        let businessPause = null;
         // Hold mode: the person's release, settled with what came of it.
         let holdRelease = null;
         // A prepared Amadeus SDK add must be sent within its window (see amadeus.ts).
@@ -3094,11 +3117,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             activeRequest = { attempt, requestId, networkId, sessionId, frameId, request,
                 identity: requestIdentity(opts, request.url, request.method, body, undefined, undefined, flexPause?.shape, request.headers),
                 preparedFrame: preparation ? { sessionId, frameId } : undefined };
-            // An ACI card-number request: the page's CVC and expiry requests for its checkout are held
-            // until this approval ends (see AciGate). One whose checkout already has a card-number
-            // request running or answered never begins; the pre-claim gate refuses it before this.
+            // An ACI or JSON split card's card request: the page's CVC and expiry requests for its
+            // checkout are held until this approval ends (see AciGate). One whose checkout already has a
+            // card request running or answered never begins; the pre-claim gate refuses it before this.
             if (!aci.begin(request.url, request.method, body, preparation?.merchantOrigin)) {
-                throw new CheckoutPreparationError(preparation?.id ?? null, ACI_CHECKOUT_REUSED);
+                throw new CheckoutPreparationError(preparation?.id ?? null, aci.reuseCode(request.url));
             }
             // A Worldpay eProtect registration: the vendor's give-up report for it ends this attempt as
             // the page abandoning its request (see EprotectGate.gaveUp).
@@ -3148,8 +3171,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             const cardRecord = cardEndpoint ? await cardEndpointFacts(cardEndpointRecord, cardEndpoint, request.url, pausedAt, attempt.signal) : null;
             attempt.assertLive();
             // Paddle's own checkout answers as of the pause, once the texts of those that finished before it are read
-            // (a Billing /pay only; sent only with a Paddle TokenEx create, which a pause-only business makes itself).
-            const paddleAnswers = opts.pauseOnly ? undefined : await paddleCheckout.capture(pausedAt, request.url, attempt.signal);
+            // (a Billing /pay only; sent only with a Paddle TokenEx create).
+            const paddleAnswers = await paddleCheckout.capture(pausedAt, request.url, attempt.signal);
             attempt.assertLive();
             // Hold mode: nothing is created until the person's total releases the request (hold.ts).
             if (holdGate) {
@@ -3167,10 +3190,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 holdRelease = decision;
                 attempt.assertLive();
             }
-            // Decision 176: pause only. The business creates the authorization from the paused request and answers
-            // through controller.resume; the replay it hands back goes down the same delivery path as a create's.
-            const pause = opts.pauseOnly ? pauseForBusiness(opts, lifecycle, attempt.signal, { url: request.url, method: request.method, headers: request.headers ?? {}, body }, pageOrigin) : null;
-            businessPause = pause;
+            // From the create on, the device may store the card at the merchant: Nike's orders are held from here (nike-order.ts).
+            if (cardEndpoint && nikeOrders.asking(cardEndpoint.id)) {
+                await holdNikeOrdersAtRoot().catch(() => { throw new CardEndpointRefusedError(cardEndpoint.id, 'request_unsupported', "Nike's order cannot be held in this browser"); });
+                attempt.assertLive();
+            }
             // A sandbox hold never sends the request on: the approval is created at the released total and read, the
             // page's request fails the moment it exists, and the attempt ends with nothing charged.
             const holdSandbox = !!holdRelease && opts.vault.sandbox === true;
@@ -3185,7 +3209,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                     lifecycle.abort.signal.addEventListener('abort', retire, { once: true });
             }
             let holdRequestFailed = false;
-            const authorization = pause ? null : opts.vault.authorize({
+            const authorization = opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: holdRelease ? holdRelease.amount : opts.amount,
@@ -3198,6 +3222,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 pageOrigin,
                 pageAmount,
                 ...(payToInterceptMs !== undefined ? { payToInterceptMs } : {}),
+                // When the request paused, which a VTEX card post's send-by counts from (the client sends it for VTEX alone).
