@agent-cards/sdk 0.23.3 → 0.23.5

package/dist/cybersource-secure-acceptance.js

@@ -0,0 +1,214 @@
+/**
+ * CyberSource Secure Acceptance's Silent Order POST, which this SDK refuses for every company.
+ *
+ * CyberSource's Secure Acceptance Checkout API, formerly Silent Order POST, takes the card from a form
+ * on the merchant's own page. The merchant's server signs the order fields, and the shopper's browser
+ * posts them, with the card fields left unsigned, to a /silent/ path on one of CyberSource's Secure
+ * Acceptance hosts: /silent/pay, /silent/token/create, /silent/token/update, and the iframe form of
+ * each under /silent/embedded/ (CyberSource's endpoint table, read 2026-10-08). Arrow Electronics'
+ * checkout (its public bundles, read 2026-10-08; no card was sent) builds that form once its server
+ * has signed the fields and submits it into a hidden iframe:
+ *
+ *   <iframe name="secureAcceptanceiFrame" style="display:none">
+ *   <form action="https://secureacceptance.cybersource.com/silent/embedded/token/create" method="post"
+ *     target="secureAcceptanceiFrame">: access_key, profile_id, transaction_type=create_payment_token,
+ *     amount=0 and the other signed fields with their signature, then card_type, card_number,
+ *     card_expiry_date (MM-YYYY) and card_cvn
+ *
+ * No Vault mode takes this post over, so no company can pay it, and an SDK without this guard let the
+ * card the agent typed reach CyberSource. Both adapters arm /silent/ on the three hosts whatever the
+ * synced registry serves, over https and http, each host also spelled with the trailing dot of a fully
+ * qualified name, and the pre-claim gate (cybersourceSecureAcceptancePreClaim, pre-claim.ts) judges
+ * each request there, whether a fetch, an XHR or a form navigation of the page or of a frame sent it,
+ * by its body and by its URL's query (cybersourceSecureAcceptanceRequest):
+ *   - a card_number that holds a value: stop it, so CyberSource never receives the card. A form
+ *     navigation is answered with the stopped page (card-endpoint-page.ts), which names CyberSource,
+ *     since an aborted page load renders nothing and invites another click on Pay; any other request
+ *     fails. The checkout reads `unsupported` with reason `unsupported_cybersource_secure_acceptance`
+ *     and holds, as every unsupported refusal does;
+ *   - no card_number, or an empty one, as in a payment with a stored payment_token: continue untouched;
+ *   - a body the adapter could not read: stop that request alone, since nothing proves it carries no card.
+ * A request the synced registry recognizes as a card request belongs to that recognizer instead; no
+ * build serves one today. Hosted Checkout, the same hosts without /silent/, takes the card on
+ * CyberSource's own page, and neither adapter arms it.
+ */
+export const CYBERSOURCE_SECURE_ACCEPTANCE_REASON = 'unsupported_cybersource_secure_acceptance';
+/** Where the stopped page says the card was going. */
+export const CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT = 'CyberSource';
+/** CyberSource's Secure Acceptance hosts: production, test, and production in India. */
+export const CYBERSOURCE_SECURE_ACCEPTANCE_HOSTS = Object.freeze([
+    'secureacceptance.cybersource.com', 'testsecureacceptance.cybersource.com', 'secureacceptance.in.cybersource.com',
+]);
+/**
+ * CDP Fetch patterns for every /silent/ path on the three hosts, armed on every attachment, over https
+ * and over http, each host also with its trailing dot: Chrome sends a URL spelled either way unchanged,
+ * and DNS reads both spellings as the same host, so a page's form posted to either reaches CyberSource.
+ * The * before silent/ also pauses a path that doubles its slash, as a base URL that ends in a slash
+ * joined to /silent/pay writes it, which a server that merges slashes reads as /silent/pay. The gate
+ * judges each path with its slashes merged (isCybersourceSecureAcceptanceUrl), and anything else the *
+ * pauses, such as /billing/silent/pay, continues untouched. A pattern matches the canonical URL Chrome
+ * sends, whose host is lower case and whose standard port is dropped; no URL without silent/ is armed.
+ */
+export const CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS = Object.freeze(CYBERSOURCE_SECURE_ACCEPTANCE_HOSTS.flatMap((host) => ['https', 'http'].flatMap((scheme) => [`${scheme}://${host}/*silent/*`, `${scheme}://${host}./*silent/*`])));
+/**
+ * Whether this URL is a /silent/ path on one of the three hosts: https or http, the host with or without
+ * its trailing dot, on the scheme's standard port, with no credentials, and its path read with each run
+ * of slashes merged into one, as a server that merges slashes reads it.
+ */
+export function isCybersourceSecureAcceptanceUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return (parsed.protocol === 'https:' || parsed.protocol === 'http:') && !parsed.port && !parsed.username && !parsed.password
+        && CYBERSOURCE_SECURE_ACCEPTANCE_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''))
+        && parsed.pathname.replace(/\/{2,}/g, '/').startsWith('/silent/');
+}
+/** Methods that send no body: only the URL's query can carry a card on them. */
+const BODILESS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * What a request to a /silent/ path carries: 'card' when card_number holds a value in the URL's query,
+ * on any method, since a form whose method is GET puts its fields there; otherwise the body's verdict
+ * (cybersourceSecureAcceptanceBody) for a method that sends one, and 'no_card' for a GET, a HEAD or a
+ * CORS preflight.
+ */
+export function cybersourceSecureAcceptanceRequest(url, method, body, contentType) {
+    let query = '';
+    try {
+        query = new URL(url).search;
+    }
+    catch {
+        query = '';
+    }
+    if (carriesCardNumber(formFields(query)))
+        return 'card';
+    return BODILESS.has(String(method).toUpperCase()) ? 'no_card' : cybersourceSecureAcceptanceBody(body, contentType);
+}
+/**
