@agent-cards/checkout 0.19.0 → 0.21.0

package/dist/stripe-checkout.generated.js

@@ -1,1093 +0,0 @@
-// @ts-nocheck
-// Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 9edf78da59b3bdfe310b4422e06d333cd164497cdb4070db59ffed348492198a
-// src/deep-freeze.js
-function deepFreeze(value) {
-    if (value && typeof value === "object" && !Object.isFrozen(value)) {
-        for (const child of Object.values(value))
-            deepFreeze(child);
-        Object.freeze(value);
-    }
-    return value;
-}
-// src/definitions.js
-var PROCESSOR_DEFINITIONS = deepFreeze([
-    {
-        psp: "spreedly",
-        // Native iframe new-card tokenization only; spreedly.js pins the query and body.
-        match: "core\\.spreedly\\.com/v1/payment_methods/restricted\\.json",
-        hosts: ["^core\\.spreedly\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^spreedly-environment-key$"]
-    },
-    {
-        psp: "shopify",
-        match: "(checkout\\.pci\\.shopifyinc\\.com|deposit\\.[a-z0-9-]+\\.shopifycs\\.com)/sessions",
-        hosts: ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^shopify-identification-signature$"]
-    },
-    {
-        psp: "stripe",
-        // Every endpoint Stripe.js sends a card to, read from its own controller
-        // bundle: `tokens` (createToken), `payment_methods` (createPaymentMethod),
-        // `sources` (createSource, the older API), `confirmation_tokens`
-        // (createConfirmationToken: the page collects the card and confirms on its
-        // own server), and the intent confirmations that carry the card inline as
-        // `payment_method_data[card][number]` (confirmPayment, confirmSetup). The
-        // modern Payment Element mostly confirms inline or through a confirmation
-        // token, so matching the tokenizers alone never paused it. Observed live on
-        // Anthropic's own billing page (platform.claude.com/settings/billing),
-        // which posts to /v1/setup_intents/{seti_...}/confirm, the "save a card"
-        // flow; /v1/payment_intents/{pi_...}/confirm is the same shape for "pay
-        // now". Stripe Checkout Sessions confirm at
-        // /v1/payment_pages/{cs_...}/confirm: Checkout Elements (initCheckout)
-        // sends the card there inline, while hosted and embedded Checkout send only
-        // the payment method they created first. The id segment is matched
-        // narrowly (seti_/pi_/cs_ + word chars) rather than `.*` so the pattern
-        // cannot be widened by a crafted path. A client that does not check
-        // cardFields is served the pattern it knew before sources, confirmation
-        // tokens and Checkout Sessions joined (recognition.js recognizersForClient).
-        match: "api\\.stripe\\.com/v1/(payment_methods|tokens|sources|confirmation_tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm|payment_pages/cs_(?:test|live)_\\w+/confirm)",
-        hosts: ["^api\\.stripe\\.com$"],
-        encoding: "form",
-        // Elements' own surface markers; without these Stripe rejects the surface.
-        passthroughHeaders: ["^authorization$", "^stripe-version$", "^x-stripe-client-user-agent$"],
-        // The same confirmations also run WITHOUT a card: a page that created the
-        // method first confirms with `payment_method=pm_...`. Only a body that
-        // carries one of these fields is a card request (card-fields.js). Any
-        // other request on these endpoints has no card to approve, so it is
-        // refused (requestWithoutCard) instead of paused for the cardholder,
-        // unless passWithoutCard below names its endpoint.
-        cardFields: ["card[number]", "payment_method_data[card][number]"],
-        // A confirmation token that wraps a saved method, a source for a bank, or a
-        // Checkout Session confirm paying with the method hosted or embedded
-        // Checkout created first carries no card and was never ours: it continues
-        // untouched, as it did before these endpoints were recognized.
-        passWithoutCard: "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)"
-    },
-    {
-        psp: "braintree",
-        match: "payments(\\.sandbox)?\\.braintree-api\\.com/graphql",
-        hosts: ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"],
-        sandboxHosts: ["^payments\\.sandbox\\.braintree-api\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^authorization$", "^braintree-version$"]
-    },
-    {
-        psp: "checkout_com",
-        // Flow 1.226.0's card controller selects api or card-acquisition-gateway
-        // for the same card-token body and Bearer public-key Authorization.
-        // Native source: checkout-web-components.checkout.com/pages/1.226.0/index.html.
-        // Endpoint recognition does not establish consumer-wallet, CVV-only,
-        // reusable-token, 3DS or merchant payment completion compatibility.
-        match: "(api|card-acquisition-gateway)(\\.sandbox)?\\.checkout\\.com/tokens",
-        hosts: [
-            "^api\\.checkout\\.com$",
-            "^api\\.sandbox\\.checkout\\.com$",
-            "^card-acquisition-gateway\\.checkout\\.com$",
-            "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"
-        ],
-        sandboxHosts: ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^authorization$"]
-    },
-    // NOT here, on purpose: VGS Collect (Very Good Security; Wolt's add-a-card
-    // call through `<tenant>.<live|sandbox>.verygoodproxy.com`). Served for a
-    // few hours on 2026-09-03 and withdrawn the same night: the proxy aliases
-    // only submissions that originate in VGS's own iframe (its Collect session
-    // handshake), so a byte-identical replay from the cardholder's device, 4 s
-    // after capture, with the iframe's own headers and origin, is forwarded
-    // un-aliased and the merchant answers 400 "Failed to process card". A
-    // recognizer that pauses a call the vault cannot finish only blocks the
-    // agent's browser from adding a card at all, so the entry is gone from
-    // every registry; the page keeps its on-file wording machinery for the
-    // merchant that does allow it.
-    {
-        psp: "adyen",
-        encryptedCardFields: { number: "encryptedCardNumber", month: "encryptedExpiryMonth", year: "encryptedExpiryYear", cvc: "encryptedSecurityCode" },
-        // The Sessions-flow payments call only (adyen-web's makePayment): the
-        // card rides in paymentMethod as four JWE blobs the vault page produces
-        // under the merchant's Adyen public key (services/checkout-cse-adyen.ts),
-        // and the runtime substitutes them into the paused body. binLookup,
-        // analytics and paymentDetails share these hosts, carry no card, and must
-        // never raise an approval; the hosts test pins them refused. The host
-        // alternation covers the regional live hosts (live-us, live-au, live-apse,
-        // live-in, live-nea): `checkoutshopper-[a-z]+` never matched those, so
-        // merchants on them were silently never paused.
-        match: "(checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com|([a-z0-9-]+\\.)*adyenpayments\\.com)/checkoutshopper/v1/sessions/[A-Za-z0-9_-]+/payments",
-        hosts: ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"],
-        // The sandbox marker matches ONLY the TEST hostname, a subset of the first
-        // host source (which matches checkoutshopper-test and every checkoutshopper-live
-        // regional host). checkoutshopper-live* and *.adyenpayments.com are live.
-        // Load-bearing for Adyen although Adyen does not pin its environment: the
-        // Adyen TEST platform rule (backend.js adyenLivePlatform) reads this marker
-        // on the server's authorization create and cardholder legs
-        // (services/checkout-cse-adyen.ts in the backend), on the device and in the
-        // enclave. Dropping or widening it moves which payments count as Adyen TEST.
-        sandboxHosts: ["^checkoutshopper-test\\.adyen\\.com$"],
-        encoding: "json",
-        passthroughHeaders: [],
-        clientSideEncrypted: true,
-        // kept: older SDKs read this and refuse locally
-        mode: "cse",
-        cse: {
-            at: "paymentMethod",
-            fields: ["encryptedCardNumber", "encryptedExpiryMonth", "encryptedExpiryYear", "encryptedSecurityCode"],
-            // adyen-web stamps `paymentMethod.brand` from the digits typed into its
-            // Card component, i.e. the agent's dummy. Proven on Adyen TEST
-            // (2026-09-02): a Mastercard dummy swapped for the vault's Visa
-            // ciphertext was refused 422/109 "Invalid variant"; without `brand`
-            // Adyen reads it off the decrypted PAN and authorises.
