@agent-cards/sdk 0.24.1 → 0.25.0

package/dist/cdp.js

@@ -15,6 +15,7 @@ import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
 import { isToastPaymentMethodsUrl, readToastBody } from './toast.generated.js';
 import { PADDLE_VGS_PAY_PATTERNS, PaddleVgsPayGate, isPaddleCheckoutService, recognizesPaddleVgs } from './paddle-vgs-pay.js';
 import { DatatransRepeats } from './datatrans.js';
+import { TokenRepeats } from './token-repeats.js';
 import { TokenexIframeRepeats, isArmedTokenexIframeUrl } from './tokenex-iframe.js';
 import { isArmedPaytrailUrl } from './paytrail.js';
 import { SHIJI_STS_COMPANION_WINDOW_MS, ShijiStsCompanions, ShijiStsError, isShijiStsHost, shijiStsTokenContinuation, } from './shiji-sts.js';
@@ -43,6 +44,7 @@ import { CYBERSOURCE_SECURE_ACCEPTANCE_PATTERNS, CYBERSOURCE_SECURE_ACCEPTANCE_R
 import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
 import { cseBody } from './cse-body.js';
 import { STRIPE_SETUP_INTENT_CONFIRM, setupConfirmPayingWith } from './stripe-setup.js';
+import { confirmPayingWith } from './stripe-continuation.js';
 import { replayTemplatedUrl, reviewedMerchantProfileUrlPatterns } from './merchant-hosted.js';
 import { verifoneTemplatedUrl } from './verifone.js';
 import { MerchantHandoffWatch } from './merchant-handoff.js';
@@ -1112,30 +1114,41 @@ function claimStripeContinuation(opts, lifecycle, url, method, body) {
     }
     if (parsed.origin !== 'https://api.stripe.com')
         return null;
-    if (STRIPE_PAYMENT_INTENT_CONFIRM.test(parsed.pathname)) {
-        if (typeof opts.vault.checkStripeContinuation !== 'function' || opts.vault.withoutCard?.(url, body) !== 'refuse')
-            return null;
-        const authorizationId = lifecycle.claimStripeContinuation();
-        return authorizationId ? { authorizationId, kind: 'payment', body, rewritten: false } : null;
-    }
-    if (!STRIPE_SETUP_INTENT_CONFIRM.test(parsed.pathname) || typeof opts.vault.checkStripeSetupContinuation !== 'function')
+    const payment = STRIPE_PAYMENT_INTENT_CONFIRM.test(parsed.pathname);
+    const setup = !payment && STRIPE_SETUP_INTENT_CONFIRM.test(parsed.pathname);
+    if (!payment && !setup)
+        return null;
+    // Each kind needs the client method that judges it; an older client keeps the ordinary hold.
+    if (payment && typeof opts.vault.checkStripeContinuation !== 'function')
+        return null;
+    if (setup && typeof opts.vault.checkStripeSetupContinuation !== 'function')
         return null;
     const withoutCard = opts.vault.withoutCard?.(url, body);
     let send = null;
     if (withoutCard === 'refuse')
         send = body;
     else if (withoutCard === null) {
-        // The card again, inline: only the approved payment method may replace it,
-        // and only when what is left carries no card at all.
-        const paymentMethod = lifecycle.approvedStripePaymentMethod();
-        send = paymentMethod ? setupConfirmPayingWith(body, paymentMethod) : null;
+        // The card again, inline: only the object the cardholder's approval
+        // returned may replace it, and only when what is left carries no card at
+        // all. A payment pays with whichever object its approval produced (a
+        // confirmation token, for a store that creates one for a fraud check and
+        // then confirms with the Payment Element); a card save pays with a payment
+        // method alone, which is all a SetupIntent confirm takes.
+        if (payment) {
+            const way = lifecycle.approvedStripeWay();
+            send = way ? confirmPayingWith(body, way) : null;
+        }
+        else {
+            const paymentMethod = lifecycle.approvedStripePaymentMethod();
+            send = paymentMethod ? setupConfirmPayingWith(body, paymentMethod) : null;
+        }
         if (send !== null && opts.vault.withoutCard?.(url, send) !== 'refuse')
             send = null;
     }
     if (send === null)
         return null;
     const authorizationId = lifecycle.claimStripeContinuation();
-    return authorizationId ? { authorizationId, kind: 'setup', body: send, rewritten: send !== body } : null;
+    return authorizationId ? { authorizationId, kind: payment ? 'payment' : 'setup', body: send, rewritten: send !== body } : null;
 }
 /**
  * Ask the API about a claimed continuation, with the body it would continue
@@ -1158,7 +1171,7 @@ async function checkStripeContinuation(opts, lifecycle, claim, request) {
     if (proceed) {
         opts.onEvent?.(kind === 'setup'
             ? { type: 'stripe_setup_continued', detail: { authorizationId, setupIntentId: intentId, rewritten: claim.rewritten } }
-            : { type: 'stripe_payment_continued', detail: { authorizationId, paymentIntentId: intentId } });
+            : { type: 'stripe_payment_continued', detail: { authorizationId, paymentIntentId: intentId, rewritten: claim.rewritten } });
     }
     else if (intentId !== null)
         opts.onEvent?.({ type: 'blocked', detail: 'stripe_continuation_superseded' });
@@ -2084,6 +2097,8 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
     // The approved TokenEx iframe answers, per frameId (the card-number frame is an out-of-process iframe whose own
     // session pauses its post; its frameId names it): the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     // The Shiji STS getCvvId companion of the getTokenId this attachment last continued (shiji-sts.ts).
@@ -2905,6 +2920,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             juspay: juspayCheckout,
             datatrans: datatransRepeats,
             tokenexIframe: tokenexIframeRepeats,
+            tokenRepeats,
             ebanx: ebanxFollowUps,
             payrexx: payrexxFollowUps,
             nikeOrders,
@@ -3446,6 +3462,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
                 // The frame that received it: the paused request's, or its retry's once rebound.
                 datatransRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 tokenexIframeRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
+                tokenRepeats.remember(activeRequest?.frameId || undefined, deliverRequest.url, deliverBody, replay);
                 attempt.assertLive();
                 // An ACI card-number request answered: its checkout's held CVC and expiry requests get the
                 // same answer, and its /payment submission may continue (see AciGate).
@@ -3982,6 +3999,8 @@ export async function attachToPlaywright(page, opts) {
     const datatransRepeats = new DatatransRepeats();
     // The approved TokenEx iframe answers, per Frame: the repeat rule (tokenex-iframe.ts).
     const tokenexIframeRepeats = new TokenexIframeRepeats();
+    // The last approved plain token answer, for the page's identical re-send (token-repeats.ts).
+    const tokenRepeats = new TokenRepeats();
     // The card product each Worldline MyCheckout hosted checkout chose (worldline-mycheckout.ts).
     const worldlineProducts = new WorldlineMyCheckoutProducts();
     const frameOf = (request) => { try {
@@ -4180,6 +4199,7 @@ export async function attachToPlaywright(page, opts) {
                 juspay: juspayCheckout,
                 datatrans: datatransRepeats,
                 tokenexIframe: tokenexIframeRepeats,
+                tokenRepeats,
                 ebanx: ebanxFollowUps,
                 payrexx: payrexxFollowUps,
                 nikeOrders,
@@ -4586,6 +4606,7 @@ export async function attachToPlaywright(page, opts) {
                     await deliverTo.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
                     datatransRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     tokenexIframeRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
+                    tokenRepeats.remember(frameOf(deliverRequest), deliverRequest.url(), deliverBody, replay);
                     assertRequestLive();
                     // See the same step in attachToCdp.
                     aci.answered(deliverRequest.url(), { status: replay.status, headers: replay.headers, body: replay.body }, replay.authorizationId);

