@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/cybersource-flex.generated.d.ts

@@ -12,6 +12,19 @@ declare var CybersourceFlexError: {
 };
 declare function isVerifiedCaptureContext(value: any): boolean;
 declare function flexHostEnvironment(hostname: any): "production" | "sandbox" | null;
+declare var UNIFIED_CHECKOUT_HOSTS: Readonly<{
+    production: "up.cybersource.com";
+    sandbox: "testup.cybersource.com";
+}>;
+declare var UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS: readonly string[];
+declare var UNIFIED_CHECKOUT_FRAMES: readonly string[];
+declare function unifiedCheckoutHostEnvironment(hostname: any): "production" | "sandbox" | null;
+declare function parseUnifiedCheckoutFrame(rawUrl: any): Readonly<{
+    environment: "production" | "sandbox";
+    frame: string;
+    asset: string;
+    captureContext: string;
+}> | null;
 declare var CYBERSOURCE_FLEX_PSP: string;
 declare var CYBERSOURCE_FLEX_CONTENT_TYPE: string;
 declare var CYBERSOURCE_FLEX_TOKENS_URLS: Readonly<{
@@ -38,6 +51,7 @@ declare function verifyCaptureContext(jwt: any, { crypto, now }?: {}): Promise<R
     modulusBytes: number;
     index: any;
     contextType: any;
+    clientVersion: any;
     allowedCardNetworks: readonly any[] | null;
     targetOrigins: readonly any[];
     iat: any;
@@ -76,6 +90,29 @@ declare function buildCardPlaintext(verified: any, card: any, { fields, trigger,
     trigger?: string | undefined;
 }): string;
 declare function sealForContext(verified: any, plaintext: any, { crypto }?: {}): Promise<string>;
+declare function verifyUnifiedCheckoutContext(jwt: any, { crypto, now }?: {}): Promise<Readonly<{
+    raw: any;
+    signingKid: any;
+    environment: any;
+    origin: string;
+    path: string;
+    url: string;
+    jwk: Readonly<{
+        kty: "RSA";
+        n: any;
+        e: any;
+        kid: any;
+    }>;
+    modulusBytes: number;
+    index: any;
+    contextType: any;
+    clientVersion: any;
+    allowedCardNetworks: readonly any[] | null;
+    targetOrigins: readonly any[];
+    iat: any;
+    exp: any;
+}>>;
+declare function buildUnifiedCheckoutPlaintext(verified: any, card: any, { billTo, now }?: {}): string;
 declare var CYBERSOURCE_FLEX_REFUSAL_REASONS: readonly string[];
 declare function cybersourceFlexRefusalCode(text: any): string | null;
 declare function isCybersourceFlexTokenShape(text: any): boolean;
@@ -107,6 +144,7 @@ declare function admitCybersourceFlexPreparation(prepared: any, { crypto, now }?
         modulusBytes: number;
         index: any;
         contextType: any;
+        clientVersion: any;
         allowedCardNetworks: readonly any[] | null;
         targetOrigins: readonly any[];
         iat: any;
@@ -115,4 +153,4 @@ declare function admitCybersourceFlexPreparation(prepared: any, { crypto, now }?
     fields: readonly string[];
 }>>;
 declare function sameCybersourceFlexPreparation(prepared: any, request: any): boolean;
-export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, verifyCaptureContext };
+export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, UNIFIED_CHECKOUT_FRAMES, UNIFIED_CHECKOUT_HOSTS, UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, buildUnifiedCheckoutPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, parseUnifiedCheckoutFrame, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, unifiedCheckoutHostEnvironment, verifyCaptureContext, verifyUnifiedCheckoutContext };

