@agent-cards/sdk 0.24.0 → 0.24.2

package/dist/cardlink-vpos.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Cardlink's VPOS (the redirect payment page Greek banks give their merchants: Eurobank's paycenter on
+ * vpos.eurocommerce.gr, Cardlink's own on ecommerce.cardlink.gr, Nexi Greece's on www.alphaecommerce.gr), as this SDK
+ * reads it.
+ *
+ * The merchant's order page posts a signed entry form, top-level, to https://<host>/vpos/shophandlermpi, and the VPOS
+ * answers with its card page, whose form posts the card back to that same URL. The entry carries no card, and it is the
+ * one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and fills the card into
+ * the page the VPOS returns to it (payment-core processors/cardlink_vpos.js). Every other POST the agent's browser makes
+ * to these hosts carries a card the agent typed or leads to a page that asks for one: the card page's own post and its
+ * card check, which share the entry's URL and carry the page's own fields, and anything posted to Cardlink's test
+ * hosts. This SDK aborts every one of them, so a placeholder card never reaches the VPOS.
+ *
+ * CARDLINK_VPOS_ENTRY_HOSTS is payment-core's CARDLINK_VPOS_HOSTS, and isCardlinkVposEntryUrl is payment-core's
+ * isCardlinkVposEntryUrl; cardlink-vpos.test.mjs pins both to payment-core.
+ */
+export declare const CARDLINK_VPOS_PSP = "cardlink_vpos";
+export declare const CARDLINK_VPOS_ENTRY_HOSTS: readonly string[];
+export declare const CARDLINK_VPOS_TEST_HOSTS: readonly string[];
+/**
+ * Whether a URL is an entry exactly as a merchant's form action writes it: https, one of the three live hosts in lower
+ * case, the default port, no credentials, the path /vpos/shophandlermpi, and no query or fragment, not even an empty one.
+ */
+export declare function isCardlinkVposEntryUrl(raw: unknown): boolean;
+/** Whether a URL is on one of the VPOS's hosts, live or test: https, no credentials, any port, any case, a trailing dot or not. */
+export declare function isCardlinkVposHost(raw: string): boolean;
+/**
+ * Whether a body reads as a merchant's entry and never as the card page's post: a form whose every pair decodes, that
+ * names a mid and a digest, and that carries none of the card page's fields or a card field. payment-core's entry rules
+ * judge the rest at create.
+ */
+export declare function isCardlinkVposEntryBody(body: string | null | undefined): boolean;
+/** The one request on the VPOS's hosts this SDK pauses: a POST of an entry body to an entry URL. */
+export declare function isCardlinkVposEntry(url: string, method: string, body: string | null | undefined): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of the VPOS's hosts and this build's
+ * registry serves the entry. The card page's posts share the entry's URL, so the CDP adapter pauses them through the
+ * recognizer's host patterns, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to a VPOS host once the lane is armed.
+ */
+export declare function isArmedCardlinkVposUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/cardlink-vpos.js

@@ -0,0 +1,90 @@
+/**
+ * Cardlink's VPOS (the redirect payment page Greek banks give their merchants: Eurobank's paycenter on
+ * vpos.eurocommerce.gr, Cardlink's own on ecommerce.cardlink.gr, Nexi Greece's on www.alphaecommerce.gr), as this SDK
+ * reads it.
+ *
+ * The merchant's order page posts a signed entry form, top-level, to https://<host>/vpos/shophandlermpi, and the VPOS
+ * answers with its card page, whose form posts the card back to that same URL. The entry carries no card, and it is the
+ * one request this SDK pauses: the cardholder's device repeats it over the end-to-end TLS relay and fills the card into
+ * the page the VPOS returns to it (payment-core processors/cardlink_vpos.js). Every other POST the agent's browser makes
+ * to these hosts carries a card the agent typed or leads to a page that asks for one: the card page's own post and its
+ * card check, which share the entry's URL and carry the page's own fields, and anything posted to Cardlink's test
+ * hosts. This SDK aborts every one of them, so a placeholder card never reaches the VPOS.
+ *
+ * CARDLINK_VPOS_ENTRY_HOSTS is payment-core's CARDLINK_VPOS_HOSTS, and isCardlinkVposEntryUrl is payment-core's
+ * isCardlinkVposEntryUrl; cardlink-vpos.test.mjs pins both to payment-core.