package/dist/client.d.ts

@@ -608,6 +608,15 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
  * on for.
  *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's

package/dist/client.js

@@ -602,6 +602,15 @@ export const SUPPORTED_REGISTRY_FEATURES = ['card_fields', 'checkout_sessions'];
  * judge. Served on the same terms: only to a build that lists it, for a company Agentcard turned Frisbii
  * on for.
  *
+ * `bigcommerce_card_form`: the payment BigCommerce's own card form (the card fields on
+ * payments.bigcommerce.com/pay/hosted_forms/<id>/field, or the store page's own inputs) sends as JSON to
+ * https://payments.bigcommerce.com/api/public/v1/orders/payments under the order's payment token, the card
+ * in payment.credit_card. This build pauses only a body that carries a new card there (payment-core
+ * processors/bigcommerce.js); a card saved at the store, another processor's token and a wallet continue
+ * untouched, and a card the store would keep fails in the browser before anything is created. The body
+ * names the store's total, which the cardholder approves. Served on the same terms: only to a build that
+ * lists it, for a company Agentcard turned BigCommerce on for.
+ *
  * `aps_custom_merchant_page`: Amazon Payment Services' custom merchant page, whose own card form
  * posts top-level to /FortAPI/paymentPage on checkout.payfort.com (sbcheckout.payfort.com on APS's
  * sandbox) with service_command=TOKENIZATION. This build pauses that navigation; the cardholder's

