@agent-cards/sdk 0.23.9 → 0.23.10

package/dist/preflight-catalog.json

@@ -95,10 +95,6 @@
       "psp": "recurly",
       "detection": "reviewed_rules"
     },
-    {
-      "psp": "moneris",
-      "detection": "reviewed_rules"
-    },
     {
       "psp": "bambora",
       "detection": "reviewed_rules"
@@ -106,10 +102,6 @@
     {
       "psp": "global_payments",
       "detection": "reviewed_rules"
-    },
-    {
-      "psp": "gravy",
-      "detection": "reviewed_rules"
     }
   ],
   "rules": [
@@ -2108,16 +2100,21 @@
         "script"
       ],
       "origin": "https://cdn.:merchant.gr4vy.app",
-      "path_pattern": "/secure-fields.js",
+      "path_pattern": "/secure-fields/{latest,:version}/secure-fields.js",
       "sources": [
         {
           "kind": "primary_source",
-          "reference": "https://docs.gr4vy.com/guides/payments/secure-fields",
-          "reviewed_on": "2026-09-15"
+          "reference": "https://docs.gr4vy.com/guides/payments/secure-fields/quick-start/embed",
+          "reviewed_on": "2026-10-10"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://cdn.trek.gr4vy.app/secure-fields/latest/secure-fields.js",
+          "reviewed_on": "2026-10-10"
         }
       ],
       "hostname_pattern": "^cdn\\.[a-z0-9-]+\\.gr4vy\\.app$",
-      "pathname_pattern": "^\\/secure-fields\\.js$"
+      "pathname_pattern": "^\\/secure-fields\\/(?:latest|[0-9]{1,3}(?:\\.[0-9]{1,3}){0,2})\\/secure-fields\\.js$"
     },
     {
       "id": "gravy-secure-fields-script-sandbox",
@@ -2126,16 +2123,21 @@
         "script"
       ],
       "origin": "https://cdn.sandbox.:merchant.gr4vy.app",
-      "path_pattern": "/secure-fields.js",
+      "path_pattern": "/secure-fields/{latest,:version}/secure-fields.js",
       "sources": [
         {
           "kind": "primary_source",
-          "reference": "https://docs.gr4vy.com/guides/payments/secure-fields",
-          "reviewed_on": "2026-09-15"
+          "reference": "https://docs.gr4vy.com/guides/payments/secure-fields/quick-start/embed",
+          "reviewed_on": "2026-10-10"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://cdn.trek.gr4vy.app/secure-fields/latest/secure-fields.js",
+          "reviewed_on": "2026-10-10"
         }
       ],
       "hostname_pattern": "^cdn\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$",
-      "pathname_pattern": "^\\/secure-fields\\.js$"
+      "pathname_pattern": "^\\/secure-fields\\/(?:latest|[0-9]{1,3}(?:\\.[0-9]{1,3}){0,2})\\/secure-fields\\.js$"
     },
     {
       "id": "paypal-hosted-fields-payments-sdk",
@@ -4903,6 +4905,49 @@
       "hostname_pattern": "^api\\.demo\\.convergepay\\.com$",
       "pathname_pattern": "^\\/hosted-payments\\/(?:Checkout|PayWithConverge)\\.js$"
     },
+    {
+      "id": "elavon-converge-hosted-payment-page-www",
+      "psp": "elavon_converge",
+      "kinds": [
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://www.convergepay.com",
+      "path_pattern": "/hosted-payments/",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://api.convergepay.com/hosted-payments/",
+          "reviewed_on": "2026-09-25"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://developer.elavon.com/products/hosted-payment-page/v1/take-a-payment",
+          "reviewed_on": "2026-09-25"
+        }
+      ],
+      "hostname_pattern": "^www\\.convergepay\\.com$",
+      "pathname_pattern": "^\\/hosted-payments\\/$"
+    },
+    {
+      "id": "elavon-converge-hpp-bundle-www",
+      "psp": "elavon_converge",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://www.convergepay.com",
+      "path_pattern": "/hosted-payments/assets/hpp-:version.js",
+      "sources": [
+        {
+          "kind": "primary_source",
+          "reference": "https://api.convergepay.com/hosted-payments/assets/hpp-2.505.07.js",
+          "reviewed_on": "2026-09-25"
+        }
+      ],
+      "hostname_pattern": "^www\\.convergepay\\.com$",
+      "pathname_pattern": "^\\/hosted-payments\\/assets\\/hpp-[0-9]+\\.[0-9]+\\.[0-9]+\\.js$"
+    },
     {
       "id": "wspay-components-script-test",
       "psp": "wspay",
@@ -6705,81 +6750,6 @@
         "src/backend.js"
       ]
     },
-    {
-      "psp": "moneris",
-      "status": "supported",
-      "mode": "token",
-      "operations": [
-        {
-          "id": "moneris.card_request",
-          "effect": "processor_specific_card_request",
-          "amount_binding": "unestablished",
-          "psp": "moneris",
-          "version": 1,
-          "mode": "token",
-          "autopilot_eligible": false,
-          "requires": "reviewed_final_payment_and_continuation_evidence"
-        }
-      ],
-      "scenarios": {
-        "one_time": {
-          "status": "supported",
-          "reason": "card_request_adapter_implemented",
-          "requirements": [
-            "actual_payment_request_validation",
-            "merchant_confirmation"
-          ]
-        },
-        "save_card": {
-          "status": "conditional",
-          "reason": "merchant_card_storage_and_consent_required",