+ * What a Silent Order POST's body carries: 'card' when any reading of it finds a field named card_number
+ * that holds a value, 'no_card' when none does, and 'unreadable' for a body the adapter could not read
+ * (null), or a multipart body whose parts cannot be read and in which no reading finds a card, a
+ * multipart content type with no boundary included.
+ *
+ * The page writes both the bytes and their content type, and a server reads the bytes by that type, so
+ * the gate trusts no one reading. It reads every body as URL-encoded pairs (split on & and line by line,
+ * which also reads a plain-text form's name=value lines), as JSON at any depth, and as a multipart form:
+ * by its parts, when its content type names a boundary or it opens with a delimiter line and a part
+ * header, and by every part header that names card_number, wherever it sits. A card in any reading stops
+ * the post, so a body whose content type names one encoding and whose bytes hold another, a URL-encoded
+ * body that also parses as JSON, say, cannot carry the card past the gate.
+ */
+export function cybersourceSecureAcceptanceBody(body, contentType) {
+    if (typeof body !== 'string')
+        return 'unreadable';
+    const delimiter = multipartDelimiter(body, typeof contentType === 'string' ? contentType : '');
+    const parts = delimiter === undefined ? [] : delimiter === null ? null : multipartFields(body, delimiter);
+    if (carriesCardNumber(formFields(body)) || carriesCardNumber(jsonFields(body)) || carriesCardNumber(parts ?? [])
+        || multipartNamesCardNumber(body, delimiter ?? undefined))
+        return 'card';
+    return parts === null ? 'unreadable' : 'no_card';
+}
+/**
+ * Whether a field named card_number holds a value. The name matches in any case and every occurrence
+ * counts; an empty value, or one of whitespace only, holds no card.
+ */
+function carriesCardNumber(fields) {
+    return fields.some(([name, value]) => name.trim().toLowerCase() === 'card_number'
+        && value !== undefined && value !== null && !(typeof value === 'string' && value.trim() === ''));
+}
+/**
+ * The delimiter line of a multipart body: the one its content type names, or, whatever its content type
+ * says, the one it opens with when a part header follows. Undefined for a body that is not multipart,
+ * and null for a multipart content type that names no boundary.
+ */
+function multipartDelimiter(body, contentType) {
+    if (/^\s*multipart\//i.test(contentType)) {
+        const boundary = /;\s*boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType);
+        return boundary ? `--${boundary[1] ?? boundary[2]}` : null;
+    }
+    return /^(--[^\r\n]+)\r?\n[^\s:]+:/.exec(body)?.[1];
+}
+/**
+ * A multipart body's named parts, or null when a body with content never names its delimiter or one
+ * of its parts has no blank line after its headers. A part takes every name its headers give it.
+ */
+function multipartFields(body, delimiter) {
+    if (!body.includes(delimiter))
+        return body.trim() === '' ? [] : null;
+    const fields = [];
+    for (const part of body.split(delimiter).slice(1)) {
+        if (part.startsWith('--'))
+            break; // the closing delimiter
+        const blank = /\r?\n\r?\n/.exec(part);
+        if (!blank)
+            return null;
+        const value = part.slice(blank.index + blank[0].length).replace(/\r?\n$/, '');
+        for (const name of headerNames(part.slice(0, blank.index)))
+            fields.push([name, value]);
+    }
+    return fields;
+}
+/** Every name a part's headers give it, quoted or bare, whichever header carries it. */
+function headerNames(headers) {
+    return [...headers.matchAll(/;\s*name\s*=\s*(?:"([^"]*)"|([^;\s"]*))/gi)].map((match) => match[1] ?? match[2]);
+}
+/**
+ * Whether a part named card_number holds a value, read without trusting where the body splits into
+ * parts: each header line that names card_number, wherever it sits, opens a part whose value runs from
+ * the blank line after its headers to the next delimiter line (the body's own, or any line that opens
+ * with -- when it names none). A server that splits the parts elsewhere, at a delimiter written inside
+ * another part's value, say, finds no card this reading misses.
+ */
+function multipartNamesCardNumber(body, delimiter) {
+    const lines = body.split(/\r?\n/);
+    const ends = (line) => (delimiter === undefined ? line.startsWith('--') : [delimiter, `${delimiter}--`].includes(line.trimEnd()));
+    for (let i = 0; i < lines.length; i++) {
+        if (!/^[^\s:]+:/.test(lines[i]) || !headerNames(lines[i]).some((name) => name.trim().toLowerCase() === 'card_number'))
+            continue;
+        let j = i + 1;
+        while (j < lines.length && lines[j].trim() !== '')
+            j++;
+        for (j++; j < lines.length && !ends(lines[j]); j++)
+            if (lines[j].trim() !== '')
+                return true;
+    }
+    return false;
+}
+/** Every key of a JSON body, at any depth, with its value; none for a body that is not JSON. */
+function jsonFields(body) {
+    if (!/^\s*[[{]/.test(body))
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return [];
+    }
+    const fields = [];
+    const walk = (node, depth) => {
+        if (node === null || typeof node !== 'object' || depth > 64)
+            return;
+        for (const [name, value] of Object.entries(node)) {
+            fields.push([name, value]);
+            walk(value, depth + 1);
+        }
+    };
+    walk(parsed, 0);
+    return fields;
+}
+/**
+ * URL-encoded pairs, split on & as a server splits a form, and again line by line: a plain-text form
+ * sends name=value lines, and no raw line break survives URL encoding, so a line break in a URL-encoded
+ * body only comes from a page that wrote one there.
+ */
+function formFields(body) {
+    const fields = [...new URLSearchParams(body)];
+    for (const line of body.split(/[\r\n]+/))
+        for (const pair of new URLSearchParams(line))
+            fields.push(pair);
+    return fields;
+}