-            remove: ["brand"]
-        }
-    },
-    {
-        psp: "tranzila",
-        // Tranzila's hosted form (direct.tranzila.com/<terminal>/iframenew.php,
-        // embedded by the merchant page) submits the card as a top-level form
-        // POST to /process/n/ (directng: /process), application/x-www-form-
-        // urlencoded, with the card in ccno/expmonth/expyear/mycvv and the
-        // Israeli ID number in myid. The paused request is a Document navigation,
-        // not an XHR: the runtime cannot resume it with the real card, so the
-        // cardholder's device rebuilds and submits the SAME form itself, top-level
-        // from the vault origin (mode hosted_form), and the runtime resolves the
-        // paused navigation with a synthetic page once the device says the form
-        // left. The iframe page itself and Tranzila's /done/ result page share
-        // these hosts, carry no card, and are refused by `match`. Served only to
-        // SDKs that ask for hosted_form on sync: an older SDK would arm these
-        // hosts, pause the navigation, get a 400 and abort the frame.
-        match: "(direct\\.tranzila\\.com/process/n/|directng\\.tranzila\\.com/process/?)",
-        hosts: ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"],
-        encoding: "form",
-        passthroughHeaders: [],
-        mode: "hosted_form",
-        hostedForm: {
-            required: ["sum", "supplier"],
-            card: { number: "ccno", month: "expmonth", year: "expyear", cvc: "mycvv", nationalId: "myid" },
-            amount: { sum: "sum", currency: "currency" },
-            // supplier (the terminal) + benid (the iframe session) + the amount:
-            // one submission, whatever nonce the form regenerated on a re-click.
-            dedupe: ["supplier", "benid", "sum", "currency"],
-            // One plain sale, reporting to the merchant the person sees: tranmode
-            // A (or absent) only (V verifies, K charges a token, C refunds, D
-            // forces), no TranzilaTK in either direction (`1` asks for a reusable
-            // token back, a token charges one), and every *_url_address on the
-            // merchant's host (Tranzila redirects the device there and POSTs the
-            // result there with the card's last four, expiry and ID number).
-            sale: { key: "tranmode", values: ["A"] },
-            token: "TranzilaTK",
-            callbackUrls: ["success_url_address", "fail_url_address", "notify_url_address"]
-        }
-    },
-    // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
-    // Each entry below was checked against the PSP's own shipped browser SDK or a
-    // live probe, then run through resolveRecognizerForUrl with positive, sibling
-    // and spoof URLs. Two rules the vectors keep proving, worth restating before
-    // anyone edits one of these:
-    //   1. Every dot in `hosts` is escaped. `^api.mercadopago.com$` admits the
-    //      REGISTRABLE domain apiamercadopago.com; the escape is the allowlist.
-    //   2. `hosts` is pinned to literal labels, never widened to a wildcard label
-    //      (`[a-z0-9-]+\.psp\.com`). Several of these vendors run wildcard DNS,
-    //      so "the hostname resolves" is not evidence that it receives cards.
-    {
-        psp: "square",
-        // PAN@ card_data.number. POST /v2/card-nonce (URL always carries ?_=&version=).
-        match: "pci-connect\\.squareup(?:sandbox)?\\.com/v2/card-nonce",
-        hosts: ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"],
-        sandboxHosts: ["^pci-connect\\.squareupsandbox\\.com$"],
-        encoding: "json",
-        passthroughHeaders: []
-        // auth = client_id in body; no auth header
-    },
-    {
-        psp: "authorize_net",
-        // Accept.js. PAN@ securePaymentContainerRequest.data.token.cardNumber.
-        // Auth is body-level (merchantAuthentication: apiLoginID + clientKey) — nothing to replay.
-        // NOTE: prod is api2, not api. `api.authorize.net` is the server-side AIM/API host and is
-        // deliberately NOT allowlisted — a browser never posts a PAN there. Legacy SIM/DPM
-        // (secure2.authorize.net/gateway/transact.dll) is excluded for the same reason plus: it is
-        // retired, and it is a top-level form POST rather than an XHR.
-        // Coverage caveat: AcceptUI (the hosted lightbox) renders its fields inside an
-        // accept.authorize.net iframe, so that POST is cross-origin to the merchant page and an
-        // in-page hook cannot observe it. This entry covers the Accept.js custom-fields path, which
-        // does run in the merchant page. /xml/v1/request.api is Authorize.Net's single monolithic
-        // endpoint (request type is chosen by the body root key), so the path pin admits sibling
-        // request types on the same URL — the body, not the URL, is what distinguishes them.
-        match: "(api2|apitest)\\.authorize\\.net/xml/v1/request\\.api",
-        hosts: ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"],
-        sandboxHosts: ["^apitest\\.authorize\\.net$"],
-        encoding: "json",
-        // JSON body; Content-Type is sometimes text/plain (preflight dodge), replayed as-is
-        passthroughHeaders: []
-    },
-    {
-        psp: "worldpay",
-        // Access Worldpay. PAN@ root key `cardNumber`. Accept is load-bearing:
-        // the two paths need DIFFERENT vendor media types; `application/json` → HTTP 406.
-        match: "(try\\.)?access\\.worldpay\\.com/(sessions/card|verifiedTokens/sessions)",
-        hosts: ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"],
-        sandboxHosts: ["^try\\.access\\.worldpay\\.com$"],
-        // try.* is Worldpay's try/test host
-        encoding: "json",
-        passthroughHeaders: ["^accept$"]
-    },
-    {
-        psp: "nuvei",
-        // Safecharge Fields. PAN@ paymentOption.card.cardNumber.
-        // THREE PAN-bearing endpoints, not one. Nuvei picks between them from
-        // `sourceApplication`, and the covered one was the WRONG half of that
-        // branch: WEB_SDK (merchant holds the raw PAN in their own page) posts
-        // cardTokenization.do, while WEB_SDK_FIELDS (hosted fields, the
-        // PCI-conscious integration) posts websdk/initPaymentWithCardTokenization.do
-        // and clientPayment.do. Confirmed against sfc_inner_card.min.js, whose
-        // initPayment() opens initPaymentWithCardTokenization.do unconditionally
-        // with no branch back to the covered path.
-        match: "(secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:cardTokenization|clientPayment|websdk/initPaymentWithCardTokenization)\\.do",
-        hosts: ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"],
-        sandboxHosts: ["^ppp-test\\.safecharge\\.com$"],
-        encoding: "json",
-        passthroughHeaders: []
-    },
-    // bluesnap: DELIBERATELY NOT SHIPPED — it cannot be intercepted at all. Its tokenizer is a PUT, and isCardRequest
-    // gates on POST — but accepting PUT is not enough on its own. hpf.js fires the
-    // same token PUT SEVERAL TIMES per checkout (blur and submit each send a delta
-    // body), so intercepting it would raise one approval prompt per fire and hand the
-    // device partial card data. An entry that cannot actually be intercepted does not
-    // belong in an allowlist that advertises interception: it reads as support we do
-    // not have, and on the CDP path it arms Fetch.enable, gets refused by the POST
-    // gate, and is then continued straight to the PSP while the integrator believes
-    // the card was protected. Ship it when the multi-fire semantics are handled.
-    {
-        psp: "airwallex",
-        // PAN@ payment_method.card.number (payment_intents/confirm,
-        // payment_consents/verify) / card.number (payment_methods/create).