package/dist/cybersource-flex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c6a711b5dc964dbeb45863780001d99b79090f919b282fed9ae6fc06b4839681
+// artifact-sha256: a9a624dbdd5a025d710f99e5ce83a985e4561b4db6d3e60dc427b5e406e4b653
 // src/cybersource-flex-rules.js
 var CYBERSOURCE_FLEX_RULES_SOURCE = Object.freeze({ version: "2.12.1", sha256: "8429ebae83e9745cd53ad8ff0d9ba69bee0087c1435ed0695a25444bed418327" });
 var CYBERSOURCE_FLEX_RULES = [
@@ -201,6 +201,7 @@ async function sealCompactJwe(jwk, plaintext, { crypto }) {
 }
 // src/cybersource-flex-context.js
 var FLEX_TOKENS_PATH = "/flex/v2/tokens";
+var UNIFIED_CHECKOUT_TOKENS_PATH = "/flex/v2/tokens/uc";
 var FLEX_HOSTS = Object.freeze({ production: "flex.cybersource.com", sandbox: "testflex.cybersource.com" });
 var CAPTURE_CONTEXT_MAX_LENGTH = 16384;
 var CLOCK_SKEW_MS = 6e4;
@@ -233,7 +234,8 @@ function origins(value) {
         return Object.freeze([]);
     return Object.freeze(value.filter((origin) => typeof origin === "string" && origin.length <= 2048).slice(0, 16));
 }
-async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
+async function verifyContextWithKeys(jwt, keys, { crypto, now, kind = "microform" } = {}) {
+    const unified = kind === "unified_checkout";
     const [encodedHeader] = compactParts(jwt, 3, CAPTURE_CONTEXT_MAX_LENGTH, "format");
     const peek = jsonFromBytes(base64UrlToBytes(encodedHeader), "format");
     const kid = peek.kid;
@@ -254,8 +256,9 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
     if (!record(flx))
         refuse("format", "the capture context has no Flex section.");
     const origin = `https://${host}`;
-    const url = `${origin}${FLEX_TOKENS_PATH}`;
-    if (flx.origin !== origin || flx.path !== FLEX_TOKENS_PATH || own(flx, "tokensUrl") && flx.tokensUrl !== url) {
+    const path = unified ? UNIFIED_CHECKOUT_TOKENS_PATH : FLEX_TOKENS_PATH;
+    const url = `${origin}${path}`;
+    if (unified ? flx.origin !== origin || flx.tokensUrl !== url || own(flx, "path") : flx.origin !== origin || flx.path !== FLEX_TOKENS_PATH || own(flx, "tokensUrl") && flx.tokensUrl !== url) {
         refuse("url_mismatch", `the capture context does not send the card to ${url}.`);
     }
     const jwk = flx.jwk;
@@ -271,21 +274,22 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
         refuse("expired", "the capture context has expired.");
     }
     const ctx = Array.isArray(payload.ctx) ? payload.ctx : [];
-    const index = ctx.findIndex((entry) => record(entry) && typeof entry.type === "string" && /^mf-/.test(entry.type));
+    const index = ctx.findIndex((entry) => record(entry) && typeof entry.type === "string" && (unified ? /^uc-/ : /^mf-/).test(entry.type));
     if (index < 0)
-        refuse("microform", "the capture context is not a Microform context.");
+        refuse("microform", unified ? "the capture context is not a Unified Checkout context." : "the capture context is not a Microform context.");
     const data = record(ctx[index].data) ? ctx[index].data : {};
     const context = Object.freeze({
         raw: jwt,
         signingKid: kid,
         environment,
         origin,
-        path: FLEX_TOKENS_PATH,
+        path,
         url,
         jwk: Object.freeze({ kty: "RSA", n: jwk.n, e: jwk.e, kid: jwk.kid }),
         modulusBytes: Math.ceil(bits / 8),
         index,
         contextType: ctx[index].type,
+        clientVersion: unified && typeof data.clientVersion === "string" && data.clientVersion.length <= 32 ? data.clientVersion : null,
         allowedCardNetworks: networks(data.allowedCardNetworks),
         targetOrigins: origins(data.targetOrigins),
         iat: Number.isFinite(payload.iat) ? payload.iat : null,
@@ -294,6 +298,51 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
     VERIFIED.add(context);
     return context;
 }
+// src/cybersource-unified-checkout.js
+var UNIFIED_CHECKOUT_HOSTS = Object.freeze({ production: "up.cybersource.com", sandbox: "testup.cybersource.com" });
+var UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS = Object.freeze(["1.8.2"]);
+var UNIFIED_CHECKOUT_FRAMES = Object.freeze(["mce", "orc", "ga"]);
+var FRAME_PATH = /^\/uc\/v1\/assets\/([A-Za-z0-9_-]{16,1024})\/(mce|orc|ga)\/(mce|orc|ga)\.html$/;
+var FRAGMENT_MAX_LENGTH = CAPTURE_CONTEXT_MAX_LENGTH + 4096;
+function unifiedCheckoutHostEnvironment(hostname) {
+    const host = String(hostname ?? "").toLowerCase();
+    if (host === UNIFIED_CHECKOUT_HOSTS.production)
+        return "production";
+    if (host === UNIFIED_CHECKOUT_HOSTS.sandbox)
+        return "sandbox";
+    return null;
+}
+function parseUnifiedCheckoutFrame(rawUrl) {
+    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH + 2048)
+        return null;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    const environment = unifiedCheckoutHostEnvironment(url.hostname);
+    const path = FRAME_PATH.exec(url.pathname);
+    if (url.protocol !== "https:" || url.port || url.username || url.password || !environment || !path || path[2] !== path[3])
+        return null;
+    const fragment = url.hash.slice(1);
+    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(decodeURIComponent(fragment));
