@agent-cards/sdk 0.24.0 → 0.24.2

package/dist/cybersource-flex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c6a711b5dc964dbeb45863780001d99b79090f919b282fed9ae6fc06b4839681
+// artifact-sha256: a9a624dbdd5a025d710f99e5ce83a985e4561b4db6d3e60dc427b5e406e4b653
 // src/cybersource-flex-rules.js
 var CYBERSOURCE_FLEX_RULES_SOURCE = Object.freeze({ version: "2.12.1", sha256: "8429ebae83e9745cd53ad8ff0d9ba69bee0087c1435ed0695a25444bed418327" });
 var CYBERSOURCE_FLEX_RULES = [
@@ -201,6 +201,7 @@ async function sealCompactJwe(jwk, plaintext, { crypto }) {
 }
 // src/cybersource-flex-context.js
 var FLEX_TOKENS_PATH = "/flex/v2/tokens";
+var UNIFIED_CHECKOUT_TOKENS_PATH = "/flex/v2/tokens/uc";
 var FLEX_HOSTS = Object.freeze({ production: "flex.cybersource.com", sandbox: "testflex.cybersource.com" });
 var CAPTURE_CONTEXT_MAX_LENGTH = 16384;
 var CLOCK_SKEW_MS = 6e4;
@@ -233,7 +234,8 @@ function origins(value) {
         return Object.freeze([]);
     return Object.freeze(value.filter((origin) => typeof origin === "string" && origin.length <= 2048).slice(0, 16));
 }
-async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
+async function verifyContextWithKeys(jwt, keys, { crypto, now, kind = "microform" } = {}) {
+    const unified = kind === "unified_checkout";
     const [encodedHeader] = compactParts(jwt, 3, CAPTURE_CONTEXT_MAX_LENGTH, "format");
     const peek = jsonFromBytes(base64UrlToBytes(encodedHeader), "format");
     const kid = peek.kid;
@@ -254,8 +256,9 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
     if (!record(flx))
         refuse("format", "the capture context has no Flex section.");
     const origin = `https://${host}`;
-    const url = `${origin}${FLEX_TOKENS_PATH}`;
-    if (flx.origin !== origin || flx.path !== FLEX_TOKENS_PATH || own(flx, "tokensUrl") && flx.tokensUrl !== url) {
+    const path = unified ? UNIFIED_CHECKOUT_TOKENS_PATH : FLEX_TOKENS_PATH;
+    const url = `${origin}${path}`;
+    if (unified ? flx.origin !== origin || flx.tokensUrl !== url || own(flx, "path") : flx.origin !== origin || flx.path !== FLEX_TOKENS_PATH || own(flx, "tokensUrl") && flx.tokensUrl !== url) {
         refuse("url_mismatch", `the capture context does not send the card to ${url}.`);
     }
     const jwk = flx.jwk;
@@ -271,21 +274,22 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
         refuse("expired", "the capture context has expired.");
     }
     const ctx = Array.isArray(payload.ctx) ? payload.ctx : [];
-    const index = ctx.findIndex((entry) => record(entry) && typeof entry.type === "string" && /^mf-/.test(entry.type));
+    const index = ctx.findIndex((entry) => record(entry) && typeof entry.type === "string" && (unified ? /^uc-/ : /^mf-/).test(entry.type));
     if (index < 0)
-        refuse("microform", "the capture context is not a Microform context.");
+        refuse("microform", unified ? "the capture context is not a Unified Checkout context." : "the capture context is not a Microform context.");
     const data = record(ctx[index].data) ? ctx[index].data : {};
     const context = Object.freeze({
         raw: jwt,
         signingKid: kid,
         environment,
         origin,
-        path: FLEX_TOKENS_PATH,
+        path,
         url,
         jwk: Object.freeze({ kty: "RSA", n: jwk.n, e: jwk.e, kid: jwk.kid }),
         modulusBytes: Math.ceil(bits / 8),
         index,
         contextType: ctx[index].type,
+        clientVersion: unified && typeof data.clientVersion === "string" && data.clientVersion.length <= 32 ? data.clientVersion : null,
         allowedCardNetworks: networks(data.allowedCardNetworks),
         targetOrigins: origins(data.targetOrigins),