-          "requirements": [
-            "actual_payment_request_validation",
-            "merchant_confirmation",
-            "stored_card_consent",
-            "merchant_card_saved"
-          ]
-        },
-        "subscription_initial": {
-          "status": "conditional",
-          "reason": "merchant_card_storage_and_consent_required",
-          "requirements": [
-            "actual_payment_request_validation",
-            "merchant_confirmation",
-            "stored_card_consent",
-            "merchant_subscription_confirmation"
-          ]
-        },
-        "subscription_renewal": {
-          "status": "outside_vault",
-          "reason": "renewal_managed_by_merchant",
-          "requirements": [
-            "verify_merchant_billing"
-          ]
-        }
-      },
-      "limitations": [
-        "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-        "The implemented integration is Moneris Hosted Tokenization."
-      ],
-      "unsupported_variants": [
-        {
-          "variant": "moneris_checkout_chkt",
-          "status": "unsupported",
-          "constraint": "direct_sdk",
-          "reason": "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented."
-        }
-      ],
-      "processor_amount": "none",
-      "challenge_surface": "merchant_browser",
-      "merchant_confirmation_required": true,
-      "live_validation": "not_established_by_catalog",
-      "sources": [
-        "src/definitions.js",
-        "src/operations.js",
-        "src/backend.js"
-      ]
-    },
     {
       "psp": "bambora",
       "status": "supported",
@@ -6922,84 +6892,6 @@
         "src/operations.js",
         "src/backend.js"
       ]
-    },
-    {
-      "psp": "gravy",
-      "status": "unsupported",
-      "mode": "token",
-      "operations": [
-        {
-          "id": "gravy.card_request",
-          "effect": "processor_specific_card_request",
-          "amount_binding": "unestablished",
-          "psp": "gravy",
-          "version": 1,
-          "mode": "token",
-          "autopilot_eligible": false,
-          "requires": "reviewed_final_payment_and_continuation_evidence"
-        }
-      ],
-      "scenarios": {
-        "one_time": {
-          "status": "unsupported",
-          "reason": "request_method_not_supported",
-          "requirements": []
-        },
-        "save_card": {
-          "status": "unsupported",
-          "reason": "request_method_not_supported",
-          "requirements": []
-        },
-        "subscription_initial": {
-          "status": "unsupported",
-          "reason": "request_method_not_supported",
-          "requirements": []
-        },
-        "subscription_renewal": {
-          "status": "outside_vault",
-          "reason": "renewal_managed_by_merchant",
-          "requirements": [
-            "verify_merchant_billing"
-          ]
-        }
-      },
-      "limitations": [
-        "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-        "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.",
-        "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.",
-        "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.",
-        "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."
-      ],
-      "unsupported_variants": [
-        {
-          "variant": "embed_hosted_checkout",
-          "status": "unsupported",
-          "constraint": "direct_sdk",
-          "reason": "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path."
-        },
-        {
-          "variant": "stored_payment_method_or_security_code_only",
-          "status": "unsupported",
-          "constraint": "direct_sdk",
-          "reason": "Saved payment methods and security-code-only updates are outside new-card session updates."
-        },
-        {
-          "variant": "checkout_session_create_or_transaction",
-          "status": "unsupported",
-          "constraint": "direct_sdk",
-          "reason": "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser."
-        }
-      ],
-      "processor_amount": "none",
-      "challenge_surface": "merchant_browser",
-      "merchant_confirmation_required": true,
-      "live_validation": "not_established_by_catalog",
-      "sources": [
-        "src/definitions.js",
-        "src/operations.js",
-        "src/backend.js",
-        "test/fixtures/gravy-secure-fields.json"
-      ]
     }
   ],
   "exclusions": [
@@ -7180,12 +7072,6 @@
         "scenario": "one_time",
         "status": "supported"
       },
-      {
-        "psp": "moneris",
-        "mode": "token",
-        "scenario": "one_time",
-        "status": "supported"
-      },
       {
         "psp": "bambora",
         "mode": "token",
@@ -7197,12 +7083,6 @@
         "mode": "token",
         "scenario": "one_time",
         "status": "supported"
-      },
-      {
-        "psp": "gravy",
-        "mode": "token",
-        "scenario": "one_time",
-        "status": "unsupported"
       }
     ],
     "entries": [