package/dist/lifecycle.d.ts

@@ -226,11 +226,14 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
      * shiji-sts.ts reasons), a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * the cardholder's device can fill (processor_card_page: NMI's), a card
      * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
-     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts), or a card
+     * a merchant's page posts to CyberSource Secure Acceptance's Silent Order
+     * POST, which no Vault mode takes over either
+     * (unsupported_cybersource_secure_acceptance, cybersource-secure-acceptance.ts).
      */
-    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields'): void;
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | 'unsupported_cybersource_secure_acceptance'): void;
     /**
      * A card request that only a prepared checkout pays (an Adyen merchant
      * profile's, or a Fiserv card capture) arrived with no preparation on this

package/dist/lifecycle.js

@@ -202,9 +202,12 @@ export class CheckoutLifecycle {
      * (`unsupported_payrails_card_payment` and the card-save refusal codes), a
      * Shiji STS request its gate refuses (shiji_sts_keep_on_file and the other
      * shiji-sts.ts reasons), a post to a processor's own card page that only
-     * the cardholder's device can fill (processor_card_page: NMI's), or a card
+     * the cardholder's device can fill (processor_card_page: NMI's), a card
      * sent to PayPal's legacy Hosted Fields confirm, which no Vault mode takes
-     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts).
+     * over (unsupported_paypal_hosted_fields, paypal-hosted-fields.ts), or a card
+     * a merchant's page posts to CyberSource Secure Acceptance's Silent Order
+     * POST, which no Vault mode takes over either
+     * (unsupported_cybersource_secure_acceptance, cybersource-secure-acceptance.ts).
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;