package/dist/datatrans.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 169752c8d6a6c9f131c83502766f0026b2ffa45cf9f27c450735eef5ad2fa931
+// artifact-sha256: c4280e1c95d016a93163f49d9d66178a9c4fdfae08e4570952c9c7f533a1c643
 // src/answer-card-leak.js
 var DECIMAL = /\p{Nd}/u;
 function digitValue(char) {
@@ -20,6 +20,8 @@ function enclosedValue(char) {
 var asciiDigits = (text2) => (typeof text2.normalize === "function" ? text2.normalize("NFKC") : text2).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var digitCount = (text2) => (asciiDigits(String(text2)).match(/\p{N}/gu) ?? []).length;
 var NAME_DIGITS = 3;
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/datatrans.js
 var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
 var DATATRANS_TOKENIZE_PATH = "/upp/payment/SecureFields/paymentField";

package/dist/index.d.ts

@@ -46,7 +46,7 @@ export type { ApiTransport } from './api-module.js';
 export { BuyModule, BuyError, isBuyDeclined, BUY_TURN_TIMEOUT_MS } from './buy.js';
 export type { BuyStatus, BuyCart, BuyCartLine, BuyDeliveryAddress, BuyPaymentSource, BuyOutcome, BuyPlacement, BuyCatalog, BuyUnmatched, BuyTurn, BuyDeclined, BuyOrder, BuyLastCheckout, BuyConversation, BuyAskInput, BuyConfirmInput, BuyConversationInput, BuyCheckoutHandoff, BuyOpenOffer, BuyBrowserCheckout, BuyApiAmount, } from './buy.js';
 export { ApprovalsModule, CANCEL_REASONS, SANDBOX_REQUEST } from './approvals.js';
-export type { CreateAuthorizationInput, Authorization, AuthorizationResult, AuthorizationFields, Cancelled, PayingCard, ChoosableCard } from './approvals.js';
+export type { CreateAuthorizationInput, OrderLineItem, OrderShipTo, Authorization, AuthorizationResult, AuthorizationFields, Cancelled, PayingCard, ChoosableCard } from './approvals.js';
 export { verifyWebhook, signWebhook, parseWebhookEvent, parseSignatureHeader, isCheckoutAuthorizationEvent, isVaultEvent, CHECKOUT_AUTHORIZATION_EVENT_TYPES, VAULT_EVENT_TYPES } from './webhooks.js';
 export type { WebhookEvent, AgentcardEvent, CheckoutAuthorizationEvent, CheckoutAuthorizationEventType, CheckoutAuthorizationEventData, VaultEvent, VaultEventType, VaultEventData, OtherEvent, VerifyWebhookOptions } from './webhooks.js';
 export { AgentcardError } from './api-types.js';