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const ctx = value.ctx;
+    if (typeof ctx !== "string" || ctx.length < 1 || ctx.length > CAPTURE_CONTEXT_MAX_LENGTH)
+        return null;
+    return Object.freeze({ environment, frame: path[2], asset: path[1], captureContext: ctx });
+}
 // src/cybersource-flex.js
 var CYBERSOURCE_FLEX_PSP = "cybersource_flex";
 var CYBERSOURCE_FLEX_CONTENT_TYPE = "application/jwt; charset=utf-8";
@@ -343,11 +392,11 @@ function cybersourceFlexEnvironment(url) {
         return "sandbox";
     return void 0;
 }
-var FRAGMENT_MAX_LENGTH = 16384;
+var FRAGMENT_MAX_LENGTH2 = 16384;
 var IFRAME_PATH = /^\/microform\/bundle\/v(\d+\.\d+\.\d+)\/iframe\.html$/;
 var FIELD_TYPES = Object.freeze(["number", "securityCode"]);
 function parseMicroformFragment(rawUrl) {
-    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH + 2048)
+    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH2 + 2048)
         return null;
     let url;
     try {
@@ -361,7 +410,7 @@ function parseMicroformFragment(rawUrl) {
     if (url.protocol !== "https:" || url.port || url.username || url.password || !environment || !path)
         return null;
     const fragment = url.hash.slice(1);
-    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH)
+    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH2)
         return null;
     let value;
     try {
@@ -556,6 +605,46 @@ async function sealForContext(verified, plaintext, { crypto } = {}) {
         refuse("context", "the capture context was not verified on this device.");
     return sealCompactJwe(verified.jwk, plaintext, { crypto });
 }
+function verifyUnifiedCheckoutContext(jwt, { crypto, now } = {}) {
+    return verifyContextWithKeys(jwt, CYBERSOURCE_FLEX_SIGNING_KEYS, { crypto, now, kind: "unified_checkout" });
+}
+var BILL_TO_NAME = /^[^\u0000-\u001f\u007f<>]{1,60}$/;
+var BILL_TO_EMAIL = /^[^\s@<>]{1,64}@[^\s@<>]{1,190}$/;
+function buildUnifiedCheckoutPlaintext(verified, card, { billTo, now } = {}) {
+    if (!isVerifiedCaptureContext(verified) || !/^uc-/.test(verified.contextType))
+        refuse("context", "the capture context was not verified as a Unified Checkout context on this device.");
+    if (!UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS.includes(verified.clientVersion))
+        refuse("microform_version", "this Unified Checkout client version was not reviewed.");
+    const first = billTo?.firstName;
+    const last = billTo?.lastName;
+    const email = billTo?.email;
+    if (typeof first !== "string" || !BILL_TO_NAME.test(first) || typeof last !== "string" || !BILL_TO_NAME.test(last) || email !== void 0 && (typeof email !== "string" || !BILL_TO_EMAIL.test(email)))
+        refuse("fields", "the billing name or email is not one the card entry takes.");
+    const normalized = flexCard(card, typeof now === "function" ? now() : Date.now());
+    const detected = detectCardTypes(normalized.number, verified.allowedCardNetworks ?? void 0);
+    if (detected.codes.length === 0)
+        refuse("card_network", "this merchant's CyberSource form does not accept this card network.");
+    if (!detected.valid)
+        refuse("card_invalid", "the card number fails its network's length or check digit.");
+    if (detected.securityCode.required && !new RegExp(`^[0-9]{${detected.securityCode.length}}$`).test(normalized.cvc)) {
+        refuse("card_security_code", "the security code has the wrong length for this card.");
+    }
+    const data = {
+        PANENTRY: {
+            orderInformation: { billTo: { firstName: first, lastName: last, ...email !== void 0 ? { email } : {} } },
+            paymentInformation: { card: {
+                    number: normalized.number,
+                    expirationMonth: normalized.expirationMonth,
+                    expirationYear: normalized.expirationYear,
+                    securityCode: normalized.cvc,
+                    type: detected.codes[0]
+                } }
+        }
+    };
+    const plaintext = JSON.stringify({ data, context: verified.raw, index: 0 }).replace(/[\u0080-\uffff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    asciiBytes(plaintext, "card_ascii");
+    return plaintext;
+}
 var TOKEN_MAX_LENGTH = 8192;
 var CYBERSOURCE_FLEX_REFUSAL_REASONS = Object.freeze([
     "VALIDATION_ERROR",
@@ -728,4 +817,4 @@ function sameCybersourceFlexPreparation(prepared, request) {
     const theirs = new Set(two.fields);
     return mine.size === one.fields.length && theirs.size === two.fields.length && mine.size === theirs.size && [...mine].every((field) => theirs.has(field));
 }
-export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, verifyCaptureContext };
+export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, UNIFIED_CHECKOUT_FRAMES, UNIFIED_CHECKOUT_HOSTS, UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, buildUnifiedCheckoutPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, parseUnifiedCheckoutFrame, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, unifiedCheckoutHostEnvironment, verifyCaptureContext, verifyUnifiedCheckoutContext };