-        // ⚠ reference/bin/lookup is EXCLUDED. It egresses the PAN in an `x-pan` request
-        // HEADER, and it is a POST — so matching it would not merely "pause" it, it would
-        // intercept it and raise a real approval prompt for a bin lookup whose body holds
-        // no card. Handling header-borne PANs needs its own design; until then this
-        // header-aware handling, not the body cardFieldPath path. `x-pan` is deliberately NOT a
-        // passthrough header, so today the replay carries no PAN at all (inert, never a leak).
-        // `card/tokenize` was dropped from the candidate: an OPTIONS preflight on BOTH pci-api
-        // hosts returns the same 404 as a bogus control path, while real POST-only routes
-        // (payment_methods/create, payment_consents/create) answer 200 + Allow-Methods: POST.
-        // The trailing (\?|$) is a no-op server-side (pathname has no query) — it is the
-        // right-edge boundary for the SDK's UNANCHORED client-side test of the full URL.
-        match: "(checkout(\\.sandbox)?\\.airwallex\\.com|pci-api(\\.sandbox)?\\.airwallex\\.com)/api/v1/pa/(payment_intents/[^/?#]+/confirm|payment_consents/[^/?#]+/verify|payment_methods/create)(\\?|$)",
-        hosts: [
-            "^checkout\\.airwallex\\.com$",
-            "^checkout\\.sandbox\\.airwallex\\.com$",
-            "^pci-api\\.airwallex\\.com$",
-            "^pci-api\\.sandbox\\.airwallex\\.com$"
-        ],
-        sandboxHosts: ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^client-secret$", "^authorization$", "^x-auth-token$", "^x-on-behalf-of$", "^x-api-version$"]
-    },
-    {
-        psp: "rapyd",
-        // PAN@ required_fields.number (hosted collect page) OR payment_method.fields.number
-        // (checkout page — it renders on checkout.rapyd.net/?token=checkout_… and posts cross-origin to
-        // api.rapyd.net). The checkout-id segment is pinned to the documented `checkout_` prefix: a bare
-        // [^/?#]+ also admitted /v1/checkout/collect and the encoded-slash smuggle
-        // /v1/checkout/checkout_x%2Fadmin. ⚠ /v1/checkout/{id} is ALSO the documented GET Retrieve
-        // Checkout Page (signature-authed, server-to-server, no card) — the POST gate is what splits them.
-        match: "(api|sandboxapi)\\.rapyd\\.net/v1/(?:hosted/collect/card/[^/?#]+/payment_method|checkout/checkout_[A-Za-z0-9]+)(?:[?#]|$)",
-        hosts: ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"],
-        sandboxHosts: ["^sandboxapi\\.rapyd\\.net$"],
-        encoding: "json",
-        passthroughHeaders: []
-        // auth rides the opaque hosted-page / checkout token in the URL
-    },
-    {
-        psp: "dlocal",
-        // Smart Fields cvault. PAN@ pan. Do NOT match /cvault/cvv/store (CVV only).
-        // Hosts are two literal labels (no wildcard/`[a-z]+` label), so there is no
-        // multi-tenant surface: `ppmcc` is dlocal-operated, not merchant-registrable.
-        match: "ppmcc(-sandbox)?\\.dlocal\\.com/cvault/credit-card/temporal",
-        hosts: ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"],
-        sandboxHosts: ["^ppmcc-sandbox\\.dlocal\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^x-fields-api-key$", "^x-uow$", "^x-dlocal-infrav2$"]
-    },
-    {
-        psp: "ebanx",
-        compose: { card_due_date: "MM/YYYY" },
-        // PAN@ card.card_number. POST /ws/token. Body content-type is text/plain
-        // (CORS-preflight dodge) — replay it verbatim; encoding:json describes the body shape.
-        // The two domains SHARE one `/ws/token` tail on purpose: a bare top-level `|` (the shape
-        // this entry arrived in) degrades to `(^A)|(B$)` under any caller that anchors without
-        // re-grouping, admitting both `api.ebanx.com/ws/tokenizer_admin` and
-        // `evil.com/api-diamond.ebanxpay.com/ws/token`. Keep the alternation wrapped.
-        //
-        // `api.ebanxpay.com` / `sandbox.ebanxpay.com` are the hosts a STOCK integration
-        // actually uses: every published EBANX JS SDK (1.6.0 through 1.11.0, verified
-        // against the live bundles) hardcodes
-        //   path: () => config.isLive() ? 'https://api.ebanxpay.com/' : 'https://sandbox.ebanxpay.com/'
-        // Without them we recognized only the `.ebanx.com` and `api-diamond` variants, so
-        // an ordinary EBANX checkout was invisible to us and the cardholder was never asked.
-        match: "(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\\.ebanx\\.com|(?:api-diamond|api|sandbox)\\.ebanxpay\\.com)/ws/token",
-        hosts: [
-            "^customer\\.ebanx\\.com$",
-            "^customer-frontier\\.ebanx\\.com$",
-            "^api\\.ebanx\\.com$",
-            "^sandbox\\.ebanx\\.com$",
-            "^api-local-latam\\.ebanx\\.com$",
-            "^sandbox-local-latam\\.ebanx\\.com$",
-            "^api-diamond\\.ebanxpay\\.com$",
-            "^api\\.ebanxpay\\.com$",
-            "^sandbox\\.ebanxpay\\.com$"
-        ],
-        sandboxHosts: ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"],
-        encoding: "json",
-        passthroughHeaders: []
-    },
-    {
-        psp: "mercado_pago",
-        // PAN@ card_number. POST api.mercadopago.com/v1/card_tokens — the ONLY
-        // PAN egress in sdk.mercadopago.com/js/v2 (verified against the live bundle). No sandbox host:
-        // test mode is the TEST-* public_key. Auth + attribution ride the QUERY (the SDK's
-        // defaultQueries appends public_key, locale, js_version, referer), so replay the URL verbatim
-        // and never give `match` a trailing `$` — the SDK tests it unanchored against the raw URL.
-        // Same endpoint also serves saved-card {card_id,security_code} (no PAN) → check body before swap.
-        // (?![\w/-]) pins the exact endpoint: the `/card_tokens/{id}` sibling is a PUT carrying only
-        // {security_code,expiration_*} (no PAN), and the guard stops the SDK pausing it or /{id}/clone.
-        match: "api\\.mercadopago\\.com/v1/card_tokens(?![\\w/-])",
-        hosts: ["^api\\.mercadopago\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^x-product-id$"]
-        // SDK sets X-Product-Id on the tokenize POST
-    },
-    {
-        psp: "payu",
-        // GPO Secure Forms. PAN@ card.number.
-        match: "(secure\\.payu\\.com|(merch-prod|secure)\\.snd\\.payu\\.com)/api/front/tokens",
-        hosts: ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"],
-        sandboxHosts: ["^(merch-prod|secure)\\.snd\\.payu\\.com$"],
-        // .snd. is PayU's sandbox
-        encoding: "json",
-        // Native checkout attaches a bearer to tokenization; preserve it on replay.
-        passthroughHeaders: ["^authorization$"]
-    },
-    {
-        psp: "razorpay",
-        // PAN@ card[number] (form). Body carries risk/fingerprint fields — replay
-        // body verbatim, swap only card[*]. Auth = ?key_id= (or ?x_entity_id=) in the URL.
-        // THREE sinks, all POST, all carrying the SAME payload object. checkout-frame.js builds
-        // them as ib(r,"payments/create/ajax") and ib(r,"payments/create/"+(fees?"fees":"checkout")):
-        //   /ajax     XHR, standard flow
-        //   /checkout form-POST redirect flow
-        //   /fees     form-POST, customer-fee-bearer merchants
-        // `fees` is NOT optional: it is the same card body behind a boolean (vS(this.r, t.fees)),
-        // so dropping it silently un-intercepts every fee-bearer merchant.
