@agent-cards/sdk 0.24.1 → 0.24.2

package/dist/cdp.js

@@ -15,6 +15,7 @@ import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
 import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
 import { PADDLE_VGS_PAY_PATTERNS, PaddleVgsPayGate, isPaddleCheckoutService, recognizesPaddleVgs } from './paddle-vgs-pay.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenRepeats } from './token-repeats.js';
 import { TokenexIframeRepeats, isArmedTokenexIframeUrl } from './tokenex-iframe.js';
 import { isArmedPaytrailUrl } from './paytrail.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
@@ -2084,6 +2085,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // The approved TokenEx iframe answers, per frameId (the card-number frame is an out-of-process iframe whose own
     // session pauses its post; its frameId names it): the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     // The Shiji STS getCvvId companion of the getTokenId this attachment last continued (shiji-sts.ts).
@@ -2905,6 +2908,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             juspay: juspayCheckout,
             datatrans: datatransRepeats,
             tokenexIframe: tokenexIframeRepeats,
+            tokenRepeats,
             ebanx: ebanxFollowUps,
             payrexx: payrexxFollowUps,
             nikeOrders,
@@ -3446,6 +3450,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // The frame that received it: the paused request's, or its retry's once rebound.
                 datatransRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 tokenexIframeRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
+                tokenRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 attempt.assertLive();
                 // An ACI card-number request answered: its checkout's held CVC and expiry requests get the
                 // same answer, and its /payment submission may continue (see AciGate).
@@ -3982,6 +3987,8 @@ export async function attachToPlaywright(page, opts) {
     const datatransRepeats = new DatatransRepeats();
     // The approved TokenEx iframe answers, per Frame: the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     const frameOf = (request) => { try {
@@ -4180,6 +4187,7 @@ export async function attachToPlaywright(page, opts) {
                 juspay: juspayCheckout,
                 datatrans: datatransRepeats,
                 tokenexIframe: tokenexIframeRepeats,
+                tokenRepeats,
                 ebanx: ebanxFollowUps,
                 payrexx: payrexxFollowUps,
                 nikeOrders,
@@ -4586,6 +4594,7 @@ export async function attachToPlaywright(page, opts) {
                     await deliverTo.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
                     datatransRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     tokenexIframeRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
+                    tokenRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     assertRequestLive();
                     // See the same step in attachToCdp.
                     aci.answered(deliverRequest.url(), { status: replay.status, headers: replay.headers, body: replay.body }, replay.authorizationId);

package/dist/client.d.ts

@@ -608,6 +608,15 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
  * on for.
  *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's

package/dist/client.js

@@ -602,6 +602,15 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
  * on for.
  *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's

package/dist/lifecycle.d.ts

@@ -109,6 +109,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private orderRefusal;
     private readonly handoffs;
     private reconciliation;
+    private pendingHold;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -150,6 +151,15 @@ export declare class CheckoutLifecycle implements CheckoutController {
     isCancelled(): boolean;
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver(): boolean;
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable(): boolean;
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no

package/dist/lifecycle.js

@@ -70,6 +70,8 @@ export class CheckoutLifecycle {
     // Every request this attachment handed the card to: see cardHandoffs().
     handoffs = [];
     reconciliation = null;
+    // The hold is only the merchant resolver's `pending` on a handoff nothing else held (resolve): see repeatAnswerable.
+    pendingHold = false;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -140,6 +142,18 @@ export class CheckoutLifecycle {
     isCancelled() { return this.cancelled; }
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver() { return typeof this.options.resolveMerchantResult === 'function'; }
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable() {
+        return this.state.status === 'awaiting_merchant' && !!this.state.authorizationId && !this.active && !this.cancelled
+            && !this.merchantAborted && this.followUpsOut === 0 && (!this.held || this.pendingHold);
+    }
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no
@@ -169,6 +183,10 @@ export class CheckoutLifecycle {
     }
     end() { this.active = false; }
     set(state) {
+        // Any state but awaiting the merchant (a challenge, a failure, a completion) ends the pending read's exception for
+        // good: a later pending read that brings awaiting_merchant back holds every card request again (repeatAnswerable).
+        if (state.status !== 'awaiting_merchant')
+            this.pendingHold = false;
         this.state = state;
         // Application telemetry must never interrupt a paused payment after it reaches the processor.
         try {
@@ -287,6 +305,7 @@ export class CheckoutLifecycle {
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;
+        this.pendingHold = false;
         if (this.state.authorizationId)
             return; // do not hide an outstanding/completed payment behind a later unsupported request
         this.set({ ...this.state, status: 'unsupported', reason });
@@ -416,6 +435,7 @@ export class CheckoutLifecycle {
         if (this.merchantAborted)
             return;
         this.settled = true;
+        this.pendingHold = false;
         if (this.orderRefusal) {
             // Nike's order was refused while this approval was on its way: the answer lands, and the checkout stays failed.
             this.held = true;
@@ -591,6 +611,10 @@ export class CheckoutLifecycle {
             await this.requestUserAction(result.reason);
         }
         else {
+            // A pending order on a handoff nothing held still lets the page's identical re-send of the same card request have
+            // its answer again (repeatAnswerable); every other card request stays refused.
+            if (!this.held && result.status === 'pending' && this.state.status === 'awaiting_merchant')
+                this.pendingHold = true;
             this.held = true;
             this.set({ ...this.state, status: result.status === 'pending' ? 'awaiting_merchant' : 'outcome_unknown', reason: 'merchant_not_confirmed' });
         }
@@ -612,6 +636,7 @@ export class CheckoutLifecycle {
         if (this.unboundStripeToken)
             throw new Error('This attachment delivered an unbound Stripe token; reconcile the merchant order and use a separately validated checkout flow.');
         this.held = false;
+        this.pendingHold = false;
         this.merchantAborted = false;
         this.orderRefusal = null;
         this.set({ status: 'idle', authorizationId: null });