package/dist/lifecycle.d.ts

@@ -6,6 +6,7 @@ import type { ShijiStsUnsupportedReason } from './shiji-sts.js';
 import type { PaddleVgsPayRefusal } from './paddle-vgs-pay.js';
 import type { PaypalCardFormReason } from './paypal-card-forms.js';
 import { type CardRequestHold, type HoldReleaseInput, type HoldReleaseOutcome } from './hold.js';
+import { type StripeApprovedWay } from './stripe-continuation.js';
 /** The application's resolver confirmed the payment for this checkout authorization. */
 export interface MerchantPaymentConfirmation {
     kind: 'merchant_payment';
@@ -104,11 +105,12 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private wspayChallenge;
     private heldBeforeHandoff;
     private stripeContinuedReason;
-    private approvedPaymentMethod;
+    private approvedWay;
     private ownedShopOrderId;
     private orderRefusal;
     private readonly handoffs;
     private reconciliation;
+    private pendingHold;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -150,6 +152,15 @@ export declare class CheckoutLifecycle implements CheckoutController {
     isCancelled(): boolean;
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver(): boolean;
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable(): boolean;
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no
@@ -258,12 +269,19 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * VaultClient.withoutCard, which then refuses a Nuvei payment without a card.
      */
     cardHandoffs(): readonly string[];
+    /**
+     * The object a Stripe confirmation may pay with in place of the card it sends
+     * again (cdp.ts claimStripeContinuation): the one this attachment's approved
+     * tokenization returned, with the field that names it, while its continuation
+     * is still open. Null for a tokenization no confirmation names by id
+     * (`/v1/tokens`), and once the checkout was cancelled, aborted or reconciled.
+     */
+    approvedStripeWay(): StripeApprovedWay | null;
     /**
      * The payment method a Stripe card save may pay with in place of the card
-     * it sends again (cdp.ts claimStripeContinuation): the one this
-     * attachment's approved `/v1/payment_methods` request returned, while its
-     * continuation is still open. Null for any other tokenization, and once the
-     * checkout was cancelled, aborted or reconciled.
+     * it sends again: the `pm_` an approved `/v1/payment_methods` request
+     * returned. Null for every other approved object, since a SetupIntent
+     * confirm pays with a payment method alone.
      */
     approvedStripePaymentMethod(): string | null;
     /**