package/dist/merchant-hosted.js

@@ -17,7 +17,8 @@
  * the agent's dummy card never reaches the merchant and nothing is charged;
  * 'enabled' lets a prepared checkout pay it. The API can hold a profile in
  * 'observe' for a client but never enable it past this build: a profile is
- * 'enabled' only when both say so. Every profile ships in 'observe' today.
+ * 'enabled' only when both say so. Cinemark and Dick's own storefront ship
+ * 'enabled'; every other profile ships in 'observe'.
  */
 import { MERCHANT_PROFILE_RECOGNIZERS as SHARED_PROFILES, classifyDeclaredMerchantRequest as sharedClassifyDeclared, declaredTemplatedUrl as sharedDeclaredTemplatedUrl, declaredUrlGlobs as sharedDeclaredUrlGlobs, declaredUrlRelation as sharedDeclaredUrlRelation, declaredEndpointRefusal as sharedDeclaredEndpointRefusal, classifyMerchantRequest as sharedClassify, merchantBodyKeyPathSha256 as sharedKeyPathSha256, merchantProfileEnvironment as sharedEnvironment, merchantProfileRulesMatch as sharedRulesMatch, merchantProfileTemplatedUrl as sharedTemplatedUrl, merchantProfileUrlGlobs as sharedUrlGlobs, merchantProfileUrlRelation as sharedUrlRelation, sha256Hex as sharedSha256Hex, } from './adyen-merchant-hosted.generated.js';
 import { SubstitutionError, substituteMerchantHosted as sharedSubstitute } from './substitutions.generated.js';

package/dist/merchant-total.js

@@ -12,7 +12,10 @@
  *
  * What this proves: the total is what the agent's browser session saw. It catches a
  * mistyped amount and a cart that changed under the agent; it cannot tell a merchant's
- * response from one the agent wrote, so every profile priced this way stays in observe.
+ * response from one the agent wrote. So a profile priced this way stays in observe unless
+ * Agentcard accepted that risk for it by name (Cinemark and Dick's own storefront, Oct 7,
+ * 2026), and then it pays only for the company Agentcard enables it for, and only after the
+ * cardholder approves each payment.
  *
  * What the SDK owes payment-core (the header of merchant-amount.js): every exchange of
  * the profile's shapes, projected, with the time it left; a wait for any such request