package/dist/pre-claim.d.ts

@@ -15,6 +15,7 @@ import { type CardEndpointProfile } from './card-endpoint.js';
 import { type NikeOrders } from './nike-order.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
+import type { TokenRepeats } from './token-repeats.js';
 import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 import { type PaddleVgsPayGate } from './paddle-vgs-pay.js';
 import { type EbanxFollowUps } from './ebanx.js';
@@ -210,6 +211,8 @@ export interface PreClaimContext {
     datatrans?: DatatransRepeats;
     /** The attachment's approved TokenEx iframe answers (the repeat rule, tokenex-iframe.ts). Absent: none are kept. */
     tokenexIframe?: TokenexIframeRepeats;
+    /** The attachment's last approved plain token answer, for the page's identical re-send (token-repeats.ts). Absent: none is kept. */
+    tokenRepeats?: TokenRepeats;
     /** The adapter's identity for the request's frame (CDP frameId, Playwright Frame); undefined when unknown. */
     frame?: unknown;
     /**

package/dist/pre-claim.js

@@ -1002,6 +1002,50 @@ const tokenexIframePreClaim = (ctx) => {
     return ctx.lifecycle.getState().status === 'awaiting_merchant'
         ? repeatAfterHandoff(ctx, repeat, TOKENEX_IFRAME_PSP) : answerRepeat(ctx, repeat, TOKENEX_IFRAME_PSP);
 };
+// Any processor's plain token request, sent again by the page byte for byte after its approved answer reached it
+// (token-repeats.ts). Last among the gates, so a processor with its own repeat rule (Datatrans, the TokenEx iframe) or
+// its own hold (Stripe, a card endpoint) decides first. While the lifecycle reads the re-send as answerable
+// (repeatAnswerable: the same approval awaits the merchant, and nothing but a pending read holds it), the gate asks the
+// merchant resolver and answers with the stored token only while the order still reads pending, as repeatAfterHandoff
+// does. Every other card request, another amount or approval among them, defers to the terminal arbiter and the
+// adapters' hold, as before.
+const tokenRepeatPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.tokenRepeats || method.toUpperCase() !== 'POST' || !ctx.lifecycle.repeatAnswerable?.() || !ctx.lifecycle.hasMerchantResolver?.())
+        return undefined;
+    // A processor with its own repeat rule keeps its own limits: a re-send its rule declined is a new question.
+    if (isDatatransHost(url) || isTokenexIframePath(url))
+        return undefined;
+    if (ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    // Read only here, past every cheaper check: a body the adapter cannot read is no re-send of an answered one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return undefined;
+    }
+    const repeats = ctx.tokenRepeats;
+    const repeat = repeats.answerFor(ctx.frame, url, body, ctx.lifecycle.getState().authorizationId);
+    if (!repeat)
+        return undefined;
+    // A re-send the page never got an answer for gives its place in the count back.
+    return tokenRepeatWhilePending(ctx, repeat).then((decision) => {
+        if (decision?.kind !== 'answer')
+            repeats.released(repeat.authorizationId);
+        return decision;
+    }, (error) => { repeats.released(repeat.authorizationId); throw error; });
+};
+async function tokenRepeatWhilePending(ctx, repeat) {
+    if (!await ctx.lifecycle.merchantOrderPending())
+        return undefined;
+    // The resolver answered asynchronously: the same approval must still be the one awaiting the merchant.
+    if (!ctx.lifecycle.repeatAnswerable() || ctx.lifecycle.getState().authorizationId !== repeat.authorizationId
+        || ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    return answerRepeat(ctx, repeat, 'token');
+}
 async function tokenexIframeBlock(ctx, reason) {
     ctx.onEvent?.({ type: 'blocked', detail: reason });
     await ctx.effects.abort();
@@ -2623,7 +2667,7 @@ async function unsupportedContinue(ctx) {
  * pauses each one itself. */
 export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, cardlinkVposPreClaim, eghlPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim,
-    oceanpaymentPreClaim, aurusPreClaim];
+    oceanpaymentPreClaim, aurusPreClaim, tokenRepeatPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -3522,6 +3522,31 @@
       "hostname_pattern": "^payment\\.pay1\\.checkout\\.worldline-solutions\\.com$",
       "pathname_pattern": "^\\/checkout$"
     },
+    {
+      "id": "bigcommerce-hosted-card-field",
+      "psp": "bigcommerce",
+      "kinds": [
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://payments.bigcommerce.com",
+      "path_pattern": "/pay/hosted_forms/:form/field",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "drsturm-2026-11-06:bigcommerce-hosted-form-field-1.997.1",
+          "reviewed_on": "2026-11-06"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://checkout-sdk.bigcommerce.com/v1/loader-v1.997.1.js",
+          "reviewed_on": "2026-11-06"
+        }
+      ],
+      "hostname_pattern": "^payments\\.bigcommerce\\.com$",
+      "pathname_pattern": "^\\/pay\\/hosted_forms\\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\/field$"
+    },
     {
       "id": "gmo-mp-token-script-test",
       "psp": "gmo_pg",

