@agent-cards/sdk 0.24.0 → 0.24.1

package/dist/eghl.d.ts

@@ -0,0 +1,40 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export declare const EGHL_PSP = "eghl";
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export declare const EGHL_CAPABILITY = "eghl_hosted_payment_page";
+/** eGHL's live host, and its test platform's. */
+export declare const EGHL_HOST = "securepay.e-ghl.com";
+export declare const EGHL_SANDBOX_HOST = "test2pay.ghl.com";
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export declare function isEghlEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export declare function isEghlPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export declare function isArmedEghlUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/eghl.js

@@ -0,0 +1,72 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export const EGHL_PSP = 'eghl';
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export const EGHL_CAPABILITY = 'eghl_hosted_payment_page';
+/** eGHL's live host, and its test platform's. */
+export const EGHL_HOST = 'securepay.e-ghl.com';
+export const EGHL_SANDBOX_HOST = 'test2pay.ghl.com';
+const LIVE_PATH = '/ipg/payment.aspx';
+const SANDBOX_PATH = '/ipgsg/payment.aspx';
+// An entry of that shape, for asking whether this build's registry serves the entry.
+const PROBE = 'https://securepay.e-ghl.com/IPG/payment.aspx?TransactionType=SALE';
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export function isEghlEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 8192 || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password || url.search.length < 2)
+        return false;
+    const path = url.pathname.toLowerCase();
+    return (url.hostname === EGHL_HOST && path === LIVE_PATH) || (url.hostname === EGHL_SANDBOX_HOST && path === SANDBOX_PATH);
+}
+/** Whether a URL is on one of eGHL's hosts, live or test: https, no credentials, any port, any case, a trailing dot or not. */
+function onEghlHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return url.protocol === 'https:' && !url.username && !url.password && (host === EGHL_HOST || host === EGHL_SANDBOX_HOST);
+}
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export function isEghlPayStep(url, method) {
+    return onEghlHost(url) && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export function isArmedEghlUrl(vault, url) {
+    return onEghlHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'GET');
+}

package/dist/gmo.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a65199bcbf0b67546130fb4f2c12ba72c8f51a2ff5b4e3054e2bfcc29b06f95d
+// artifact-sha256: 192df19d53f4c68d74db3d692397b94f4a1b45ce8bee44a2326e01b56a329adf
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/hosted-entry.js

@@ -19,12 +19,14 @@ import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
 import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
 import { BARION_PSP, isBarionEntryUrl } from './barion.js';
 import { PAYPLUG_PSP, isPayplugEntryUrl } from './payplug.js';
+import { EGHL_PSP, isEghlEntryUrl } from './eghl.js';
 const HOSTED_GET_ENTRIES = new Map([
     [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
     [COMGATE_PSP, isComgateEntryUrl],
     [TRANSBANK_PSP, isTransbankEntryUrl],
     [BARION_PSP, isBarionEntryUrl],
     [PAYPLUG_PSP, isPayplugEntryUrl],
+    [EGHL_PSP, isEghlEntryUrl],
 ]);
 /** Whether this processor's hosted page is entered with a GET this build reads exactly. */
 export function hasHostedGetEntry(psp) {

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 4b24c682dbd8cd7bbaa0157f2932021d71f7c6802ce3814c6f3047173df29911
+// artifact-sha256: 0bd60e76821ed0f63235a99cc37dece9f0db8afef89492a0a7930fb49f80eb18
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 139d0001a168e053ebe3283721905ae95d7c159a25848469965f037b844a44cf
+// artifact-sha256: d6d50b6577a932c3586fcade6b8cbd03c562bd3394e8addcb954d797ea9999b4
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -174,6 +174,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
@@ -182,6 +183,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -214,7 +218,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/pre-claim.d.ts