package/dist/preflight-schemas.json

@@ -230,10 +230,8 @@
                     "mollie",
                     "paysafe",
                     "recurly",
-                    "moneris",
                     "bambora",
-                    "global_payments",
-                    "gravy"
+                    "global_payments"
                   ]
                 },
                 "mode": {
@@ -585,6 +583,8 @@
                 "elavon-converge-hpp-bundle-demo",
                 "elavon-converge-lightbox-demo",
                 "elavon-converge-checkout-js-demo",
+                "elavon-converge-hosted-payment-page-www",
+                "elavon-converge-hpp-bundle-www",
                 "wspay-components-script-test",
                 "wspay-components-card-frame-test",
                 "wspay-form-hosted-page-test",
@@ -754,10 +754,8 @@
                 "mollie",
                 "paysafe",
                 "recurly",
-                "moneris",
                 "bambora",
-                "global_payments",
-                "gravy"
+                "global_payments"
               ]
             },
             "mode": {
@@ -1219,6 +1217,8 @@
                       "elavon-converge-hpp-bundle-demo",
                       "elavon-converge-lightbox-demo",
                       "elavon-converge-checkout-js-demo",
+                      "elavon-converge-hosted-payment-page-www",
+                      "elavon-converge-hpp-bundle-www",
                       "wspay-components-script-test",
                       "wspay-components-card-frame-test",
                       "wspay-form-hosted-page-test",

package/dist/preflight.generated.d.ts

@@ -1244,54 +1244,6 @@ export declare function getCheckoutPreflightCatalog(): {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "moneris";
-        readonly status: "supported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "moneris.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "moneris";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "supported";
-                readonly reason: "card_request_adapter_implemented";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
-            };
-            readonly save_card: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
-            };
-            readonly subscription_initial: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The implemented integration is Moneris Hosted Tokenization."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "moneris_checkout_chkt";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
     }, {
         readonly psp: "bambora";
         readonly status: "supported";
@@ -1383,64 +1335,6 @@ export declare function getCheckoutPreflightCatalog(): {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "gravy";
-        readonly status: "unsupported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "gravy.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "gravy";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly save_card: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_initial: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.", "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.", "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.", "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "embed_hosted_checkout";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path.";
-        }, {
-            readonly variant: "stored_payment_method_or_security_code_only";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Saved payment methods and security-code-only updates are outside new-card session updates.";
-        }, {
-            readonly variant: "checkout_session_create_or_transaction";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "test/fixtures/gravy-secure-fields.json"];
     }];
     exclusions: readonly [{
         readonly psp: "vgs";

