@agent-cards/sdk 0.24.0 → 0.24.2

package/dist/pre-claim.js

@@ -88,10 +88,13 @@ import { isRedsysEntry, isRedsysHost, redsysEntryUrl } from './redsys.js';
 import { isArmedPrzelewy24Url, isPrzelewy24PayStep } from './przelewy24.js';
 import { isArmedBarionUrl, isBarionPayStep } from './barion.js';
 import { isArmedPayplugUrl, isPayplugPayStep } from './payplug.js';
+import { isArmedCardlinkVposUrl, isCardlinkVposEntry } from './cardlink-vpos.js';
+import { isArmedEghlUrl, isEghlPayStep } from './eghl.js';
 import { isQuickpayCardLookup, isQuickpayEntry, quickpayEntryUrl } from './quickpay.js';
 import { isArmedComgateUrl } from './comgate.js';
 import { isArmedEximbayUrl, isEximbayEntry } from './eximbay.js';
 import { isArmedOceanpaymentUrl, isOceanpaymentSendPay } from './oceanpayment.js';
+import { aurusPreClaim } from './aurus.js';
 import { PAYPAL_HOSTED_FIELDS_REASON, isPaypalHostedFieldsConfirm, paypalHostedFieldsBody } from './paypal-hosted-fields.js';
 import { PAYPAL_CARD_FIELDS_REASON, PAYPAL_GUEST_CHECKOUT_REASON, isPaypalCardFieldsConfirm, isPaypalGraphql, paypalCardFieldsBody, paypalGraphqlCard, paypalGraphqlNamesCardOperation, } from './paypal-card-forms.js';
 import { CYBERSOURCE_SECURE_ACCEPTANCE_REASON, CYBERSOURCE_SECURE_ACCEPTANCE_RECIPIENT, cybersourceSecureAcceptanceRequest, isCybersourceSecureAcceptanceUrl, isSecureAcceptanceFramePost, } from './cybersource-secure-acceptance.js';
@@ -999,6 +1002,50 @@ const tokenexIframePreClaim = (ctx) => {
     return ctx.lifecycle.getState().status === 'awaiting_merchant'
         ? repeatAfterHandoff(ctx, repeat, TOKENEX_IFRAME_PSP) : answerRepeat(ctx, repeat, TOKENEX_IFRAME_PSP);
 };
+// Any processor's plain token request, sent again by the page byte for byte after its approved answer reached it
+// (token-repeats.ts). Last among the gates, so a processor with its own repeat rule (Datatrans, the TokenEx iframe) or
+// its own hold (Stripe, a card endpoint) decides first. While the lifecycle reads the re-send as answerable
+// (repeatAnswerable: the same approval awaits the merchant, and nothing but a pending read holds it), the gate asks the
+// merchant resolver and answers with the stored token only while the order still reads pending, as repeatAfterHandoff
+// does. Every other card request, another amount or approval among them, defers to the terminal arbiter and the
+// adapters' hold, as before.
+const tokenRepeatPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.tokenRepeats || method.toUpperCase() !== 'POST' || !ctx.lifecycle.repeatAnswerable?.() || !ctx.lifecycle.hasMerchantResolver?.())
+        return undefined;
+    // A processor with its own repeat rule keeps its own limits: a re-send its rule declined is a new question.
+    if (isDatatransHost(url) || isTokenexIframePath(url))
+        return undefined;
+    if (ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    // Read only here, past every cheaper check: a body the adapter cannot read is no re-send of an answered one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return undefined;
+    }
+    const repeats = ctx.tokenRepeats;
+    const repeat = repeats.answerFor(ctx.frame, url, body, ctx.lifecycle.getState().authorizationId);
+    if (!repeat)
+        return undefined;
+    // A re-send the page never got an answer for gives its place in the count back.
+    return tokenRepeatWhilePending(ctx, repeat).then((decision) => {
+        if (decision?.kind !== 'answer')
+            repeats.released(repeat.authorizationId);
+        return decision;
+    }, (error) => { repeats.released(repeat.authorizationId); throw error; });
+};
+async function tokenRepeatWhilePending(ctx, repeat) {
+    if (!await ctx.lifecycle.merchantOrderPending())
+        return undefined;
+    // The resolver answered asynchronously: the same approval must still be the one awaiting the merchant.