+                pausedAt,
                 preparation,
                 timeoutMs: opts.timeoutMs,
                 signal: lifecycle.abort.signal,
@@ -3231,7 +3257,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                         ...(flexPause ? flexPause.sidecar : {}),
                         ...(payrailsSidecar ? { payrails: payrailsSidecar } : {}) },
             });
-            if (holdSandbox && authorization) {
+            if (holdSandbox) {
                 const outcome = await authorization.then((r) => ({ outcome: 'approved_not_charged', authorizationId: r.authorizationId }), (err) => ({ outcome: err instanceof ApprovalDeclinedError ? 'declined' : err instanceof ApprovalTimeoutError ? 'expired' : 'failed',
                     authorizationId: lifecycle.getState().authorizationId, detail: failureSummary(err) }));
                 if (!holdRequestFailed)
@@ -3239,7 +3265,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 holdRelease.settle(outcome);
                 throw new HoldAnsweredError(outcome);
             }
-            const replay = pause ? sbpsResumedReplay(eprotectResumedReplay(await pause.replay, request), request) : await authorization;
+            const replay = await authorization;
             attempt.assertLive();
             approvedId = replay.authorizationId;
             if (lifecycle.isCancelled())
@@ -3272,6 +3298,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // False only for a card endpoint answer the device withheld (see deliverCardEndpointAnswer).
             let handedOver = true;
             if (replay.mode === 'card_endpoint') {
+                // The approved amount Nike's order after the card is held to (nike-order.ts).
+                nikeOrders.remember(replay);
                 handedOver = await deliverCardEndpointAnswer(opts, lifecycle, cardEndpoint, replay, { url: deliverRequest.url, headers: deliverRequest.headers }, {
                     readJar: async () => (await cdp.send('Network.getCookies', { urls: [deliverRequest.url] }, deliverOn))?.cookies,
                     writeCookie: async (cookie) => {
@@ -3430,7 +3458,6 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             }
             if (handedOver)
                 lifecycle.handedOff(replay);
-            businessPause?.delivered.resolve();
             holdRelease?.settle({ outcome: 'authorized', authorizationId: replay.authorizationId });
         }
         catch (err) {
@@ -3451,13 +3478,6 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 ebanxFollowUps.stop();
                 payrexxFollowUps.stop();
             }
-            // The business's resume settles once the request is answered: a terminal read is an answer (failed, nothing charged), a lost handoff is not.
-            const settlePause = () => { if (businessPause) {
-                if (isApprovalOutcome(err))
-                    businessPause.delivered.resolve();
-                else
-                    businessPause.delivered.reject(err);
-            } };
             if (activeRequest?.attempt === attempt)
                 activeRequest = null;
             // Vault clients may normalize a merchantSignal abort. Preserve the
@@ -3492,7 +3512,6 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // A Secure Acceptance frame post reads CyberSource's side too (secureAcceptanceFailedRefusal).
             const sent = handoffStarted || approvedId !== null, failedFor = approvedId ?? lifecycle.getState().authorizationId;
             await refusePaused(dead.requestId, dead.sessionId, request.url, cardEndpoint, secureAcceptance ? secureAcceptanceFailedRefusal(err, sent, failedFor) : failedNavigationRefusal(err, sent, failedFor), secureAcceptance);
-            settlePause();
         }
         finally {
             disarmSendWindow?.();
@@ -3532,8 +3551,10 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             for (const target of targetInfos)
                 assertContextTarget(target, merchantContext, targetAllowance);
             // The page may have committed another document since its TargetInfo was read; the list names the one it holds.
-            for (const target of targetInfos)
+            for (const target of targetInfos) {
                 notePageTarget(target);
+                noteTargetContext(target);
+            }
             for (const target of targetInfos)
                 if (target?.type === 'shared_worker')
                     await watchSharedWorker(target);
@@ -3560,7 +3581,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         // A window reported after that drain, before this line, is adopted the way a later window is.