+ */
+export const CARDLINK_VPOS_PSP = 'cardlink_vpos';
+export const CARDLINK_VPOS_ENTRY_HOSTS = Object.freeze(['vpos.eurocommerce.gr', 'ecommerce.cardlink.gr', 'www.alphaecommerce.gr']);
+export const CARDLINK_VPOS_TEST_HOSTS = Object.freeze(['eurocommerce-test.cardlink.gr', 'ecommerce-test.cardlink.gr',
+    'alphaecommerce-test.cardlink.gr']);
+const ENTRY_PATH = '/vpos/shophandlermpi';
+// An entry URL, for asking whether this build's registry serves the entry.
+const PROBE = 'https://vpos.eurocommerce.gr/vpos/shophandlermpi';
+// A field of the card page's form or of its card check, or any card field: an entry never carries one.
+const PAGE_FIELD = /^(?:card[._]|cvv|cmd$|trid$|st$|paystep$|paymentmethod$|startbonus$|bonusdata$|what$|tds2_)/i;
+/**
+ * Whether a URL is an entry exactly as a merchant's form action writes it: https, one of the three live hosts in lower
+ * case, the default port, no credentials, the path /vpos/shophandlermpi, and no query or fragment, not even an empty one.
+ */
+export function isCardlinkVposEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256 || raw.includes('?') || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    return url.href === raw && url.protocol === 'https:' && !url.port && !url.username && !url.password
+        && CARDLINK_VPOS_ENTRY_HOSTS.includes(url.hostname) && url.pathname === ENTRY_PATH;
+}
+/** Whether a URL is on one of the VPOS's hosts, live or test: https, no credentials, any port, any case, a trailing dot or not. */
+export function isCardlinkVposHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return url.protocol === 'https:' && !url.username && !url.password && (CARDLINK_VPOS_ENTRY_HOSTS.includes(host) || CARDLINK_VPOS_TEST_HOSTS.includes(host));
+}
+/**
+ * Whether a body reads as a merchant's entry and never as the card page's post: a form whose every pair decodes, that
+ * names a mid and a digest, and that carries none of the card page's fields or a card field. payment-core's entry rules
+ * judge the rest at create.
+ */
+export function isCardlinkVposEntryBody(body) {
+    if (typeof body !== 'string' || body === '')
+        return false;
+    const names = [];
+    for (const chunk of body.split('&')) {
+        const eq = chunk.indexOf('=');
+        if (eq < 1)
+            return false;
+        try {
+            names.push(decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, ' ')));
+            decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, ' '));
+        }
+        catch {
+            return false;
+        }
+    }
+    return names.includes('mid') && names.includes('digest') && !names.some((name) => PAGE_FIELD.test(name));
+}
+/** The one request on the VPOS's hosts this SDK pauses: a POST of an entry body to an entry URL. */
+export function isCardlinkVposEntry(url, method, body) {
+    return String(method).toUpperCase() === 'POST' && isCardlinkVposEntryUrl(url) && isCardlinkVposEntryBody(body);
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of the VPOS's hosts and this build's
+ * registry serves the entry. The card page's posts share the entry's URL, so the CDP adapter pauses them through the
+ * recognizer's host patterns, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to a VPOS host once the lane is armed.
+ */
+export function isArmedCardlinkVposUrl(vault, url) {
+    return isCardlinkVposHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'POST');
+}

package/dist/cdp.js

@@ -15,6 +15,7 @@ import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
 import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
 import { PADDLE_VGS_PAY_PATTERNS, PaddleVgsPayGate, isPaddleCheckoutService, recognizesPaddleVgs } from './paddle-vgs-pay.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenRepeats } from './token-repeats.js';
 import { TokenexIframeRepeats, isArmedTokenexIframeUrl } from './tokenex-iframe.js';
 import { isArmedPaytrailUrl } from './paytrail.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
@@ -27,6 +28,8 @@ import { isArmedRedsysUrl } from './redsys.js';
 import { isArmedPrzelewy24Url } from './przelewy24.js';
 import { isArmedBarionUrl } from './barion.js';
 import { isArmedPayplugUrl } from './payplug.js';
+import { isArmedCardlinkVposUrl } from './cardlink-vpos.js';
+import { isArmedEghlUrl } from './eghl.js';
 import { isArmedQuickpayUrl } from './quickpay.js';
 import { COMGATE_CARD_PATTERNS, isArmedComgateUrl, servesComgate } from './comgate.js';
 import { isArmedEximbayUrl } from './eximbay.js';
@@ -2082,6 +2085,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // The approved TokenEx iframe answers, per frameId (the card-number frame is an out-of-process iframe whose own
     // session pauses its post; its frameId names it): the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     // The Shiji STS getCvvId companion of the getTokenId this attachment last continued (shiji-sts.ts).