+    if (!ctx.lifecycle.repeatAnswerable() || ctx.lifecycle.getState().authorizationId !== repeat.authorizationId
+        || ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    return answerRepeat(ctx, repeat, 'token');
+}
 async function tokenexIframeBlock(ctx, reason) {
     ctx.onEvent?.({ type: 'blocked', detail: reason });
     await ctx.effects.abort();
@@ -1743,6 +1790,47 @@ export const payplugPreClaim = (ctx) => {
         return undefined;
     return processorPageAbort(ctx);
 };
+// eGHL's payment page (eghl.ts). Once this build's registry serves eGHL's entry (a capability the API serves only to
+// Agentcard's own company), every request to eGHL's hosts pauses. The merchant's entry, a GET of /IPG/payment.aspx whose
+// query names the payment, is no step of this gate's: it defers, and the terminal arbiter pauses it for the claim flow
+// like any card request, so the cardholder's device pays it. Every step toward paying on the page itself aborts as an
+// unsupported checkout: every POST to eGHL's hosts, the card page's card post to the entry's own address among them. So
+// eGHL never sees the card the agent typed. The page's own GETs continue. With eGHL not served, the gate defers, and
+// every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate registry's
+// tests.
+export const eghlPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!isEghlPayStep(url, method) || !isArmedEghlUrl(ctx.vault, url))
+        return undefined;
+    return processorPageAbort(ctx);
+};
+// Cardlink's VPOS (cardlink-vpos.ts). Once this build's registry serves the entry (a capability the API serves only to
+// Agentcard's own company), every request to the VPOS's hosts pauses, and this gate judges the POSTs:
+//   - the merchant's entry, an entry body posted to /vpos/shophandlermpi on one of the three live hosts, defers, and the
+//     terminal arbiter pauses it for the claim flow like any card request: the cardholder's device pays it;
+//   - every other POST (the card page's post and its card check, which share the entry's URL and carry the page's own
+//     fields, a body the adapter could not read, and anything on Cardlink's test hosts) aborts as an unsupported
+//     checkout, so the VPOS never sees the card the agent typed.
+// A GET (the card page's script, its status poll) is not this gate's and continues. With the lane not served, the gate
+// defers, and every request continues as before. Synchronous until it must abort, like every gate. Exported for the gate
+// registry's tests.
+export const cardlinkVposPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isArmedCardlinkVposUrl(ctx.vault, url))
+        return undefined;
+    // The body is a getter an adapter can fail in (Playwright's postData() throws on a body it cannot decode): a body that
+    // cannot be read is no entry this gate can tell from a card post, so it fails closed, aborted and reported like one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return processorPageAbort(ctx);
+    }
+    if (isCardlinkVposEntry(url, method, body))
+        return undefined;
+    return processorPageAbort(ctx);
+};
 // NMI's hosted payment page (ekashu.ts). Once this build's registry serves NMI's entry (a
 // capability the API serves only to a company Agentcard turned NMI on for), every request to
 // NMI's two hosts pauses, and this gate judges the POSTs:
@@ -2577,9 +2665,9 @@ async function unsupportedContinue(ctx) {
  * arbiter runs after all of them and is not part of this list. A gate appended
  * after Stripe is never offered a step Stripe claimed: Stripe answers, aborts or
  * pauses each one itself. */
-export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, paypalHostedFieldsPreClaim,
+export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, cardlinkVposPreClaim, eghlPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim,
-    oceanpaymentPreClaim];
+    oceanpaymentPreClaim, aurusPreClaim, tokenRepeatPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -211,7 +211,26 @@
       "origin": "https://js.braintreegateway.com",
       "path_pattern": "/web/:version/js/*",
       "hostname_pattern": "^js\\.braintreegateway\\.com$",
-      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$)",
+      "sources": [
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.paypal.com/braintree/docs/start/hello-client/javascript/v3/",
+          "reviewed_on": "2026-09-11"
+        }
+      ]
+    },
+    {
+      "id": "braintree-web-wallet",
+      "psp": "braintree",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://js.braintreegateway.com",