@@ -288,6 +288,8 @@ export declare function isArmedCreditguardCall(vault: {
 export declare const przelewy24PreClaim: PreClaimGate;
 export declare const barionPreClaim: PreClaimGate;
 export declare const payplugPreClaim: PreClaimGate;
+export declare const eghlPreClaim: PreClaimGate;
+export declare const cardlinkVposPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const transbankPreClaim: PreClaimGate;
 export declare const paytrailPreClaim: PreClaimGate;

package/dist/pre-claim.js

@@ -88,10 +88,13 @@ import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
 import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
 import { isArmedBarionUrl, isBarionPayStep } from './barion.js';
 import { isArmedPayplugUrl, isPayplugPayStep } from './payplug.js';
+import { isArmedCardlinkVposUrl, isCardlinkVposEntry } from './cardlink-vpos.js';
+import { isArmedEghlUrl, isEghlPayStep } from './eghl.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
 import { isArmedComgateUrl } from './comgate.js';
 import { isArmedEximbayUrl, isEximbayEntry } from './eximbay.js';
 import { isArmedOceanpaymentUrl, isOceanpaymentSendPay } from './oceanpayment.js';
+import { aurusPreClaim } from './aurus.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { PAYPAL_CARD_FIELDS_REASON, PAYPAL_GUEST_CHECKOUT_REASON, isPaypalCardFieldsConfirm, isPaypalGraphql, paypalCardFieldsBody, paypalGraphqlCard, paypalGraphqlNamesCardOperation, } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
@@ -1743,6 +1746,47 @@ export const payplugPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// eGHL's payment page (eghl.ts). Once this build's registry serves eGHL's entry (a capability the API serves only to
+// Agentcard's own company), every request to eGHL's hosts pauses. The merchant's entry, a GET of /IPG/payment.aspx whose
+// query names the payment, is no step of this gate's: it defers, and the terminal arbiter pauses it for the claim flow
+// like any card request, so the cardholder's device pays it. Every step toward paying on the page itself aborts as an
+// unsupported checkout: every POST to eGHL's hosts, the card page's card post to the entry's own address among them. So
+// eGHL never sees the card the agent typed. The page's own GETs continue. With eGHL not served, the gate defers, and
+// every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate registry's
+// tests.
+export const eghlPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isEghlPayStep(url, method) || !isArmedEghlUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
+// Cardlink's VPOS (cardlink-vpos.ts). Once this build's registry serves the entry (a capability the API serves only to
+// Agentcard's own company), every request to the VPOS's hosts pauses, and this gate judges the POSTs:
+//   - the merchant's entry, an entry body posted to /vpos/shophandlermpi on one of the three live hosts, defers, and the
+//     terminal arbiter pauses it for the claim flow like any card request: the cardholder's device pays it;
+//   - every other POST (the card page's post and its card check, which share the entry's URL and carry the page's own
+//     fields, a body the adapter could not read, and anything on Cardlink's test hosts) aborts as an unsupported
+//     checkout, so the VPOS never sees the card the agent typed.
+// A GET (the card page's script, its status poll) is not this gate's and continues. With the lane not served, the gate
+// defers, and every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate
+// registry's tests.
+export const cardlinkVposPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isArmedCardlinkVposUrl(ctx.vault, url))
+        return undefined;
+    // The body is a getter an adapter can fail in (Playwright's postData() throws on a body it cannot decode): a body that
+    // cannot be read is no entry this gate can tell from a card post, so it fails closed, aborted and reported like one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return processorPageAbort(ctx);
+    }
+    if (isCardlinkVposEntry(url, method, body))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -2577,9 +2621,9 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, paypalHostedFieldsPreClaim,
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, cardlinkVposPreClaim, eghlPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim,
-    oceanpaymentPreClaim];
+    oceanpaymentPreClaim, aurusPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -211,7 +211,26 @@
       "origin": "https://js.braintreegateway.com",
       "path_pattern": "/web/:version/js/*",
       "hostname_pattern": "^js\\.braintreegateway\\.com$",
-      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$)",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.paypal.com/braintree/docs/start/hello-client/javascript/v3/",
+          "reviewed_on": "2026-09-11"
+        }
+      ]
+    },
+    {
+      "id": "braintree-web-wallet",
+      "psp": "braintree",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://js.braintreegateway.com",
+      "path_pattern": "/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js",
+      "card_free": "braintree-web's client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.",
+      "hostname_pattern": "^js\\.braintreegateway\\.com$",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$",
       "sources": [
         {
           "kind": "official_documentation",
@@ -2566,6 +2585,92 @@
       "hostname_pattern": "^flex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
+    {
+      "id": "aurus-ecom-iframe",
+      "psp": "aurus",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/getiframe",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/getiframe$"
+    },
+    {
+      "id": "aurus-ecom-init-script",
+      "psp": "aurus",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/ecominitjs",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/ecominitjs$"
+    },
     {
       "id": "juspay-hypercheckout-payment-page",
       "psp": "juspay",
@@ -3565,6 +3670,54 @@
       "hostname_pattern": "^testflex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
     {
       "id": "cybersource-secure-acceptance-silent-order-post-test",
       "psp": "cybersource_secure_acceptance",

