@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/pre-claim.js

@@ -66,7 +66,7 @@ import { datatransPauseDecision, isDatatransHost } from './datatrans.js';
 import { DATATRANS_INVALID_REQUEST } from './datatrans.generated.js';
 import { INVALID_TOKENEX_IFRAME_REQUEST, TOKENEX_IFRAME_PSP, isTokenexIframePath, servesTokenexIframe, tokenexIframePauseDecision, } from './tokenex-iframe.js';
 import { isPelecardHost, pelecardRefusal } from './pelecard.js';
-import { ACI_CHECKOUT_REUSED } from './aci.js';
+import { ACI_CHECKOUT_REUSED, SPLIT_CARD_REUSED } from './aci.js';
 import { ACI_EXPIRY_UNSTRIPPABLE } from './aci.generated.js';
 import { CREDITGUARD_PPS_HOSTS, classifyCreditguardRequest, creditguardCompanionAnswer, creditguardCompanionCall, creditguardNuveiRefusal, creditguardProcessRefusal, creditguardProcessTxId, } from './creditguard.generated.js';
 import { isPrimerPciHost, primerRequestVerdict } from './primer.js';
@@ -78,6 +78,7 @@ import { isFiservCaptureHost, isFiservPausableBody } from './fiserv.js';
 import { CYBERSOURCE_FLEX_PSP, isCybersourceFlexHost } from './cybersource-flex.js';
 import { cardEndpointCarriesCard, cardEndpointDetail, cardEndpointFor, cardEndpointLive, cardEndpointPasses, cardEndpointResendFor, cardEndpointReviewed, } from './card-endpoint.js';
 import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
+import { NIKE_ORDER_DETAIL } from './nike-order.js';
 import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsPaymentUrl, isPayrailsStaticHost, payrailsKeyRefusal, payrailsPaymentRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { isPaymentHighwayCardLookup, isPaymentHighwayHost, isPaytrailCardMethodUrl, isPaytrailEntry, isPaytrailServed } from './paytrail.js';
@@ -86,9 +87,14 @@ import { isArmedTransbankUrl } from './transbank.js';
 import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
 import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
 import { isArmedBarionUrl, isBarionPayStep } from './barion.js';
+import { isArmedPayplugUrl, isPayplugPayStep } from './payplug.js';
+import { isArmedCardlinkVposUrl, isCardlinkVposEntry } from './cardlink-vpos.js';
+import { isArmedEghlUrl, isEghlPayStep } from './eghl.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
 import { isArmedComgateUrl } from './comgate.js';
 import { isArmedEximbayUrl, isEximbayEntry } from './eximbay.js';
+import { isArmedOceanpaymentUrl, isOceanpaymentSendPay } from './oceanpayment.js';
+import { aurusPreClaim } from './aurus.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { PAYPAL_CARD_FIELDS_REASON, PAYPAL_GUEST_CHECKOUT_REASON, isPaypalCardFieldsConfirm, isPaypalGraphql, paypalCardFieldsBody, paypalGraphqlCard, paypalGraphqlNamesCardOperation, } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
@@ -287,6 +293,38 @@ async function cardEndpointUnsupported(ctx, profile, reviewed) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// Nike's order after its card request (nike-order.ts, payment-core merchant-card-endpoint-nike-order.js), Felipe's amount
+// rule C: the one request off a profile's endpoint the SDK holds. Once the adapters asked the cardholder to pay a card
+// request through Nike's profile on this attachment, every write to Nike's API host is judged here. One reviewed order
+// whose total and currency are the approved amount continues with its body unchanged, and only while the checkout still
+// names that approval as under way (followUpMaySend); after it, only a byte-identical retry does. An order that fails the
+// rule aborts, so Nike never authorizes the card, and the checkout ends failed with nothing charged
+// (lifecycle.merchantOrderRefused); so does every order while no approved amount was read, and every later order under
+// that approval. Another order after the one let go, or one the checkout no longer names as under way, aborts and leaves
+// the checkout's state as it is. Anything else, every request of an attachment where no card went through Nike's
+// profile included, defers. The adapters also run nikeOrderGate on a request paused at the browser target.