+      "path_pattern": "/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js",
+      "card_free": "braintree-web's client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.",
+      "hostname_pattern": "^js\\.braintreegateway\\.com$",
+      "pathname_pattern": "^\\/web\\/(?![^/]*-payments-sdk)[^/]+\\/js\\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\\.min)?\\.js$",
       "sources": [
         {
           "kind": "official_documentation",
@@ -2566,6 +2585,92 @@
       "hostname_pattern": "^flex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://up.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^up\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
+    {
+      "id": "aurus-ecom-iframe",
+      "psp": "aurus",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/getiframe",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/getiframe$"
+    },
+    {
+      "id": "aurus-ecom-init-script",
+      "psp": "aurus",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://pecst01.aurusepay.com",
+      "path_pattern": "/storeservices/ecom/ecominitjs",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^pecst[0-9]{2}\\.aurusepay\\.com$",
+      "pathname_pattern": "^\\/storeservices\\/ecom\\/ecominitjs$"
+    },
     {
       "id": "juspay-hypercheckout-payment-page",
       "psp": "juspay",
@@ -3417,6 +3522,31 @@
       "hostname_pattern": "^payment\\.pay1\\.checkout\\.worldline-solutions\\.com$",
       "pathname_pattern": "^\\/checkout$"
     },
+    {
+      "id": "bigcommerce-hosted-card-field",
+      "psp": "bigcommerce",
+      "kinds": [
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://payments.bigcommerce.com",
+      "path_pattern": "/pay/hosted_forms/:form/field",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "drsturm-2026-11-06:bigcommerce-hosted-form-field-1.997.1",
+          "reviewed_on": "2026-11-06"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://checkout-sdk.bigcommerce.com/v1/loader-v1.997.1.js",
+          "reviewed_on": "2026-11-06"
+        }
+      ],
+      "hostname_pattern": "^payments\\.bigcommerce\\.com$",
+      "pathname_pattern": "^\\/pay\\/hosted_forms\\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\/field$"
+    },
     {
       "id": "gmo-mp-token-script-test",
       "psp": "gmo_pg",
@@ -3565,6 +3695,54 @@
       "hostname_pattern": "^testflex\\.cybersource\\.com$",
       "pathname_pattern": "^\\/microform\\/bundle\\/v2\\.[0-9]+\\.[0-9]+\\/iframe\\.html$"
     },
+    {
+      "id": "cybersource-unified-checkout-script-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "script"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/UnifiedCheckout.js",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/UnifiedCheckout\\.js$"
+    },
+    {
+      "id": "cybersource-unified-checkout-frame-test",
+      "psp": "cybersource_flex",
+      "kinds": [
+        "frame",
+        "iframe",
+        "document"
+      ],
+      "origin": "https://testup.cybersource.com",
+      "path_pattern": "/uc/v1/assets/:asset/{mce,orc,ga}/*.html",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames",
+          "reviewed_on": "2026-10-31"
+        },
+        {
+          "kind": "official_documentation",
+          "reference": "https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html",
+          "reviewed_on": "2026-10-31"
+        }
+      ],
+      "hostname_pattern": "^testup\\.cybersource\\.com$",
+      "pathname_pattern": "^\\/uc\\/v1\\/assets\\/[A-Za-z0-9_-]{16,1024}\\/(?:mce\\/mce|orc\\/orc|ga\\/ga)\\.html$"
+    },
     {
       "id": "cybersource-secure-acceptance-silent-order-post-test",
       "psp": "cybersource_secure_acceptance",

package/dist/preflight-schemas.json

@@ -385,6 +385,7 @@
                 "mollie-components-v1-script",
                 "mollie-hosted-credit-card",
                 "braintree-web-sdk",
+                "braintree-web-wallet",
                 "braintree-hosted-fields",
                 "paysafe-js",
                 "worldpay-checkout-sdk",
@@ -483,6 +484,10 @@
                 "gmo-link-hosted-page",
                 "cybersource-flex-microform-script",
                 "cybersource-flex-microform-field",
+                "cybersource-unified-checkout-script",
+                "cybersource-unified-checkout-frame",
+                "aurus-ecom-iframe",
+                "aurus-ecom-init-script",
                 "juspay-hypercheckout-payment-page",
                 "pelecard-payment-page",
                 "pelecard-payment-script",