         iat: Number.isFinite(payload.iat) ? payload.iat : null,
@@ -294,6 +298,51 @@ async function verifyContextWithKeys(jwt, keys, { crypto, now } = {}) {
     VERIFIED.add(context);
     return context;
 }
+// src/cybersource-unified-checkout.js
+var UNIFIED_CHECKOUT_HOSTS = Object.freeze({ production: "up.cybersource.com", sandbox: "testup.cybersource.com" });
+var UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS = Object.freeze(["1.8.2"]);
+var UNIFIED_CHECKOUT_FRAMES = Object.freeze(["mce", "orc", "ga"]);
+var FRAME_PATH = /^\/uc\/v1\/assets\/([A-Za-z0-9_-]{16,1024})\/(mce|orc|ga)\/(mce|orc|ga)\.html$/;
+var FRAGMENT_MAX_LENGTH = CAPTURE_CONTEXT_MAX_LENGTH + 4096;
+function unifiedCheckoutHostEnvironment(hostname) {
+    const host = String(hostname ?? "").toLowerCase();
+    if (host === UNIFIED_CHECKOUT_HOSTS.production)
+        return "production";
+    if (host === UNIFIED_CHECKOUT_HOSTS.sandbox)
+        return "sandbox";
+    return null;
+}
+function parseUnifiedCheckoutFrame(rawUrl) {
+    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH + 2048)
+        return null;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    const environment = unifiedCheckoutHostEnvironment(url.hostname);
+    const path = FRAME_PATH.exec(url.pathname);
+    if (url.protocol !== "https:" || url.port || url.username || url.password || !environment || !path || path[2] !== path[3])
+        return null;
+    const fragment = url.hash.slice(1);
+    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(decodeURIComponent(fragment));
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const ctx = value.ctx;
+    if (typeof ctx !== "string" || ctx.length < 1 || ctx.length > CAPTURE_CONTEXT_MAX_LENGTH)
+        return null;
+    return Object.freeze({ environment, frame: path[2], asset: path[1], captureContext: ctx });
+}
 // src/cybersource-flex.js
 var CYBERSOURCE_FLEX_PSP = "cybersource_flex";
 var CYBERSOURCE_FLEX_CONTENT_TYPE = "application/jwt; charset=utf-8";
@@ -343,11 +392,11 @@ function cybersourceFlexEnvironment(url) {
         return "sandbox";
     return void 0;
 }
-var FRAGMENT_MAX_LENGTH = 16384;
+var FRAGMENT_MAX_LENGTH2 = 16384;
 var IFRAME_PATH = /^\/microform\/bundle\/v(\d+\.\d+\.\d+)\/iframe\.html$/;
 var FIELD_TYPES = Object.freeze(["number", "securityCode"]);
 function parseMicroformFragment(rawUrl) {
-    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH + 2048)
+    if (typeof rawUrl !== "string" || rawUrl.length > FRAGMENT_MAX_LENGTH2 + 2048)
         return null;
     let url;
     try {
@@ -361,7 +410,7 @@ function parseMicroformFragment(rawUrl) {
     if (url.protocol !== "https:" || url.port || url.username || url.password || !environment || !path)
         return null;
     const fragment = url.hash.slice(1);
-    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH)
+    if (!fragment || fragment.length > FRAGMENT_MAX_LENGTH2)
         return null;
     let value;
     try {
@@ -556,6 +605,46 @@ async function sealForContext(verified, plaintext, { crypto } = {}) {
         refuse("context", "the capture context was not verified on this device.");
     return sealCompactJwe(verified.jwk, plaintext, { crypto });
 }
+function verifyUnifiedCheckoutContext(jwt, { crypto, now } = {}) {
+    return verifyContextWithKeys(jwt, CYBERSOURCE_FLEX_SIGNING_KEYS, { crypto, now, kind: "unified_checkout" });
+}
+var BILL_TO_NAME = /^[^\u0000-\u001f\u007f<>]{1,60}$/;
+var BILL_TO_EMAIL = /^[^\s@<>]{1,64}@[^\s@<>]{1,190}$/;
+function buildUnifiedCheckoutPlaintext(verified, card, { billTo, now } = {}) {
+    if (!isVerifiedCaptureContext(verified) || !/^uc-/.test(verified.contextType))