package/dist/preflight-schemas.json

@@ -385,6 +385,7 @@
                 "mollie-components-v1-script",
                 "mollie-hosted-credit-card",
                 "braintree-web-sdk",
+                "braintree-web-wallet",
                 "braintree-hosted-fields",
                 "paysafe-js",
                 "worldpay-checkout-sdk",
@@ -483,6 +484,10 @@
                 "gmo-link-hosted-page",
                 "cybersource-flex-microform-script",
                 "cybersource-flex-microform-field",
+                "cybersource-unified-checkout-script",
+                "cybersource-unified-checkout-frame",
+                "aurus-ecom-iframe",
+                "aurus-ecom-init-script",
                 "juspay-hypercheckout-payment-page",
                 "pelecard-payment-page",
                 "pelecard-payment-script",
@@ -526,6 +531,8 @@
                 "gmo-link-hosted-page-test",
                 "cybersource-flex-microform-script-test",
                 "cybersource-flex-microform-field-test",
+                "cybersource-unified-checkout-script-test",
+                "cybersource-unified-checkout-frame-test",
                 "cybersource-secure-acceptance-silent-order-post-test",
                 "cybersource-secure-acceptance-silent-order-post-in",
                 "worldpay-eprotect-js-api-prelive",
@@ -1023,6 +1030,7 @@
                       "mollie-components-v1-script",
                       "mollie-hosted-credit-card",
                       "braintree-web-sdk",
+                      "braintree-web-wallet",
                       "braintree-hosted-fields",
                       "paysafe-js",
                       "worldpay-checkout-sdk",
@@ -1121,6 +1129,10 @@
                       "gmo-link-hosted-page",
                       "cybersource-flex-microform-script",
                       "cybersource-flex-microform-field",
+                      "cybersource-unified-checkout-script",
+                      "cybersource-unified-checkout-frame",
+                      "aurus-ecom-iframe",
+                      "aurus-ecom-init-script",
                       "juspay-hypercheckout-payment-page",
                       "pelecard-payment-page",
                       "pelecard-payment-script",
@@ -1164,6 +1176,8 @@
                       "gmo-link-hosted-page-test",
                       "cybersource-flex-microform-script-test",
                       "cybersource-flex-microform-field-test",
+                      "cybersource-unified-checkout-script-test",
+                      "cybersource-unified-checkout-frame-test",
                       "cybersource-secure-acceptance-silent-order-post-test",
                       "cybersource-secure-acceptance-silent-order-post-in",
                       "worldpay-eprotect-js-api-prelive",

package/dist/preflight.generated.d.ts

@@ -148,6 +148,11 @@ export declare function getCheckoutPreflightCatalog(): {
         path_pattern: string;
         flow?: string;
         variant_unverified?: string;
+        /**
+         * Why the asset never takes a card: a wallet button, a fraud collector, or the client those load. When no card frame
+         * is active and scripts alone name several processors, one whose every asset says this is not the card form's.
+         */
+        card_free?: string;
     }[];
     processors: readonly [{
         readonly psp: "spreedly";