package/dist/datatrans.generated.js

@@ -1,6 +1,25 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 829167e03a7ffe9fc109ababe9755f1263a840fd5294ebec970e08d41aa9741b
+// artifact-sha256: 169752c8d6a6c9f131c83502766f0026b2ffa45cf9f27c450735eef5ad2fa931
+// src/answer-card-leak.js
+var DECIMAL = /\p{Nd}/u;
+function digitValue(char) {
+    const point = char.codePointAt(0);
+    let first = point;
+    while (DECIMAL.test(String.fromCodePoint(first - 1)))
+        first -= 1;
+    return String((point - first) % 10);
+}
+var ENCLOSED = /* @__PURE__ */ Object.freeze([[9451, 10, 11], [9461, 10, 1], [9471, 1, 0], [10102, 30, 1], [127243, 2, 0]]);
+var ENCLOSED_CHAR = /[\u24eb-\u24ff\u2776-\u2793\u{1f10b}\u{1f10c}]/gu;
+function enclosedValue(char) {
+    const point = char.codePointAt(0);
+    const [first, , start] = ENCLOSED.find(([from, size]) => point >= from && point < from + size);
+    return String(first === 127243 ? 0 : first === 10102 ? (point - first) % 10 + 1 : start + point - first);
+}
+var asciiDigits = (text2) => (typeof text2.normalize === "function" ? text2.normalize("NFKC") : text2).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
+var digitCount = (text2) => (asciiDigits(String(text2)).match(/\p{N}/gu) ?? []).length;
+var NAME_DIGITS = 3;
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";
@@ -374,6 +393,8 @@ function rebuildCardInfo(info) {
         return null;
     if (owns(info, "brand") && !optionalText(info.brand, CARD_WORD) || owns(info, "type") && !optionalText(info.type, CARD_WORD) || owns(info, "usage") && !optionalText(info.usage, CARD_WORD) || owns(info, "country") && !optionalText(info.country, COUNTRY) || owns(info, "issuer") && info.issuer !== null && !plain(info.issuer, 128) || owns(info, "coBrand") && info.coBrand !== null && !plain(info.coBrand, 64) || owns(info, "accountType") && !optionalText(info.accountType, CARD_WORD) || owns(info, "binLength") && !optionalBinLength(info.binLength))
         return null;
+    if (digitCount(`${info.issuer ?? ""} ${info.coBrand ?? ""}`) > NAME_DIGITS)
+        return null;
     const safe = {};
     for (const key of CARD_INFO_KEYS)
         if (owns(info, key))

package/dist/eghl.d.ts

@@ -0,0 +1,40 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export declare const EGHL_PSP = "eghl";
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export declare const EGHL_CAPABILITY = "eghl_hosted_payment_page";
+/** eGHL's live host, and its test platform's. */
+export declare const EGHL_HOST = "securepay.e-ghl.com";
+export declare const EGHL_SANDBOX_HOST = "test2pay.ghl.com";
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export declare function isEghlEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export declare function isEghlPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export declare function isArmedEghlUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/eghl.js