+        refuse("context", "the capture context was not verified as a Unified Checkout context on this device.");
+    if (!UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS.includes(verified.clientVersion))
+        refuse("microform_version", "this Unified Checkout client version was not reviewed.");
+    const first = billTo?.firstName;
+    const last = billTo?.lastName;
+    const email = billTo?.email;
+    if (typeof first !== "string" || !BILL_TO_NAME.test(first) || typeof last !== "string" || !BILL_TO_NAME.test(last) || email !== void 0 && (typeof email !== "string" || !BILL_TO_EMAIL.test(email)))
+        refuse("fields", "the billing name or email is not one the card entry takes.");
+    const normalized = flexCard(card, typeof now === "function" ? now() : Date.now());
+    const detected = detectCardTypes(normalized.number, verified.allowedCardNetworks ?? void 0);
+    if (detected.codes.length === 0)
+        refuse("card_network", "this merchant's CyberSource form does not accept this card network.");
+    if (!detected.valid)
+        refuse("card_invalid", "the card number fails its network's length or check digit.");
+    if (detected.securityCode.required && !new RegExp(`^[0-9]{${detected.securityCode.length}}$`).test(normalized.cvc)) {
+        refuse("card_security_code", "the security code has the wrong length for this card.");
+    }
+    const data = {
+        PANENTRY: {
+            orderInformation: { billTo: { firstName: first, lastName: last, ...email !== void 0 ? { email } : {} } },
+            paymentInformation: { card: {
+                    number: normalized.number,
+                    expirationMonth: normalized.expirationMonth,
+                    expirationYear: normalized.expirationYear,
+                    securityCode: normalized.cvc,
+                    type: detected.codes[0]
+                } }
+        }
+    };
+    const plaintext = JSON.stringify({ data, context: verified.raw, index: 0 }).replace(/[\u0080-\uffff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    asciiBytes(plaintext, "card_ascii");
+    return plaintext;
+}
 var TOKEN_MAX_LENGTH = 8192;
 var CYBERSOURCE_FLEX_REFUSAL_REASONS = Object.freeze([
     "VALIDATION_ERROR",
@@ -728,4 +817,4 @@ function sameCybersourceFlexPreparation(prepared, request) {
     const theirs = new Set(two.fields);
     return mine.size === one.fields.length && theirs.size === two.fields.length && mine.size === theirs.size && [...mine].every((field) => theirs.has(field));
 }
-export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, verifyCaptureContext };
+export { CYBERSOURCE_FLEX_CAPTURE_CONTEXT_MAX_LENGTH, CYBERSOURCE_FLEX_CONTENT_TYPE, CYBERSOURCE_FLEX_PRESEAL_TRIGGER, CYBERSOURCE_FLEX_PSP, CYBERSOURCE_FLEX_REFUSAL_REASONS, CYBERSOURCE_FLEX_REVIEWED_IFRAME_VERSIONS, CYBERSOURCE_FLEX_RULES_SOURCE, CYBERSOURCE_FLEX_SIGNING_KEYS, CYBERSOURCE_FLEX_TEST_PANS, CYBERSOURCE_FLEX_TOKENS_URLS, CybersourceFlexError, UNIFIED_CHECKOUT_FRAMES, UNIFIED_CHECKOUT_HOSTS, UNIFIED_CHECKOUT_REVIEWED_CLIENT_VERSIONS, admitCybersourceFlexPreparation, assertCybersourceFlexTemplate, buildCardPlaintext, buildUnifiedCheckoutPlaintext, cybersourceFlexEnvironment, flexHostEnvironment as cybersourceFlexHostEnvironment, cybersourceFlexPreparationUrl, cybersourceFlexRefusalCode, cybersourceFlexTemplateKid, detectCardTypes, isCybersourceFlexMediaType, isCybersourceFlexRequest, isCybersourceFlexTemplateBody, isCybersourceFlexTokenShape, isPreparedCybersourceFlexRequest, isVerifiedCaptureContext, parseMicroformFragment, parseUnifiedCheckoutFrame, sameCybersourceFlexPreparation, sealForContext, transientTokenFacts, transientTokenSigned, unifiedCheckoutHostEnvironment, verifyCaptureContext, verifyUnifiedCheckoutContext };