@@ -520,12 +525,15 @@
                 "amadeus-data-collection-page",
                 "worldline-mycheckout-page",
                 "worldline-mycheckout-card-form",
+                "bigcommerce-hosted-card-field",
                 "gmo-mp-token-script-test",
                 "gmo-token-v1-script-test",
                 "gmo-elements-card-frame-test",
                 "gmo-link-hosted-page-test",
                 "cybersource-flex-microform-script-test",
                 "cybersource-flex-microform-field-test",
+                "cybersource-unified-checkout-script-test",
+                "cybersource-unified-checkout-frame-test",
                 "cybersource-secure-acceptance-silent-order-post-test",
                 "cybersource-secure-acceptance-silent-order-post-in",
                 "worldpay-eprotect-js-api-prelive",
@@ -1023,6 +1031,7 @@
                       "mollie-components-v1-script",
                       "mollie-hosted-credit-card",
                       "braintree-web-sdk",
+                      "braintree-web-wallet",
                       "braintree-hosted-fields",
                       "paysafe-js",
                       "worldpay-checkout-sdk",
@@ -1121,6 +1130,10 @@
                       "gmo-link-hosted-page",
                       "cybersource-flex-microform-script",
                       "cybersource-flex-microform-field",
+                      "cybersource-unified-checkout-script",
+                      "cybersource-unified-checkout-frame",
+                      "aurus-ecom-iframe",
+                      "aurus-ecom-init-script",
                       "juspay-hypercheckout-payment-page",
                       "pelecard-payment-page",
                       "pelecard-payment-script",
@@ -1158,12 +1171,15 @@
                       "amadeus-data-collection-page",
                       "worldline-mycheckout-page",
                       "worldline-mycheckout-card-form",
+                      "bigcommerce-hosted-card-field",
                       "gmo-mp-token-script-test",
                       "gmo-token-v1-script-test",
                       "gmo-elements-card-frame-test",
                       "gmo-link-hosted-page-test",
                       "cybersource-flex-microform-script-test",
                       "cybersource-flex-microform-field-test",
+                      "cybersource-unified-checkout-script-test",
+                      "cybersource-unified-checkout-frame-test",
                       "cybersource-secure-acceptance-silent-order-post-test",
                       "cybersource-secure-acceptance-silent-order-post-in",
                       "worldpay-eprotect-js-api-prelive",

package/dist/preflight.generated.d.ts

@@ -148,6 +148,11 @@ export declare function getCheckoutPreflightCatalog(): {
         path_pattern: string;
         flow?: string;
         variant_unverified?: string;
+        /**
+         * Why the asset never takes a card: a wallet button, a fraud collector, or the client those load. When no card frame
+         * is active and scripts alone name several processors, one whose every asset says this is not the card form's.
+         */
+        card_free?: string;
     }[];
     processors: readonly [{
         readonly psp: "spreedly";

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 761b59c7c043a43a8d462a840e204c1677c55c0022f37e6be4a007d025357af8
+// source-sha256: 84246b0b75dadb1798e0c9bd4ab7a8ab8567df86ea490fb20c9f0f890309e7df
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -23,7 +23,13 @@ const RULES = [
     // A braintree-web build whose version carries -payments-sdk (3.32.0-payments-sdk-dev) is PayPal's
     // (paypal-hosted-fields-payments-sdk below): its card goes to PayPal, never to Braintree, so neither
     // Braintree rule takes one.
-    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\//, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    { id: 'braintree-web-sdk', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?!(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$)/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/*' },
+    // braintree-web's client and its wallet and fraud components take no card: a page that loads only these runs a
+    // PayPal, Venmo, Apple Pay or Google Pay button through Braintree, and its card boxes belong to another processor.
+    // AutoZone's checkout loads client, paypal-checkout and data-collector 3.125.0 beside Worldpay eProtect's JS API, whose
+    // script reads the card from the page's own fields (2026-10-31).