package/dist/preflight-schemas.json

@@ -525,6 +525,7 @@
                 "amadeus-data-collection-page",
                 "worldline-mycheckout-page",
                 "worldline-mycheckout-card-form",
+                "bigcommerce-hosted-card-field",
                 "gmo-mp-token-script-test",
                 "gmo-token-v1-script-test",
                 "gmo-elements-card-frame-test",
@@ -1170,6 +1171,7 @@
                       "amadeus-data-collection-page",
                       "worldline-mycheckout-page",
                       "worldline-mycheckout-card-form",
+                      "bigcommerce-hosted-card-field",
                       "gmo-mp-token-script-test",
                       "gmo-token-v1-script-test",
                       "gmo-elements-card-frame-test",

package/dist/preflight.generated.js

@@ -1,5 +1,5 @@
 // Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 1ac6ffa819d0bb72040d0a95cac79f780aeae4f5dea22599fbc4c5ec6c6c8687
+// source-sha256: 84246b0b75dadb1798e0c9bd4ab7a8ab8567df86ea490fb20c9f0f890309e7df
 import { CHECKOUT_PREFLIGHT_CAPABILITIES } from './preflight-capabilities.generated.js';
 /** Advisory page discovery. These rules never admit a payment destination. */
 export const CHECKOUT_PREFLIGHT_VERSION = '1';
@@ -371,6 +371,15 @@ RULES.push({ id: 'worldline-mycheckout-page', psp: 'worldline_mycheckout', kinds
     pathname: /^\/checkout\/(?:payment-product-details\/)?[1-9][0-9]{0,9}-[0-9a-f]{32}:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout/{payment-product-details/}:hosted_checkout', sources: worldlineSources }, { id: 'worldline-mycheckout-card-form', psp: 'worldline_mycheckout', kinds: ['form'], hostname: /^payment\.pay1\.checkout\.worldline-solutions\.com$/, pathname: /^\/checkout$/,
     origin: 'https://payment.pay1.checkout.worldline-solutions.com', path_pattern: '/checkout', sources: worldlineSources });
+// BigCommerce's own card form, read 2026-11-06 at drsturm.com: the store's /checkout/payment/hosted-field iframes
+// redirect to one field document per card input on payments.bigcommerce.com, which loads checkout-sdk's hosted-form
+// module and sends the card to BigCommerce's payments API (processors/bigcommerce.js), whichever gateway charges it.
+// BigCommerce ships dark, so the field names bigcommerce and the result stays unknown, as GMO's does.
+RULES.push({ id: 'bigcommerce-hosted-card-field', psp: 'bigcommerce', kinds: ['document', 'frame', 'iframe'], hostname: /^payments\.bigcommerce\.com$/,
+    pathname: /^\/pay\/hosted_forms\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/field$/, origin: 'https://payments.bigcommerce.com',
+    path_pattern: '/pay/hosted_forms/:form/field',
+    sources: [{ kind: 'saved_observation', reference: 'drsturm-2026-11-06:bigcommerce-hosted-form-field-1.997.1', reviewed_on: '2026-11-06' },
+        { kind: 'primary_source', reference: 'https://checkout-sdk.bigcommerce.com/v1/loader-v1.997.1.js', reviewed_on: '2026-11-06' }] });
 // A processor that ships dark (its definition declares a capability) is left out of the bundled
 // catalog. Datatrans's and the TokenEx iframe's discovery rules wait with it: they join RULES only once KNOWN_PSPS, the
 // bundled catalog's processors, lists its psp. Until then its assets are not evidence, so a page