@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/preflight-schemas.json

@@ -385,6 +385,7 @@
                 "mollie-components-v1-script",
                 "mollie-hosted-credit-card",
                 "braintree-web-sdk",
+                "braintree-web-wallet",
                 "braintree-hosted-fields",
                 "paysafe-js",
                 "worldpay-checkout-sdk",
@@ -466,6 +467,8 @@
                 "mercado-pago-checkout-pro-card-form",
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
+                "bambora-na-custom-checkout-fields",
+                "worldpay-wpg-hosted-payment-page",
                 "paypal-hosted-fields-payments-sdk",
                 "paypal-card-fields-v5",
                 "paypal-card-fields-v6",
@@ -481,6 +484,10 @@
                 "gmo-link-hosted-page",
                 "cybersource-flex-microform-script",
                 "cybersource-flex-microform-field",
+                "cybersource-unified-checkout-script",
+                "cybersource-unified-checkout-frame",
+                "aurus-ecom-iframe",
+                "aurus-ecom-init-script",
                 "juspay-hypercheckout-payment-page",
                 "pelecard-payment-page",
                 "pelecard-payment-script",
@@ -524,6 +531,8 @@
                 "gmo-link-hosted-page-test",
                 "cybersource-flex-microform-script-test",
                 "cybersource-flex-microform-field-test",
+                "cybersource-unified-checkout-script-test",
+                "cybersource-unified-checkout-frame-test",
                 "cybersource-secure-acceptance-silent-order-post-test",
                 "cybersource-secure-acceptance-silent-order-post-in",
                 "worldpay-eprotect-js-api-prelive",
@@ -1021,6 +1030,7 @@
                       "mollie-components-v1-script",
                       "mollie-hosted-credit-card",
                       "braintree-web-sdk",
+                      "braintree-web-wallet",
                       "braintree-hosted-fields",
                       "paysafe-js",
                       "worldpay-checkout-sdk",
@@ -1102,6 +1112,8 @@
                       "mercado-pago-checkout-pro-card-form",
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
+                      "bambora-na-custom-checkout-fields",
+                      "worldpay-wpg-hosted-payment-page",
                       "paypal-hosted-fields-payments-sdk",
                       "paypal-card-fields-v5",
                       "paypal-card-fields-v6",
@@ -1117,6 +1129,10 @@
                       "gmo-link-hosted-page",
                       "cybersource-flex-microform-script",
                       "cybersource-flex-microform-field",
+                      "cybersource-unified-checkout-script",
+                      "cybersource-unified-checkout-frame",
+                      "aurus-ecom-iframe",
+                      "aurus-ecom-init-script",
                       "juspay-hypercheckout-payment-page",
                       "pelecard-payment-page",
                       "pelecard-payment-script",
@@ -1160,6 +1176,8 @@
                       "gmo-link-hosted-page-test",
                       "cybersource-flex-microform-script-test",
                       "cybersource-flex-microform-field-test",
+                      "cybersource-unified-checkout-script-test",
+                      "cybersource-unified-checkout-frame-test",
                       "cybersource-secure-acceptance-silent-order-post-test",
                       "cybersource-secure-acceptance-silent-order-post-in",
                       "worldpay-eprotect-js-api-prelive",

package/dist/preflight.generated.d.ts

@@ -148,6 +148,11 @@ export declare function getCheckoutPreflightCatalog(): {
         path_pattern: string;
         flow?: string;
         variant_unverified?: string;
+        /**
+         * Why the asset never takes a card: a wallet button, a fraud collector, or the client those load. When no card frame
+         * is active and scripts alone name several processors, one whose every asset says this is not the card form's.