@@ -2453,6 +2458,11 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             && params?.frameId === pageTargetId && typeof params?.url === 'string') {
             committedTopUrl = params.url.split('#')[0];
         }
+        // A history update that leaves the prepared page's origin, path and query as they were (a single-page
+        // checkout's replaceState to its own URL, a hash change) is the same document, and keeps the preparation.
+        if (method === 'Page.navigatedWithinDocument' && sessionId === pageSessionId && preparationFrameId && params?.frameId === preparationFrameId
+            && preparationGate.keepsDocument(params.url))
+            return;
         if (((method === 'Page.frameNavigated' && !params.frame?.parentId) || (method === 'Page.navigatedWithinDocument' && preparationFrameId && params.frameId === preparationFrameId)) && sessionId === pageSessionId) {
             preparationGate.invalidate('merchant_document_changed');
             mercadoCheckout.invalidate();
@@ -2898,6 +2908,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             juspay: juspayCheckout,
             datatrans: datatransRepeats,
             tokenexIframe: tokenexIframeRepeats,
+            tokenRepeats,
             ebanx: ebanxFollowUps,
             payrexx: payrexxFollowUps,
             nikeOrders,
@@ -3439,6 +3450,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // The frame that received it: the paused request's, or its retry's once rebound.
                 datatransRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 tokenexIframeRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
+                tokenRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 attempt.assertLive();
                 // An ACI card-number request answered: its checkout's held CVC and expiry requests get the
                 // same answer, and its /payment submission may continue (see AciGate).
@@ -3975,6 +3987,8 @@ export async function attachToPlaywright(page, opts) {
     const datatransRepeats = new DatatransRepeats();
     // The approved TokenEx iframe answers, per Frame: the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     const frameOf = (request) => { try {
@@ -4029,6 +4043,12 @@ export async function attachToPlaywright(page, opts) {
             // Every request to PayPlug's page host once its entry is served (payplug.ts): the page's card post reaches the
             // PayPlug gate and fails.
             || isArmedPayplugUrl(opts.vault, url.toString())
+            // Every request to the VPOS's hosts once its entry is served (cardlink-vpos.ts): the card page's post, which shares
+            // the entry's URL, reaches the Cardlink gate and fails.
+            || isArmedCardlinkVposUrl(opts.vault, url.toString())
+            // Every request to eGHL's hosts once its entry is served (eghl.ts): the card page's post, which shares the entry's
+            // address, reaches the eGHL gate and fails.
+            || isArmedEghlUrl(opts.vault, url.toString())
             // Every request to an NMI host whose entry is served (ekashu.ts), as attachToCdp arms the
             // host: the card page's post and its 3-D Secure calls reach the NMI gate and fail.
             || isArmedEkashuUrl(opts.vault, url.toString())
@@ -4167,6 +4187,7 @@ export async function attachToPlaywright(page, opts) {
                 juspay: juspayCheckout,
                 datatrans: datatransRepeats,
                 tokenexIframe: tokenexIframeRepeats,
+                tokenRepeats,
                 ebanx: ebanxFollowUps,
                 payrexx: payrexxFollowUps,
                 nikeOrders,
@@ -4573,6 +4594,7 @@ export async function attachToPlaywright(page, opts) {
                     await deliverTo.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
                     datatransRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     tokenexIframeRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
+                    tokenRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     assertRequestLive();
                     // See the same step in attachToCdp.