package/dist/lifecycle.js

@@ -3,6 +3,7 @@ import { CardEndpointRefusedError } from './card-endpoint.js';
 import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 import { isWspayChallenge } from './wspay.js';
 import { HoldAnsweredError, HoldEndedError } from './hold.js';
+import { stripeApprovedWay } from './stripe-continuation.js';
 /**
  * The statuses that end an attempt: its outcome is known (`completed`, `declined`, `failed`,
  * `timed_out`, `unsupported`, `cancelled`), or the SDK already reported it unknown with its own
@@ -25,19 +26,6 @@ export const MAX_STRIPE_CONTINUATION_CHECKS = 3;
  * the post becomes a new approval instead of hanging the checkout.
  */
 export const MERCHANT_ORDER_READ_MS = 5_000;
-const STRIPE_PAYMENT_METHOD_ID = /^pm_[A-Za-z0-9]{1,250}$/;
-/** The `pm_` id in a Stripe `/v1/payment_methods` answer, or null for any other body. */
-function stripePaymentMethodId(body) {
-    if (typeof body !== 'string')
-        return null;
-    try {
-        const id = JSON.parse(body)?.id;
-        return typeof id === 'string' && STRIPE_PAYMENT_METHOD_ID.test(id) ? id : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** Shared by the raw CDP and Playwright transports. No browser ownership or payment execution lives here. */
 export class CheckoutLifecycle {
     options;
@@ -62,14 +50,17 @@ export class CheckoutLifecycle {
     heldBeforeHandoff = false;
     // What the continuation that went through confirmed: a payment, or a card save.
     stripeContinuedReason = 'stripe_payment_continued';
-    // The payment method a Stripe /v1/payment_methods approval returned: see approvedStripePaymentMethod.
-    approvedPaymentMethod = null;
+    // The object a Stripe tokenization approval returned, and the field a confirmation
+    // names it by: see approvedStripeWay.
+    approvedWay = null;
     ownedShopOrderId = null;
     // The reason Nike's order was refused while this attempt was under way (merchantOrderRefused): its handoff keeps it failed.
     orderRefusal = null;
     // Every request this attachment handed the card to: see cardHandoffs().
     handoffs = [];
     reconciliation = null;
+    // The hold is only the merchant resolver's `pending` on a handoff nothing else held (resolve): see repeatAnswerable.
+    pendingHold = false;
     /**
      * EBANX sends this attachment claimed that are still out (pre-claim.ts ebanxFollowUp): the cardholder's device may be
      * sending a confirm that pays, outside `active`, so reconcile() and retryAfterMerchantFailure() wait for them too.
@@ -140,6 +131,18 @@ export class CheckoutLifecycle {
     isCancelled() { return this.cancelled; }
     /** Whether the application gave a merchant resolver, so reconcile() reads the merchant's own record. */
     hasMerchantResolver() { return typeof this.options.resolveMerchantResult === 'function'; }
+    /**
+     * Whether the page's byte-identical re-send of the card request this approval answered may get the same answer
+     * (token-repeats.ts, pre-claim.ts tokenRepeatPreClaim): the checkout awaits the merchant on a plain token handoff
+     * that held nothing, and the only hold since is the merchant resolver reading the order as pending. A hold from
+     * anything else stands: an amount the processor charged that differs from the approval's, an unbound Stripe token,
+     * a hosted form or card endpoint, an integrator's requireMerchantResult, a follow-up send still out, an unsupported
+     * request, a cancel or an aborted request. The gate still asks the resolver before it answers.
+     */
+    repeatAnswerable() {
+        return this.state.status === 'awaiting_merchant' && !!this.state.authorizationId && !this.active && !this.cancelled
+            && !this.merchantAborted && this.followUpsOut === 0 && (!this.held || this.pendingHold);
+    }
     /**
      * For a Datatrans re-submit once the approved answer reached the page (pre-claim.ts): whether the
      * application's merchant resolver still reports this approval's order pending. A read only: no
@@ -169,6 +172,10 @@ export class CheckoutLifecycle {
     }
     end() { this.active = false; }
     set(state) {
+        // Any state but awaiting the merchant (a challenge, a failure, a completion) ends the pending read's exception for
+        // good: a later pending read that brings awaiting_merchant back holds every card request again (repeatAnswerable).
+        if (state.status !== 'awaiting_merchant')
+            this.pendingHold = false;
         this.state = state;
         // Application telemetry must never interrupt a paused payment after it reaches the processor.
         try {
@@ -287,6 +294,7 @@ export class CheckoutLifecycle {
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;
+        this.pendingHold = false;
         if (this.state.authorizationId)
             return; // do not hide an outstanding/completed payment behind a later unsupported request
         this.set({ ...this.state, status: 'unsupported', reason });
@@ -348,8 +356,7 @@ export class CheckoutLifecycle {
                     this.unboundStripeToken = true;
                     this.stripeTokenPrepared = true;
                     this.held = true;
-                    if (url.pathname === '/v1/payment_methods')
-                        this.approvedPaymentMethod = stripePaymentMethodId(replay.body);
+                    this.approvedWay = stripeApprovedWay(url.pathname, replay.body);
                 }
             }
             catch { /* unknown URL cannot establish a token binding */ }
@@ -363,15 +370,25 @@ export class CheckoutLifecycle {
      * VaultClient.withoutCard, which then refuses a Nuvei payment without a card.
      */
     cardHandoffs() { return [...this.handoffs]; }
+    /**
+     * The object a Stripe confirmation may pay with in place of the card it sends
+     * again (cdp.ts claimStripeContinuation): the one this attachment's approved
+     * tokenization returned, with the field that names it, while its continuation
+     * is still open. Null for a tokenization no confirmation names by id
+     * (`/v1/tokens`), and once the checkout was cancelled, aborted or reconciled.
+     */
+    approvedStripeWay() {
+        return this.stripeContinuationOpen() ? this.approvedWay : null;
+    }
     /**
      * The payment method a Stripe card save may pay with in place of the card
-     * it sends again (cdp.ts claimStripeContinuation): the one this
-     * attachment's approved `/v1/payment_methods` request returned, while its
-     * continuation is still open. Null for any other tokenization, and once the
-     * checkout was cancelled, aborted or reconciled.
+     * it sends again: the `pm_` an approved `/v1/payment_methods` request
+     * returned. Null for every other approved object, since a SetupIntent
+     * confirm pays with a payment method alone.
      */
     approvedStripePaymentMethod() {
-        return this.stripeContinuationOpen() ? this.approvedPaymentMethod : null;
+        const way = this.approvedStripeWay();
+        return way?.field === 'payment_method' ? way.id : null;
     }
     /**
      * The approval a page's card-free Stripe confirmation may continue, or null.
@@ -416,6 +433,7 @@ export class CheckoutLifecycle {
         if (this.merchantAborted)
             return;
         this.settled = true;
+        this.pendingHold = false;
         if (this.orderRefusal) {
             // Nike's order was refused while this approval was on its way: the answer lands, and the checkout stays failed.
             this.held = true;
@@ -591,6 +609,10 @@ export class CheckoutLifecycle {
             await this.requestUserAction(result.reason);
         }
         else {
+            // A pending order on a handoff nothing held still lets the page's identical re-send of the same card request have
+            // its answer again (repeatAnswerable); every other card request stays refused.
+            if (!this.held && result.status === 'pending' && this.state.status === 'awaiting_merchant')
+                this.pendingHold = true;
             this.held = true;
             this.set({ ...this.state, status: result.status === 'pending' ? 'awaiting_merchant' : 'outcome_unknown', reason: 'merchant_not_confirmed' });
         }
@@ -612,6 +634,7 @@ export class CheckoutLifecycle {
         if (this.unboundStripeToken)
             throw new Error('This attachment delivered an unbound Stripe token; reconcile the merchant order and use a separately validated checkout flow.');
         this.held = false;
+        this.pendingHold = false;
         this.merchantAborted = false;
         this.orderRefusal = null;
         this.set({ status: 'idle', authorizationId: null });