+const nikeOrderPreClaim = (ctx) => nikeOrderGate(ctx);
+/** The Nike order gate's decision, already performed, or undefined when the request is not its to judge. */
+export function nikeOrderGate(ctx) {
+    const verdict = ctx.nikeOrders?.judge(ctx.request.url, ctx.request.method, () => ctx.request.body, (authorizationId) => followUpMaySend(ctx, { authorizationId })) ?? null;
+    if (!verdict)
+        return undefined;
+    return verdict.refusal === null ? nikeOrderReleased(ctx, verdict.authorizationId) : nikeOrderRefused(ctx, verdict.authorizationId, verdict.refusal);
+}
+// The refusals that stop one order and leave the checkout's state as it is.
+const NIKE_ORDER_STOPS = new Set(['another_order', 'approval_not_current', 'earlier_order_refused']);
+async function nikeOrderReleased(ctx, authorizationId) {
+    ctx.onEvent?.({ type: 'merchant_order_released', detail: { authorizationId, ...NIKE_ORDER_DETAIL } });
+    await ctx.effects.continueRequest().catch(() => { });
+    return { kind: 'continue' };
+}
+async function nikeOrderRefused(ctx, authorizationId, reason) {
+    if (!NIKE_ORDER_STOPS.has(reason))
+        ctx.lifecycle.merchantOrderRefused(`merchant_order_${reason}`);
+    ctx.onEvent?.({ type: 'merchant_order_refused', detail: { authorizationId, ...NIKE_ORDER_DETAIL, reason } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // Mercado Pago's native Checkout Pro shares one origin between its BIN-lookup
 // configuration and its card association. A request that is not for that origin
 // defers synchronously; a POST to it is handled asynchronously (a document read
@@ -1034,6 +1072,12 @@ async function pelecardBlock(ctx, reason) {
 // Everything else on ACI's hosts (the widget script, /bins, /v1/collect, GETs)
 // is not a POST to a checkout and defers. Synchronous for the card-number
 // request, so it pauses in the microtask it paused in.
+// A JSON split card the registry serves (aci.ts) takes the same path, keyed by
+// the URL its legs share: its card request defers to the arbiter unless that URL
+// already has one answered, or one running with no approval open
+// (split_card_reused), its code and expiry requests are held, a holder request
+// continues, and anything else is refused with the processor's code or
+// split_card_leg_unsupported. It has no /payment.
 const aciPreClaim = (ctx) => {
     const leg = ctx.aci?.classify(ctx.request.url, ctx.request.method, ctx.request.body);
     if (!leg)
@@ -1050,8 +1094,15 @@ const aciPreClaim = (ctx) => {
         return aciPayment(ctx);
     // The card-number request: the arbiter pauses it for the vault claim flow,
     // unless this checkout already has one running or answered (AciGate.begin).
-    if (ctx.aci.reused(leg))
-        return aciRefuse(ctx, ACI_CHECKOUT_REUSED);
+    // While a JSON split card's approval is still open, its card request again is
+    // the page's retry of the one it gave up on: the adapters bind that retry to
+    // the open approval, or refuse it there as a second purchase, so the page's
+    // retry gets the late approval's answer instead of a refusal here.
+    if (ctx.aci.reused(leg)) {
+        if ('group' in leg && ctx.awaitingApproval())
+            return undefined;
+        return aciRefuse(ctx, 'group' in leg ? SPLIT_CARD_REUSED : ACI_CHECKOUT_REUSED);
+    }
     return undefined;
 };
 async function aciContinue(ctx) {
@@ -1059,16 +1110,17 @@ async function aciContinue(ctx) {
     return { kind: 'continue' };
 }
 async function aciHold(ctx, leg) {
+    const prefix = 'group' in leg ? 'split_card' : 'aci';
     const answer = await ctx.aci.hold(leg);
     if (answer && !ctx.interceptionAborted() && !ctx.lifecycleAborted()) {
         try {
             await ctx.effects.answer(answer);
-            ctx.onEvent?.({ type: 'aci_leg_absorbed', detail: { url: redactUrl(ctx.request.url) } });
+            ctx.onEvent?.({ type: `${prefix}_leg_absorbed`, detail: { url: redactUrl(ctx.request.url) } });
             return { kind: 'answer' };
         }
         catch { /* the page's request is gone; nothing was forwarded */ }
     }
-    ctx.onEvent?.({ type: 'blocked', detail: 'aci_leg_unanswered' });
+    ctx.onEvent?.({ type: 'blocked', detail: `${prefix}_leg_unanswered` });
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
@@ -1680,6 +1732,61 @@ export const barionPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// PayPlug's payment page (payplug.ts). Once this build's registry serves PayPlug's entry (a capability the API serves
+// only to Agentcard's own company), every request to PayPlug's page host pauses. The merchant's redirect to the page,
+// a GET of /pay/<payment id> or /pay/test/<payment id> exactly, is no step of this gate's: it defers, and the terminal
+// arbiter pauses it for the claim flow like any card request, so the cardholder's device pays it. Every step toward
+// paying on the page itself aborts as an unsupported checkout: every POST to the page's host, the card post among
+// them. So PayPlug never sees the card the agent typed. The page's own GETs, its scripts, styles, images and frames,
+// continue. With PayPlug not served, the gate defers, and every request continues as before. Synchronous until it must
+// abort, like every gate. Exported for the gate registry's tests.