                     aci.answered(deliverRequest.url(), { status: replay.status, headers: replay.headers, body: replay.body }, replay.authorizationId);

package/dist/checkout-com.generated.js

@@ -1,11 +1,12 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: aaa2f76129db849a23bf8bb44043f5cff2b45e853b16b5de4d61a1f6a10cd392
+// artifact-sha256: a4f45fd0e69b19e8cb2da463b865012950ae5bcc9971c01d3e348a7de1a255ef
 // src/checkout-com.js
 var ENDPOINTS = Object.freeze({
     production: ["https://api.checkout.com/tokens", "https://card-acquisition-gateway.checkout.com/tokens"],
     sandbox: ["https://api.sandbox.checkout.com/tokens", "https://card-acquisition-gateway.sandbox.checkout.com/tokens"]
 });
+var MERCHANT_ENDPOINT = /^https:\/\/(?:[a-z0-9]+\.)?(?:api(\.sandbox)?\.checkout\.com\/tokens|devices\.api(\.sandbox)?\.checkout\.com\/(?:cag\/)?tokens)$/;
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var own = (value, name) => Object.prototype.hasOwnProperty.call(value, name);
 var keys = (value, allowed) => record(value) && Object.keys(value).every((name) => allowed.includes(name));
@@ -123,6 +124,9 @@ function checkoutComEnvironment(url) {
         return "production";
     if (ENDPOINTS.sandbox.includes(url))
         return "sandbox";
+    const merchant = typeof url === "string" ? MERCHANT_ENDPOINT.exec(url) : null;
+    if (merchant?.[0] === url)
+        return merchant[1] || merchant[2] ? "sandbox" : "production";
     return void 0;
 }
 var ADDRESS_TEXT = ["address_line1", "address_line2", "city", "state", "zip", "name"];

package/dist/client.d.ts

@@ -507,6 +507,34 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * authorize() needs the agent's pair, and the API holds its amount to the price. Served on the same
  * terms, and the API holds the lane to Agentcard's own company.
  *
+ * `aurus_one_time_token`: the card request Aurus Pay's ecom card frame (O'Reilly Auto Parts) sends to
+ * pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken, the card sealed in the frame under a public key its own
+ * script carries. This build pauses it only when Aurus's card frame sent it (aurus.ts aurusPreClaim); the same
+ * request from the store's page or another frame fails in the browser before anything is created. The request
+ * names no amount, so authorize() needs the agent's pair, above zero. The cardholder's device does not seal for
+ * Aurus yet (payment-core processors/aurus.js), so a paused request opens no approval that pays.
+ *
+ * `viva_smart_checkout_chargetoken`: the card request Viva Wallet's Smart Checkout page sends as one
+ * JSON request to www.vivapayments.com/web2/checkout/v2/chargetokens (demo.vivapayments.com in test),
+ * on Pay, after the page's own reCAPTCHA run. This build pauses only the page's own card body at that
+ * exact URL (payment-core processors/viva_wallet.js); a body that keeps the card, pays with a stored
+ * card, converts the currency or is the page's second try after a decline fails in the browser before
+ * anything is created. The cardholder's device sends the card through Agentcard's checkout relay, since
+ * the page's request answers no other origin, and the page gets Viva's single-use charge token as
+ * payment-core's judge rebuilt it; the page then charges that token card free. The body names its
+ * amount, which the API holds to the agent's pair, and the API pays a live token only for an order
+ * payment-core pins. Served on the same terms, and the API holds the lane to Agentcard's own company.
+ *
+ * `paystack_pinned_key`: the charge Paystack's hosted checkout sends as one form POST to
+ * standard.paystack.co/charge/, the card only as `clientdata`, RSA ciphertext under the one key
+ * Paystack's page carries. This build pauses only the card page's own charge at that exact URL
+ * (payment-core processors/paystack.js); a charge that keeps the card, starts a plan or carries a PIN
+ * fails in the browser before anything is created. The cardholder's device encrypts the real card under
+ * the same pinned key and sends the charge itself, and the page gets Paystack's answer: paid, declined,
+ * or the issuer's 3-D Secure step, which the page then runs in the agent's browser. The charge names
+ * no amount, so authorize() needs the agent's pair, above zero. Served on the same terms, and the API
+ * holds the lane to Agentcard's own company.
+ *
  * `usaepay_payment_key`: the card request USAePay's Pay.js card frame sends as one JSON request to
  * www.usaepay.com/api/v2/pub/payment_keys (secure.usaepay.com alike; sandbox.usaepay.com in test), under
  * the merchant's public key in its Authorization. This build pauses only the frame's own card body at
@@ -555,6 +583,40 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * approves. Served on the same terms: only to a build that lists it, for a company Agentcard turned
  * ProcessOut on for.