package/dist/eghl.d.ts

@@ -0,0 +1,40 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export declare const EGHL_PSP = "eghl";
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export declare const EGHL_CAPABILITY = "eghl_hosted_payment_page";
+/** eGHL's live host, and its test platform's. */
+export declare const EGHL_HOST = "securepay.e-ghl.com";
+export declare const EGHL_SANDBOX_HOST = "test2pay.ghl.com";
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export declare function isEghlEntryUrl(raw: unknown): boolean;
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export declare function isEghlPayStep(url: string, method: string): boolean;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export declare function isArmedEghlUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+} | undefined, url: string): boolean;

package/dist/eghl.js

@@ -0,0 +1,72 @@
+/**
+ * eGHL's hosted payment page (securepay.e-ghl.com, the Malaysian gateway now sold as ADAPTIS, behind its own Shopify app
+ * among others), as this SDK reads it.
+ *
+ * The merchant's checkout sends the buyer's browser to https://securepay.e-ghl.com/IPG/payment.aspx with the payment in
+ * the query: a GET that carries no card, and the one request a build that declares eGHL's capability pauses
+ * (hosted-entry.ts). The cardholder's device repeats it over the end-to-end TLS relay and pays on the card page eGHL
+ * returns to it (payment-core processors/eghl.js). Every step toward paying on that page is a POST to eGHL's hosts, the
+ * card page's card post to the entry's own address among them, so this SDK aborts every POST there once the lane is
+ * served, and no placeholder card reaches eGHL.
+ *
+ * EGHL_HOST is payment-core's EGHL_HOST, and isEghlEntryUrl is payment-core's isEghlEntryUrl; eghl.test.mjs pins both
+ * to payment-core.
+ */
+export const EGHL_PSP = 'eghl';
+/** The dark-launch capability the API serves eGHL's recognizer behind (payment-core processors/eghl.js). */
+export const EGHL_CAPABILITY = 'eghl_hosted_payment_page';
+/** eGHL's live host, and its test platform's. */
+export const EGHL_HOST = 'securepay.e-ghl.com';
+export const EGHL_SANDBOX_HOST = 'test2pay.ghl.com';
+const LIVE_PATH = '/ipg/payment.aspx';
+const SANDBOX_PATH = '/ipgsg/payment.aspx';
+// An entry of that shape, for asking whether this build's registry serves the entry.
+const PROBE = 'https://securepay.e-ghl.com/IPG/payment.aspx?TransactionType=SALE';
+/**
+ * Whether a URL is an entry as a browser sends it: https, eGHL's live host with its entry path or its test host with its
+ * test path, the path in any letter case as IIS reads it, the default port, no credentials, no fragment, and a query
+ * that names the payment. Any other request to eGHL's hosts is not the entry.
+ */
+export function isEghlEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 8192 || raw.includes('#'))
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password || url.search.length < 2)
+        return false;
+    const path = url.pathname.toLowerCase();
+    return (url.hostname === EGHL_HOST && path === LIVE_PATH) || (url.hostname === EGHL_SANDBOX_HOST && path === SANDBOX_PATH);
+}
+/** Whether a URL is on one of eGHL's hosts, live or test: https, no credentials, any port, any case, a trailing dot or not. */
+function onEghlHost(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase().replace(/\.$/, '');
+    return url.protocol === 'https:' && !url.username && !url.password && (host === EGHL_HOST || host === EGHL_SANDBOX_HOST);
+}
+/**
+ * Whether a request on eGHL's hosts is a step toward paying there: any POST, the card page's card post and its Click to
+ * Pay post among them. The entry, the page's scripts and its images are GETs and are not one.
+ */
+export function isEghlPayStep(url, method) {
+    return onEghlHost(url) && String(method).toUpperCase() === 'POST';
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on eGHL's hosts and this build's registry
+ * serves eGHL's entry. The page's posts are not the entry, so the registry's card-request test does not name them; the
+ * CDP adapter still pauses them through the recognizer's host patterns, and attachToPlaywright's route predicate asks
+ * this, so both adapters show the gates every request to eGHL's hosts once the lane is armed.
+ */
+export function isArmedEghlUrl(vault, url) {
+    return onEghlHost(url) && typeof vault?.isCardRequest === 'function' && vault.isCardRequest(PROBE, 'GET');
+}