+export const payplugPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isPayplugPayStep(url, method) || !isArmedPayplugUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
+// eGHL's payment page (eghl.ts). Once this build's registry serves eGHL's entry (a capability the API serves only to
+// Agentcard's own company), every request to eGHL's hosts pauses. The merchant's entry, a GET of /IPG/payment.aspx whose
+// query names the payment, is no step of this gate's: it defers, and the terminal arbiter pauses it for the claim flow
+// like any card request, so the cardholder's device pays it. Every step toward paying on the page itself aborts as an
+// unsupported checkout: every POST to eGHL's hosts, the card page's card post to the entry's own address among them. So
+// eGHL never sees the card the agent typed. The page's own GETs continue. With eGHL not served, the gate defers, and
+// every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate registry's
+// tests.
+export const eghlPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isEghlPayStep(url, method) || !isArmedEghlUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
+// Cardlink's VPOS (cardlink-vpos.ts). Once this build's registry serves the entry (a capability the API serves only to
+// Agentcard's own company), every request to the VPOS's hosts pauses, and this gate judges the POSTs:
+//   - the merchant's entry, an entry body posted to /vpos/shophandlermpi on one of the three live hosts, defers, and the
+//     terminal arbiter pauses it for the claim flow like any card request: the cardholder's device pays it;
+//   - every other POST (the card page's post and its card check, which share the entry's URL and carry the page's own
+//     fields, a body the adapter could not read, and anything on Cardlink's test hosts) aborts as an unsupported
+//     checkout, so the VPOS never sees the card the agent typed.
+// A GET (the card page's script, its status poll) is not this gate's and continues. With the lane not served, the gate
+// defers, and every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate
+// registry's tests.
+export const cardlinkVposPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isArmedCardlinkVposUrl(ctx.vault, url))
+        return undefined;
+    // The body is a getter an adapter can fail in (Playwright's postData() throws on a body it cannot decode): a body that
+    // cannot be read is no entry this gate can tell from a card post, so it fails closed, aborted and reported like one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return processorPageAbort(ctx);
+    }
+    if (isCardlinkVposEntry(url, method, body))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -1844,6 +1951,21 @@ export const eximbayPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// Oceanpayment's hosted payment page (oceanpayment.ts). Once this build's registry serves Oceanpayment's card post (a
+// capability the API serves only to the company the gate turns Oceanpayment on for), every request to its two hosts
+// pauses, and this gate judges the ones that are not a GET:
+//   - the page's card post, exactly as its form action writes it, defers, and the terminal arbiter pauses it for the
+//     claim flow like any card request: the cardholder's device pays it;
+//   - every other one (Cardinal's device-data call, which carries the typed number, a card post of another spelling, the
+//     page's cancel) aborts as an unsupported checkout, so Oceanpayment never sees the card the agent typed.
+// A GET (the page, its scripts, its log) is not this gate's and continues. With Oceanpayment not served, the gate defers
+// and every request continues as before. Synchronous until it must abort, like every gate. Exported for its tests.