+         */
+        card_free?: string;
     }[];
     processors: readonly [{
         readonly psp: "spreedly";
@@ -1340,10 +1345,6 @@ export declare function getCheckoutPreflightCatalog(): {
         readonly psp: "vgs";
         readonly reason: "iframe_bound_tokenization";
         readonly action: "human_checkout";
-    }, {
-        readonly psp: "bluesnap";
-        readonly reason: "multi_request_tokenization_not_supported";
-        readonly action: "human_checkout";
     }, {
         readonly psp: "stripe";
         readonly reason: "unbound_token_to_payment_intent_continuation";

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 639ffa689e8dfcf093eeba7e34b86c570e53ab17970976ae462a41fd2120d753
+// source-sha256: 1ac6ffa819d0bb72040d0a95cac79f780aeae4f5dea22599fbc4c5ec6c6c8687
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -23,7 +23,13 @@ const RULES = [
     // A braintree-web build whose version carries -payments-sdk (3.32.0-payments-sdk-dev) is PayPal's
     // (paypal-hosted-fields-payments-sdk below): its card goes to PayPal, never to Braintree, so neither
     // Braintree rule takes one.
-    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\//, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$)/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    // braintree-web's client and its wallet and fraud components take no card: a page that loads only these runs a
+    // PayPal, Venmo, Apple Pay or Google Pay button through Braintree, and its card boxes belong to another processor.
+    // AutoZone's checkout loads client, paypal-checkout and data-collector 3.125.0 beside Worldpay eProtect's JS API, whose
+    // script reads the card from the page's own fields (2026-10-31).
+    { id: 'braintree-web-wallet', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js',
+        card_free: 'braintree-web\'s client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.' },
     { id: 'braintree-hosted-fields', psp: 'braintree', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)/, origin: 'https://assets.braintreegateway.com', path_pattern: '/web/*' },
     { id: 'paysafe-js', psp: 'paysafe', kinds: ['script', 'frame', 'iframe'], hostname: /^hosted\.paysafe\.com$/, pathname: /^\/(?:js|checkout)\//, origin: 'https://hosted.paysafe.com', path_pattern: '/{js,checkout}/*' },
     { id: 'worldpay-checkout-sdk', psp: 'worldpay', kinds: ['script', 'frame', 'iframe'], hostname: /^access\.worldpay\.com$/, pathname: /^\/access-checkout\//, origin: 'https://access.worldpay.com', path_pattern: '/access-checkout/*' },
@@ -69,6 +75,29 @@ RULES.push({ id: 'tranzila-terminal-hosted-page', psp: 'tranzila', kinds: ['docu
 { id: 'gravy-secure-fields-script', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.[a-z0-9-]+\.gr4vy\.app$/, pathname: GRAVY_SECURE_FIELDS_SCRIPT, origin: 'https://cdn.:merchant.gr4vy.app', path_pattern: '/secure-fields/{latest,:version}/secure-fields.js',
     sources: GRAVY_SOURCES }, { id: 'gravy-secure-fields-script-sandbox', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.sandbox\.[a-z0-9-]+\.gr4vy\.app$/, pathname: GRAVY_SECURE_FIELDS_SCRIPT, origin: 'https://cdn.sandbox.:merchant.gr4vy.app', path_pattern: '/secure-fields/{latest,:version}/secure-fields.js',
     sources: GRAVY_SOURCES });
+// Card frames the catalog scan of 2026-10-23 read at stores' card forms (no card typed, nothing paid). Each
+// rule names its processor from a frame on the processor's own host. A file on the store's own host that only
+// carries the processor's name, such as the copy of Bambora's customcheckout.js that Kent serves itself, names
+// nothing.
+const catalogScan = (reference) => ({ kind: 'saved_observation', reference: `catalog-psp-scan-2026-10-23:${reference}`, reviewed_on: '2026-10-23' });
+RULES.push(
+// Bambora Custom Checkout draws each card field as an iframe from the release its library was built for:
+// /customcheckout/1/customcheckout.js draws 1.0.5-39 (the reviewed rule above), and Kent's own copy draws
+// 1.0.2. The release names the frame and nothing more. Payment-core's bambora entry matches the card request
+// on its own (/scripts/tokenization/tokens), so a release whose frame sent the card anywhere else would send
+// only the placeholder card the agent typed.
