@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/pre-claim.d.ts

@@ -12,6 +12,7 @@ import { type CybersourceFlexDecision, type CybersourceFlexPause, type FlexReque
 import { type CardEndpointProfile } from './card-endpoint.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
+import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 /** The native Stripe step the gate claimed, or null when none was: exactly what StripeCheckoutGate.claim returns. */
 type StripeStep = ReturnType<StripeCheckoutGate['claim']>;
 /** A synthetic response a gate fulfills locally. The effect applies CORS and encoding. */
@@ -183,6 +184,11 @@ export interface PreClaimContext {
         companions: ShijiStsCompanions;
         page: () => string | Promise<string>;
     };
+    /**
+     * The card products this attachment saw a Worldline MyCheckout page choose (worldline-mycheckout.ts).
+     * Absent, no MyCheckout card submit is held to a product here.
+     */
+    worldlineMyCheckout?: WorldlineMyCheckoutProducts;
 }
 /**
  * The URL an event may name for a request. For an armed merchant profile's
@@ -204,6 +210,7 @@ export declare const fiservPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const paypalHostedFieldsPreClaim: PreClaimGate;
 export declare const cybersourceSecureAcceptancePreClaim: PreClaimGate;
+export declare const worldlineMyCheckoutPreClaim: PreClaimGate;
 /** The processor gates, in order. A new family adds one entry here; the terminal
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or

package/dist/pre-claim.js

@@ -17,7 +17,8 @@
 // no new card, Shiji STS's getTokenId and getCvvId, which also carry
 // requests the vault must never pay, and PayPal's legacy Hosted Fields
 // confirm and CyberSource Secure Acceptance's Silent Order POST, whose card
-// no Vault mode takes over.
+// no Vault mode takes over, and Worldline MyCheckout's card form, held to the
+// card product its page chose.
 // The first three used to be
 // written inline in Fetch.requestPaused and again in the page.route handler, so
 // a decision could drift between the two adapters and a new family had to be
@@ -72,11 +73,12 @@ import { isFiservCaptureHost, isFiservPausableBody } from './fiserv.js';
 import { CYBERSOURCE_FLEX_PSP, isCybersourceFlexHost } from './cybersource-flex.js';
 import { cardEndpointCarriesCard, cardEndpointDetail, cardEndpointFor, cardEndpointLive, cardEndpointPasses, cardEndpointResendFor, cardEndpointReviewed, } from './card-endpoint.js';
 import { cardEndpointStoppedPage, refusedNavigationOutcome } from './card-endpoint-page.js';
-import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsStaticHost, payrailsKeyRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
+import { PAYRAILS_HOLDING_REASONS, PAYRAILS_SESSION_MESSAGE, isPayrailsHost, isPayrailsPaymentUrl, isPayrailsStaticHost, payrailsKeyRefusal, payrailsPaymentRefusal, payrailsRequestKind, payrailsSaveRefusal, } from './payrails.js';
 import { classifyVerifoneProfileRequest, verifoneTemplatedUrl } from './verifone.js';
 import { ekashuEntryUrl, isEkashuEntry, isEkashuHost } from './ekashu.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
+import { isWorldlineMyCheckoutEndpoint } from './worldline-mycheckout.js';
 /**
  * The URL an event may name for a request. For an armed merchant profile's
  * endpoint or a sibling of it: the endpoint origin, the path TEMPLATE and the
@@ -953,14 +955,17 @@ async function pelecardBlock(ctx, reason) {
 //   - the page's CVC and expiry requests are held until that request's
 //     approval ends, then answered with its answer, never forwarded; they fail
 //     when it failed or never began;
-//   - the holder request continues untouched;
+//   - the holder request, and the ReD Shield device fingerprint the widget
+//     posts on load, continue untouched;
 //   - the /payment submission continues once per answered card-number request,
 //     as a frame navigation, with the placeholder expiry a classic-mode page
 //     puts there removed (only where the browser sends a replaced navigation
 //     body, else aci_expiry_unstrippable), or is refused with the judge's code;
 //   - anything else is refused with payment-core's code: a request that asks ACI
 //     to keep the card or pay with a stored one (aci_card_on_file_refused, which
-//     also retires a ready preparation) or one the widget never sends.