+    { id: 'braintree-web-wallet', psp: 'braintree', kinds: ['script'], hostname: /^js\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)[^/]+\/js\/(?:client|paypal|paypal-checkout|venmo|apple-pay|google-payment|data-collector|local-payment)(?:\.min)?\.js$/, origin: 'https://js.braintreegateway.com', path_pattern: '/web/:version/js/{client,paypal,paypal-checkout,venmo,apple-pay,google-payment,data-collector,local-payment}[.min].js',
+        card_free: 'braintree-web\'s client, wallet and fraud components collect no card; Hosted Fields and Drop-in do.' },
     { id: 'braintree-hosted-fields', psp: 'braintree', kinds: ['frame', 'iframe'], hostname: /^assets\.braintreegateway\.com$/, pathname: /^\/web\/(?![^/]*-payments-sdk)/, origin: 'https://assets.braintreegateway.com', path_pattern: '/web/*' },
     { id: 'paysafe-js', psp: 'paysafe', kinds: ['script', 'frame', 'iframe'], hostname: /^hosted\.paysafe\.com$/, pathname: /^\/(?:js|checkout)\//, origin: 'https://hosted.paysafe.com', path_pattern: '/{js,checkout}/*' },
     { id: 'worldpay-checkout-sdk', psp: 'worldpay', kinds: ['script', 'frame', 'iframe'], hostname: /^access\.worldpay\.com$/, pathname: /^\/access-checkout\//, origin: 'https://access.worldpay.com', path_pattern: '/access-checkout/*' },
@@ -197,6 +203,27 @@ const cybersourceSources = [
 RULES.push({ id: 'cybersource-flex-microform-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2(?:\.[0-9]+\.[0-9]+)?\/flex-microform\.min\.js$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v2{,.:minor.:patch}/flex-microform.min.js',
     sources: cybersourceSources }, { id: 'cybersource-flex-microform-field', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^flex\.cybersource\.com$/, pathname: /^\/microform\/bundle\/v2\.[0-9]+\.[0-9]+\/iframe\.html$/, origin: 'https://flex.cybersource.com', path_pattern: '/microform/bundle/v:version/iframe.html',
     sources: cybersourceSources });
+// CyberSource Unified Checkout v1 sends the card to the same Flex v2 tokens URL, sealed by its orchestrator frame
+// under the capture context (cybersource-unified-checkout.js), so its script and frames name cybersource_flex too.
+// Reviewed 2026-10-31 from napaonline.com's checkout (UnifiedCheckout.js v1.8.2), with no card sent.
+const unifiedCheckoutSources = [
+    { kind: 'saved_observation', reference: 'napaonline-2026-10-31:unified-checkout-v1.8.2-mce-orc-ga-frames', reviewed_on: '2026-10-31' },
+    { kind: 'official_documentation', reference: 'https://developer.cybersource.com/docs/cybs/en-us/unified-checkout/developer/all/rest/unified-checkout/uc-intro.html', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'cybersource-unified-checkout-script', psp: 'cybersource_flex', kinds: ['script'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/UnifiedCheckout\.js$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/UnifiedCheckout.js',
+    sources: unifiedCheckoutSources }, { id: 'cybersource-unified-checkout-frame', psp: 'cybersource_flex', kinds: ['frame', 'iframe', 'document'], hostname: /^up\.cybersource\.com$/, pathname: /^\/uc\/v1\/assets\/[A-Za-z0-9_-]{16,1024}\/(?:mce\/mce|orc\/orc|ga\/ga)\.html$/, origin: 'https://up.cybersource.com', path_pattern: '/uc/v1/assets/:asset/{mce,orc,ga}/*.html',
+    sources: unifiedCheckoutSources });
+// Aurus Pay's ecom card frame (processors/aurus.js): the store frames /storeservices/ecom/getiframe on
+// pecst<NN>.aurusepay.com, the card fields sit inside it, and its own ecominitjs sends the sealed card to
+// /storeservices/ecom/oneTimeToken on the same host. Reviewed 2026-10-31 at oreillyauto.com's payment step, with every
+// aurusepay.com request but a GET aborted and only a public test card typed. Aurus is served dark, so no catalog
+// processor entry backs the candidate and the result stays unknown unless the caller is served Aurus.