+{ id: 'bambora-na-custom-checkout-fields', psp: 'bambora', kinds: ['frame', 'iframe', 'document'], hostname: /^libs\.na\.bambora\.com$/,
+    pathname: /^\/customcheckout\/1\.[0-9]{1,3}\.[0-9]{1,3}(?:-[0-9]{1,4})?\/iframe\.html$/, origin: 'https://libs.na.bambora.com', path_pattern: '/customcheckout/1.:minor.:patch{,-:build}/iframe.html',
+    sources: [{ kind: 'primary_source', reference: 'https://docs.na.worldline-solutions.com/build-your-integration/checkout-form/custom-checkout/reference', reviewed_on: '2026-09-11' },
+        catalogScan('kent-ca-custom-checkout-1.0.2-card-fields')] }, 
+// Worldpay's hosted payment pages on payments.worldpay.com: Razer's checkout opens
+// /app/hpp-iframe/integration/wpg/corporate in an iframe, which lands on /app/hpp/<build>/payment/start, where
+// the shopper types the card on Worldpay's own page. The SDK's worldpay entry takes over Access Checkout's card
+// session only, so the page names worldpay and stays unknown, as the secure.worldpay.com/wcc pages do.
+{ id: 'worldpay-wpg-hosted-payment-page', psp: 'worldpay', kinds: ['document', 'frame', 'iframe'], hostname: /^payments\.worldpay\.com$/,
+    pathname: /^\/app\/hpp(?:-iframe)?\//, origin: 'https://payments.worldpay.com', path_pattern: '/app/{hpp,hpp-iframe}/*',
+    sources: [catalogScan('razer-worldpay-hosted-payment-page')],
+    variant_unverified: 'The implemented Worldpay adapter covers Access Checkout card sessions; Worldpay hosted payment pages under payments.worldpay.com/app/hpp take the card on Worldpay\'s own page and are not admitted.' });
 // PayPal's legacy Hosted Fields (its JS SDK's components=hosted-fields), reviewed 2026-10-07 from Planet Golf
 // UK's payment step (read live 2026-10-06, SDK 5.0.580) and the two frame files it loads. The SDK renders each
 // card field as braintree-web's 3.32.0-payments-sdk-dev hosted-fields-input-frame.min.html (sha256
@@ -174,6 +203,27 @@ const cybersourceSources = [
 RULES.push({ id: 'cybersource-flex-microform-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2(?:\.[0-9]+\.[0-9]+)?\/flex-microform\.min\.js$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v2{,.:minor.:patch}/flex-microform.min.js',
     sources: cybersourceSources }, { id: 'cybersource-flex-microform-field', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2\.[0-9]+\.[0-9]+\/iframe\.html$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v:version/iframe.html',
     sources: cybersourceSources });
+// CyberSource Unified Checkout v1 sends the card to the same Flex v2 tokens URL, sealed by its orchestrator frame
+// under the capture context (cybersource-unified-checkout.js), so its script and frames name cybersource_flex too.
+// Reviewed 2026-10-31 from napaonline.com's checkout (UnifiedCheckout.js v1.8.2), with no card sent.
+const unifiedCheckoutSources = [
+    { kind: 'saved_observation', reference: 'napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames', reviewed_on: '2026-10-31' },
+    { kind: 'official_documentation', reference: 'https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'cybersource-unified-checkout-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/UnifiedCheckout\.js$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/UnifiedCheckout.js',
+    sources: unifiedCheckoutSources }, { id: 'cybersource-unified-checkout-frame', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/(?:mce\/mce|orc\/orc|ga\/ga)\.html$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/{mce,orc,ga}/*.html',
+    sources: unifiedCheckoutSources });
+// Aurus Pay's ecom card frame (processors/aurus.js): the store frames /storeservices/ecom/getiframe on
+// pecst<NN>.aurusepay.com, the card fields sit inside it, and its own ecominitjs sends the sealed card to
+// /storeservices/ecom/oneTimeToken on the same host. Reviewed 2026-10-31 at oreillyauto.com's payment step, with every
+// aurusepay.com request but a GET aborted and only a public test card typed. Aurus is served dark, so no catalog
+// processor entry backs the candidate and the result stays unknown unless the caller is served Aurus.