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: fc24e6cb50ab112c3a15983c461185a9189bd0cf8c5e1ceb73e8432e6eebc37f
+// source-sha256: f0596389845388a1c6150964e576c420abb0b44a805347e4ba4d0617f3b8ea2b
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -39,6 +39,12 @@ RULES.push({ "id": "checkout-frames-v2-script", "psp": "checkout_com", "kinds":
 // stays unknown through `variant_unverified`; no entry here expands a recognized card destination.
 const documented = (reference) => ({ kind: 'primary_source', reference, reviewed_on: '2026-09-15' });
 const observed = (reference) => ({ kind: 'partner_observation', reference: `kernel-discovery-2026-09-14:${reference}`, reviewed_on: '2026-09-15' });
+// Gravy's Secure Fields loader, read from Gravy's guide and from two live merchants on 2026-10-10.
+const GRAVY_SECURE_FIELDS_SCRIPT = /^\/secure-fields\/(?:latest|[0-9]{1,3}(?:\.[0-9]{1,3}){0,2})\/secure-fields\.js$/;
+const GRAVY_SOURCES = [
+    { kind: 'primary_source', reference: 'https://docs.gr4vy.com/guides/payments/secure-fields/quick-start/embed', reviewed_on: '2026-10-10' },
+    { kind: 'primary_source', reference: 'https://cdn.trek.gr4vy.app/secure-fields/latest/secure-fields.js', reviewed_on: '2026-10-10' },
+];
 RULES.push({ id: 'tranzila-terminal-hosted-page', psp: 'tranzila', kinds: ['document', 'frame', 'iframe', 'form'], hostname: /^direct\.tranzila\.com$/, pathname: /^\/(?!process(?:\/|$)|done(?:\/|$))[A-Za-z0-9_-]+\/?$/, origin: 'https://direct.tranzila.com', path_pattern: '/:terminal/',
     sources: [documented('https://docs.tranzila.com/docs/payments-and-billing/hosted-payment-page'), observed('tranzila-terminal-root-hosted-page')],
     variant_unverified: 'The implemented Tranzila hosted form covers direct.tranzila.com/:terminal/iframenew.php; a terminal-root hosted payment page is not admitted.' }, { id: 'square-card-element-frame', psp: 'square', kinds: ['frame', 'iframe'], hostname: /^web\.squarecdn\.com$/, pathname: /^\/[0-9]+\.[0-9]+\.[0-9]+\/single-card-element-iframe\.html$/, origin: 'https://web.squarecdn.com', path_pattern: '/:version/single-card-element-iframe.html',
@@ -52,15 +58,17 @@ RULES.push({ id: 'tranzila-terminal-hosted-page', psp: 'tranzila', kinds: ['docu
     sources: [documented('https://docs.dlocal.com/docs/set-up-smart-fields'), observed('dlocal-smart-fields-6.8.3')] }, { id: 'mercado-pago-secure-fields-frame', psp: 'mercado_pago', kinds: ['frame', 'iframe', 'document'], hostname: /^secure-fields\.mercadopago\.com$/, pathname: /^\/$/, origin: 'https://secure-fields.mercadopago.com', path_pattern: '/',
     sources: [documented('https://sdk.mercadopago.com/js/v2'), observed('mercado-pago-secure-fields-frames')] }, { id: 'mercado-pago-checkout-pro-card-form', psp: 'mercado_pago', kinds: ['document', 'frame', 'iframe'], hostname: /^www\.mercadopago\.com\.ar$/, pathname: /^\/checkout\/v1\/payment\/redirect\/[^/]+\/card-form\/?$/, origin: 'https://www.mercadopago.com.ar', path_pattern: '/checkout/v1/payment/redirect/:preference/card-form/',
     sources: [documented('https://www.mercadopago.com.ar/developers/es/docs/checkout-pro/landing'), observed('mercado-pago-checkout-pro-guest-card-form')] }, 
-// Gravy (Gr4vy) Secure Fields: the merchant page loads secure-fields.js from the
-// merchant's own CDN host, cdn.<merchant>.gr4vy.app, or cdn.sandbox.<merchant>.gr4vy.app
-// in test. The bounded merchant label mirrors the recognizer's api.<merchant> hosts and