-        // The optional `standard_checkout/` segment appears when a session_token is present
-        // (builder: api + "v1/" + "standard_checkout" + "/" + path).
-        // NOT matched, deliberately: the pg_router shape (api + "pg_router/" + "v1/" +
-        // "standard_checkout" + path — note the MISSING slash before the path). Every ib() call
-        // site passes only 2 args, so that flag is always false and the shape is unreachable for
-        // card paths. If Razorpay ever enables it we go inert (fail-closed), never leaky.
-        // NOT allowlisted, deliberately: api-<region>.razorpay.com. checkout.js only builds that
-        // when the merchant page sets Razorpay.config.api="" — page-controlled input must never
-        // widen a card allowlist.
-        match: "api\\.razorpay\\.com/v1/(?:standard_checkout/)?payments/create/(?:ajax|checkout|fees)",
-        hosts: ["^api\\.razorpay\\.com$"],
-        encoding: "form",
-        passthroughHeaders: ["^x-razorpay-sessionid$", "^x-customer-access-token$"]
-    },
-    {
-        psp: "mollie",
-        // Components v1+v2. PAN@ cardNumber. No sandbox host (body `testmode` boolean).
-        match: "api\\.cc\\.mollie\\.com/v1/card-tokens",
-        hosts: ["^api\\.cc\\.mollie\\.com$"],
-        encoding: "json",
-        passthroughHeaders: [],
-        compose: { cardExpiryDate: "MM/YY" }
-    },
-    {
-        psp: "paysafe",
-        // Paysafe.js. PAN@ card.cardNum, expiry@ card.cardExpiry.{month,year}.
-        // `paymenthub/v1/singleusepaymenthandles` was pinned from the docs and
-        // has NEVER been observed in a capture; every run of the live SDK posts to
-        // `/js/api/v1/tokenize` instead, from hosted.paysafe.com's own iframe. Both are kept:
-        // the SUPH path may be reachable on integrations we have not exercised.
-        // Auth travels as `x-paysafe-credentials` on the observed path (NOT `Authorization`,
-        // which the docs describe for SUPH), so both are declared — replaying the wrong one
-        // gets the tokenization rejected.
-        // Token boundary is `(?![\w/-])`, not `(?!/)`: the server anchors `match` with ^(?:…)$
-        // so either works there, but the SDK compiles `match` with `i` ALONE (unanchored), and
-        // `(?!/)` lets `…/singleusepaymenthandlesEVIL` satisfy the browser-side pause test.
-        // NOTE: legacy Paysafe.js v1 (/customervault/v1/singleusetokens, same two hosts) is
-        // deliberately NOT covered here — it needs its own verification pass before adding.
-        // Checkout 1.8 uses a separate hosted origin, with the same nested card shape.
-        // Verified from https://hosted.test.paysafe.com/checkout/1.8.0/main.bundle.js
-        // and its byte-identical production sibling (SHA-256 e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c).
-        // Its native LIVE/TEST environment map selects exactly hosted[.test].paysafe.com.
-        // Keep host/path pairs separate: details/log are not card requests;
-        // card/tokenize uses a saved paymentToken, and 3DS-specific paths are unverified.
-        match: "(?:api(\\.test)?\\.paysafe\\.com/(?:paymenthub/v1/singleusepaymenthandles|js/api/v1/tokenize)|hosted(\\.test)?\\.paysafe\\.com/checkout/api/v1/tokenize)(?![\\w/-])",
-        hosts: ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"],
-        sandboxHosts: ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^authorization$", "^x-paysafe-credentials$", "^correlationid$"]
-    },
-    {
-        psp: "recurly",
-        // PAN@ number (form-encoded POST). recurly.js hardcodes exactly TWO API bases:
-        // "https://api.recurly.com/js/v1" and "https://api.eu.recurly.com/js/v1". EU is auto-selected
-        // when the public key starts with `fra-`. No sandbox host: sandbox sites reuse api.recurly.com
-        // with a sandbox public key.
-        // WARNING: never widen these to [a-z0-9-]+\.recurly\.com. *.recurly.com is WILDCARD DNS (every
-        // merchant subdomain resolves to the same LB), so a broad host pattern is a card-exfil hole.
-        // (?![\w-]) excludes the live /js/v1/tokens sibling (iban/bacs/becs bank accounts + 3DS action
-        // results, no PAN); /js/v1/payment_methods/token is APM/wallet ({currency,amount}) and is
-        // excluded by the anchored path too.
-        // WARNING: the opt-in `cors:false` legacy path tokenizes over a JSONP GET, which the POST gate
-        // in isCardRequest cannot intercept. Default is `cors:true` (XHR POST), so this entry is live.
-        match: "api(\\.eu)?\\.recurly\\.com/js/v1/token(?![\\w-])",
-        hosts: ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"],
-        encoding: "form",
-        passthroughHeaders: ["^recurly-credential-checkout-hostname$"]
-        // only in configure({hostname}) mode
-    },
-    {
-        psp: "moneris",
-        compose: { input_exp: "MMYY" },
-        // Hosted Tokenization. VERIFIED live against hpp_common.js on all six
-        // hosts: the iframe does `request.open('POST', 'request.php')` (XHR, relative to
-        // /HPPtoken/index.php) with Content-Type application/x-www-form-urlencoded and
-        // PAN@ input_data. It sets no auth header (the HT profile is the ?id= on the iframe
-        // URL), so passthroughHeaders is correctly empty. hpp_common.js references exactly
-        // one URL and one method, so there is no second tokenization path to cover.
-        // NOTE: do NOT add Moneris Checkout (chkt/) as a separate entry. It shares these
-        // hosts and resolveRecognizerForUrl .find()s on host first, so one would permanently
-        // shadow the other; chkt/ instead falls out at the path check (refused, not leaked).
-        match: "(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\\.moneris\\.com/HPPtoken/request\\.php",
-        hosts: [
-            "^www3\\.moneris\\.com$",
-            "^esqa\\.moneris\\.com$",
-            "^gateway\\.moneris\\.com$",
-            "^gatewayqa\\.moneris\\.com$",
-            "^gatewayt\\.moneris\\.com$",
-            "^gatewaydev\\.moneris\\.com$"
-        ],
-        // Live: www3, gateway. Test/QA/dev: esqa, gatewayqa, gatewayt, gatewaydev.
-        sandboxHosts: ["^esqa\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"],
-        encoding: "form",
-        passthroughHeaders: []
-    },
-    {
-        psp: "bambora",
-        // Bambora NA / Worldline Custom Checkout. PAN@ number. POST. Content-Type is
-        // text/plain (preflight dodge) — replay verbatim; `encoding: 'json'` describes the body shape.
-        // No sandbox host: test mode rides the same host, decided by merchant id + API key.
-        // api.bam.shift4api.net is the post-migration host (Dec-2026 cutover); both hosts are pinned
-        // exact — never widen to the docs' *.bam.shift4api.net wildcard. api.na.bambora.com CNAMEs to
-        // the legacy beanstream.com origin; do NOT add www.beanstream.com, the browser SDK never calls it.
-        match: "(api\\.na\\.bambora\\.com|api\\.bam\\.shift4api\\.net)/scripts/tokenization/tokens",
-        hosts: ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"],
-        encoding: "json",
-        passthroughHeaders: []
-    },
-    {
-        psp: "global_payments",
-        // GlobalPayments.js, two gateways behind one PSP id. PAN@ card.number on
-        // both (verified in the shipped js.globalpay.com/v1/globalpayments.js, actionTokenize$3/$4).