+const aurusSources = [
+    { kind: 'saved_observation', reference: 'oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'aurus-ecom-iframe', psp: 'aurus', kinds: ['frame', 'iframe', 'document'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/getiframe$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/getiframe',
+    sources: aurusSources }, { id: 'aurus-ecom-init-script', psp: 'aurus', kinds: ['script'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/ecominitjs$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/ecominitjs',
+    sources: aurusSources });
 // Juspay HyperCheckout: Juspay's own hosted payment page (the Session API's payment_links.web),
 // which a merchant embeds in an iframe (IndiGo's payment step). The card request that page makes
 // has not been observed, so the Vault does not take it over, and the rule tells the agent so
@@ -359,6 +409,8 @@ for (const [baseId, suffix, hostname, origin] of [
     ['gmo-link-hosted-page', 'test', /^pt01\.mul-pay\.jp$/, 'https://pt01.mul-pay.jp'],
     ['cybersource-flex-microform-script', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
     ['cybersource-flex-microform-field', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
+    ['cybersource-unified-checkout-script', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
+    ['cybersource-unified-checkout-frame', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
     // Secure Acceptance's test host and its production host in India serve the same /silent/ paths.
     ['cybersource-secure-acceptance-silent-order-post', 'test', /^testsecureacceptance\.cybersource\.com$/, 'https://testsecureacceptance.cybersource.com'],
     ['cybersource-secure-acceptance-silent-order-post', 'in', /^secureacceptance\.in\.cybersource\.com$/, 'https://secureacceptance.in.cybersource.com'],
@@ -765,19 +817,27 @@ export function assessCheckoutSupport(input, options = {}) {
     result.candidates = [...candidates.values()].sort((a, b) => a.psp.localeCompare(b.psp));
     if (missingCorroboration && activeFlows.size === 0)
         result.reason_codes.push('flow_corroboration_missing');
+    // Scripts alone naming several processors: one whose every asset is card-free (a wallet button, a fraud collector)
+    // is not the card form's. When exactly one other is left, the page's card form is that one's.
+    const cardCapable = activePsps.size === 0 && candidates.size > 1
+        ? [...candidates.values()].filter(candidate => candidate.evidence.some(evidence => !RULE_BY_ID.get(evidence.rule_id).card_free))
+        : [];
+    const cardFormPsp = cardCapable.length === 1 ? cardCapable[0].psp : null;
     if (activePsps.size === 1)
         result.psp = [...activePsps][0];
     // Script-only evidence names the processor only when the scan saw everything. On a partial scan
     // the sole candidate stays listed as undetermined instead of becoming the selected route.
     else if (activePsps.size === 0 && candidates.size === 1 && result.observation.complete)
         result.psp = [...candidates.keys()][0];
+    else if (cardFormPsp !== null && result.observation.complete)
+        result.psp = cardFormPsp;
     if (!result.observation.complete)
         result.reason_codes.push('observation_incomplete');
     if (!input.signals.length) {
         result.reason_codes.push('psp_not_detected');
         result.missing_evidence.push('payment_page_signal');
     }
-    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1)
+    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1 && cardFormPsp === null)
         result.reason_codes.push('ambiguous_checkout');
     if (activeFlows.size !== 1 || result.psp === null) {
         result.reason_codes.push('checkout_flow_unidentified');

package/dist/preparation.d.ts

@@ -25,6 +25,13 @@ export declare class PreparationGate {
      * own method is what binds: a POST for most processors, the registration GET for Worldpay eProtect.