  *
+ * `monei_card_token`: the card request MONEI's card frame sends from MONEI's payment page
+ * (secure.monei.com/payments/<id>) to api.monei.com/v1/tokens, with the payment's id and the card. This
+ * build pauses only the frame's own body for a payment at that exact URL (payment-core
+ * processors/monei.js); MONEI's account flow, Click to Pay and a wallet on the same URL fail in the
+ * browser before anything is created. The request names neither the merchant nor the amount, so the API
+ * reads MONEI's own record of the payment and holds the agent's pair, above zero
+ * (agent-amount-processors.json), to MONEI's amount exactly. The cardholder's device sends the card to
+ * MONEI itself and the frame gets back MONEI's payment token alone, rebuilt by payment-core's judge.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned MONEI on for.
+ *
+ * `frisbii_card_token`: the card request Frisbii Checkout's hosted payment page (checkout.reepay.com or
+ * checkout.frisbii.com, as an overlay, an embedded frame or a full window) sends to
+ * card.reepay.com or card.frisbii.com /v1/token/?session=<id>, with the merchant's public key and the
+ * card. This build pauses only the page's own body at that exact URL (payment-core
+ * processors/frisbii.js); any other body on it, one that keeps the card on file included, fails in the
+ * browser before anything is created. The page's two other card paths, a stored card's token
+ * (/v1/token/cof/) and Click to Pay (/v1/token/create_click_to_pay), are held and refused whatever
+ * their body, so neither leaves the browser either. The request names the amount only when
+ * the session carries 3-D Secure data, so the agent's pair is required, above zero
+ * (agent-amount-processors.json), and the API refuses it when it differs from the page's own. The
+ * cardholder's device sends the card to Frisbii
+ * itself and the page gets back Frisbii's card token or 3-D Secure step alone, rebuilt by payment-core's
+ * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
+ * on for.
+ *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's
@@ -598,6 +660,19 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * zero. Served only to a build that lists it, and the API turns PayPlug on for Agentcard's own
  * company alone.
  *
+ * `cardlink_vpos_hosted_payment_page`: Cardlink's VPOS, the payment page of Eurobank, Cardlink and Nexi
+ * Greece, whose card-free signed entry (a form post to /vpos/shophandlermpi on one of the three hosts) this build
+ * pauses for the cardholder's device, and whose card page's post and card check on the same URL this build never
+ * lets the agent's browser send (pre-claim.ts, cardlink-vpos.ts). Served only to a build that lists it, and the API
+ * turns the lane on for Agentcard's own company alone.
+ *
+ * `eghl_hosted_payment_page`: eGHL's payment page (ADAPTIS, formerly eGHL, on securepay.e-ghl.com), whose card-free
+ * entry (a GET of /IPG/payment.aspx with the payment in its query, which the merchant's checkout or eGHL's Shopify app
+ * sends the buyer to) this build pauses for the cardholder's device by its exact URL (hosted-entry.ts), and whose card
+ * page's post to the same address this build never lets the agent's browser send (pre-claim.ts, eghl.ts). The entry
+ * names its amount, and the API holds the agent's pair to it exactly. Served only to a build that lists it, and the API
+ * turns the lane on for Agentcard's own company alone.
+ *
  * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
  * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
  * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the

package/dist/client.js

@@ -501,6 +501,34 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * authorize() needs the agent's pair, and the API holds its amount to the price. Served on the same
  * terms, and the API holds the lane to Agentcard's own company.
  *
+ * `aurus_one_time_token`: the card request Aurus Pay's ecom card frame (O'Reilly Auto Parts) sends to
+ * pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken, the card sealed in the frame under a public key its own
+ * script carries. This build pauses it only when Aurus's card frame sent it (aurus.ts aurusPreClaim); the same
+ * request from the store's page or another frame fails in the browser before anything is created. The request
+ * names no amount, so authorize() needs the agent's pair, above zero. The cardholder's device does not seal for
+ * Aurus yet (payment-core processors/aurus.js), so a paused request opens no approval that pays.
+ *
+ * `viva_smart_checkout_chargetoken`: the card request Viva Wallet's Smart Checkout page sends as one
+ * JSON request to www.vivapayments.com/web2/checkout/v2/chargetokens (demo.vivapayments.com in test),
+ * on Pay, after the page's own reCAPTCHA run. This build pauses only the page's own card body at that
+ * exact URL (payment-core processors/viva_wallet.js); a body that keeps the card, pays with a stored
+ * card, converts the currency or is the page's second try after a decline fails in the browser before
+ * anything is created. The cardholder's device sends the card through Agentcard's checkout relay, since
+ * the page's request answers no other origin, and the page gets Viva's single-use charge token as
+ * payment-core's judge rebuilt it; the page then charges that token card free. The body names its
+ * amount, which the API holds to the agent's pair, and the API pays a live token only for an order
+ * payment-core pins. Served on the same terms, and the API holds the lane to Agentcard's own company.