@@ -0,0 +1,72 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export const EGHL_PSP = 'eghl';
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export const EGHL_CAPABILITY = 'eghl_hosted_payment_page';
+/** eGHL's live host, and its test platform's. */
+export const EGHL_HOST = 'securepay.e-ghl.com';
+export const EGHL_SANDBOX_HOST = 'test2pay.ghl.com';
+const LIVE_PATH = '/ipg/payment.aspx';
+const SANDBOX_PATH = '/ipgsg/payment.aspx';
+// An entry of that shape, for asking whether this build's registry serves the entry.
+const PROBE = 'https://securepay.e-ghl.com/IPG/payment.aspx?TransactionType=SALE';
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export function isEghlEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 8192 || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password || url.search.length < 2)
+        return false;
+    const path = url.pathname.toLowerCase();
+    return (url.hostname === EGHL_HOST && path === LIVE_PATH) || (url.hostname === EGHL_SANDBOX_HOST && path === SANDBOX_PATH);
+}
+/** Whether a URL is on one of eGHL's hosts, live or test: https, no credentials, any port, any case, a trailing dot or not. */
+function onEghlHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return url.protocol === 'https:' && !url.username && !url.password && (host === EGHL_HOST || host === EGHL_SANDBOX_HOST);
+}
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export function isEghlPayStep(url, method) {
+    return onEghlHost(url) && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export function isArmedEghlUrl(vault, url) {
+    return onEghlHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'GET');
+}

package/dist/elavon-converge.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 136e1c2b0fd2bdee0cfbf5efbbfaf1a92ace7d1cc52e17a3fd5a4584370e5e53
+// artifact-sha256: 7f75fa0deecb8db3b33aa07bdaf4a70e5e548c9bd528b45348022c22138599b3
 // src/elavon-converge.js
 var CONVERGE_HOSTS = /* @__PURE__ */ Object.freeze(["api.convergepay.com", "api.demo.convergepay.com", "www.convergepay.com"]);
 var CONVERGE_DEMO_HOST = "api.demo.convergepay.com";
@@ -339,6 +339,8 @@ var RESPONSE_FIELDS = /* @__PURE__ */ Object.freeze([
     "ssl_customer_code"
 ]);
 var MASKED_CARD = /^(?=.{12,19}$)\d{0,6}[*Xx#]+\d{0,4}$/;
+var CARD_WORDS = /* @__PURE__ */ Object.freeze(["ssl_card_short_description", "ssl_card_type"]);
+var hasDigit = (value) => /\p{N}/u.test(String(value).normalize("NFKC"));
 var FIELD_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
 function luhn(digits) {
     let sum = 0;
@@ -391,7 +393,7 @@ function keepReturnField(name, value) {
         return false;
     if (lower === "ssl_card_number")
         return typeof value === "string" && MASKED_CARD.test(value);
-    return safeScalar(value);
+    return safeScalar(value) && !(CARD_WORDS.includes(lower) && hasDigit(value));
 }
 function sanitizeReturnList(list) {
     if (Array.isArray(list)) {
@@ -423,7 +425,7 @@ function sanitizeConvergeResponse(text) {
         if (!owns(answer.responseFields, name))
             continue;
         const value = answer.responseFields[name];
-        if (name === "ssl_card_number" ? typeof value === "string" && MASKED_CARD.test(value) : safeScalar(value))
+        if (name === "ssl_card_number" ? typeof value === "string" && MASKED_CARD.test(value) : safeScalar(value) && !(CARD_WORDS.includes(name) && hasDigit(value)))
             fields[name] = value;
     }
     out.responseFields = fields;

package/dist/gmo.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a65199bcbf0b67546130fb4f2c12ba72c8f51a2ff5b4e3054e2bfcc29b06f95d
+// artifact-sha256: 192df19d53f4c68d74db3d692397b94f4a1b45ce8bee44a2326e01b56a329adf
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/hold.d.ts