      */
     claim(requestUrl: string, requestMethod: string, requestBody?: string | null, requestHeaders?: Record<string, string>): PreparedCheckout | undefined;
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url: unknown): boolean;
     assertDocument(): Promise<void>;
     private readDocument;
     isEngaged(): boolean;

package/dist/preparation.js

@@ -3,6 +3,17 @@ import { amountRefusal, validAmountInput } from './client.js';
 import { matchesPreparation, validPreparationEnvironment, preparationEndpoint, preparationBindsByShape, preparationRequestMethod, preparedRequestRefusal } from './prepared-processor.js';
 import { SECURE_ACCEPTANCE_PSP, secureAcceptanceCheckoutProfile } from './cybersource-secure-acceptance.js';
 import { creditguardPageProcessUrl, creditguardProcessTxId } from './creditguard.generated.js';
+/** A page URL without its fragment, or undefined when it does not parse. */
+function documentWithoutFragment(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.hash = '';
+        return parsed.href;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** A local, one-use rendezvous. It never starts or retries a merchant request. */
 export class PreparationGate {
     opts;
@@ -195,6 +206,16 @@ export class PreparationGate {
         clearTimeout(this.expiryTimer);
         return prepared;
     }
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url) {
+        const kept = typeof url === 'string' ? documentWithoutFragment(url) : undefined;
+        return kept !== undefined && this.documentUrl !== '' && kept === documentWithoutFragment(this.documentUrl);
+    }
     async assertDocument() {
         if (this.documentUrl && await this.readDocument() !== this.documentUrl)
             throw new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_changed');

package/dist/prepared-processor.d.ts

@@ -37,8 +37,20 @@
  * approval after Pay. Its environments are its API hosts: api.openpay.<mx|co|pe> (production) and
  * sandbox-api.openpay.<mx|co|pe> (sandbox). The token URL names the merchant in its path, so no URL is
  * prepared in advance: the claim binds the request by its host's environment and its shape, as ACI's.
+ *
+ * vtex_payments: prepared only. Ollie's headless checkout aborts its card post to the store's VTEX vault 12 seconds after
+ * it starts it, too soon for an approval after Pay. Its one environment is production: VTEX has no test host. The card
+ * URL names the store's account in its host and VTEX's transaction in its path, neither known before Pay, so the claim
+ * binds the request by its shape, as Openpay's. Ollie sends the same post again on a non-OK answer or a network error,
+ * then once more to api.vtexvault.com: the first post spends the approval, and each later one is refused like any
+ * request on a spent preparation, so one approval is one card use.
+ *
+ * processout: prepared only. ProcessOut.js gives its card frame 20 seconds from the tokenize message before it calls
+ * the page's error callback, too soon for an approval after the shop's continue press. Its environments share one
+ * host, api.processout.com: the project id in the card URL's query names them, proj_ (production) and test-proj_
+ * (sandbox), so the claim binds the request by its project's environment and its shape, as Openpay's.
  */
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments' | 'paygent' | 'hipay' | 'openpay_bbva';
+export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe' | 'fiserv' | 'cybersource_flex' | 'aci' | 'creditguard' | 'worldpay_eprotect' | 'amadeus_checkout' | 'verifone' | 'cybersource_secure_acceptance' | 'paddle_vgs' | 'wix_payments' | 'paygent' | 'hipay' | 'openpay_bbva' | 'vtex_payments' | 'processout';
 export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
 /**
  * How the approved card reaches the processor: the device's own request (token), or
@@ -77,7 +89,8 @@ export declare function preparedApprovalAnswersRetry(psp: string): boolean;
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
  * sandbox-vault is test. So are Paygent's two token hosts: token is live, sandbox is test. So are
  * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test. So are Openpay's API
- * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test.
+ * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test. ProcessOut's share
+ * one host, and the card URL's project id attests them: proj_ is live, test-proj_ is test.
  */
 export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
 /**
@@ -90,9 +103,9 @@ export declare function aciPreparationUrl(environment: PreparationEnvironment):
 /**
  * A processor whose card request names an id the merchant mints only at Pay time (ACI's checkout
  * id), or the merchant's own id (Openpay's token URL carries the merchant id in its path and the
- * country in its host), so no URL can be prepared in advance: whether the adapters can intercept it
- * is asked of the registry (VaultClient.recognizesProcessor), not of the prepared endpoint, which
- * only names the preparation.
+ * country in its host, ProcessOut's card URL the project id in its query), so no URL can be prepared
+ * in advance: whether the adapters can intercept it is asked of the registry
+ * (VaultClient.recognizesProcessor), not of the prepared endpoint, which only names the preparation.