package/dist/merchant-card-endpoints.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 4acbca9604c5eee50f5f73dc3dea5ab0d40c9cba1214ccda0d2074271b3554a5
+// artifact-sha256: e2228c7919341a7b3615b285c3aa77948c247c13145a1e394a1bb1c64acbca06
 // src/json-path.js
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function isPlainObject(v) {
@@ -318,17 +318,39 @@ function enclosedValue(char) {
 }
 var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var unescaped = (text) => text.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
+var UTF8_ONE = /* @__PURE__ */ new RegExp(UTF8_SEQUENCE, "g");
+function utf8Of(bytes) {
+    if (!/[\x80-\xff]/.test(bytes) || !UTF8_WHOLE.test(bytes))
+        return null;
+    return bytes.replace(UTF8_ONE, (sequence) => {
+        if (sequence.length === 1)
+            return sequence;
+        const lead = sequence.charCodeAt(0);
+        let point = lead & (sequence.length === 2 ? 31 : sequence.length === 3 ? 15 : 7);
+        for (let i = 1; i < sequence.length; i += 1)
+            point = point << 6 | sequence.charCodeAt(i) & 63;
+        return String.fromCodePoint(point);
+    });
+}
+var utf8Runs = (text) => text.replace(/[\x80-\xff]+/g, (run) => utf8Of(run) ?? run);
 var decodedInPlace = (text) => text.replace(BASE64_PIECE, (piece) => {
     const bare = piece.replace(/=+$/, "");
     for (let skip = 0; skip < 4 && skip < bare.length - 1; skip += 1) {
         const bytes = base64Text(bare.slice(skip));
         if (/^[\x20-\x7e]+$/.test(bytes))
             return bare.slice(0, skip) + bytes;
+        const utf82 = utf8Of(bytes);
+        if (utf82 !== null && !/\p{C}/u.test(utf82))
+            return bare.slice(0, skip) + utf82;
     }
     return piece;
 });
 function collect(text, layers, streams, runs) {
     const base = /* @__PURE__ */ new Set([...readings(text), ...readings(unescaped(text))]);
+    for (const reading of [...base])
+        base.add(utf8Runs(reading));
     for (const reading of /* @__PURE__ */ new Set([...base, ...[...base].map(decodedInPlace)])) {
         const digits = asciiDigits(reading);
         const sequence = digits.match(/[0-9]+/g) ?? [];
@@ -341,8 +363,13 @@ function collect(text, layers, streams, runs) {
         if (layers === 0)
             continue;
         for (const run of new Set(reading.match(BASE64_RUN))) {
-            for (let skip = 0; skip < 4; skip += 1)
-                collect(base64Text(run.slice(skip)), layers - 1, streams, runs);
+            for (let skip = 0; skip < 4; skip += 1) {
+                const bytes = base64Text(run.slice(skip));
+                collect(bytes, layers - 1, streams, runs);
+                const utf82 = utf8Of(bytes);
+                if (utf82 !== null)
+                    collect(utf82, layers - 1, streams, runs);
+            }
         }
     }
 }

