@agent-cards/sdk 0.24.0 → 0.24.1

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 761b59c7c043a43a8d462a840e204c1677c55c0022f37e6be4a007d025357af8
+// source-sha256: 1ac6ffa819d0bb72040d0a95cac79f780aeae4f5dea22599fbc4c5ec6c6c8687
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -23,7 +23,13 @@ const RULES = [
     // A braintree-web build whose version carries -payments-sdk (3.32.0-payments-sdk-dev) is PayPal's
     // (paypal-hosted-fields-payments-sdk below): its card goes to PayPal, never to Braintree, so neither
     // Braintree rule takes one.
-    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\//, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$)/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    // braintree-web's client and its wallet and fraud components take no card: a page that loads only these runs a
+    // PayPal, Venmo, Apple Pay or Google Pay button through Braintree, and its card boxes belong to another processor.
+    // AutoZone's checkout loads client, paypal-checkout and data-collector 3.125.0 beside Worldpay eProtect's JS API, whose
+    // script reads the card from the page's own fields (2026-10-31).
+    { id: 'braintree-web-wallet', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js',
+        card_free: 'braintree-web\'s client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.' },
     { id: 'braintree-hosted-fields', psp: 'braintree', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)/, origin: 'https://assets.braintreegateway.com', path_pattern: '/web/*' },
     { id: 'paysafe-js', psp: 'paysafe', kinds: ['script', 'frame', 'iframe'], hostname: /^hosted\.paysafe\.com$/, pathname: /^\/(?:js|checkout)\//, origin: 'https://hosted.paysafe.com', path_pattern: '/{js,checkout}/*' },
     { id: 'worldpay-checkout-sdk', psp: 'worldpay', kinds: ['script', 'frame', 'iframe'], hostname: /^access\.worldpay\.com$/, pathname: /^\/access-checkout\//, origin: 'https://access.worldpay.com', path_pattern: '/access-checkout/*' },
@@ -197,6 +203,27 @@ const cybersourceSources = [
 RULES.push({ id: 'cybersource-flex-microform-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2(?:\.[0-9]+\.[0-9]+)?\/flex-microform\.min\.js$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v2{,.:minor.:patch}/flex-microform.min.js',
     sources: cybersourceSources }, { id: 'cybersource-flex-microform-field', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2\.[0-9]+\.[0-9]+\/iframe\.html$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v:version/iframe.html',
     sources: cybersourceSources });
+// CyberSource Unified Checkout v1 sends the card to the same Flex v2 tokens URL, sealed by its orchestrator frame
+// under the capture context (cybersource-unified-checkout.js), so its script and frames name cybersource_flex too.
+// Reviewed 2026-10-31 from napaonline.com's checkout (UnifiedCheckout.js v1.8.2), with no card sent.
+const unifiedCheckoutSources = [
+    { kind: 'saved_observation', reference: 'napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames', reviewed_on: '2026-10-31' },
+    { kind: 'official_documentation', reference: 'https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'cybersource-unified-checkout-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/UnifiedCheckout\.js$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/UnifiedCheckout.js',
+    sources: unifiedCheckoutSources }, { id: 'cybersource-unified-checkout-frame', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/(?:mce\/mce|orc\/orc|ga\/ga)\.html$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/{mce,orc,ga}/*.html',
+    sources: unifiedCheckoutSources });
+// Aurus Pay's ecom card frame (processors/aurus.js): the store frames /storeservices/ecom/getiframe on
+// pecst<NN>.aurusepay.com, the card fields sit inside it, and its own ecominitjs sends the sealed card to
+// /storeservices/ecom/oneTimeToken on the same host. Reviewed 2026-10-31 at oreillyauto.com's payment step, with every
+// aurusepay.com request but a GET aborted and only a public test card typed. Aurus is served dark, so no catalog
+// processor entry backs the candidate and the result stays unknown unless the caller is served Aurus.
+const aurusSources = [
+    { kind: 'saved_observation', reference: 'oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'aurus-ecom-iframe', psp: 'aurus', kinds: ['frame', 'iframe', 'document'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/getiframe$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/getiframe',
+    sources: aurusSources }, { id: 'aurus-ecom-init-script', psp: 'aurus', kinds: ['script'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/ecominitjs$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/ecominitjs',
+    sources: aurusSources });
 // Juspay HyperCheckout: Juspay's own hosted payment page (the Session API's payment_links.web),
 // which a merchant embeds in an iframe (IndiGo's payment step). The card request that page makes
 // has not been observed, so the Vault does not take it over, and the rule tells the agent so
@@ -382,6 +409,8 @@ for (const [baseId, suffix, hostname, origin] of [
     ['gmo-link-hosted-page', 'test', /^pt01\.mul-pay\.jp$/, 'https://pt01.mul-pay.jp'],
     ['cybersource-flex-microform-script', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
     ['cybersource-flex-microform-field', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
+    ['cybersource-unified-checkout-script', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
+    ['cybersource-unified-checkout-frame', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
     // Secure Acceptance's test host and its production host in India serve the same /silent/ paths.
     ['cybersource-secure-acceptance-silent-order-post', 'test', /^testsecureacceptance\.cybersource\.com$/, 'https://testsecureacceptance.cybersource.com'],
     ['cybersource-secure-acceptance-silent-order-post', 'in', /^secureacceptance\.in\.cybersource\.com$/, 'https://secureacceptance.in.cybersource.com'],
@@ -788,19 +817,27 @@ export function assessCheckoutSupport(input, options = {}) {
     result.candidates = [...candidates.values()].sort((a, b) => a.psp.localeCompare(b.psp));
     if (missingCorroboration && activeFlows.size === 0)
         result.reason_codes.push('flow_corroboration_missing');
+    // Scripts alone naming several processors: one whose every asset is card-free (a wallet button, a fraud collector)
+    // is not the card form's. When exactly one other is left, the page's card form is that one's.
+    const cardCapable = activePsps.size === 0 && candidates.size > 1
+        ? [...candidates.values()].filter(candidate => candidate.evidence.some(evidence => !RULE_BY_ID.get(evidence.rule_id).card_free))
+        : [];
+    const cardFormPsp = cardCapable.length === 1 ? cardCapable[0].psp : null;
     if (activePsps.size === 1)
         result.psp = [...activePsps][0];
     // Script-only evidence names the processor only when the scan saw everything. On a partial scan
     // the sole candidate stays listed as undetermined instead of becoming the selected route.
     else if (activePsps.size === 0 && candidates.size === 1 && result.observation.complete)
         result.psp = [...candidates.keys()][0];
+    else if (cardFormPsp !== null && result.observation.complete)
+        result.psp = cardFormPsp;
     if (!result.observation.complete)
         result.reason_codes.push('observation_incomplete');
     if (!input.signals.length) {
         result.reason_codes.push('psp_not_detected');
         result.missing_evidence.push('payment_page_signal');
     }
-    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1)
+    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1 && cardFormPsp === null)
         result.reason_codes.push('ambiguous_checkout');
     if (activeFlows.size !== 1 || result.psp === null) {
         result.reason_codes.push('checkout_flow_unidentified');