  */
 export declare function preparationBindsByShape(psp: string): boolean;
 /**

package/dist/prepared-processor.js

@@ -18,6 +18,8 @@ import { WIX_PAYMENTS_TOKENIZE_URL, isPreparedWixPaymentsRequest } from './wix-p
 import { paygentEnvironment, paygentPreparationUrl, paygentRequestRefusal } from './paygent.generated.js';
 import { HIPAY_TOKEN_URLS, hipayRequestRefusal, hipayTokenEnvironment, isPreparedHipayRequest } from './hipay.generated.js';
 import { OPENPAY_PREPARATION_URLS, isPreparedOpenpayRequest, openpayRequestRefusal, openpayTokenEnvironment } from './openpay.generated.js';
+import { VTEX_PAYMENTS_PREPARATION_URL, isPreparedVtexPaymentsRequest, vtexPaymentsCardTarget, vtexPaymentsRequestRefusal } from './vtex-payments.generated.js';
+import { PROCESSOUT_PREPARATION_URLS, isPreparedProcessoutRequest, processoutEnvironment, processoutRequestRefusal } from './processout.generated.js';
 export function preparationMode(psp) {
     return psp === 'adyen' || psp === 'fiserv' || psp === 'verifone' ? 'cse' : 'token';
 }
@@ -54,16 +56,17 @@ export function preparedApprovalAnswersRetry(psp) {
  * live, testsecureacceptance is test. So are Paddle VGS's two card URLs: vault is live,
  * sandbox-vault is test. So are Paygent's two token hosts: token is live, sandbox is test. So are
  * HiPay's two vault hosts: secure2-vault is live, stage-secure2-vault is test. So are Openpay's API
- * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test.
+ * hosts: api.openpay.<mx|co|pe> is live, sandbox-api.openpay.<mx|co|pe> is test. ProcessOut's share
+ * one host, and the card URL's project id attests them: proj_ is live, test-proj_ is test.
  */
 export function validPreparationEnvironment(psp, environment) {
     if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
-    // Wix Payments has production alone: its tokenizer has no test host.
-    if (psp === 'wix_payments')
+    // Wix Payments has production alone: its tokenizer has no test host. VTEX Payments too: every store's vault is live.
+    if (psp === 'wix_payments' || psp === 'vtex_payments')
         return environment === 'production';
     return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe', 'fiserv', 'cybersource_flex', 'aci', 'creditguard', 'worldpay_eprotect', 'amadeus_checkout', 'verifone',
-        'cybersource_secure_acceptance', 'paddle_vgs', 'paygent', 'hipay', 'openpay_bbva'].includes(psp) && ['production', 'sandbox'].includes(environment);
+        'cybersource_secure_acceptance', 'paddle_vgs', 'paygent', 'hipay', 'openpay_bbva', 'processout'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 /**
  * ACI's prepared endpoint, the literal the API names (backend checkout-prepared-processor.ts): its
@@ -77,12 +80,12 @@ export function aciPreparationUrl(environment) {
 /**
  * A processor whose card request names an id the merchant mints only at Pay time (ACI's checkout
  * id), or the merchant's own id (Openpay's token URL carries the merchant id in its path and the
- * country in its host), so no URL can be prepared in advance: whether the adapters can intercept it
- * is asked of the registry (VaultClient.recognizesProcessor), not of the prepared endpoint, which
- * only names the preparation.
+ * country in its host, ProcessOut's card URL the project id in its query), so no URL can be prepared
+ * in advance: whether the adapters can intercept it is asked of the registry
+ * (VaultClient.recognizesProcessor), not of the prepared endpoint, which only names the preparation.
  */
 export function preparationBindsByShape(psp) {
-    return psp === 'aci' || psp === 'openpay_bbva';
+    return psp === 'aci' || psp === 'openpay_bbva' || psp === 'vtex_payments' || psp === 'processout';
 }
 /**
  * The endpoint a CreditGuard preparation stands for, per environment, as the API advertises it: the
@@ -124,6 +127,15 @@ export function preparationEndpoint(psp, environment) {
     // and the claim binds the real token URL by environment and shape (matchesPreparedRequest), as ACI's.
     if (psp === 'openpay_bbva')
         return OPENPAY_PREPARATION_URLS[environment];
+    // VTEX Payments: the literal that only names the preparation. Its "prepared" is no transaction id, so no card request
+    // is ever sent to it, and the claim binds the store's own card post by its shape (matchesPreparedRequest).