-// the VGS tenant rule above; gr4vy.app is Gravy's own domain, so no third party can
-// stand up a host that satisfies it. Written from the published integration contract,
-// not yet confirmed against a live merchant page.
-{ id: 'gravy-secure-fields-script', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.[a-z0-9-]+\.gr4vy\.app$/, pathname: /^\/secure-fields\.js$/, origin: 'https://cdn.:merchant.gr4vy.app', path_pattern: '/secure-fields.js',
-    sources: [documented('https://docs.gr4vy.com/guides/payments/secure-fields')] }, { id: 'gravy-secure-fields-script-sandbox', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.sandbox\.[a-z0-9-]+\.gr4vy\.app$/, pathname: /^\/secure-fields\.js$/, origin: 'https://cdn.sandbox.:merchant.gr4vy.app', path_pattern: '/secure-fields.js',
-    sources: [documented('https://docs.gr4vy.com/guides/payments/secure-fields')] });
+// Gravy (Gr4vy) Secure Fields: the merchant page loads /secure-fields/latest/secure-fields.js
+// from the merchant's own CDN host, cdn.<merchant>.gr4vy.app, or cdn.sandbox.<merchant>.gr4vy.app
+// in test, as Gravy's guide writes it and as Trek Bicycle and the Wikimedia Foundation load it
+// (read 2026-10-10); /secure-fields.js at the root answers 404 on every instance checked. A
+// numbered directory in place of `latest` is admitted too. The bounded merchant label mirrors
+// the recognizer's api.<merchant> hosts and the VGS tenant rule above; gr4vy.app is Gravy's own
+// domain, so no third party can stand up a host that satisfies it. Gravy ships dark, so these
+// signals name gravy and the result stays unknown.
+{ id: 'gravy-secure-fields-script', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.[a-z0-9-]+\.gr4vy\.app$/, pathname: GRAVY_SECURE_FIELDS_SCRIPT, origin: 'https://cdn.:merchant.gr4vy.app', path_pattern: '/secure-fields/{latest,:version}/secure-fields.js',
+    sources: GRAVY_SOURCES }, { id: 'gravy-secure-fields-script-sandbox', psp: 'gravy', kinds: ['script'], hostname: /^cdn\.sandbox\.[a-z0-9-]+\.gr4vy\.app$/, pathname: GRAVY_SECURE_FIELDS_SCRIPT, origin: 'https://cdn.sandbox.:merchant.gr4vy.app', path_pattern: '/secure-fields/{latest,:version}/secure-fields.js',
+    sources: GRAVY_SOURCES });
 // PayPal's legacy Hosted Fields (its JS SDK's components=hosted-fields), reviewed 2026-10-07 from Planet Golf
 // UK's payment step (read live 2026-10-06, SDK 5.0.580) and the two frame files it loads. The SDK renders each
 // card field as braintree-web's 3.32.0-payments-sdk-dev hosted-fields-input-frame.min.html (sha256
@@ -212,7 +220,7 @@ RULES.push({ id: 'payrails-web-sdk-v6-script', psp: 'payrails', kinds: ['script'
     sources: [payrailsSource('https://assets.payrails.io/web-sdk/v6/payrails.js'), payrailsSource('https://www.npmjs.com/package/@payrails/web-sdk/v/6.5.0')] }, { id: 'payrails-secure-frame-v6', psp: 'payrails', kinds: ['frame', 'iframe', 'document'], hostname: /^assets\.payrails\.io$/, pathname: /^\/apps\/secure-frame\/(?:v6|6\.[0-9]+\.[0-9]+)\/index\.html$/, origin: 'https://assets.payrails.io', path_pattern: '/apps/secure-frame/{v6,6.:minor.:patch}/index.html',
     sources: [payrailsSource('https://assets.payrails.io/apps/secure-frame/v6/index.html'), payrailsSource('https://docs.payrails.com/docs/secure-fields')] });
 // Elavon Converge Hosted Payment Page (NY DMV), reviewed from Converge's own page shell and bundle