-        // Heartland/Portico: prod api.heartlandportico.com/SecureSubmit.v1/api/token, sandbox
-        //   cert.api2.heartlandportico.com/Hps.Exchange.PosGateway.Hpf.v1/api/token. The host/path
-        //   pairing is ASYMMETRIC (prod is not api2, sandbox is not SecureSubmit.v1). That is the
-        //   vendor's own domains$4/urls$4 table, not a typo, so do not "correct" it. Auth is ?api_key=
-        //   in the URL, so there is nothing to replay in headers. api2.heartlandportico.com is
-        //   deliberately absent: it is the server-side PHP SDK's endpoint, never a browser call.
-        // GP-API/UCP: apis[.sandbox][.eu].globalpay.com/ucp/[merchants/{id}/]payment-methods, auth via
-        //   Authorization Bearer + X-GP-Version. All four hosts verified live and serving cross-origin
-        //   POST. accounts/{id}/ is deliberately NOT accepted: the tokenizer only ever prefixes
-        //   merchants/{id}/, so allowing it would widen the path with no endpoint behind it.
-        // Both gateways POST application/json, so isCardRequest's POST gate lets them through.
-        match: "(?:api\\.heartlandportico\\.com/SecureSubmit\\.v1/api/token|cert\\.api2\\.heartlandportico\\.com/Hps\\.Exchange\\.PosGateway\\.Hpf\\.v1/api/token|apis(?:\\.sandbox)?(?:\\.eu)?\\.globalpay\\.com/ucp/(?:merchants/[^/]+/)?payment-methods)",
-        hosts: [
-            "^api\\.heartlandportico\\.com$",
-            "^cert\\.api2\\.heartlandportico\\.com$",
-            "^apis\\.globalpay\\.com$",
-            "^apis\\.sandbox\\.globalpay\\.com$",
-            "^apis\\.eu\\.globalpay\\.com$",
-            "^apis\\.sandbox\\.eu\\.globalpay\\.com$"
-        ],
-        // Heartland/Portico cert.* is the certification (sandbox) host; GP-API sandbox is apis.sandbox[.eu].
-        sandboxHosts: ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"],
-        encoding: "json",
-        passthroughHeaders: ["^authorization$", "^x-gp-version$"]
-    },
-    // ── Encrypted on the device under a pinned key ────────────────────────────
-    {
-        psp: "fiserv",
-        // Fiserv Commerce Hub card capture from the Secure Data Capture (SDC) frame,
-        // the request Home Depot's OrangePay checkout sends (payment-fields.js and
-        // sdk-secure 3.8.14). The frame always encrypts: it seals the card with
-        // AES-256-GCM under a fresh key, wraps that key with RSA-OAEP-SHA256 under the
-        // public key the page passed it, and posts the envelope as
-        // source.encryptionData. It picks its endpoint by the page's auth type
-        // (iframe.js @85480): an AccessToken (Security Credentials) posts here, to
-        // card-capture; a Checkout Sessions JWT posts to /ch/checkouts/v1/payment-link
-        // instead. payment-link also carries the card, and it is left out on purpose:
-        // `match` names card-capture only, so a Sessions merchant's capture is never
-        // paused and fails as it does today. Fastlane (PaymentToken), ACH
-        // (PaymentCheck), gift and EBT captures share this URL, carry no Vault card,
-        // and the SDK continues them unpaused (fiserv.js isFiservPausableBody).
-        // The Wave 0 sandbox gate (2026-09-24, connect-cert, Fiserv simulator cards)
-        // settled the mode: card-capture refuses a plaintext source.card (400
-        // GATEWAY 302 "Missing or Invalid Encryption Data") and captures the frame's
-        // own envelope with no Origin, so the device builds that envelope under a
-        // key Agentcard pinned (fiserv-keys.js), the runtime writes its four members
-        // over the paused ones, and the capture continues from the agent's browser.
-        // The AccessToken the agent can read was refused on charges and tokens at
-        // Fiserv's edge in that sandbox. Every other Commerce Hub path is refused
-        // here: charges, tokens, security/keys, payment-link, and the non-production
-        // hosts (connect-dev, -qa, -uat, -test); resolveRecognizerForUrl also takes
-        // only the two endpoints written exactly (fiserv-environment.js). The
-        // envelope carries no timestamp or session binding, so it is approved by the
-        // cardholder every time: dark until an org is allowlisted, and autopilot
-        // refuses fiserv at all three gates.
-        capability: "fiserv_card_capture",
-        // A Fiserv card is sealed only for a capture the cardholder already approved
-        // through a prepare(): the backend refuses an unprepared create (409
-        // preparation_required), the internal buy loop never mints a Fiserv round,
-        // and the SDK refuses locally before it prompts.
-        preparationRequired: true,
-        match: "connect(?:-cert)?\\.fiservapis\\.com/ch/payments-vas/v1/card-capture(?![\\w/.-])",
-        hosts: ["^connect\\.fiservapis\\.com$", "^connect-cert\\.fiservapis\\.com$"],
-        sandboxHosts: ["^connect-cert\\.fiservapis\\.com$"],
-        // A live row reaches connect only and a test row connect-cert only, and
-        // connect-cert receives only documented test cards (device-replay.js).
-        hostEnvironmentPinned: true,
-        encoding: "json",
-        // The browser continues the capture with its own headers, so only the ones
-        // the backend checks against the body and the merchant are kept:
-        // Auth-Token-Type, the merchant and terminal ids, and the embedding frame's
-        // origin the SDC names (x-integration-origin, self-asserted). The
-        // AccessToken, the API key, Client-Request-Id and Timestamp are never stored.