+//     also retires a ready preparation) or one the widget never sends. Only a
+//     refused request that names the card number fails the checkout's waiting
+//     CVC and expiry requests (AciGate.refused).
 // Everything else on ACI's hosts (the widget script, /bins, /v1/collect, GETs)
 // is not a POST to a checkout and defers. Synchronous for the card-number
 // request, so it pauses in the microtask it paused in.
@@ -969,7 +974,7 @@ const aciPreClaim = (ctx) => {
     if (!leg)
         return undefined;
     if (leg.leg === 'refuse') {
-        ctx.aci.refused(leg);
+        ctx.aci.refused(leg, ctx.request.body);
         return aciRefuse(ctx, leg.code);
     }
     if (leg.leg === 'pass')
@@ -1204,9 +1209,17 @@ async function primerUnsupported(ctx, reason) {
 //     static host (assets.payrails.io) is the one exception: it serves the SDK's and the secure
 //     frame's files and takes no payment, so another script's bodyless POST there continues
 //     untouched on both adapters;
-//   - a payment that carries an encrypted card inside paymentComposition (the card form paying,
-//     a stored card with a CVC field) aborts as an unsupported checkout,
-//     `unsupported_payrails_card_payment`, and the attachment holds;
+//   - the card form's payment (an encrypted card inside paymentComposition) on exactly an
+//     execution's authorize link the registry recognizes is judged like a save below, by
+//     payment-core's payment guard: a payment that stores the card at the merchant aborts as
+//     `payrails_card_on_file_consent_required`, a shape this build does not take over as
+//     `unsupported_payrails_card_payment`, and the attachment holds. A sound one is bound to the one
+//     captured session its token, execution, host and providerConfigId name, and pauses carrying
+//     the session's key and holderReference, which the payment's JWE carries;
+//   - any other payment that carries an encrypted card inside paymentComposition (a stored card
+//     with a CVC field, a split payment, another link, or one the registry does not recognize)
+//     aborts as an unsupported checkout, `unsupported_payrails_card_payment`, and the attachment
+//     holds;
 //   - a card save the registry recognizes is judged first by payment-core's guard and its
 //     card-on-file policy: a refusal aborts as an unsupported checkout with that code, and the
 //     attachment holds. Then it is bound to the one captured session its token, URL,
@@ -1214,9 +1227,9 @@ async function primerUnsupported(ctx, reason) {
 //     the page's frame wrapped. A miss aborts that request alone (`payrails_session_unavailable`,
 //     or the key's code) with a message to reload the checkout, and the attachment does not hold,
 //     so the save after a reload is judged afresh. A bound save pauses carrying the key;
-//   - anything else defers to the arbiter: a save with no card pauses there and the claim flow
-//     continues it (passWithoutCard), and every other request continues.
-// Synchronous unless answer bodies are still being read (the save then waits for them, briefly)
+//   - anything else defers to the arbiter: a save or payment with no card pauses there and the
+//     claim flow continues it (passWithoutCard), and every other request continues.
+// Synchronous unless answer bodies are still being read (the request then waits for them, briefly)
 // or the request aborts.