-// on 2026-09-25 (byte-identical on the production and demo hosts). The processor ships dark: until
+// on 2026-09-25 (byte-identical on the production and demo hosts, and on www on 2026-10-10). The processor ships dark: until
 // the bundled catalog serves elavon_converge, a lone Converge signal names the processor and stays
 // unknown. The page URL carries ?ssl_txn_auth_token=, which never takes part in matching. The
 // Lightbox modal and Checkout.js are named as unverified variants.
@@ -304,8 +312,8 @@ RULES.push({ id: 'worldline-mycheckout-page', psp: 'worldline_mycheckout', kinds
 // bundled catalog's processors, lists its psp. Until then its assets are not evidence, so a page
 // that loads them, alone or beside another processor's SDK, reads exactly as it did before the
 // processor existed. (The dark GMO, CyberSource Flex, Juspay, Pelecard, ACI, CreditGuard,
-// Primer, Payrails, Elavon Converge, Worldpay eProtect, WSPay, Shiji STS, Amadeus and Worldline
-// MyCheckout rules above join RULES now, and their signals stay unknown.)
+// Primer, Payrails, Elavon Converge, Worldpay eProtect, WSPay, Shiji STS, Amadeus, Worldline
+// MyCheckout and Gravy rules above join RULES now, and their signals stay unknown.)
 const SERVED_ONLY_RULES = [];
 // Datatrans / PCI Proxy Secure Fields 2.0.0, reviewed from Datatrans's public library and iframe
 // script (pay.datatrans.com/upp/payment/js/secure-fields-2.0.0.js and .min.js, field.js 3.24.602)
@@ -400,6 +408,9 @@ for (const [baseId, suffix, hostname, origin] of [
     ['elavon-converge-hpp-bundle', 'demo', /^api\.demo\.convergepay\.com$/, 'https://api.demo.convergepay.com'],
     ['elavon-converge-lightbox', 'demo', /^api\.demo\.convergepay\.com$/, 'https://api.demo.convergepay.com'],
     ['elavon-converge-checkout-js', 'demo', /^api\.demo\.convergepay\.com$/, 'https://api.demo.convergepay.com'],
+    // Every Buy Button and pay link opens the same page shell and bundle on www (read 2026-10-10).
+    ['elavon-converge-hosted-payment-page', 'www', /^www\.convergepay\.com$/, 'https://www.convergepay.com'],
+    ['elavon-converge-hpp-bundle', 'www', /^www\.convergepay\.com$/, 'https://www.convergepay.com'],
     ['wspay-components-script', 'test', /^proxy-test\.wspay\.biz$/, 'https://proxy-test.wspay.biz'],
     ['wspay-components-card-frame', 'test', /^proxy-test\.wspay\.biz$/, 'https://proxy-test.wspay.biz'],
     ['wspay-form-hosted-page', 'test', /^formtest\.wspay\.biz$/, 'https://formtest.wspay.biz'],
@@ -435,8 +446,9 @@ const DEFAULT_PROFILE = {
     schema_version: 1, profile_version: 'preflight-2', catalog_version: CHECKOUT_PREFLIGHT_CATALOG_VERSION,
     integration: { id: 'direct_sdk', version: 'bundled' },
     // The bundled profile repeats each processor's projected status. A processor whose card
-    // request the SDK cannot pause at all, Gravy's PUT today, is declared unsupported here
-    // as well as in its scenarios, so the exported profile never contradicts the assessment.
+    // request the SDK cannot pause at all (a `card_request` gate in the projection) is declared
+    // unsupported here as well as in its scenarios, so the exported profile never contradicts
+    // the assessment.
     processor_entries: CHECKOUT_PREFLIGHT_CAPABILITIES.processors.map(processor => ({
         psp: processor.psp, mode: processor.mode, scenario: 'one_time', status: processor.status,
     })),