-        passthroughHeaders: ["^auth-token-type$", "^x-integration-merchant-id$", "^x-integration-terminal-id$", "^x-integration-origin$"],
-        clientSideEncrypted: true,
-        mode: "cse",
-        cse: {
-            at: "source.encryptionData",
-            fields: ["keyId", "encryptedKey", "encryptionBlock", "aesIv"]
-        }
-    }
-]);
-var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, ...definition }) => definition));
-var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
-    psp: definition.psp,
-    match: new RegExp(definition.match, "i"),
-    hosts: definition.hosts.map((source) => new RegExp(source, "i")),
-    encoding: definition.encoding,
-    headers: definition.passthroughHeaders.map((source) => new RegExp(source, "i")),
-    ...definition.sandboxHosts ? { sandboxHosts: definition.sandboxHosts.map((source) => new RegExp(source, "i")) } : {},
-    ...definition.hostEnvironmentPinned ? { hostEnvironmentPinned: true } : {},
-    ...definition.mode ? { mode: definition.mode } : {},
-    ...definition.clientSideEncrypted ? { clientSideEncrypted: true } : {},
-    ...definition.compose ? { compose: definition.compose } : {},
-    ...definition.encryptedCardFields ? { cse: { fields: definition.encryptedCardFields } } : {},
-    ...definition.hostedForm ? { form: definition.hostedForm.card } : {}
-})));
-function buildBuiltinRegistry(recognizers) {
-    return recognizers.filter((definition) => !definition.capability).map(({ cse, hostedForm, ...definition }) => ({
-        ...definition,
-        match: new RegExp(definition.match, "i"),
-        passthroughHeaders: definition.passthroughHeaders.map((source) => new RegExp(source, "i"))
-    }));
-}
-var BUILTIN_REGISTRY = deepFreeze(buildBuiltinRegistry(PSP_RECOGNIZERS));
-var CHECKOUT_MODES = deepFreeze(["token", "cse", "hosted_form"]);
-function recognizerByPsp(psp) {
-    return typeof psp === "string" ? PSP_CLIENT_TABLE.find((entry) => entry.psp === psp) ?? null : null;
-}
-function trustedClientRecognizer(pspOrEntry) {
-    const psp = typeof pspOrEntry === "string" ? pspOrEntry : pspOrEntry?.psp;
-    const definition = recognizerByPsp(psp);
-    if (!definition)
-        throw new Error("Refusing to pay: unknown payment processor.");
-    return definition;
-}
-// src/recognition.js
-var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
-    stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
-});
-var WITHOUT_CHECKOUT_SESSIONS = Object.freeze({
-    stripe: Object.freeze({
-        match: "api\\.stripe\\.com/v1/(payment_methods|tokens|sources|confirmation_tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)",
-        passWithoutCard: "api\\.stripe\\.com/v1/(sources|confirmation_tokens)"
-    })
-});
-// src/request-policy.js
-var HEADER_NEVER_FORWARD = /^(cookie|set-cookie|authorization2|proxy-authorization|host|content-length|origin|referer)$/i;
-var ALLOWED_MEDIA_TYPES = {
-    json: ["application/json", "text/plain"],
-    form: ["application/x-www-form-urlencoded"]
-};
-function contentTypeFor(pspOrEntry, headers) {
-    const rec = trustedClientRecognizer(pspOrEntry);
-    const encoding = rec && rec.encoding === "form" ? "form" : "json";
-    const allowed = ALLOWED_MEDIA_TYPES[encoding];
-    const fallback = allowed[0];
-    const entry = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
-    const raw = entry && entry[1];
-    if (typeof raw !== "string")
-        return fallback;
-    const base = raw.split(";")[0].trim().toLowerCase();
-    const worldpaySessionType = rec.psp === "worldpay" && encoding === "json" && base === "application/vnd.worldpay.sessions-v1.hal+json";
-    if (!allowed.includes(base) && !worldpaySessionType)
-        return fallback;
-    const charset = raw.match(/;\s*charset=([\w-]+)/i);
-    return charset ? `${base}; charset=${charset[1]}` : base;
-}
-function replayHeaders(pspOrEntry, captured = {}) {
-    const rec = trustedClientRecognizer(pspOrEntry);
-    const headers = { "content-type": contentTypeFor(rec, captured) };
-    for (const [name, value] of Object.entries(captured)) {
-        if (rec.headers.some((pattern) => pattern.test(name)) && !HEADER_NEVER_FORWARD.test(name))
-            headers[name] = value;
-    }
-    return headers;
-}
-var replayPolicy = Object.freeze({ contentTypeFor, HEADER_NEVER_FORWARD });
-// src/stripe-checkout.js
-var STRIPE_CHECKOUT_OPERATION = "stripe.device_checkout_confirm.v1";
-var STRIPE_CHECKOUT_CONTEXT_HEADER = "x-agentcard-stripe-checkout-context";
-var SESSION = /^cs_(?:test|live)_[A-Za-z0-9]{1,200}(?![\s\S])/;
-var KEY = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
-var SYNTHETIC = /^pm_agentcard_checkout_[A-Za-z0-9_-]{16,80}(?![\s\S])/;
-var STRIPE_CHECKOUT_VALIDATION_CODES = Object.freeze({
-    unclassified: "unclassified",
-    request_shape: "request_shape",
-    request_body_bounds: "request_body_bounds",
-    request_headers: "request_headers",
-    form_encoding: "form_encoding",
-    form_field_unknown: "form_field_unknown",
-    form_field_duplicate: "form_field_duplicate",
-    form_value_bounds: "form_value_bounds",
-    context_invalid: "context_invalid",
-    session_binding: "session_binding",
-    publishable_key: "publishable_key",
-    mode_binding: "mode_binding",
-    attribution_session: "attribution_session",
-    tokenization_fields: "tokenization_fields",
-    billing_email: "billing_email",
-    billing_binding: "billing_binding",
-    billing_conflict: "billing_conflict",
-    expected_amount: "expected_amount",
-    payment_method_type: "payment_method_type",
-    synthetic_payment_method: "synthetic_payment_method",
-    required_final_fields: "required_final_fields"
-});
-var validationCodes = /* @__PURE__ */ new WeakMap();
-var reject = (code = "unclassified") => {
-    const error = new Error("stripe_checkout_rejected");
-    validationCodes.set(error, code);
-    throw error;
-};
-function stripeCheckoutValidationCode(error) {
-    const code = validationCodes.get(error);
-    return Object.values(STRIPE_CHECKOUT_VALIDATION_CODES).find((value) => value === code) ?? STRIPE_CHECKOUT_VALIDATION_CODES.unclassified;
-}
-var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var opaque = (value) => typeof value === "string" && value.length <= 8192 && !/[\x00-\x1f\x7f]/.test(value);
-var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-function validateStripeCheckoutIdentity(value) {
-    if (!object(value) || !["test", "production"].includes(value.environment ?? "test") || value.environment === null || !["sessionId", "publishableKey", "livemode"].some((key) => Object.hasOwn(value, key)))
-        reject("mode_binding");
-    const environment = value.environment ?? "test", livemode = environment === "production";
-    const mode = livemode ? "live" : "test";
-    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
-        reject("mode_binding");
-    return Object.freeze({ environment, livemode });
-}
-var TEST_CARDS = ["4242424242424242", "4000000000000002", "4000002500003155"];
-var SYNTHETIC_CARDS = [...TEST_CARDS, "4111111111111111"];
-function validateStripeCheckoutCard(card, environment = "test") {
-    if (!["test", "production"].includes(environment) || !object(card) || typeof card.number !== "string" || typeof card.cvc !== "string" || !/^(?:0?[1-9]|1[0-2])(?![\s\S])/.test(String(card.month)) || !/^(?:\d{2}|\d{4})(?![\s\S])/.test(String(card.year)) || card.name !== void 0 && !opaque(card.name))
-        reject();
-    if (environment === "test") {
-        if (!TEST_CARDS.includes(card.number) || card.cvc !== "123")
-            reject();
-    }
-    else {
-        if (!/^\d{12,19}(?![\s\S])/.test(card.number) || /^(\d)\1+(?![\s\S])/.test(card.number) || !/^\d{3,4}(?![\s\S])/.test(card.cvc) || SYNTHETIC_CARDS.includes(card.number))
-            reject();
-        let sum = 0, double = false;
-        for (let i = card.number.length - 1; i >= 0; i--) {
-            let digit = Number(card.number[i]);
-            if (double) {
-                digit *= 2;
-                if (digit > 9)
-                    digit -= 9;
-            }
-            sum += digit;
-            double = !double;
-        }
-        if (sum % 10 !== 0)
-            reject();
-    }
-    return true;
-}
-function isStripeCheckoutHostedMode(value) {
-    return value === "hosted" || value === "hosted_page";
-}