+export const oceanpaymentPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() === 'GET' || !isArmedOceanpaymentUrl(ctx.vault, url) || isOceanpaymentSendPay(url, method))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // PayPal's legacy Hosted Fields (paypal-hosted-fields.ts). Its tokenization frame posts the card the
 // agent typed to the Orders v2 confirm-payment-source on cors.api.paypal.com (or its sandbox), which
 // no Vault mode takes over, so every company's adapters hand each POST there to this gate:
@@ -2499,8 +2621,9 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, paypalHostedFieldsPreClaim,
-    paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, cardlinkVposPreClaim, eghlPreClaim, paypalHostedFieldsPreClaim,
+    paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim,
+    oceanpaymentPreClaim, aurusPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-capabilities.generated.d.ts

@@ -1193,10 +1193,6 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly psp: "vgs";
         readonly reason: "iframe_bound_tokenization";
         readonly action: "human_checkout";
-    }, {
-        readonly psp: "bluesnap";
-        readonly reason: "multi_request_tokenization_not_supported";
-        readonly action: "human_checkout";
     }, {
         readonly psp: "stripe";
         readonly reason: "unbound_token_to_payment_intent_continuation";

package/dist/preflight-capabilities.generated.js

@@ -1840,11 +1840,6 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             "reason": "iframe_bound_tokenization",
             "action": "human_checkout"
         },
-        {
-            "psp": "bluesnap",
-            "reason": "multi_request_tokenization_not_supported",
-            "action": "human_checkout"
-        },
         {
             "psp": "stripe",
             "reason": "unbound_token_to_payment_intent_continuation",

package/dist/preflight-catalog.json

@@ -211,7 +211,26 @@
       "origin": "https://js.braintreegateway.com",
       "path_pattern": "/web/:version/js/*",
       "hostname_pattern": "^js\\.braintreegateway\\.com$",
-      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$)",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.paypal.com/braintree/docs/start/hello-client/javascript/v3/",
+          "reviewed_on": "2026-09-11"
+        }
+      ]
+    },
+    {
+      "id": "braintree-web-wallet",
+      "psp": "braintree",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://js.braintreegateway.com",
+      "path_pattern": "/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js",
+      "card_free": "braintree-web's client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.",
+      "hostname_pattern": "^js\\.braintreegateway\\.com$",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$",
       "sources": [
         {
           "kind": "official_documentation",
@@ -2139,6 +2158,52 @@
       "hostname_pattern": "^cdn\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$",
       "pathname_pattern": "^\\/secure-fields\\/(?:latest|[0-9]{1,3}(?:\\.[0-9]{1,3}){0,2})\\/secure-fields\\.js$"
     },
+    {
+      "id": "bambora-na-custom-checkout-fields",
+      "psp": "bambora",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://libs.na.bambora.com",
+      "path_pattern": "/customcheckout/1.:minor.:patch{,-:build}/iframe.html",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://docs.na.worldline-solutions.com/build-your-integration/checkout-form/custom-checkout/reference",
+          "reviewed_on": "2026-09-11"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "catalog-psp-scan-2026-10-23:kent-ca-custom-checkout-1.0.2-card-fields",
+          "reviewed_on": "2026-10-23"
+        }
+      ],
+      "hostname_pattern": "^libs\\.na\\.bambora\\.com$",
+      "pathname_pattern": "^\\/customcheckout\\/1\\.[0-9]{1,3}\\.[0-9]{1,3}(?:-[0-9]{1,4})?\\/iframe\\.html$"
+    },
+    {
+      "id": "worldpay-wpg-hosted-payment-page",
+      "psp": "worldpay",
+      "kinds": [
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://payments.worldpay.com",
+      "path_pattern": "/app/{hpp,hpp-iframe}/*",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "catalog-psp-scan-2026-10-23:razer-worldpay-hosted-payment-page",
+          "reviewed_on": "2026-10-23"
+        }
+      ],
+      "variant_unverified": "The implemented Worldpay adapter covers Access Checkout card sessions; Worldpay hosted payment pages under payments.worldpay.com/app/hpp take the card on Worldpay's own page and are not admitted.",
+      "hostname_pattern": "^payments\\.worldpay\\.com$",
+      "pathname_pattern": "^\\/app\\/hpp(?:-iframe)?\\/"
+    },
     {
       "id": "paypal-hosted-fields-payments-sdk",
       "psp": "paypal",
@@ -2520,6 +2585,92 @@
       "hostname_pattern": "^flex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
+    {
+      "id": "aurus-ecom-iframe",
+      "psp": "aurus",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/getiframe",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/getiframe$"
+    },
+    {
+      "id": "aurus-ecom-init-script",
+      "psp": "aurus",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/ecominitjs",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/ecominitjs$"
+    },
     {
       "id": "juspay-hypercheckout-payment-page",
       "psp": "juspay",
@@ -3519,6 +3670,54 @@