         for (const info of pendingWindows.splice(0))
             void adoptOpenedWindow(info);
-        opts.onEvent?.({ type: 'fetch_armed', detail: { patterns: urlPatterns, ...(holdGate ? { hold: true, holdRules: holdGate.rules.map((r) => r.psp) } : {}), ...(bypassServiceWorkers ? { serviceWorkers: 'bypass' } : {}) } });
+        opts.onEvent?.({ type: 'fetch_armed', detail: { patterns: armedPatterns, ...(holdGate ? { hold: true, holdRules: holdGate.rules.map((r) => r.psp) } : {}), ...(bypassServiceWorkers ? { serviceWorkers: 'bypass' } : {}) } });
     }
     catch (error) {
         const failure = attachmentFailure(error);
@@ -3589,8 +3610,6 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
  */
 export async function attachToPlaywright(page, opts) {
     opts = safeOptions(opts);
-    if (opts.pauseOnly)
-        throw new Error('pauseOnly is a raw CDP mode (attachToCdp); attachToPlaywright creates the authorization itself.');
     if (opts.hold)
         throw new Error('hold is a raw CDP mode (attachToCdp): it needs the frames\' own interception.');
     const setupTimeoutMs = attachmentDeadline(opts.attachmentTimeoutMs);
@@ -3625,6 +3644,36 @@ export async function attachToPlaywright(page, opts) {
     const ebanxFollowUps = new EbanxFollowUps();
     // The approved Payrexx card request on this attachment and the 3-D Secure sends claimed under it (payrexx.ts).
     const payrexxFollowUps = new PayrexxFollowUps();
+    // The approval Nike's order is held to once a card went through Nike's profile (nike-order.ts).
+    const nikeOrders = new NikeOrders();
+    /**
+     * Nike's order is held for every page of the browser context, from the moment this attachment asks the cardholder to
+     * pay through Nike's profile: a context route on Nike's API host, which the Nike order gate judges. Playwright routes
+     * no shared or service worker's request. A context that cannot take the route refuses that payment before anything
+     * is created. The context keeps the route after this checkout ends; only the route of the attachment holding the
+     * context judges the order (nikeContextHolders), and a released order goes straight to the network, past the others.
+     */
+    let nikeInContext = null;
+    // This attachment, as the holder of Nike's order in its browser context (nikeContextHolders).
+    const nikeHolder = {};
+    const holdNikeOrdersInContext = () => Promise.resolve().then(async () => {
+        const context = page.context();
+        await (nikeInContext ??= Promise.resolve().then(() => context.route((url) => nikeOrderRouted(url.toString()), async (route) => {
+            // Another attachment asked through Nike's profile here since this one did: its route judges the order.
+            if (nikeContextHolders.get(context) !== nikeHolder)
+                return route.fallback();
+            const request = route.request();
+            const fail = () => route.abort(refusalFailure(request.url()));
+            const gate = {
+                request: { url: request.url(), method: request.method(), get headers() { return request.headers(); }, get body() { return request.postData(); } },
+                nikeOrders, lifecycle, onEvent: opts.onEvent, lifecycleAborted: () => lifecycle.abort.signal.aborted, terminal: () => !!terminal,
+                effects: { continueRequest: () => route.continue(), answer: fail, abort: fail },
+            };
+            await (nikeOrderGate(gate) ?? route.fallback());
+        })));
+        // Every ask takes the context over once this attachment's route is on, one for another attempt included.
+        nikeContextHolders.set(context, nikeHolder);
+    });
     const aci = new AciGate(opts.vault);
     let navigationBodyReplaced;
     const eprotect = new EprotectGate(opts.vault);
@@ -3984,6 +4033,15 @@ export async function attachToPlaywright(page, opts) {
             // Every request to Barion's gateway hosts once its entry is served (barion.ts), as attachToCdp arms the hosts:
             // the gateway's email check, card posts and 3-D Secure post reach the Barion gate and fail.
             || isArmedBarionUrl(opts.vault, url.toString())
+            // Every request to PayPlug's page host once its entry is served (payplug.ts): the page's card post reaches the
+            // PayPlug gate and fails.
+            || isArmedPayplugUrl(opts.vault, url.toString())
+            // Every request to the VPOS's hosts once its entry is served (cardlink-vpos.ts): the card page's post, which shares
+            // the entry's URL, reaches the Cardlink gate and fails.
+            || isArmedCardlinkVposUrl(opts.vault, url.toString())
+            // Every request to eGHL's hosts once its entry is served (eghl.ts): the card page's post, which shares the entry's
+            // address, reaches the eGHL gate and fails.