-function encodeAscii(value) {
-    let result = "", bits = 0, count = 0;
-    for (const char of value) {
-        bits = bits << 8 | char.charCodeAt(0);
-        count += 8;
-        while (count >= 6) {
-            count -= 6;
-            result += alphabet[bits >>> count & 63];
-        }
-    }
-    return result + (count ? alphabet[bits << 6 - count & 63] : "");
-}
-function context(value) {
-    if (!object(value) || Object.keys(value).length !== 3 || value.version !== 1 || !["version", "session_id", "synthetic_payment_method_id"].every((key) => Object.hasOwn(value, key)) || !SESSION.test(value.session_id) || !SYNTHETIC.test(value.synthetic_payment_method_id))
-        reject("context_invalid");
-    return { version: 1, session_id: value.session_id, synthetic_payment_method_id: value.synthetic_payment_method_id };
-}
-function encodeStripeCheckoutContext(value) {
-    return encodeAscii(JSON.stringify(context(value)));
-}
-function hasStripeCheckoutMarker(request) {
-    return object(request?.headers) && Object.keys(request.headers).some((key) => key.toLowerCase() === STRIPE_CHECKOUT_CONTEXT_HEADER);
-}
-function parseStripeCheckoutContext(request) {
-    const entries = Object.entries(request?.headers ?? {}).filter(([key]) => key.toLowerCase() === STRIPE_CHECKOUT_CONTEXT_HEADER);
-    if (!entries.length)
-        return null;
-    if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
-        reject("context_invalid");
-    const encoded = entries[0][1];
-    let text = "", bits = 0, count = 0;
-    for (const char of encoded) {
-        bits = bits << 6 | alphabet.indexOf(char);
-        count += 6;
-        if (count >= 8) {
-            count -= 8;
-            text += String.fromCharCode(bits >>> count & 255);
-        }
-    }
-    let value;
-    try {
-        value = context(JSON.parse(text));
-    }
-    catch {
-        reject("context_invalid");
-    }
-    if (encodeStripeCheckoutContext(value) !== encoded)
-        reject("context_invalid");
-    return value;
-}
-function endpoint(raw) {
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        return null;
-    }
-    if (url.origin !== "https://api.stripe.com" || url.port || url.username || url.password || url.search || url.hash)
-        return null;
-    return url;
-}
-function isStripeCheckoutEndpoint(raw) {
-    const url = endpoint(raw);
-    const match = url && /^\/v1\/payment_pages\/(cs_(?:test|live)_[A-Za-z0-9]+)\/confirm$/.exec(url.pathname);
-    return !!match && SESSION.test(match[1]);
-}
-var finalFields = /* @__PURE__ */ new Set([
-    "payment_method",
-    "key",
-    "expected_amount",
-    "expected_payment_method_type",
-    "payment_method_data[billing_details][email]",
-    "init_checksum",
-    "js_checksum",
-    "version",
-    "rv_timestamp",
-    "eid",
-    "link_brand",
-    "guid",
-    "muid",
-    "sid",
-    "passive_captcha_token",
-    "passive_captcha_ekey",
-    "pxcts",
-    "pxvid",
-    "px3",
-    ...[
-        "checkout_config_id",
-        "checkout_session_id",
-        "client_session_id",
-        "merchant_integration_source",
-        "merchant_integration_version",
-        "payment_method_selection_flow"
-    ].map((key) => `client_attribution_metadata[${key}]`),
-    ...["shipping_rate_amount", "subtotal", "total_discount_amount", "total_exclusive_tax", "total_inclusive_tax"].map((key) => `last_displayed_line_item_group_details[${key}]`)
-]);
-var addressFields = ["city", "country", "line1", "line2", "postal_code", "state"];
-var tokenFields = /* @__PURE__ */ new Set([
-    "type",
-    "key",
-    "card[number]",
-    "card[cvc]",
-    "card[exp_month]",
-    "card[exp_year]",
-    "billing_details[name]",
-    "billing_details[email]",
-    "billing_details[phone]",
-    "allow_redisplay",
-    ...addressFields.map((key) => `billing_details[address][${key}]`),
-    "guid",
-    "muid",
-    "sid",
-    "payment_user_agent",
-    "referrer",
-    "time_on_page",
-    ...[
-        "checkout_config_id",
-        "checkout_session_id",
-        "client_session_id",
-        "merchant_integration_source",
-        "merchant_integration_version",
-        "payment_method_selection_flow"
-    ].map((key) => `client_attribution_metadata[${key}]`)
-]);
-function form(request, fields) {
-    if (!object(request) || request.method !== "POST" || typeof request.body !== "string")
-        reject("request_shape");
-    if (request.body.length > 2e4)
-        reject("request_body_bounds");
-    if (!object(request.headers) || Object.keys(request.headers).length > 40 || Object.values(request.headers).some((value) => !opaque(value)))
-        reject("request_headers");
-    const pairs = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const raw of request.body.split("&")) {
-        const index = raw.indexOf("=");
-        if (index < 1)
-            reject("form_encoding");
-        let key, value;
-        try {
-            key = decodeURIComponent(raw.slice(0, index).replace(/\+/g, " "));
-            value = decodeURIComponent(raw.slice(index + 1).replace(/\+/g, " "));
-        }
-        catch {
-            reject("form_encoding");
-        }
-        if (!fields.has(key))
-            reject("form_field_unknown");
-        if (seen.has(key))
-            reject("form_field_duplicate");
-        if (!opaque(value))
-            reject("form_value_bounds");
-        seen.add(key);
-        pairs.push({ key, value, raw });
-    }
-    return { pairs, values: new Map(pairs.map(({ key, value }) => [key, value])) };
-}
-function keyFor(request, values, expected) {
-    const authorization = Object.entries(request.headers).filter(([key2]) => key2.toLowerCase() === "authorization");
-    if (authorization.length > 1)
-        reject("publishable_key");
-    let headerKey;
-    if (authorization.length) {
-        const match = /^Bearer (pk_(?:test|live)_[A-Za-z0-9_]{1,256})$/.exec(authorization[0][1]);
-        if (!match)
-            reject("publishable_key");
-        headerKey = match[1];
-    }
-    const key = values.get("key") || headerKey;
-    if (!KEY.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
-        reject("publishable_key");
-    return key;
-}
-var billingEmail = (value) => value === null || typeof value === "string" && value.length > 0 && value.length <= 320 && opaque(value);
-function captureStripeCheckoutBilling(request, options) {
-    const phase = classifyStripeCheckoutRequest(request, options);
-    if (phase?.phase !== "tokenization" || !SYNTHETIC.test(options?.syntheticPaymentMethodId))
-        reject("billing_binding");
-    const email = form(request, tokenFields).values.get("billing_details[email]") ?? null;
-    if (!billingEmail(email))
-        reject("billing_email");
-    return Object.freeze({
-        session_id: phase.session_id,
-        synthetic_payment_method_id: options.syntheticPaymentMethodId,
-        email
-    });
-}
-function attachStripeCheckoutBilling(request, captured, options) {
-    const phase = classifyStripeCheckoutRequest(request, options);
-    if (phase?.phase !== "final" || !object(captured) || Object.keys(captured).length !== 3 || !["session_id", "synthetic_payment_method_id", "email"].every((key) => Object.hasOwn(captured, key)) || captured.session_id !== phase.session_id || captured.synthetic_payment_method_id !== phase.synthetic_payment_method_id || !billingEmail(captured.email))
-        reject("billing_binding");
-    const field = "payment_method_data[billing_details][email]";
-    const existing = form(request, finalFields).values.get(field);
-    if (existing !== void 0 && existing !== captured.email)
-        reject("billing_conflict");
-    if (captured.email === null || existing !== void 0)
-        return { ...request };
-    const body = `${request.body}&${encodeURIComponent(field)}=${encodeURIComponent(captured.email)}`;
-    const result = { ...request, body };
-    classifyStripeCheckoutRequest(result, options);
-    return result;
-}
-function classifyStripeCheckoutRequest(request, options = {}) {
-    const url = endpoint(request?.url);
-    if (!url) {
-        if (hasStripeCheckoutMarker(request))
-            reject("context_invalid");
-        return null;
-    }
-    const final = isStripeCheckoutEndpoint(request.url);
-    const token = url.pathname === "/v1/payment_methods";
-    if (!final && !token) {
-        if (hasStripeCheckoutMarker(request))