package/dist/gmo.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: a65199bcbf0b67546130fb4f2c12ba72c8f51a2ff5b4e3054e2bfcc29b06f95d
+// artifact-sha256: 192df19d53f4c68d74db3d692397b94f4a1b45ce8bee44a2326e01b56a329adf
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/hosted-entry.js

@@ -19,12 +19,14 @@ import { COMGATE_PSP, isComgateEntryUrl } from './comgate.js';
 import { TRANSBANK_PSP, isTransbankEntryUrl } from './transbank.js';
 import { BARION_PSP, isBarionEntryUrl } from './barion.js';
 import { PAYPLUG_PSP, isPayplugEntryUrl } from './payplug.js';
+import { EGHL_PSP, isEghlEntryUrl } from './eghl.js';
 const HOSTED_GET_ENTRIES = new Map([
     [PRZELEWY24_PSP, isPrzelewy24EntryUrl],
     [COMGATE_PSP, isComgateEntryUrl],
     [TRANSBANK_PSP, isTransbankEntryUrl],
     [BARION_PSP, isBarionEntryUrl],
     [PAYPLUG_PSP, isPayplugEntryUrl],
+    [EGHL_PSP, isEghlEntryUrl],
 ]);
 /** Whether this processor's hosted page is entered with a GET this build reads exactly. */
 export function hasHostedGetEntry(psp) {

package/dist/lifecycle.d.ts

@@ -109,6 +109,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private orderRefusal;
     private readonly handoffs;
     private reconciliation;
+    private pendingHold;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -150,6 +151,15 @@ export declare class CheckoutLifecycle implements CheckoutController {
     isCancelled(): boolean;
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver(): boolean;
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable(): boolean;
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no