       "hostname_pattern": "^testflex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
     {
       "id": "cybersource-secure-acceptance-silent-order-post-test",
       "psp": "cybersource_secure_acceptance",
@@ -6958,11 +7157,6 @@
       "reason": "iframe_bound_tokenization",
       "action": "human_checkout"
     },
-    {
-      "psp": "bluesnap",
-      "reason": "multi_request_tokenization_not_supported",
-      "action": "human_checkout"
-    },
     {
       "psp": "stripe",
       "reason": "unbound_token_to_payment_intent_continuation",

package/dist/preflight-playwright.d.ts

@@ -20,9 +20,9 @@ export interface CheckoutCollectionOptions {
     timeoutMs?: number;
     /** Maximum frame count. Default and maximum 64. */
     maxFrames?: number;
-    /** Maximum document and asset observations. Default and maximum 2,048. */
+    /** Maximum document and asset observations. Default and maximum 2,048. An asset no reviewed rule can match is skipped and not counted. */
     maxSignals?: number;
-    /** Maximum transient observation and returned snapshot size. Default and maximum 262,144 bytes; minimum 512 bytes. */
+    /** Maximum transient observation and returned snapshot size. Default and maximum 262,144 bytes; minimum 512 bytes. Skipped assets cost nothing. */
     maxSnapshotBytes?: number;
 }
 export type InspectCheckoutOptions = CheckoutPreflightOptions & {

package/dist/preflight-playwright.js

@@ -1,10 +1,15 @@
-import { normalizeCheckoutSignals, assessCheckoutSupport, cardEntryAttributable, } from './preflight.js';
+import { normalizeCheckoutSignals, assessCheckoutSupport, cardEntryAttributable, getCheckoutPreflightCatalog, CHECKOUT_PREFLIGHT_LIMITS, } from './preflight.js';
 const EVENTS = ['framenavigated', 'frameattached', 'framedetached'];
 const DEADLINE = Symbol('checkout inspection deadline');
 const DEFAULTS = { timeoutMs: 1_500, maxFrames: 64, maxSignals: 2_048, maxSnapshotBytes: 262_144 };
 /** Frames at one nesting depth are read together. A remote CDP connection pays per round trip, not per frame. */
 const CONCURRENCY = 8;
+/** Script, iframe and form elements one frame's read examines, skipped ones included, so a page cannot keep the read walking. */
+const ELEMENT_LIMIT = 16_384;
 const encoder = new TextEncoder();
+let reviewedHosts;
+/** Hostname patterns of the reviewed rules. A URL on any other host can never become evidence. */
+const reviewedHostPatterns = () => reviewedHosts ??= [...new Set(getCheckoutPreflightCatalog().rules.map(rule => rule.hostname_pattern))];
 function bounded(value, fallback, maximum, minimum = 1) {
     if (value === undefined)
         return fallback;
@@ -185,7 +190,7 @@ export async function collectCheckoutSignals(page, options = {}) {
                     }
                 }
                 visibility.set(frame, visible);
-                const data = await beforeDeadline(() => frame.evaluate(({ remaining, byteBudget }) => {
+                const data = await beforeDeadline(() => frame.evaluate(({ signalRoom, byteBudget, hosts, elementLimit, urlLength, rawUrlLength }) => {
                     const collected = [];
                     let bytes = 0;
                     let signalLimit = false;
@@ -203,9 +208,37 @@ export async function collectCheckoutSignals(page, options = {}) {
                         const rect = element.getBoundingClientRect();
                         return rect.width > 0 && rect.height > 0;
                     };
+                    // The normalizer drops a URL short enough to match without a trace when it is not https, carries credentials
+                    // or a port, or sits on a host no reviewed rule names (preflight.ts). Such a URL can never become evidence,
+                    // so the read skips it before it costs any signal or byte budget, and a store's own scripts (hundreds on a
+                    // RequireJS checkout) no longer spend the budget before the read reaches the card frames. A URL kept here is
+                    // still matched against the reviewed rules by the normalizer, so the page cannot add evidence this way. The
+                    // patterns are tested case-insensitively: a hostname is lowercase, so this keeps every host a rule can match.
+                    const reviewed = hosts.map(source => new RegExp(source, 'i'));
+                    const named = new Map();
+                    const silent = (url) => {
+                        if (url.href.length > rawUrlLength || url.origin.length + url.pathname.length > urlLength)
+                            return false;
+                        if (url.protocol !== 'https:' || url.username || url.password || url.port)
+                            return true;
+                        let known = named.get(url.hostname);
+                        if (known === undefined) {
+                            known = reviewed.some(pattern => pattern.test(url.hostname));
+                            named.set(url.hostname, known);
+                        }
+                        return !known;
+                    };
+                    const silentAddress = (address) => { try {
+                        return silent(new URL(address));
+                    }
+                    catch {
+                        return false;
+                    } };
+                    // The frame's own address takes a signal slot only when it is appended, which a silent one never is.