package/dist/preparation.d.ts

@@ -28,6 +28,8 @@ export declare class PreparationGate {
     assertDocument(): Promise<void>;
     private readDocument;
     isEngaged(): boolean;
+    /** Whether the one preparation was bound to a card request (claim() took it). */
+    isConsumed(): boolean;
     /**
      * A card request that only a prepared checkout may pay (an Adyen merchant
      * profile's, or a Fiserv card capture, pre-claim.ts) arrived with no

package/dist/preparation.js

@@ -183,8 +183,8 @@ export class PreparationGate {
         // carries, sent from the page it approved (the request's own Origin header names it).
         if (Date.parse(prepared.expiresAt) <= Date.now() || !matchesPreparation(prepared, requestUrl, requestMethod, requestBody, requestHeaders)) {
             // An Amadeus request payment-core refuses names its own reason (preparedRequestRefusal), so
-            // Air France's split expiry reads amadeus_merchant_held_expiry rather than a changed checkout,
-            // and a Secure Acceptance frame post with no Origin reads secure_acceptance_origin_header.
+            // a Data Collection Page store reads amadeus_dcp_field_config_unreviewed rather than a changed
+            // checkout, and a Secure Acceptance frame post with no Origin reads secure_acceptance_origin_header.
             const reason = Date.parse(prepared.expiresAt) <= Date.now() ? 'expired'
                 : preparedRequestRefusal(prepared.psp, prepared.environment, requestUrl, requestBody, requestHeaders, prepared.merchantOrigin, prepared.currency);
             this.invalidate(reason);
@@ -216,6 +216,8 @@ export class PreparationGate {
         }
     }
     isEngaged() { return this.state !== 'unused'; }
+    /** Whether the one preparation was bound to a card request (claim() took it). */
+    isConsumed() { return this.state === 'consumed'; }
     /**
      * A card request that only a prepared checkout may pay (an Adyen merchant
      * profile's, or a Fiserv card capture, pre-claim.ts) arrived with no

package/dist/prepared-processor.d.ts

@@ -29,6 +29,20 @@ export type PreparationMode = 'token' | 'cse';
 export declare function preparationMode(psp: string): PreparationMode;
 /** The method of the native card request a preparation binds: the registration GET for Worldpay eProtect, a POST for every other processor. */
 export declare function preparationRequestMethod(psp: string): 'GET' | 'POST';
+/**
+ * Whether a prepared checkout's approval outlives the page's own request, as an unprepared token
+ * approval does (cdp.ts survivesAbandonment): the page's next request for the same purchase, from
+ * the card frame that sent the first, is answered from it, with no second prompt. The approval stays
+ * that frame's (cdp.ts sameFrame): another frame's request is refused, and the frame's removal ends it.
+ *
+ * Bambora only. Custom Checkout's card frame fails its tokenization request 5 seconds after
+ * sending it, and a Pay button that runs the tokenization again sends the same placeholder and
+ * fields (WooCommerce's Bambora plugin shows the timeout, clears its token fields and lets Pay be
+ * clicked again). The cardholder's device answers with a token that pays nothing until the
+ * merchant's server charges it. Every other prepared checkout still answers only the request it
+ * was bound to.
+ */
+export declare function preparedApprovalAnswersRetry(psp: string): boolean;
 /**
  * Shared endpoint processors cannot attest test/live mode from their URL or key prefix.
  * Adyen can: test and live are separate hosts and key prefixes. Fiserv's are separate
@@ -129,10 +143,10 @@ export declare function matchesPreparation(preparation: {
 /**
  * The reason a claim reports for a request its preparation does not match. An Amadeus preparation
  * names what payment-core's Amadeus check refused on its own environment's card URL, as
- * `amadeus_<reason>`: Air France's and KLM's add, whose expiry their own form keeps, is
- * `amadeus_merchant_held_expiry`, every Data Collection Page store is
- * `amadeus_dcp_field_config_unreviewed` until a merchant's field config is reviewed, and a Host
- * header that does not name the approved page is `amadeus_header_binding`. Everything else, another
- * processor's request or the other environment's host included, is `checkout_changed`.
+ * `amadeus_<reason>`: every Data Collection Page store is `amadeus_dcp_field_config_unreviewed`
+ * until a merchant's field config is reviewed, an add that keeps the card on file is
+ * `amadeus_card_on_file`, and a Host header that does not name the approved page is
+ * `amadeus_header_binding`. Everything else, another processor's request or the other
+ * environment's host included, is `checkout_changed`.
  */
 export declare function preparedRequestRefusal(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, body?: string | null, headers?: Record<string, string>, merchantOrigin?: string | null, currency?: string | null): string;