+            || isArmedEghlUrl(opts.vault, url.toString())
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
             || isArmedEkashuUrl(opts.vault, url.toString())
@@ -4013,6 +4071,9 @@ export async function attachToPlaywright(page, opts) {
             // Every request to an Eximbay host once its entry is served there (eximbay.ts), as attachToCdp arms the host: the
             // step, the window's lookups and its card post reach the Eximbay gate and fail.
             || isArmedEximbayUrl(opts.vault, url.toString())
+            // Every request to an Oceanpayment host once its card post is served (oceanpayment.ts), as attachToCdp arms the
+            // hosts: Cardinal's device-data call and any other post there reach the Oceanpayment gate and fail.
+            || isArmedOceanpaymentUrl(opts.vault, url.toString())
             // PayPal's legacy Hosted Fields confirm, for every org, as attachToCdp arms it (paypal-hosted-fields.ts).
             || isPaypalHostedFieldsConfirm(url.toString())
             // PayPal's Card Fields confirm and GraphQL on www.paypal.com, for every org, as attachToCdp arms them (paypal-card-forms.ts).
@@ -4121,6 +4182,7 @@ export async function attachToPlaywright(page, opts) {
                 tokenexIframe: tokenexIframeRepeats,
                 ebanx: ebanxFollowUps,
                 payrexx: payrexxFollowUps,
+                nikeOrders,
                 frame: frameOf(request),
                 payrails,
                 shijiSts: { companions: shijiCompanions, page: async () => (await playwrightShijiDocumentPage(request)) ?? `pw:none:${++playwrightShijiSeq}` },
@@ -4306,9 +4368,9 @@ export async function attachToPlaywright(page, opts) {
                 activeRequest = { request, frames, attempt,
                     identity: requestIdentity(opts, request.url(), request.method(), body, undefined, undefined, flexPause?.shape, request.headers()),
                     preparedFrames: preparation ? [...frames] : undefined };
-                // An ACI card-number request: see the same step in attachToCdp.
+                // An ACI or JSON split card's card request: see the same step in attachToCdp.
                 if (!aci.begin(request.url(), request.method(), body, preparation?.merchantOrigin)) {
-                    throw new CheckoutPreparationError(preparation?.id ?? null, ACI_CHECKOUT_REUSED);
+                    throw new CheckoutPreparationError(preparation?.id ?? null, aci.reuseCode(request.url()));
                 }
                 // A Worldpay eProtect registration: see the same step in attachToCdp.
                 eprotect.begin(request.url(), request.method(), () => attempt.stop());
@@ -4356,6 +4418,10 @@ export async function attachToPlaywright(page, opts) {
                 // Paddle's own checkout answers as of the pause, once their texts are read (see attachToCdp).
                 const paddleAnswers = await paddleCheckout.capture(pausedAt, request.url(), attempt.signal);
                 assertRequestLive();
+                if (cardEndpoint && nikeOrders.asking(cardEndpoint.id)) {
+                    await holdNikeOrdersInContext().catch(() => { throw new CardEndpointRefusedError(cardEndpoint.id, 'request_unsupported', "Nike's order cannot be held in this browser"); });
+                    assertRequestLive();
+                }
                 const replay = await opts.vault.authorize({
                     user: opts.user,
                     merchant: opts.merchant,
@@ -4369,6 +4435,8 @@ export async function attachToPlaywright(page, opts) {
                     pageOrigin,
                     pageAmount,
                     ...(payToInterceptMs !== undefined ? { payToInterceptMs } : {}),
+                    // Same as the CDP path: when the request paused, for a VTEX card post's send-by.
+                    pausedAt,
                     preparation,
                     timeoutMs: opts.timeoutMs,
                     signal: lifecycle.abort.signal,
@@ -4415,6 +4483,7 @@ export async function attachToPlaywright(page, opts) {
                 // False only for a card endpoint answer the device withheld (see deliverCardEndpointAnswer).
                 let handedOver = true;
                 if (replay.mode === 'card_endpoint') {
+                    nikeOrders.remember(replay);
                     handedOver = await deliverCardEndpointAnswer(opts, lifecycle, cardEndpoint, replay, { url: deliverRequest.url(), headers: deliverRequest.headers() }, {
                         readJar: () => page.context().cookies(deliverRequest.url()),
                         writeCookie: (cookie) => page.context().addCookies([playwrightCookieParams(cookie)]),