 const payrailsPreClaim = (ctx) => {
     const capture = ctx.payrails;
@@ -1227,23 +1240,33 @@ const payrailsPreClaim = (ctx) => {
     if (body === null || body === '')
         return isPayrailsStaticHost(url) ? undefined : payrailsUnreadable(ctx);
     const kind = payrailsRequestKind(url, method, body);
-    if (kind === 'card_payment')
-        return payrailsUnsupported(ctx, 'unsupported_payrails_card_payment');
-    if (kind !== 'card' || !ctx.vault.isCardRequest(url, method))
-        return undefined;
-    const refusal = payrailsSaveRefusal(body);
-    if (refusal)
-        return payrailsUnsupported(ctx, refusal);
+    if (kind === 'card_payment') {
+        if (!isPayrailsPaymentUrl(url) || !ctx.vault.isCardRequest(url, method))
+            return payrailsUnsupported(ctx, 'unsupported_payrails_card_payment');
+        const refusal = payrailsPaymentRefusal(body);
+        if (refusal)
+            return payrailsUnsupported(ctx, refusal);
+    }
+    else {
+        if (kind !== 'card' || !ctx.vault.isCardRequest(url, method))
+            return undefined;
+        const refusal = payrailsSaveRefusal(body);
+        if (refusal)
+            return payrailsUnsupported(ctx, refusal);
+    }
     return capture.pending ? capture.settle().then(() => payrailsBind(ctx, capture, body)) : payrailsBind(ctx, capture, body);
 };
 function payrailsBind(ctx, capture, body) {
-    const key = capture.keyFor({ url: ctx.request.url, headers: ctx.request.headers, body });
-    if (key === null)
+    const bound = capture.bind({ url: ctx.request.url, headers: ctx.request.headers, body });
+    if (bound === null)
         return payrailsUnsupported(ctx, 'payrails_session_unavailable');
-    const refusal = payrailsKeyRefusal(key, body);
+    const refusal = payrailsKeyRefusal(bound.key, body);
     if (refusal)
         return payrailsUnsupported(ctx, refusal);
-    return { kind: 'pause', stripeStep: ctx.stripeStep, payrails: { encryption_public_key: key } };
+    // A save names its own holderReference; a card-form payment's JWE needs the session's.
+    const payrails = isPayrailsPaymentUrl(ctx.request.url)
+        ? { encryption_public_key: bound.key, holder_reference: bound.holderReference } : { encryption_public_key: bound.key };
+    return { kind: 'pause', stripeStep: ctx.stripeStep, payrails };
 }
 async function payrailsUnreadable(ctx) {
     ctx.onEvent?.({ type: 'blocked', detail: 'unreadable_payrails_request' });
@@ -1263,15 +1286,15 @@ async function payrailsUnsupported(ctx, reason) {
     return { kind: 'abort' };
 }
 // Elavon Converge's Hosted Payment Page (elavon-converge.ts). Its card URL, POST
-// /hosted-payments/service/payment/hpp/process on api.convergepay.com or
-// api.demo.convergepay.com, also carries electronic check and financing payments
+// /hosted-payments/service/payment/hpp/process on api.convergepay.com,
+// www.convergepay.com or api.demo.convergepay.com, also carries electronic check and financing payments
 // with no card, and card-shaped bodies the Vault never pays: a wallet with a card
 // number the server supplied, the debit, gift card and push-to-card tabs, the
-// follow-ups after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA, a
-// service fee, recurring or installment fields, card saving, a tip, another
-// currency. So a POST the registry recognizes on a Converge host that carries a
-// card is judged here, before the terminal arbiter would pause it, by the
-// whole-request check the API runs at create:
+// follow-ups after a 3-D Secure, Pay Defense or surcharge step, a CAPTCHA answer
+// that is not a solved reCAPTCHA token, a service fee, recurring or installment
+// fields, card saving, a tip, another currency. So a POST the registry recognizes
+// on a Converge host that carries a card is judged here, before the terminal
+// arbiter would pause it, by the whole-request check the API runs at create:
 //   - the page's own first credit card sale defers, and the arbiter pauses it
 //     for approval;
 //   - anything else aborts with a `blocked` event naming payment-core's code
@@ -1356,12 +1379,13 @@ async function eprotectGiveUp(ctx, attempt, code) {
 // temp_card_id bodies with no new card, and the page builds the transaction object itself, so a
 // POST the registry recognizes on a WSPay host is judged here, before the terminal arbiter would
 // pause it, by the whole-request check the API runs at create:
-//   - a new card for a one-time payment defers, and the arbiter pauses it for approval;
-//   - anything else aborts with a `blocked` event that names why, with no claim, create or
-//     prompt: `unsupported_wspay_payment_method`, or `wspay_keep_on_file_unsupported` for a
-//     confirm that asks WSPay to keep the card on file. Like Braintree's unsupported operation
-//     it neither holds the attachment nor changes its state, so the page's next confirm (a new
-//     card instead of a saved one) is judged afresh.