package/dist/pre-claim.d.ts

@@ -201,6 +201,7 @@ export declare const verifonePreClaim: PreClaimGate;
 export declare const fiservPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
+export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -16,7 +16,8 @@
 // card-saving bodies, WSPay's confirm URL, which also carries bodies with
 // no new card, Shiji STS's getTokenId and getCvvId, which also carry
 // requests the vault must never pay, and PayPal's legacy Hosted Fields
-// confirm, whose card no Vault mode takes over.
+// confirm and CyberSource Secure Acceptance's Silent Order POST, whose card
+// no Vault mode takes over.
 // The first three used to be
 // written inline in Fetch.requestPaused and again in the page.route handler, so
 // a decision could drift between the two adapters and a new family had to be
@@ -75,6 +76,7 @@ import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isP
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
+import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, } from './cybersource-secure-acceptance.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -169,14 +171,16 @@ function cardEndpointPausedBody(ctx) {
 }
 /**
  * Answer a paused card form navigation with the page that says Agentcard stopped it before
- * its card left. While an approval is outstanding, or once a payment for this checkout may
- * already exist, the page says a payment is in progress instead of that nothing was sent
- * (card-endpoint-page.ts refusedNavigationOutcome), and names that payment's authorization.
+ * its card left, naming where the card was going: a card endpoint profile's own merchant, or
+ * CyberSource for a Secure Acceptance post. While an approval is outstanding, or once a payment
+ * for this checkout may already exist, the page says a payment is in progress instead of that
+ * nothing was sent (card-endpoint-page.ts refusedNavigationOutcome), and names that payment's
+ * authorization.
  */
-async function stopNavigationBeforeSend(ctx, profile, reason) {
+async function stopNavigationBeforeSend(ctx, merchant, reason) {
     const state = ctx.lifecycle.getState();
     const outcome = refusedNavigationOutcome({ awaitingApproval: ctx.awaitingApproval(), status: state.status });
-    await ctx.effects.answer(cardEndpointStoppedPage({ outcome, reason, merchant: profile.merchant,
+    await ctx.effects.answer(cardEndpointStoppedPage({ outcome, reason, merchant,
         authorizationId: outcome === 'payment_in_progress' ? state.authorizationId : null }));
     return { kind: 'answer' };
 }
@@ -216,13 +220,13 @@ async function cardEndpointNavigationPreClaim(ctx, profile) {
     }
     if (navigation !== profile.navigation) {
         ctx.onEvent?.({ type: 'card_endpoint_refused', detail: { ...cardEndpointDetail(profile), reason: 'request_unsupported', refusal: `the card post navigates ${navigation === 'top' ? 'the page' : 'an iframe'}` } });
-        return stopNavigationBeforeSend(ctx, profile, 'request_unsupported');
+        return stopNavigationBeforeSend(ctx, profile.merchant, 'request_unsupported');
     }
     if (!cardEndpointLive(profile)) {
         ctx.preparationGate.invalidate('unsupported_checkout');
         ctx.lifecycle.unsupported('merchant_card_endpoint_not_enabled');
         ctx.onEvent?.({ type: 'unsupported_checkout', detail: { ...cardEndpointDetail(profile), reason: 'merchant_card_endpoint_not_enabled' } });
-        return stopNavigationBeforeSend(ctx, profile, 'not_enabled');
+        return stopNavigationBeforeSend(ctx, profile.merchant, 'not_enabled');
     }
     return { kind: 'pause', stripeStep: null, cardEndpoint: profile, navigation };
 }
@@ -1530,6 +1534,68 @@ async function paypalHostedFieldsUnreadable(ctx) {
     await ctx.effects.abort();
     return { kind: 'abort' };
 }
+// CyberSource Secure Acceptance's Silent Order POST (cybersource-secure-acceptance.ts). The merchant's
+// page posts the card the agent typed, beside the fields its server signed, to a /silent/ path on
+// CyberSource's Secure Acceptance hosts, which no Vault mode takes over, so every company's adapters
+// hand each request there to this gate, whether a fetch, an XHR or a form navigation sent it:
+//   - a card_number that holds a value, in the body or in the URL's query, stops the request as an
+//     unsupported checkout, reason `unsupported_cybersource_secure_acceptance`, with no claim, create or
+//     prompt, so CyberSource never receives the card. A form navigation of the page or of a frame (Arrow
+//     submits its form into a hidden iframe) is answered with the stopped page, as a card endpoint's form
+//     is, since an aborted page load renders nothing and invites another click on Pay; any other request
+//     fails. The attachment then reads `unsupported` and holds: the page's next post would carry the
+//     card again;