-            reject("context_invalid");
-        return null;
-    }
-    if (token && options.sessionId === void 0 && !hasStripeCheckoutMarker(request))
-        return null;
-    const marker = parseStripeCheckoutContext(request);
-    const sessionId = final ? url.pathname.split("/")[3] : options.sessionId;
-    if (!SESSION.test(sessionId) || options.sessionId !== void 0 && options.sessionId !== sessionId || marker && marker.session_id !== sessionId)
-        reject("session_binding");
-    const { values } = form(request, final ? finalFields : tokenFields);
-    const key = keyFor(request, values, options.publishableKey);
-    validateStripeCheckoutIdentity({ environment: options.environment, sessionId, publishableKey: key });
-    const attributionSession = values.get("client_attribution_metadata[checkout_session_id]");
-    if (attributionSession !== void 0 && attributionSession !== sessionId)
-        reject("attribution_session");
-    if (token) {
-        const number = values.get("card[number]");
-        if (values.get("type") !== "card" || typeof number !== "string" || number.length > 64 || /[^0-9 -]/.test(number) || !["4111111111111111", "4242424242424242"].includes(number.replace(/[ -]/g, "")) || !/^\d{3}$/.test(values.get("card[cvc]") ?? "") || !/^(?:0?[1-9]|1[0-2])$/.test(values.get("card[exp_month]") ?? "") || !/^(?:\d{2}|\d{4})$/.test(values.get("card[exp_year]") ?? "") || values.has("allow_redisplay") && values.get("allow_redisplay") !== "unspecified")
-            reject("tokenization_fields");
-        return { phase: "tokenization", session_id: sessionId, publishable_key: key };
-    }
-    const amount = values.get("expected_amount");
-    const syntheticId = values.get("payment_method");
-    const email = values.get("payment_method_data[billing_details][email]");
-    if (email !== void 0 && !billingEmail(email))
-        reject("billing_email");
-    if (!/^[1-9]\d{0,11}$/.test(amount ?? "") || !Number.isSafeInteger(Number(amount)) || options.amountCents !== void 0 && options.amountCents !== Number(amount))
-        reject("expected_amount");
-    if (values.get("expected_payment_method_type") !== "card")
-        reject("payment_method_type");
-    if (!SYNTHETIC.test(syntheticId))
-        reject("synthetic_payment_method");
-    if (["init_checksum", "js_checksum", "version", "rv_timestamp"].some((key2) => !values.get(key2)))
-        reject("required_final_fields");
-    if (options.syntheticPaymentMethodId !== void 0 && options.syntheticPaymentMethodId !== syntheticId || marker && marker.synthetic_payment_method_id !== syntheticId)
-        reject("synthetic_payment_method");
-    return {
-        phase: "final",
-        session_id: sessionId,
-        publishable_key: key,
-        synthetic_payment_method_id: syntheticId,
-        amount_cents: Number(amount),
-        currency: "usd"
-    };
-}
-function createStripeCheckoutTokenizationStub(request, options) {
-    const phase = classifyStripeCheckoutRequest(request, options);
-    if (phase?.phase !== "tokenization" || !SYNTHETIC.test(options?.syntheticPaymentMethodId))
-        reject();
-    const { values } = form(request, tokenFields);
-    const address = Object.fromEntries(addressFields.filter((key) => values.has(`billing_details[address][${key}]`)).map((key) => [key, values.get(`billing_details[address][${key}]`)]));
-    const billing = Object.fromEntries(["name", "email", "phone"].filter((key) => values.has(`billing_details[${key}]`)).map((key) => [key, values.get(`billing_details[${key}]`)]));
-    const year = values.get("card[exp_year]");
-    return { status: 200, headers: { "content-type": "application/json" }, body: JSON.stringify({
-            id: options.syntheticPaymentMethodId,
-            object: "payment_method",
-            type: "card",
-            livemode: validateStripeCheckoutIdentity({ environment: options.environment, sessionId: phase.session_id }).livemode,
-            billing_details: { ...billing, address },
-            card: {
-                brand: "visa",
-                last4: "4242",
-                exp_month: Number(values.get("card[exp_month]")),
-                exp_year: Number(year.length === 2 ? `20${year}` : year),
-                funding: "credit",
-                country: "US"
-            }
-        }) };
-}
-var terminalFields = /* @__PURE__ */ new Set([
-    "id",
-    "object",
-    "state",
-    "status",
-    "payment_status",
-    "currency",
-    "livemode",
-    "session_id",
-    "mode",
-    "ui_mode",
-    "success_url",
-    "return_url"
-]);
-function parseStripeCheckoutResponse(raw, options) {
-    let value;
-    try {
-        value = typeof raw === "string" ? JSON.parse(raw) : raw;
-        validateStripeCheckoutIdentity({ environment: options?.environment, sessionId: options?.sessionId, livemode: value?.livemode });
-    }
-    catch {
-        return null;
-    }
-    if (!object(value) || !SESSION.test(options?.sessionId) || value.session_id !== options.sessionId || Object.keys(value).some((key) => !terminalFields.has(key)) || !["id", "object", "state", "status", "payment_status", "currency", "livemode", "session_id", "mode", "ui_mode"].every((key) => Object.hasOwn(value, key)) || typeof value.id !== "string" || !/^[A-Za-z0-9_]{1,256}(?![\s\S])/.test(value.id) || value.object !== "checkout.session" || value.state !== "succeeded" || value.status !== "complete" || value.payment_status !== "paid" || value.currency !== "usd" || value.mode !== "payment" || !isStripeCheckoutHostedMode(value.ui_mode))
-        return null;
-    for (const key of ["success_url", "return_url"]) {
-        if (!Object.hasOwn(value, key) || value[key] === null)
-            continue;
-        if (typeof value[key] !== "string" || value[key].length > 2048)
-            return null;
-        let url;
-        try {
-            url = new URL(value[key]);
-        }
-        catch {
-            return null;
-        }
-        let parameters;
-        try {
-            parameters = decodeURIComponent(url.search + url.hash);
-        }
-        catch {
-            return null;
-        }
-        if (url.protocol !== "https:" || url.username || url.password || options.returnOrigin !== void 0 && url.origin !== options.returnOrigin || /(?:client_secret|payment_method|secret_)/i.test(parameters))
-            return null;
-    }
-    return { ...value };
-}
-function prepareStripeCheckoutReplay(request, card, options = {}) {
-    const marker = parseStripeCheckoutContext(request);
-    if (!marker)
-        reject();
-    const phase = classifyStripeCheckoutRequest(request, {
-        ...options,
-        sessionId: marker.session_id,
-        syntheticPaymentMethodId: marker.synthetic_payment_method_id
-    });
-    if (phase?.phase !== "final" || options.amountCents !== void 0 && phase.amount_cents !== options.amountCents || options.sessionId !== void 0 && options.sessionId !== marker.session_id || !validateStripeCheckoutCard(card, options.environment))
-        reject();
-    const replacements = {
-        "payment_method_data[type]": "card",
-        "payment_method_data[card][number]": card.number,
-        "payment_method_data[card][cvc]": card.cvc,
-        "payment_method_data[card][exp_month]": String(card.month),
-        "payment_method_data[card][exp_year]": String(card.year),
-        ...card.name ? { "payment_method_data[billing_details][name]": card.name } : {}
-    };
-    const inline = Object.entries(replacements).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
-    const body = form(request, finalFields).pairs.map((pair) => pair.key === "payment_method" ? inline : pair.raw).join("&");
-    return {
-        psp: "stripe",
-        request: { url: request.url, method: "POST", headers: replayHeaders("stripe", request.headers), body },
-        where: Object.keys(replacements)
-    };
-}
-export { STRIPE_CHECKOUT_CONTEXT_HEADER, STRIPE_CHECKOUT_OPERATION, STRIPE_CHECKOUT_VALIDATION_CODES, attachStripeCheckoutBilling, captureStripeCheckoutBilling, classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, hasStripeCheckoutMarker, isStripeCheckoutEndpoint, isStripeCheckoutHostedMode, parseStripeCheckoutContext, parseStripeCheckoutResponse, prepareStripeCheckoutReplay, stripeCheckoutValidationCode, validateStripeCheckoutCard, validateStripeCheckoutIdentity };