+ *
+ * `paystack_pinned_key`: the charge Paystack's hosted checkout sends as one form POST to
+ * standard.paystack.co/charge/, the card only as `clientdata`, RSA ciphertext under the one key
+ * Paystack's page carries. This build pauses only the card page's own charge at that exact URL
+ * (payment-core processors/paystack.js); a charge that keeps the card, starts a plan or carries a PIN
+ * fails in the browser before anything is created. The cardholder's device encrypts the real card under
+ * the same pinned key and sends the charge itself, and the page gets Paystack's answer: paid, declined,
+ * or the issuer's 3-D Secure step, which the page then runs in the agent's browser. The charge names
+ * no amount, so authorize() needs the agent's pair, above zero. Served on the same terms, and the API
+ * holds the lane to Agentcard's own company.
+ *
  * `usaepay_payment_key`: the card request USAePay's Pay.js card frame sends as one JSON request to
  * www.usaepay.com/api/v2/pub/payment_keys (secure.usaepay.com alike; sandbox.usaepay.com in test), under
  * the merchant's public key in its Authorization. This build pauses only the frame's own card body at
@@ -549,6 +577,40 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * approves. Served on the same terms: only to a build that lists it, for a company Agentcard turned
  * ProcessOut on for.
  *
+ * `monei_card_token`: the card request MONEI's card frame sends from MONEI's payment page
+ * (secure.monei.com/payments/<id>) to api.monei.com/v1/tokens, with the payment's id and the card. This
+ * build pauses only the frame's own body for a payment at that exact URL (payment-core
+ * processors/monei.js); MONEI's account flow, Click to Pay and a wallet on the same URL fail in the
+ * browser before anything is created. The request names neither the merchant nor the amount, so the API
+ * reads MONEI's own record of the payment and holds the agent's pair, above zero
+ * (agent-amount-processors.json), to MONEI's amount exactly. The cardholder's device sends the card to
+ * MONEI itself and the frame gets back MONEI's payment token alone, rebuilt by payment-core's judge.
+ * Served on the same terms: only to a build that lists it, for a company Agentcard turned MONEI on for.
+ *
+ * `frisbii_card_token`: the card request Frisbii Checkout's hosted payment page (checkout.reepay.com or
+ * checkout.frisbii.com, as an overlay, an embedded frame or a full window) sends to
+ * card.reepay.com or card.frisbii.com /v1/token/?session=<id>, with the merchant's public key and the
+ * card. This build pauses only the page's own body at that exact URL (payment-core
+ * processors/frisbii.js); any other body on it, one that keeps the card on file included, fails in the
+ * browser before anything is created. The page's two other card paths, a stored card's token
+ * (/v1/token/cof/) and Click to Pay (/v1/token/create_click_to_pay), are held and refused whatever
+ * their body, so neither leaves the browser either. The request names the amount only when
+ * the session carries 3-D Secure data, so the agent's pair is required, above zero
+ * (agent-amount-processors.json), and the API refuses it when it differs from the page's own. The
+ * cardholder's device sends the card to Frisbii
+ * itself and the page gets back Frisbii's card token or 3-D Secure step alone, rebuilt by payment-core's
+ * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
+ * on for.
+ *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's
@@ -592,6 +654,19 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * zero. Served only to a build that lists it, and the API turns PayPlug on for Agentcard's own
  * company alone.
  *
+ * `cardlink_vpos_hosted_payment_page`: Cardlink's VPOS, the payment page of Eurobank, Cardlink and Nexi
+ * Greece, whose card-free signed entry (a form post to /vpos/shophandlermpi on one of the three hosts) this build
+ * pauses for the cardholder's device, and whose card page's post and card check on the same URL this build never
+ * lets the agent's browser send (pre-claim.ts, cardlink-vpos.ts). Served only to a build that lists it, and the API
+ * turns the lane on for Agentcard's own company alone.