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d6d50b6577a932c3586fcade6b8cbd03c562bd3394e8addcb954d797ea9999b4
+// artifact-sha256: d5e732dd0bce3debee02e3f31107e65059e0d3888b54a605357a5817bb8909ce
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -29,6 +29,8 @@ function enclosedValue(char) {
 var asciiDigits = (text) => (typeof text.normalize === "function" ? text.normalize("NFKC") : text).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
 var digitCount = (text) => (asciiDigits(String(text)).match(/\p{N}/gu) ?? []).length;
 var NAME_DIGITS = 3;
+var UTF8_SEQUENCE = "[\\x00-\\x7f]|[\\xc2-\\xdf][\\x80-\\xbf]|\\xe0[\\xa0-\\xbf][\\x80-\\xbf]|[\\xe1-\\xec\\xee\\xef][\\x80-\\xbf]{2}|\\xed[\\x80-\\x9f][\\x80-\\xbf]|\\xf0[\\x90-\\xbf][\\x80-\\xbf]{2}|[\\xf1-\\xf3][\\x80-\\xbf]{3}|\\xf4[\\x80-\\x8f][\\x80-\\xbf]{2}";
+var UTF8_WHOLE = /* @__PURE__ */ new RegExp(`^(?:${UTF8_SEQUENCE})*$`);
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,

package/dist/pre-claim.d.ts

@@ -15,6 +15,7 @@ import { type CardEndpointProfile } from './card-endpoint.js';
 import { type NikeOrders } from './nike-order.js';
 import { type PayrailsSessionCapture, type PayrailsSidecar } from './payrails.js';
 import { type VerifoneProfile } from './verifone.js';
+import type { TokenRepeats } from './token-repeats.js';
 import { type WorldlineMyCheckoutProducts } from './worldline-mycheckout.js';
 import { type PaddleVgsPayGate } from './paddle-vgs-pay.js';
 import { type EbanxFollowUps } from './ebanx.js';
@@ -210,6 +211,8 @@ export interface PreClaimContext {
     datatrans?: DatatransRepeats;
     /** The attachment's approved TokenEx iframe answers (the repeat rule, tokenex-iframe.ts). Absent: none are kept. */
     tokenexIframe?: TokenexIframeRepeats;
+    /** The attachment's last approved plain token answer, for the page's identical re-send (token-repeats.ts). Absent: none is kept. */
+    tokenRepeats?: TokenRepeats;
     /** The adapter's identity for the request's frame (CDP frameId, Playwright Frame); undefined when unknown. */
     frame?: unknown;
     /**