+//   - a new card defers, and the arbiter pauses it for approval. A confirm that asks WSPay to
+//     keep the card on file defers too: the approval asks the cardholder, and the API's create
+//     judges whether it is the card guarantee it pays;
+//   - anything else aborts with a `blocked` event, `unsupported_wspay_payment_method`, with no
+//     claim, create or prompt. Like Braintree's unsupported operation it neither holds the
+//     attachment nor changes its state, so the page's next confirm (a new card instead of a
+//     saved one) is judged afresh.
 // Nothing is decided without the registry: an SDK that did not sync with the wspay_confirm
 // capability, or whose org Agentcard has not enabled for WSPay (the API then serves no WSPay
 // recognizer), never recognizes a WSPay host, so the gate defers and the request continues as
@@ -1675,6 +1699,44 @@ async function cybersourceSecureAcceptanceStop(ctx) {
     await ctx.effects.abort().catch(() => { });
     return { kind: 'abort' };
 }
+// Worldline MyCheckout (worldline-mycheckout.ts). Once the registry serves its recognizer (a build
+// that declares worldline_mycheckout_form, for an org Agentcard turned Worldline on for), every POST
+// to its four card-form endpoints reaches this gate first:
+//   - a product selection (no card, and neither the Pay nor the cancel pair: the post of the page's
+//     select-payment-product step) is remembered for its hosted checkout and defers, and the adapter
+//     continues it untouched as before (passWithoutCard);
+//   - a card submit whose paymentProductId is another product than the one chosen for its hosted
+//     checkout aborts with a `blocked` event, `worldline_mycheckout_product_changed`, and one that
+//     names no product with `worldline_mycheckout_product_missing`, with no claim, create or prompt.
+//     The page's IIN lookup on the agent's placeholder switched the product, and the cardholder's
+//     device, which checks only the real card's network, would submit the card under that product.
+//     Like Converge's refusals it neither holds the attachment nor changes its state, so the page's
+//     next submit is judged afresh;
+//   - anything else defers: a card submit with the chosen product, one on the card group, one on a
+//     hosted checkout whose choice this attachment never saw, the page's cancel, a redirect product.
+// Synchronous until the abort, so a card submit pauses with no await. Exported for the gate
+// registry's tests.
+export const worldlineMyCheckoutPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.worldlineMyCheckout || String(method).toUpperCase() !== 'POST' || !isWorldlineMyCheckoutEndpoint(url)
+        || !ctx.vault.isCardRequest(url, method))
+        return undefined;
+    let body;
+    // A reader that throws (Playwright's postData() can) proves nothing either way.