package/dist/preparation.d.ts

@@ -25,6 +25,13 @@ export declare class PreparationGate {
      * own method is what binds: a POST for most processors, the registration GET for Worldpay eProtect.
      */
     claim(requestUrl: string, requestMethod: string, requestBody?: string | null, requestHeaders?: Record<string, string>): PreparedCheckout | undefined;
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url: unknown): boolean;
     assertDocument(): Promise<void>;
     private readDocument;
     isEngaged(): boolean;

package/dist/preparation.js

@@ -3,6 +3,17 @@ import { amountRefusal, validAmountInput } from './client.js';
 import { matchesPreparation, validPreparationEnvironment, preparationEndpoint, preparationBindsByShape, preparationRequestMethod, preparedRequestRefusal } from './prepared-processor.js';
 import { SECURE_ACCEPTANCE_PSP, secureAcceptanceCheckoutProfile } from './cybersource-secure-acceptance.js';
 import { creditguardPageProcessUrl, creditguardProcessTxId } from './creditguard.generated.js';
+/** A page URL without its fragment, or undefined when it does not parse. */
+function documentWithoutFragment(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.hash = '';
+        return parsed.href;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** A local, one-use rendezvous. It never starts or retries a merchant request. */
 export class PreparationGate {
     opts;
@@ -195,6 +206,16 @@ export class PreparationGate {
         clearTimeout(this.expiryTimer);
         return prepared;
     }
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url) {
+        const kept = typeof url === 'string' ? documentWithoutFragment(url) : undefined;
+        return kept !== undefined && this.documentUrl !== '' && kept === documentWithoutFragment(this.documentUrl);
+    }
     async assertDocument() {
         if (this.documentUrl && await this.readDocument() !== this.documentUrl)
             throw new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_changed');