+const aurusSources = [
+    { kind: 'saved_observation', reference: 'oreillyauto-2026-10-31:aurus-ecom-getiframe-oneTimeToken', reviewed_on: '2026-10-31' },
+];
+RULES.push({ id: 'aurus-ecom-iframe', psp: 'aurus', kinds: ['frame', 'iframe', 'document'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/getiframe$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/getiframe',
+    sources: aurusSources }, { id: 'aurus-ecom-init-script', psp: 'aurus', kinds: ['script'], hostname: /^pecst[0-9]{2}\.aurusepay\.com$/, pathname: /^\/storeservices\/ecom\/ecominitjs$/, origin: 'https://pecst01.aurusepay.com', path_pattern: '/storeservices/ecom/ecominitjs',
+    sources: aurusSources });
 // Juspay HyperCheckout: Juspay's own hosted payment page (the Session API's payment_links.web),
 // which a merchant embeds in an iframe (IndiGo's payment step). The card request that page makes
 // has not been observed, so the Vault does not take it over, and the rule tells the agent so
@@ -344,6 +371,15 @@ RULES.push({ id: 'worldline-mycheckout-page', psp: 'worldline_mycheckout', kinds
     pathname: /^\/checkout\/(?:payment-product-details\/)?[1-9][0-9]{0,9}-[0-9a-f]{32}:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout/{payment-product-details/}:hosted_checkout', sources: worldlineSources }, { id: 'worldline-mycheckout-card-form', psp: 'worldline_mycheckout', kinds: ['form'], hostname: /^payment\.pay1\.checkout\.worldline-solutions\.com$/, pathname: /^\/checkout$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout', sources: worldlineSources });
+// BigCommerce's own card form, read 2026-11-06 at drsturm.com: the store's /checkout/payment/hosted-field iframes
+// redirect to one field document per card input on payments.bigcommerce.com, which loads checkout-sdk's hosted-form
+// module and sends the card to BigCommerce's payments API (processors/bigcommerce.js), whichever gateway charges it.
+// BigCommerce ships dark, so the field names bigcommerce and the result stays unknown, as GMO's does.
+RULES.push({ id: 'bigcommerce-hosted-card-field', psp: 'bigcommerce', kinds: ['document', 'frame', 'iframe'], hostname: /^payments\.bigcommerce\.com$/,
+    pathname: /^\/pay\/hosted_forms\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/field$/, origin: 'https://payments.bigcommerce.com',
+    path_pattern: '/pay/hosted_forms/:form/field',
+    sources: [{ kind: 'saved_observation', reference: 'drsturm-2026-11-06:bigcommerce-hosted-form-field-1.997.1', reviewed_on: '2026-11-06' },
+        { kind: 'primary_source', reference: 'https://checkout-sdk.bigcommerce.com/v1/loader-v1.997.1.js', reviewed_on: '2026-11-06' }] });
 // A processor that ships dark (its definition declares a capability) is left out of the bundled
 // catalog. Datatrans's and the TokenEx iframe's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
 // bundled catalog's processors, lists its psp. Until then its assets are not evidence, so a page
@@ -382,6 +418,8 @@ for (const [baseId, suffix, hostname, origin] of [
     ['gmo-link-hosted-page', 'test', /^pt01\.mul-pay\.jp$/, 'https://pt01.mul-pay.jp'],
     ['cybersource-flex-microform-script', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
     ['cybersource-flex-microform-field', 'test', /^testflex\.cybersource\.com$/, 'https://testflex.cybersource.com'],
+    ['cybersource-unified-checkout-script', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
+    ['cybersource-unified-checkout-frame', 'test', /^testup\.cybersource\.com$/, 'https://testup.cybersource.com'],
     // Secure Acceptance's test host and its production host in India serve the same /silent/ paths.