+//   - a body the adapter could not read stops that request alone, the same way, with a `blocked` event,
+//     `unreadable_cybersource_secure_acceptance_request`, and does not hold the attachment: nothing
+//     proves it carries no card;
+//   - any other request (a payment with a stored payment_token and no card, a GET, a CORS preflight)
+//     defers, and the arbiter continues it untouched.
+// A request the synced registry recognizes as a card request defers too, so the arbiter pauses it for
+// that recognizer; no build serves one today. A path outside /silent/ is not this gate's. Synchronous
+// until it must stop a request, like every gate. Exported for the gate registry's tests.
+export const cybersourceSecureAcceptancePreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isCybersourceSecureAcceptanceUrl(url) || ctx.vault.isCardRequest(url, method))
+        return undefined;
+    // A reader that throws (Playwright's postData() can) reads as a body the adapter could not read.
+    const { body, contentType } = cardEndpointPausedBody(ctx);
+    const carried = cybersourceSecureAcceptanceRequest(url, method, body, contentType);
+    if (carried === 'no_card')
+        return undefined;
+    return carried === 'card' ? cybersourceSecureAcceptanceUnsupported(ctx) : cybersourceSecureAcceptanceUnreadable(ctx);
+};
+async function cybersourceSecureAcceptanceUnsupported(ctx) {
+    const { url, method } = ctx.request;
+    ctx.preparationGate.invalidate('unsupported_checkout');
+    ctx.lifecycle.unsupported(CYBERSOURCE_SECURE_ACCEPTANCE_REASON);
+    ctx.onEvent?.({ type: 'unsupported_checkout', detail: { url: eventUrl(ctx.vault, url), method, reason: CYBERSOURCE_SECURE_ACCEPTANCE_REASON } });
+    return cybersourceSecureAcceptanceStop(ctx);
+}
+async function cybersourceSecureAcceptanceUnreadable(ctx) {
+    ctx.onEvent?.({ type: 'blocked', detail: 'unreadable_cybersource_secure_acceptance_request' });
+    return cybersourceSecureAcceptanceStop(ctx);
+}
+/**
+ * Stop a Secure Acceptance post: a form navigation gets the stopped page, and if the page cannot be
+ * answered, or the request is not a navigation, it fails. Either way the card never leaves.
+ */
+async function cybersourceSecureAcceptanceStop(ctx) {
+    let navigation = false;
+    try {
+        navigation = ctx.request.navigation === true;
+    }
+    catch {
+        navigation = false;
+    }
+    if (navigation) {
+        try {
+            return await stopNavigationBeforeSend(ctx, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, 'request_unsupported');
+        }
+        catch { /* the page could not be answered: fail the request below */ }
+    }
+    await ctx.effects.abort().catch(() => { });
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1563,7 +1629,8 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim];
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim,
+    cybersourceSecureAcceptancePreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -2172,6 +2172,33 @@
       "hostname_pattern": "^assets\\.braintreegateway\\.com$",
       "pathname_pattern": "^\\/web\\/[0-9]+\\.[0-9]+\\.[0-9]+-payments-sdk(?:-[a-z]+)?\\/html\\/hosted-fields-(?:input-frame|payments-sdk-tokenization-frame)(?:\\.min)?\\.html$"
     },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://secureacceptance.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^secureacceptance\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
     {
       "id": "fiserv-commercehub-payment-fields",
       "psp": "fiserv",
@@ -3432,6 +3459,60 @@
       "hostname_pattern": "^testflex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post-test",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://testsecureacceptance.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^testsecureacceptance\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
+    {
+      "id": "cybersource-secure-acceptance-silent-order-post-in",
+      "psp": "cybersource_secure_acceptance",
+      "kinds": [
+        "form",
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://secureacceptance.in.cybersource.com",
+      "path_pattern": "/silent/*",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html",
+          "reviewed_on": "2026-10-08"
+        },
+        {
+          "kind": "saved_observation",
+          "reference": "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form",
+          "reviewed_on": "2026-10-08"
+        }
+      ],
+      "variant_unverified": "CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource's Secure Acceptance hosts; no Vault mode takes that request over.",
+      "hostname_pattern": "^secureacceptance\\.in\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/silent\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+\\/?$"
+    },
     {
       "id": "worldpay-eprotect-js-api-prelive",
       "psp": "worldpay_eprotect",