package/dist/lifecycle.js

@@ -70,6 +70,8 @@ export class CheckoutLifecycle {
     // Every request this attachment handed the card to: see cardHandoffs().
     handoffs = [];
     reconciliation = null;
+    // The hold is only the merchant resolver's `pending` on a handoff nothing else held (resolve): see repeatAnswerable.
+    pendingHold = false;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -140,6 +142,18 @@ export class CheckoutLifecycle {
     isCancelled() { return this.cancelled; }
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver() { return typeof this.options.resolveMerchantResult === 'function'; }
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable() {
+        return this.state.status === 'awaiting_merchant' && !!this.state.authorizationId && !this.active && !this.cancelled
+            && !this.merchantAborted && this.followUpsOut === 0 && (!this.held || this.pendingHold);
+    }
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no
@@ -169,6 +183,10 @@ export class CheckoutLifecycle {
     }
     end() { this.active = false; }
     set(state) {
+        // Any state but awaiting the merchant (a challenge, a failure, a completion) ends the pending read's exception for
+        // good: a later pending read that brings awaiting_merchant back holds every card request again (repeatAnswerable).
+        if (state.status !== 'awaiting_merchant')
+            this.pendingHold = false;
         this.state = state;
         // Application telemetry must never interrupt a paused payment after it reaches the processor.
         try {
@@ -287,6 +305,7 @@ export class CheckoutLifecycle {
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;
+        this.pendingHold = false;
         if (this.state.authorizationId)
             return; // do not hide an outstanding/completed payment behind a later unsupported request
         this.set({ ...this.state, status: 'unsupported', reason });
@@ -416,6 +435,7 @@ export class CheckoutLifecycle {
         if (this.merchantAborted)
             return;
         this.settled = true;
+        this.pendingHold = false;
         if (this.orderRefusal) {
             // Nike's order was refused while this approval was on its way: the answer lands, and the checkout stays failed.
             this.held = true;
@@ -591,6 +611,10 @@ export class CheckoutLifecycle {
             await this.requestUserAction(result.reason);
         }
         else {
+            // A pending order on a handoff nothing held still lets the page's identical re-send of the same card request have
+            // its answer again (repeatAnswerable); every other card request stays refused.
+            if (!this.held && result.status === 'pending' && this.state.status === 'awaiting_merchant')
+                this.pendingHold = true;
             this.held = true;
             this.set({ ...this.state, status: result.status === 'pending' ? 'awaiting_merchant' : 'outcome_unknown', reason: 'merchant_not_confirmed' });
         }
@@ -612,6 +636,7 @@ export class CheckoutLifecycle {
         if (this.unboundStripeToken)
             throw new Error('This attachment delivered an unbound Stripe token; reconcile the merchant order and use a separately validated checkout flow.');
         this.held = false;
+        this.pendingHold = false;
         this.merchantAborted = false;
         this.orderRefusal = null;
         this.set({ status: 'idle', authorizationId: null });

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 4b24c682dbd8cd7bbaa0157f2932021d71f7c6802ce3814c6f3047173df29911
+// artifact-sha256: 0bd60e76821ed0f63235a99cc37dece9f0db8afef89492a0a7930fb49f80eb18
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -146,6 +146,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var MIN_PADDING = 8;
 var MAX_DRAWS = 16;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
@@ -156,6 +157,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,7 +192,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 139d0001a168e053ebe3283721905ae95d7c159a25848469965f037b844a44cf
+// artifact-sha256: d6d50b6577a932c3586fcade6b8cbd03c562bd3394e8addcb954d797ea9999b4
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -174,6 +174,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
@@ -182,6 +183,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -214,7 +218,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];

package/dist/pre-claim.d.ts

@@ -15,6 +15,7 @@ import { type CardEndpointProfile } from './card-endpoint.js';
 import { type NikeOrders } from './nike-order.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
+import type { TokenRepeats } from './token-repeats.js';
 import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 import { type PaddleVgsPayGate } from './paddle-vgs-pay.js';
 import { type EbanxFollowUps } from './ebanx.js';
@@ -210,6 +211,8 @@ export interface PreClaimContext {
     datatrans?: DatatransRepeats;
     /** The attachment's approved TokenEx iframe answers (the repeat rule, tokenex-iframe.ts). Absent: none are kept. */
     tokenexIframe?: TokenexIframeRepeats;
+    /** The attachment's last approved plain token answer, for the page's identical re-send (token-repeats.ts). Absent: none is kept. */
+    tokenRepeats?: TokenRepeats;
     /** The adapter's identity for the request's frame (CDP frameId, Playwright Frame); undefined when unknown. */
     frame?: unknown;
     /**
@@ -288,6 +291,8 @@ export declare function isArmedCreditguardCall(vault: {
 export declare const przelewy24PreClaim: PreClaimGate;
 export declare const barionPreClaim: PreClaimGate;
 export declare const payplugPreClaim: PreClaimGate;
+export declare const eghlPreClaim: PreClaimGate;
+export declare const cardlinkVposPreClaim: PreClaimGate;
 export declare const ekashuPreClaim: PreClaimGate;
 export declare const transbankPreClaim: PreClaimGate;
 export declare const paytrailPreClaim: PreClaimGate;