+    if (psp === 'vtex_payments')
+        return VTEX_PAYMENTS_PREPARATION_URL;
+    // ProcessOut: the literal the API names (backend checkout-prepared-processor.ts). It only names the preparation and its
+    // environment: its "prepared" is shorter than any project id, so no card request is ever sent to it, and the claim binds
+    // the real card URL by its project's environment and its shape (matchesPreparedRequest), as Openpay's.
+    if (psp === 'processout')
+        return PROCESSOUT_PREPARATION_URLS[environment];
     // A Verifone endpoint is its reviewed profile's leg, never one per environment (verifone.ts).
     if (psp === 'verifone')
         throw new Error('unsupported_preparation_processor');
@@ -304,6 +316,19 @@ export function matchesPreparedRequest(psp, environment, requestUrl, method, bod
     // merchant a later release reviews needs no new build of this library.
     if (psp === 'openpay_bbva')
         return isPreparedOpenpayRequest(requestUrl, method, body ?? null, environment, headers ?? {});
+    // VTEX Payments: a post to a store's own vault and payment-core's whole request rule (Ollie's JSON content type and
+    // one credit card line for the URL's transaction), the rule the API and the Vault bind with too. Ollie's resend to
+    // api.vtexvault.com never binds. Which store a request may reach is the API's to judge at the bind and the Vault's
+    // before it writes the card, against the reviewed pins each holds, so a store a later release reviews needs no new SDK.
+    if (psp === 'vtex_payments')
+        return isPreparedVtexPaymentsRequest(requestUrl, method, body ?? null, environment, headers ?? {});
+    // ProcessOut: a card URL whose project names the environment and payment-core's whole request rule (the JSON content
+    // type, the API version, the URL's own project credential and tokenizeCard's body), the rule the API and the Vault bind
+    // with too. Which project a live request may name is the API's to judge at the bind and the Vault's before it writes
+    // the card, against the reviewed pin each of them holds for the approved checkout origin, so a store a later release
+    // reviews needs no new build of this library.
+    if (psp === 'processout')
+        return isPreparedProcessoutRequest(requestUrl, method, body ?? null, environment, headers ?? {});
     if (psp === 'creditguard')
         return matchesPreparedCreditguard(environment, requestUrl, body, headers, binding);
     // A Verifone request is judged only through the profile its preparation names (matchesPreparation).
@@ -479,6 +504,21 @@ export function preparedRequestRefusal(psp, environment, requestUrl, body, heade
             return 'checkout_changed';
         return openpayRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
     }
+    // A VTEX post on a vault host names what payment-core's request rule refused (vtex_payments_fallback_refused for
+    // Ollie's resend to api.vtexvault.com, vtex_payments_installments, ...); any other request is `checkout_changed`.
+    if (psp === 'vtex_payments') {
+        if (environment !== 'production' || vtexPaymentsCardTarget(requestUrl) === null)
+            return 'checkout_changed';
+        return vtexPaymentsRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
+    }
+    // A ProcessOut card request whose project names the prepared environment names what payment-core's request rule
+    // refused (processout_headers_refused, processout_body_unsupported); the other environment's project, another query
+    // or path, or any other request is `checkout_changed`.
+    if (psp === 'processout') {
+        if (processoutEnvironment(requestUrl) !== environment)
+            return 'checkout_changed';
+        return processoutRequestRefusal({ url: requestUrl, method: 'POST', headers, body: body ?? null }) ?? 'checkout_changed';
+    }
     if (psp !== 'amadeus_checkout' || amadeusEnvironment(requestUrl) !== environment)
         return 'checkout_changed';
     const merchantHost = merchantHostOf(merchantOrigin);