package/dist/pre-claim.js

@@ -1002,6 +1002,50 @@ const tokenexIframePreClaim = (ctx) => {
     return ctx.lifecycle.getState().status === 'awaiting_merchant'
         ? repeatAfterHandoff(ctx, repeat, TOKENEX_IFRAME_PSP) : answerRepeat(ctx, repeat, TOKENEX_IFRAME_PSP);
 };
+// Any processor's plain token request, sent again by the page byte for byte after its approved answer reached it
+// (token-repeats.ts). Last among the gates, so a processor with its own repeat rule (Datatrans, the TokenEx iframe) or
+// its own hold (Stripe, a card endpoint) decides first. While the lifecycle reads the re-send as answerable
+// (repeatAnswerable: the same approval awaits the merchant, and nothing but a pending read holds it), the gate asks the
+// merchant resolver and answers with the stored token only while the order still reads pending, as repeatAfterHandoff
+// does. Every other card request, another amount or approval among them, defers to the terminal arbiter and the
+// adapters' hold, as before.
+const tokenRepeatPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (!ctx.tokenRepeats || method.toUpperCase() !== 'POST' || !ctx.lifecycle.repeatAnswerable?.() || !ctx.lifecycle.hasMerchantResolver?.())
+        return undefined;
+    // A processor with its own repeat rule keeps its own limits: a re-send its rule declined is a new question.
+    if (isDatatransHost(url) || isTokenexIframePath(url))
+        return undefined;
+    if (ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    // Read only here, past every cheaper check: a body the adapter cannot read is no re-send of an answered one.
+    let body;
+    try {
+        body = ctx.request.body;
+    }
+    catch {
+        return undefined;
+    }
+    const repeats = ctx.tokenRepeats;
+    const repeat = repeats.answerFor(ctx.frame, url, body, ctx.lifecycle.getState().authorizationId);
+    if (!repeat)
+        return undefined;
+    // A re-send the page never got an answer for gives its place in the count back.
+    return tokenRepeatWhilePending(ctx, repeat).then((decision) => {
+        if (decision?.kind !== 'answer')
+            repeats.released(repeat.authorizationId);
+        return decision;
+    }, (error) => { repeats.released(repeat.authorizationId); throw error; });
+};
+async function tokenRepeatWhilePending(ctx, repeat) {
+    if (!await ctx.lifecycle.merchantOrderPending())
+        return undefined;
+    // The resolver answered asynchronously: the same approval must still be the one awaiting the merchant.
+    if (!ctx.lifecycle.repeatAnswerable() || ctx.lifecycle.getState().authorizationId !== repeat.authorizationId
+        || ctx.terminal() || ctx.interceptionAborted() || ctx.lifecycleAborted())
+        return undefined;
+    return answerRepeat(ctx, repeat, 'token');
+}
 async function tokenexIframeBlock(ctx, reason) {
     ctx.onEvent?.({ type: 'blocked', detail: reason });
     await ctx.effects.abort();
@@ -2623,7 +2667,7 @@ async function unsupportedContinue(ctx) {
  * pauses each one itself. */
 export const PSP_PRE_CLAIM_GATES = [cardEndpointResendPreClaim, cardEndpointPreClaim, nikeOrderPreClaim, mercadoPreClaim, juspayPreClaim, braintreePreClaim, stripePreClaim, merchantHostedPreClaim, verifonePreClaim, fiservPreClaim, gmoPreClaim, cybersourceFlexPreClaim, datatransPreClaim, tokenexIframePreClaim, pelecardPreClaim, aciPreClaim, creditguardPreClaim, primerPreClaim, payrailsPreClaim, convergePreClaim, eprotectPreClaim, sbpsPreClaim, wspayPreClaim, shijiStsPreClaim, ekashuPreClaim, redsysPreClaim, quickpayPreClaim, comgatePreClaim, przelewy24PreClaim, transbankPreClaim, eximbayPreClaim, barionPreClaim, payplugPreClaim, cardlinkVposPreClaim, eghlPreClaim, paypalHostedFieldsPreClaim,
     paypalCardFormsPreClaim, cybersourceSecureAcceptancePreClaim, worldlineMyCheckoutPreClaim, paddleVgsPayPreClaim, ebanxPreClaim, payrexxPreClaim, hipayPreClaim, paytrailPreClaim,
-    oceanpaymentPreClaim, aurusPreClaim];
+    oceanpaymentPreClaim, aurusPreClaim, tokenRepeatPreClaim];
 /** Run each gate in order; the first to return a decision wins. If none does,
  * the terminal arbiter decides between continue, abort (unsupported) and pause.
  * Returns synchronously while every gate defers synchronously (an ordinary card

package/dist/preflight-catalog.json

@@ -3522,6 +3522,31 @@
       "hostname_pattern": "^payment\\.pay1\\.checkout\\.worldline-solutions\\.com$",
       "pathname_pattern": "^\\/checkout$"
     },
+    {
+      "id": "bigcommerce-hosted-card-field",
+      "psp": "bigcommerce",
+      "kinds": [
+        "document",
+        "frame",
+        "iframe"
+      ],
+      "origin": "https://payments.bigcommerce.com",
+      "path_pattern": "/pay/hosted_forms/:form/field",
+      "sources": [
+        {
+          "kind": "saved_observation",
+          "reference": "drsturm-2026-11-06:bigcommerce-hosted-form-field-1.997.1",
+          "reviewed_on": "2026-11-06"
+        },
+        {
+          "kind": "primary_source",
+          "reference": "https://checkout-sdk.bigcommerce.com/v1/loader-v1.997.1.js",
+          "reviewed_on": "2026-11-06"
+        }
+      ],
+      "hostname_pattern": "^payments\\.bigcommerce\\.com$",
+      "pathname_pattern": "^\\/pay\\/hosted_forms\\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\/field$"
+    },
     {
       "id": "gmo-mp-token-script-test",
       "psp": "gmo_pg",

package/dist/preflight-schemas.json

@@ -525,6 +525,7 @@
                 "amadeus-data-collection-page",
                 "worldline-mycheckout-page",
                 "worldline-mycheckout-card-form",
+                "bigcommerce-hosted-card-field",
                 "gmo-mp-token-script-test",
                 "gmo-token-v1-script-test",
                 "gmo-elements-card-frame-test",
@@ -1170,6 +1171,7 @@
                       "amadeus-data-collection-page",
                       "worldline-mycheckout-page",
                       "worldline-mycheckout-card-form",
+                      "bigcommerce-hosted-card-field",
                       "gmo-mp-token-script-test",
                       "gmo-token-v1-script-test",
                       "gmo-elements-card-frame-test",