@@ -32,6 +32,7 @@ export declare const HOLD_DEADLINE_MARGIN_MS = 2000;
  * processor's frame encrypts first (Bolt, Adyen): those need their own rule. Null without a usable number.
  */
 export declare function placeholderHoldRule(numbers: readonly string[], deadlineMs?: number): HoldOnlyRule | null;
+export declare function encryptedCardHoldRule(deadlineMs?: number): HoldOnlyRule;
 /** The hold-only rule a request is a card request under, or null. */
 export declare function matchHoldOnlyRule(request: {
     url: string;
@@ -99,6 +100,12 @@ export interface CardRequestHold {
     readonly held: HeldCardRequest | null;
     /** Card requests failed without being held: a second one, a retry, or one after a decision. */
     readonly refused: number;
+    /**
+     * The hold-only rules armed beside the registry's recognisers (`bolt`, `placeholder_card`, `encrypted_card`). A
+     * processor whose card is encrypted in the page and may be sent inside the merchant's own request (Adyen's
+     * Advanced flow) is covered only with `encrypted_card`.
+     */
+    readonly covers: readonly string[];
     /** Resolves with the held request once one is held, or null after `timeoutMs` or once the hold is over. */
     whenHeld(timeoutMs?: number): Promise<HeldCardRequest | null>;
     release(input: HoldReleaseInput): Promise<HoldReleaseOutcome>;
@@ -149,6 +156,7 @@ export declare class HoldGate implements CardRequestHold {
     get state(): HoldState;
     get held(): HeldCardRequest | null;
     get refused(): number;
+    get covers(): readonly string[];
     /** Fetch patterns the hold-only rules need beside the registry's. */
     patterns(): Array<{
         urlPattern: string;