+                    const remaining = Math.max(0, signalRoom - (silentAddress(document.URL) ? 0 : 1));
                     const elements = document.querySelectorAll('script[src], iframe[src], form[action]');
                     for (let index = 0; index < elements.length; index++) {
-                        if (index >= remaining) {
+                        if (index >= elementLimit) {
                             signalLimit = true;
                             break;
                         }
@@ -214,23 +247,29 @@ export async function collectCheckoutSignals(page, options = {}) {
                         const source = element.getAttribute(kind === 'form' ? 'action' : 'src');
                         if (!source)
                             continue;
+                        let url = null;
+                        try {
+                            url = new URL(source, document.baseURI);
+                        }
+                        catch { /* an unparsable location is skipped below unless it is oversized */ }
+                        if (url && silent(url))
+                            continue;
                         if (source.length > byteBudget - bytes) {
                             byteLimit = true;
                             break;
                         }
-                        let url;
-                        try {
-                            url = new URL(source, document.baseURI).href;
-                        }
-                        catch {
+                        if (!url)
                             continue;
+                        if (collected.length >= remaining) {
+                            signalLimit = true;
+                            break;
                         }
-                        bytes += url.length * 3 + 128;
+                        bytes += url.href.length * 3 + 128;
                         if (bytes > byteBudget) {
                             byteLimit = true;
                             break;
                         }
-                        collected.push({ kind, url, visible: kind === 'script' ? null : shown(element) });
+                        collected.push({ kind, url: url.href, visible: kind === 'script' ? null : shown(element) });
                     }
                     // Card-entry detection reads field metadata only: the autocomplete token or the
                     // control's name and id. Values, labels and page text are never read.
@@ -248,11 +287,20 @@ export async function collectCheckoutSignals(page, options = {}) {
                         if (cardField && shown(input))
                             cardEntry = true;
                     }
+                    // The frame's own address follows the same rule, so an ad or widget frame's long address is not charged
+                    // either: it neither trips the byte budget nor is blanked. It still comes back whole, since the navigation
+                    // and card-entry checks below need it, and a silent address is at most rawUrlLength characters long.
                     const documentUrl = document.URL;
-                    if (documentUrl.length * 3 > byteBudget)
+                    const documentSilent = silentAddress(documentUrl);
+                    const oversized = !documentSilent && documentUrl.length * 3 > byteBudget;
+                    if (oversized)
                         byteLimit = true;
-                    return { documentUrl: byteLimit && documentUrl.length * 3 > byteBudget ? '' : documentUrl, collected, signalLimit, byteLimit, cardEntry };
-                }, { remaining: Math.max(0, limits.maxSignals - signals.length - 1), byteBudget: Math.max(0, limits.maxSnapshotBytes - transientBytes) }), deadline);
+                    return { documentUrl: oversized ? '' : documentUrl, documentSilent, collected, signalLimit, byteLimit, cardEntry };
+                }, {
+                    signalRoom: Math.max(0, limits.maxSignals - signals.length), byteBudget: Math.max(0, limits.maxSnapshotBytes - transientBytes),
+                    hosts: reviewedHostPatterns(), elementLimit: ELEMENT_LIMIT,
+                    urlLength: CHECKOUT_PREFLIGHT_LIMITS.url_length, rawUrlLength: CHECKOUT_PREFLIGHT_LIMITS.raw_url_length,
+                }), deadline);
                 const releaseError = released ? await released : undefined;
                 if (releaseError !== undefined)
                     throw releaseError;
@@ -286,7 +334,8 @@ export async function collectCheckoutSignals(page, options = {}) {
                 if (!outcome)
                     continue;
                 const { data, frame_id, parent_frame_id, nested, visible } = outcome;
-                append({ kind: nested ? 'frame' : 'document', url: data.documentUrl, frame_id, parent_frame_id, visible });
+                if (!data.documentSilent)
+                    append({ kind: nested ? 'frame' : 'document', url: data.documentUrl, frame_id, parent_frame_id, visible });
                 for (const signal of data.collected) {
                     if (!append({ ...signal, frame_id, parent_frame_id, visible: visible === false ? false : signal.kind === 'script' ? visible : visible === null ? null : signal.visible }))
                         break;