package/dist/preflight-schemas.json

@@ -469,6 +469,7 @@
                 "gravy-secure-fields-script",
                 "gravy-secure-fields-script-sandbox",
                 "paypal-hosted-fields-payments-sdk",
+                "cybersource-secure-acceptance-silent-order-post",
                 "fiserv-commercehub-payment-fields",
                 "fiserv-commercehub-checkout-script",
                 "fiserv-secure-data-capture-frame",
@@ -523,6 +524,8 @@
                 "gmo-link-hosted-page-test",
                 "cybersource-flex-microform-script-test",
                 "cybersource-flex-microform-field-test",
+                "cybersource-secure-acceptance-silent-order-post-test",
+                "cybersource-secure-acceptance-silent-order-post-in",
                 "worldpay-eprotect-js-api-prelive",
                 "worldpay-eprotect-iframe-client-prelive",
                 "worldpay-eprotect-payframe-prelive",
@@ -1100,6 +1103,7 @@
                       "gravy-secure-fields-script",
                       "gravy-secure-fields-script-sandbox",
                       "paypal-hosted-fields-payments-sdk",
+                      "cybersource-secure-acceptance-silent-order-post",
                       "fiserv-commercehub-payment-fields",
                       "fiserv-commercehub-checkout-script",
                       "fiserv-secure-data-capture-frame",
@@ -1154,6 +1158,8 @@
                       "gmo-link-hosted-page-test",
                       "cybersource-flex-microform-script-test",
                       "cybersource-flex-microform-field-test",
+                      "cybersource-secure-acceptance-silent-order-post-test",
+                      "cybersource-secure-acceptance-silent-order-post-in",
                       "worldpay-eprotect-js-api-prelive",
                       "worldpay-eprotect-iframe-client-prelive",
                       "worldpay-eprotect-payframe-prelive",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 9d383b5155c791fc68947784fe3e2c16d03d3056572fb353f98305358fe75bc9
+// source-sha256: fc24e6cb50ab112c3a15983c461185a9189bd0cf8c5e1ceb73e8432e6eebc37f
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -79,6 +79,23 @@ RULES.push({ id: 'paypal-hosted-fields-payments-sdk', psp: 'paypal', kinds: ['fr
         paypalHostedFieldsSource('https://www.paypal.com/sdk/js?components=hosted-fields'),
         { kind: 'saved_observation', reference: 'planet-golf-uk-2026-10-06:paypal-hosted-fields-payments-sdk-frames', reviewed_on: '2026-10-07' }],
     variant_unverified: 'PayPal legacy Hosted Fields frames send the card to the Orders v2 confirm-payment-source on cors.api.paypal.com; no Vault mode takes that request over.' });
+// CyberSource Secure Acceptance's Silent Order POST (the Secure Acceptance Checkout API), reviewed 2026-10-08 from
+// CyberSource's endpoint table and Arrow Electronics' public bundles (no card was sent). The merchant's own page
+// posts the card fields, unsigned, beside the fields its server signed, to a /silent/ path on CyberSource's Secure
+// Acceptance hosts: production, test (testsecureacceptance) and production in India (secureacceptance.in), below.
+// Arrow submits that form into a hidden iframe; a merchant can also post it as the page's own form. No Vault mode
+// takes that post over, and the checkout SDK stops it (checkout/src/cybersource-secure-acceptance.ts). So the form,
+// and a frame or document on a /silent/ path, name cybersource_secure_acceptance and the result stays unknown
+// through `variant_unverified`. Hosted Checkout, the same hosts without /silent/, takes the card on CyberSource's
+// own page and is not named here.
+const secureAcceptanceSources = [
+    { kind: 'official_documentation', reference: 'https://developer.cybersource.com/docs/cybs/en-us/sa/developer/all/sa-checkout/secure-acceptance.html', reviewed_on: '2026-10-08' },
+    { kind: 'saved_observation', reference: 'arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form', reviewed_on: '2026-10-08' },
+];
+RULES.push({ id: 'cybersource-secure-acceptance-silent-order-post', psp: 'cybersource_secure_acceptance', kinds: ['form', 'document', 'frame', 'iframe'],
+    hostname: /^secureacceptance\.cybersource\.com$/, pathname: /^\/silent\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\/?$/,
+    origin: 'https://secureacceptance.cybersource.com', path_pattern: '/silent/*', sources: secureAcceptanceSources,
+    variant_unverified: 'CyberSource Secure Acceptance Silent Order POST sends the card from the merchant page to /silent/ on CyberSource\'s Secure Acceptance hosts; no Vault mode takes that request over.' });
 // Fiserv Commerce Hub, read 2026-09-23 from Home Depot's OrangePay frame and Fiserv's
 // docs: payment-fields.js renders one Secure Data Capture iframe per card field, and
 // the Checkout JS SDK is Commerce Hub's other browser entry. Fiserv ships dark (its
@@ -310,6 +327,9 @@ for (const [baseId, suffix, hostname, origin] of [
     ['gmo-link-hosted-page', 'test', /^pt01\.mul-pay\.jp$/, 'https://pt01.mul-pay.jp'],
     ['cybersource-flex-microform-script', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
     ['cybersource-flex-microform-field', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
+    // Secure Acceptance's test host and its production host in India serve the same /silent/ paths.
+    ['cybersource-secure-acceptance-silent-order-post', 'test', /^testsecureacceptance\.cybersource\.com$/, 'https://testsecureacceptance.cybersource.com'],
+    ['cybersource-secure-acceptance-silent-order-post', 'in', /^secureacceptance\.in\.cybersource\.com$/, 'https://secureacceptance.in.cybersource.com'],
     ['worldpay-eprotect-js-api', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],
     ['worldpay-eprotect-iframe-client', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],
     ['worldpay-eprotect-payframe', 'prelive', /^request\.eprotect\.vantivprelive\.com$/, 'https://request.eprotect.vantivprelive.com'],