package/dist/hold.js

@@ -17,6 +17,9 @@
 //   - Any request whose body carries the placeholder card number (`placeholderNumbers`): a store's own card post or
 //     an unknown processor. The browser only ever holds the placeholder, so a body with its digits is a card request
 //     wherever it goes. In sandbox it may be released unchanged (it carries the documented test number only).
+//   - With `placeholderNumbers`, any request whose body carries a card a processor's frame encrypted in the page
+//     (Adyen's encryptedCardNumber, Braintree's legacy CSE, Worldline Connect's encryptedCustomerInput) sent to the
+//     merchant's own server instead of the processor (encryptedCardHoldRule). Held, then only cancelled.
 // The hold records the processor and the endpoint (origin and path, any path credential masked), never a body or a
 // header.
 import { redactUrl } from './client.js';
@@ -54,6 +57,36 @@ export function placeholderHoldRule(numbers, deadlineMs = HOLD_DEFAULT_DEADLINE_
         patterns: PLACEHOLDER_RESOURCE_TYPES.map((resourceType) => ({ urlPattern: '*', resourceType })),
     };
 }
+/**
+ * A card a processor's own frame encrypted in the page, sent on inside the merchant's own request (its order or payment
+ * step) instead of to the processor: the placeholder's digits never appear, so placeholderHoldRule cannot see it, and
+ * no recogniser matches the merchant's URL. Adyen's card component on Salesforce Commerce, Magento and other Advanced
+ * (non-Sessions) integrations posts `encryptedCardNumber` (a JWE, `eyJ...`, or the legacy `adyenjs_0_1_...`) to the
+ * store's CheckoutServices-SubmitPayment / PlaceOrder: ca.coach.com's PlaceOrder answered 200 with no hold on
+ * 2026-10-23. Also caught: Braintree's legacy client-side encryption (`$bt4|javascript_...`) and Worldline/Ingenico
+ * Connect's `encryptedCustomerInput`. Matched in JSON, escaped JSON, URL-encoded and form bodies. Held, then only
+ * cancelled: no release can answer a request the vault never encrypted for.
+ */
+const Q = '(?:\\\\?"|%22|%5C%22|\\\\u0022)?';
+const SEP = '\\s*(?::|%3A|=)\\s*';
+// A multipart field: the name's closing quote, the part's remaining header lines, a blank line, then the value.
+// The value is read on its own line only: never across a line break, and never a boundary line (`--...`), so an empty
+// field followed by a long boundary is not a card.
+const PART = '"?[^\\r\\n]{0,80}\\r?\\n(?:[^\\r\\n]{1,200}\\r?\\n){0,4}\\r?\\n[ \\t]*(?!--)';
+const ENCRYPTED_CARD_BODY = new RegExp([
+    `encryptedCardNumber${Q}${SEP}${Q}\\s*(?:eyJ|adyenjs_|[A-Za-z0-9+/_$|.-]{40})`,
+    `encryptedCardNumber${PART}(?:eyJ|adyenjs_|[A-Za-z0-9+/_$|.-]{40})`,
+    `encryptedCustomerInput${PART}[A-Za-z0-9+/_.-]{40}`,
+    'adyenjs_0_[0-9]+_[0-9]+(?:\\$|%24)',
+    '\\$bt[0-9]\\|javascript_|%24bt[0-9](?:\\||%7C)javascript_',
+    `encryptedCustomerInput${Q}${SEP}${Q}\\s*[A-Za-z0-9+/_.-]{40}`,
+].join('|'), 'i');
+export function encryptedCardHoldRule(deadlineMs = HOLD_DEFAULT_DEADLINE_MS) {
+    return {
+        psp: 'encrypted_card', match: /^[a-z]+:\/\//i, body: ENCRYPTED_CARD_BODY, kind: 'store_card_post', deadlineMs, methods: ['POST', 'PUT', 'PATCH'],
+        patterns: PLACEHOLDER_RESOURCE_TYPES.map((resourceType) => ({ urlPattern: '*', resourceType })),
+    };
+}
 /** The hold-only rule a request is a card request under, or null. */
 export function matchHoldOnlyRule(request, rules) {
     for (const rule of rules) {
@@ -127,11 +160,15 @@ export class HoldGate {
         this.sandbox = sandbox;
         this.emit = emit;
         const placeholder = options.placeholderNumbers?.length ? placeholderHoldRule(options.placeholderNumbers) : null;
-        this.rules = [BOLT_HOLD_RULE, ...(placeholder ? [placeholder] : [])];
+        // A page the vault types its placeholder into is watched for every card leaving it, encrypted or not; the
+        // encrypted-card rule shares the placeholder rule's patterns, so it pauses nothing more. It comes first: a body
+        // carrying both the placeholder and an encrypted card is the encrypted card's, and is never continued.
+        this.rules = [BOLT_HOLD_RULE, ...(placeholder ? [encryptedCardHoldRule(), placeholder] : [])];
     }
     get state() { return this._state; }
     get held() { return this._held ? { ...this._held } : null; }
     get refused() { return this._refused; }
+    get covers() { return this.rules.map((r) => r.psp); }
     /** Fetch patterns the hold-only rules need beside the registry's. */
     patterns() { return this.rules.flatMap((r) => r.patterns); }
     deadlineFor(psp, rule) {
@@ -245,7 +282,11 @@ export class HoldGate {
         let settle;
         const settled = new Promise((resolve) => { settle = resolve; });
         if (!held.replayable) {
-            if (held.kind === 'store_card_post' && input.continuePlaceholder && this.sandbox) {
+            // Only the plain placeholder post may be sent on in sandbox: an encrypted card inside a merchant's own order or
+            // payment request (encrypted_card) is the order itself, and is never continued in any mode.
+            if (held.psp === 'encrypted_card')
+                return fail('encrypted_card_post');
+            if (held.kind === 'store_card_post' && held.psp === 'placeholder_card' && input.continuePlaceholder && this.sandbox) {
                 this.decide({ kind: 'continue', settle });
                 this.emit('card_request_released', { psp: held.psp, continued: true, amount: input.amount, currency: input.currency.toLowerCase(), upTo: !!input.upTo });
                 return settled;

package/dist/hosted-entry.js

@@ -18,11 +18,15 @@ import { PRZELEWY24_PSP, isPrzelewy24EntryUrl } from './przelewy24.js';
 import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
 import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
 import { BARION_PSP, isBarionEntryUrl } from './barion.js';
+import { PAYPLUG_PSP, isPayplugEntryUrl } from './payplug.js';
+import { EGHL_PSP, isEghlEntryUrl } from './eghl.js';
 const HOSTED_GET_ENTRIES = new Map([
     [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
     [COMGATE_PSP, isComgateEntryUrl],
     [TRANSBANK_PSP, isTransbankEntryUrl],
     [BARION_PSP, isBarionEntryUrl],
+    [PAYPLUG_PSP, isPayplugEntryUrl],
+    [EGHL_PSP, isEghlEntryUrl],
 ]);
 /** Whether this processor's hosted page is entered with a GET this build reads exactly. */
 export function hasHostedGetEntry(psp) {