     ['cybersource-secure-acceptance-silent-order-post', 'test', /^testsecureacceptance\.cybersource\.com$/, 'https://testsecureacceptance.cybersource.com'],
     ['cybersource-secure-acceptance-silent-order-post', 'in', /^secureacceptance\.in\.cybersource\.com$/, 'https://secureacceptance.in.cybersource.com'],
@@ -788,19 +826,27 @@ export function assessCheckoutSupport(input, options = {}) {
     result.candidates = [...candidates.values()].sort((a, b) => a.psp.localeCompare(b.psp));
     if (missingCorroboration && activeFlows.size === 0)
         result.reason_codes.push('flow_corroboration_missing');
+    // Scripts alone naming several processors: one whose every asset is card-free (a wallet button, a fraud collector)
+    // is not the card form's. When exactly one other is left, the page's card form is that one's.
+    const cardCapable = activePsps.size === 0 && candidates.size > 1
+        ? [...candidates.values()].filter(candidate => candidate.evidence.some(evidence => !RULE_BY_ID.get(evidence.rule_id).card_free))
+        : [];
+    const cardFormPsp = cardCapable.length === 1 ? cardCapable[0].psp : null;
     if (activePsps.size === 1)
         result.psp = [...activePsps][0];
     // Script-only evidence names the processor only when the scan saw everything. On a partial scan
     // the sole candidate stays listed as undetermined instead of becoming the selected route.
     else if (activePsps.size === 0 && candidates.size === 1 && result.observation.complete)
         result.psp = [...candidates.keys()][0];
+    else if (cardFormPsp !== null && result.observation.complete)
+        result.psp = cardFormPsp;
     if (!result.observation.complete)
         result.reason_codes.push('observation_incomplete');
     if (!input.signals.length) {
         result.reason_codes.push('psp_not_detected');
         result.missing_evidence.push('payment_page_signal');
     }
-    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1)
+    if (activePsps.size > 1 || activeFlows.size > 1 || activeFlowFrames.size > 1 || activePsps.size === 0 && candidates.size > 1 && cardFormPsp === null)
         result.reason_codes.push('ambiguous_checkout');
     if (activeFlows.size !== 1 || result.psp === null) {
         result.reason_codes.push('checkout_flow_unidentified');

package/dist/preparation.d.ts

@@ -25,6 +25,13 @@ export declare class PreparationGate {
      * own method is what binds: a POST for most processors, the registration GET for Worldpay eProtect.
      */
     claim(requestUrl: string, requestMethod: string, requestBody?: string | null, requestHeaders?: Record<string, string>): PreparedCheckout | undefined;
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url: unknown): boolean;
     assertDocument(): Promise<void>;
     private readDocument;
     isEngaged(): boolean;

package/dist/preparation.js

@@ -3,6 +3,17 @@ import { amountRefusal, validAmountInput } from './client.js';
 import { matchesPreparation, validPreparationEnvironment, preparationEndpoint, preparationBindsByShape, preparationRequestMethod, preparedRequestRefusal } from './prepared-processor.js';
 import { SECURE_ACCEPTANCE_PSP, secureAcceptanceCheckoutProfile } from './cybersource-secure-acceptance.js';
 import { creditguardPageProcessUrl, creditguardProcessTxId } from './creditguard.generated.js';
+/** A page URL without its fragment, or undefined when it does not parse. */
+function documentWithoutFragment(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.hash = '';
+        return parsed.href;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** A local, one-use rendezvous. It never starts or retries a merchant request. */
 export class PreparationGate {
     opts;
@@ -195,6 +206,16 @@ export class PreparationGate {
         clearTimeout(this.expiryTimer);
         return prepared;
     }
+    /**
+     * Whether a same-document navigation of the prepared page to `url` leaves the document this
+     * preparation read: the same origin, path and query, whatever the fragment. A single-page checkout
+     * that calls history.replaceState with its own URL after each server action (Al's on VTEX) keeps
+     * its preparation; a history update to another path or query does not.
+     */
+    keepsDocument(url) {
+        const kept = typeof url === 'string' ? documentWithoutFragment(url) : undefined;
+        return kept !== undefined && this.documentUrl !== '' && kept === documentWithoutFragment(this.documentUrl);
+    }
     async assertDocument() {
         if (this.documentUrl && await this.readDocument() !== this.documentUrl)
             throw new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_changed');