+ *
+ * `eghl_hosted_payment_page`: eGHL's payment page (ADAPTIS, formerly eGHL, on securepay.e-ghl.com), whose card-free
+ * entry (a GET of /IPG/payment.aspx with the payment in its query, which the merchant's checkout or eGHL's Shopify app
+ * sends the buyer to) this build pauses for the cardholder's device by its exact URL (hosted-entry.ts), and whose card
+ * page's post to the same address this build never lets the agent's browser send (pre-claim.ts, eghl.ts). The entry
+ * names its amount, and the API holds the agent's pair to it exactly. Served only to a build that lists it, and the API
+ * turns the lane on for Agentcard's own company alone.
+ *
  * `paymob_checkout_pay`: the card payment Paymob's own checkout sends, from Unified Checkout
  * (<country>.checkout.paymob.com) or from the Pixel card frame a merchant's page embeds, as JSON to
  * https://<accept|uae|ksa|oman>.paymob.com/api/acceptance/payments/pay. This build pauses only the

package/dist/cybersource-flex.generated.d.ts

@@ -12,6 +12,19 @@ declare var CybersourceFlexError: {
 };
 declare function isVerifiedCaptureContext(value: any): boolean;
 declare function flexHostEnvironment(hostname: any): "production" | "sandbox" | null;
+declare var UNIFIED_CHECKOUT_HOSTS: Readonly<{
+    production: "up.cybersource.com";
+    sandbox: "testup.cybersource.com";
+}>;
+declare var UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS: readonly string[];
+declare var UNIFIED_CHECKOUT_FRAMES: readonly string[];
+declare function unifiedCheckoutHostEnvironment(hostname: any): "production" | "sandbox" | null;
+declare function parseUnifiedCheckoutFrame(rawUrl: any): Readonly<{
+    environment: "production" | "sandbox";
+    frame: string;
+    asset: string;
+    captureContext: string;
+}> | null;
 declare var CYBERSOURCE_FLEX_PSP: string;
 declare var CYBERSOURCE_FLEX_CONTENT_TYPE: string;
 declare var CYBERSOURCE_FLEX_TOKENS_URLS: Readonly<{
@@ -38,6 +51,7 @@ declare function verifyCaptureContext(jwt: any, { crypto, now }?: {}): Promise<R
     modulusBytes: number;
     index: any;
     contextType: any;
+    clientVersion: any;
     allowedCardNetworks: readonly any[] | null;
     targetOrigins: readonly any[];
     iat: any;
@@ -76,6 +90,29 @@ declare function buildCardPlaintext(verified: any, card: any, { fields, trigger,
     trigger?: string | undefined;
 }): string;
 declare function sealForContext(verified: any, plaintext: any, { crypto }?: {}): Promise<string>;
+declare function verifyUnifiedCheckoutContext(jwt: any, { crypto, now }?: {}): Promise<Readonly<{
+    raw: any;
+    signingKid: any;
+    environment: any;
+    origin: string;
+    path: string;
+    url: string;
+    jwk: Readonly<{
+        kty: "RSA";
+        n: any;
+        e: any;
+        kid: any;
+    }>;
+    modulusBytes: number;
+    index: any;
+    contextType: any;
+    clientVersion: any;
+    allowedCardNetworks: readonly any[] | null;
+    targetOrigins: readonly any[];
+    iat: any;
+    exp: any;
+}>>;
+declare function buildUnifiedCheckoutPlaintext(verified: any, card: any, { billTo, now }?: {}): string;
 declare var CYBERSOURCE_FLEX_REFUSAL_REASONS: readonly string[];
 declare function cybersourceFlexRefusalCode(text: any): string | null;
 declare function isCybersourceFlexTokenShape(text: any): boolean;
@@ -107,6 +144,7 @@ declare function admitCybersourceFlexPreparation(prepared: any, { crypto, now }?
         modulusBytes: number;
         index: any;
         contextType: any;
+        clientVersion: any;
         allowedCardNetworks: readonly any[] | null;
         targetOrigins: readonly any[];
         iat: any;
@@ -115,4 +153,4 @@ declare function admitCybersourceFlexPreparation(prepared: any, { crypto, now }?
     fields: readonly string[];
 }>>;
 declare function sameCybersourceFlexPreparation(prepared: any, request: any): boolean;
-export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, verifyCaptureContext };
+export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, UNIFIED_CHECKOUT_FRAMES, UNIFIED_CHECKOUT_HOSTS, UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, buildUnifiedCheckoutPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, parseUnifiedCheckoutFrame, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, unifiedCheckoutHostEnvironment, verifyCaptureContext, verifyUnifiedCheckoutContext };