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        body = null;
+    }
+    const refusal = ctx.worldlineMyCheckout.judge(url, body);
+    return refusal === null ? undefined : worldlineMyCheckoutBlock(ctx, refusal);
+};
+async function worldlineMyCheckoutBlock(ctx, reason) {
+    ctx.onEvent?.({ type: 'blocked', detail: reason });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}
 // The terminal arbiter, always last. A request that no gate claimed and that is
 // neither a native Stripe step nor a recognized card request continues, unless
 // it matches a declared payment endpoint we do not support (then it aborts as an
@@ -1709,7 +1771,7 @@ async function unsupportedContinue(ctx) {
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
 export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, paypalHostedFieldsPreClaim,
-    cybersourceSecureAcceptancePreClaim];
+    cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-capabilities.generated.d.ts

@@ -1097,54 +1097,6 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "moneris";
-        readonly status: "supported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "moneris.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "moneris";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "supported";
-                readonly reason: "card_request_adapter_implemented";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation"];
-            };
-            readonly save_card: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_card_saved"];
-            };
-            readonly subscription_initial: {
-                readonly status: "conditional";
-                readonly reason: "merchant_card_storage_and_consent_required";
-                readonly requirements: readonly ["actual_payment_request_validation", "merchant_confirmation", "stored_card_consent", "merchant_subscription_confirmation"];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The implemented integration is Moneris Hosted Tokenization."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "moneris_checkout_chkt";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
     }, {
         readonly psp: "bambora";
         readonly status: "supported";
@@ -1236,64 +1188,6 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly merchant_confirmation_required: true;
         readonly live_validation: "not_established_by_catalog";
         readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js"];
-    }, {
-        readonly psp: "gravy";
-        readonly status: "unsupported";
-        readonly mode: "token";
-        readonly operations: readonly [{
-            readonly id: "gravy.card_request";
-            readonly effect: "processor_specific_card_request";
-            readonly amount_binding: "unestablished";
-            readonly psp: "gravy";
-            readonly version: 1;
-            readonly mode: "token";
-            readonly autopilot_eligible: false;
-            readonly requires: "reviewed_final_payment_and_continuation_evidence";
-        }];
-        readonly scenarios: {
-            readonly one_time: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly save_card: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_initial: {
-                readonly status: "unsupported";
-                readonly reason: "request_method_not_supported";
-                readonly requirements: readonly [];
-            };
-            readonly subscription_renewal: {
-                readonly status: "outside_vault";
-                readonly reason: "renewal_managed_by_merchant";
-                readonly requirements: readonly ["verify_merchant_billing"];
-            };
-        };
-        readonly limitations: readonly ["Only the listed request format is recognized; a recognized processor is not verified merchant coverage.", "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.", "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.", "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.", "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."];
-        readonly unsupported_variants: readonly [{
-            readonly variant: "embed_hosted_checkout";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path.";
-        }, {
-            readonly variant: "stored_payment_method_or_security_code_only";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Saved payment methods and security-code-only updates are outside new-card session updates.";
-        }, {
-            readonly variant: "checkout_session_create_or_transaction";
-            readonly status: "unsupported";
-            readonly constraint: "direct_sdk";
-            readonly reason: "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser.";
-        }];
-        readonly processor_amount: "none";
-        readonly challenge_surface: "merchant_browser";
-        readonly merchant_confirmation_required: true;
-        readonly live_validation: "not_established_by_catalog";
-        readonly sources: readonly ["src/definitions.js", "src/operations.js", "src/backend.js", "test/fixtures/gravy-secure-fields.json"];
     }];
     readonly exclusions: readonly [{
         readonly psp: "vgs";

package/dist/preflight-capabilities.generated.js

@@ -1690,81 +1690,6 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
                 "src/backend.js"
             ]
         },
-        {
-            "psp": "moneris",
-            "status": "supported",
-            "mode": "token",
-            "operations": [
-                {
-                    "id": "moneris.card_request",
-                    "effect": "processor_specific_card_request",
-                    "amount_binding": "unestablished",
-                    "psp": "moneris",
-                    "version": 1,
-                    "mode": "token",
-                    "autopilot_eligible": false,
-                    "requires": "reviewed_final_payment_and_continuation_evidence"
-                }
-            ],
-            "scenarios": {
-                "one_time": {
-                    "status": "supported",
-                    "reason": "card_request_adapter_implemented",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation"
-                    ]
-                },
-                "save_card": {
-                    "status": "conditional",
-                    "reason": "merchant_card_storage_and_consent_required",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation",
-                        "stored_card_consent",
-                        "merchant_card_saved"
-                    ]
-                },
-                "subscription_initial": {
-                    "status": "conditional",
-                    "reason": "merchant_card_storage_and_consent_required",
-                    "requirements": [
-                        "actual_payment_request_validation",
-                        "merchant_confirmation",
-                        "stored_card_consent",
-                        "merchant_subscription_confirmation"
-                    ]
-                },
-                "subscription_renewal": {
-                    "status": "outside_vault",
-                    "reason": "renewal_managed_by_merchant",
-                    "requirements": [
-                        "verify_merchant_billing"
-                    ]
-                }
-            },
-            "limitations": [
-                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-                "The implemented integration is Moneris Hosted Tokenization."
-            ],
-            "unsupported_variants": [
-                {
-                    "variant": "moneris_checkout_chkt",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Moneris Checkout uses a different path from Hosted Tokenization and is not implemented."
-                }
-            ],
-            "processor_amount": "none",
-            "challenge_surface": "merchant_browser",
-            "merchant_confirmation_required": true,
-            "live_validation": "not_established_by_catalog",
-            "sources": [
-                "src/definitions.js",
-                "src/operations.js",
-                "src/backend.js"
-            ]
-        },
         {
             "psp": "bambora",
             "status": "supported",
@@ -1907,84 +1832,6 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
                 "src/operations.js",
                 "src/backend.js"
             ]
-        },
-        {
-            "psp": "gravy",
-            "status": "unsupported",
-            "mode": "token",
-            "operations": [
-                {
-                    "id": "gravy.card_request",
-                    "effect": "processor_specific_card_request",
-                    "amount_binding": "unestablished",
-                    "psp": "gravy",
-                    "version": 1,
-                    "mode": "token",
-                    "autopilot_eligible": false,
-                    "requires": "reviewed_final_payment_and_continuation_evidence"
-                }
-            ],
-            "scenarios": {
-                "one_time": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "save_card": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "subscription_initial": {
-                    "status": "unsupported",
-                    "reason": "request_method_not_supported",
-                    "requirements": []
-                },
-                "subscription_renewal": {
-                    "status": "outside_vault",
-                    "reason": "renewal_managed_by_merchant",
-                    "requirements": [
-                        "verify_merchant_billing"
-                    ]
-                }
-            },
-            "limitations": [
-                "Only the listed request format is recognized; a recognized processor is not verified merchant coverage.",
-                "The adapter covers the Secure Fields new-card request that updates a Gravy checkout session on the merchant's own api.<merchant>.gr4vy.app host, in sandbox and production.",
-                "Gravy publishes this request as an HTTP PUT. The SDK and the shared core pause POST requests only, so the recognizer identifies and fills the request but intercepts nothing, and the direct SDK reports Gravy unsupported until a recognizer can declare its method.",
-                "The request shape follows Gravy's published Secure Fields contract and has not been confirmed by a capture from a live merchant form.",
-                "Updating the session stores the card with Gravy; the merchant creates the transaction from the session on its own server, so a completed request is not a payment."
-            ],
-            "unsupported_variants": [
-                {
-                    "variant": "embed_hosted_checkout",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Gravy Embed renders its own form in a frame on embed.<merchant>.gr4vy.app and is outside the Secure Fields request path."
-                },
-                {
-                    "variant": "stored_payment_method_or_security_code_only",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Saved payment methods and security-code-only updates are outside new-card session updates."
-                },
-                {
-                    "variant": "checkout_session_create_or_transaction",
-                    "status": "unsupported",
-                    "constraint": "direct_sdk",
-                    "reason": "Creating the session and creating the transaction happen on the merchant server and carry no card from the browser."
-                }
-            ],
-            "processor_amount": "none",
-            "challenge_surface": "merchant_browser",
-            "merchant_confirmation_required": true,
-            "live_validation": "not_established_by_catalog",
-            "sources": [
-                "src/definitions.js",
-                "src/operations.js",
-                "src/backend.js",
-                "test/fixtures/gravy-secure-fields.json"
-            ]
         }
     ],
     "exclusions": [