@agent-cards/checkout 0.9.1 → 0.11.0

package/dist/stripe-checkout.generated.js

@@ -0,0 +1,915 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 2f7e340ba22bc33539f11e384a3e8362ae3fa510a9f8b540783c02bebcbc1ebf
+// src/definitions.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+var PROCESSOR_DEFINITIONS = deepFreeze([
+    {
+        psp: "shopify",
+        match: "(checkout\\.pci\\.shopifyinc\\.com|deposit\\.[a-z0-9-]+\\.shopifycs\\.com)/sessions",
+        hosts: ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^shopify-identification-signature$"]
+    },
+    {
+        psp: "stripe",
+        // FOUR PAN-bearing surfaces, not two. `payment_methods` and `tokens` are the
+        // LEGACY tokenizers. Modern Payment Element does not call either: it puts the
+        // card inline in the intent confirmation as
+        // `payment_method_data[card][number]`, so a merchant on the current SDK was
+        // never paused at all. Observed live on Anthropic's own billing page
+        // (platform.claude.com/settings/billing), which posts to
+        // /v1/setup_intents/{seti_...}/confirm — that is the "save a card" flow;
+        // /v1/payment_intents/{pi_...}/confirm is the same shape for "pay now".
+        // The id segment is matched narrowly (seti_/pi_ + word chars) rather than
+        // `.*` so the pattern cannot be widened by a crafted path.
+        match: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)",
+        hosts: ["^api\\.stripe\\.com$"],
+        encoding: "form",
+        // Elements' own surface markers; without these Stripe rejects the surface.
+        passthroughHeaders: ["^authorization$", "^stripe-version$", "^x-stripe-client-user-agent$"]
+    },
+    {
+        psp: "braintree",
+        match: "payments(\\.sandbox)?\\.braintree-api\\.com/graphql",
+        hosts: ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^authorization$", "^braintree-version$"]
+    },
+    {
+        psp: "checkout_com",
+        // Flow 1.226.0's card controller selects api or card-acquisition-gateway
+        // for the same card-token body and Bearer public-key Authorization.
+        // Native source: checkout-web-components.checkout.com/pages/1.226.0/index.html.
+        // Endpoint recognition does not establish consumer-wallet, CVV-only,
+        // reusable-token, 3DS or merchant payment completion compatibility.
+        match: "(api|card-acquisition-gateway)(\\.sandbox)?\\.checkout\\.com/tokens",
+        hosts: [
+            "^api\\.checkout\\.com$",
+            "^api\\.sandbox\\.checkout\\.com$",
+            "^card-acquisition-gateway\\.checkout\\.com$",
+            "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"
+        ],
+        encoding: "json",
+        passthroughHeaders: ["^authorization$"]
+    },
+    // NOT here, on purpose: VGS Collect (Very Good Security; Wolt's add-a-card
+    // call through `<tenant>.<live|sandbox>.verygoodproxy.com`). Served for a
+    // few hours on 2026-09-03 and withdrawn the same night: the proxy aliases
+    // only submissions that originate in VGS's own iframe (its Collect session
+    // handshake), so a byte-identical replay from the cardholder's device, 4 s
+    // after capture, with the iframe's own headers and origin, is forwarded
+    // un-aliased and the merchant answers 400 "Failed to process card". A
+    // recognizer that pauses a call the vault cannot finish only blocks the
+    // agent's browser from adding a card at all, so the entry is gone from
+    // every registry; the page keeps its on-file wording machinery for the
+    // merchant that does allow it.
+    {
+        psp: "adyen",
+        encryptedCardFields: { number: "encryptedCardNumber", month: "encryptedExpiryMonth", year: "encryptedExpiryYear", cvc: "encryptedSecurityCode" },
+        // The Sessions-flow payments call only (adyen-web's makePayment): the
+        // card rides in paymentMethod as four JWE blobs the vault page produces
+        // under the merchant's Adyen public key (services/checkout-cse-adyen.ts),
+        // and the runtime substitutes them into the paused body. binLookup,
+        // analytics and paymentDetails share these hosts, carry no card, and must
+        // never raise an approval; the hosts test pins them refused. The host
+        // alternation covers the regional live hosts (live-us, live-au, live-apse,
+        // live-in, live-nea): `checkoutshopper-[a-z]+` never matched those, so
+        // merchants on them were silently never paused.
+        match: "(checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com|([a-z0-9-]+\\.)*adyenpayments\\.com)/checkoutshopper/v1/sessions/[A-Za-z0-9_-]+/payments",
+        hosts: ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        clientSideEncrypted: true,
+        // kept: older SDKs read this and refuse locally
+        mode: "cse",
+        cse: {
+            at: "paymentMethod",
+            fields: ["encryptedCardNumber", "encryptedExpiryMonth", "encryptedExpiryYear", "encryptedSecurityCode"],
+            // adyen-web stamps `paymentMethod.brand` from the digits typed into its
+            // Card component, i.e. the agent's dummy. Proven on Adyen TEST
+            // (2026-09-02): a Mastercard dummy swapped for the vault's Visa
+            // ciphertext was refused 422/109 "Invalid variant"; without `brand`
+            // Adyen reads it off the decrypted PAN and authorises.
+            remove: ["brand"]
+        }
+    },
+    {
+        psp: "tranzila",
+        // Tranzila's hosted form (direct.tranzila.com/<terminal>/iframenew.php,
+        // embedded by the merchant page) submits the card as a top-level form
+        // POST to /process/n/ (directng: /process), application/x-www-form-
+        // urlencoded, with the card in ccno/expmonth/expyear/mycvv and the
+        // Israeli ID number in myid. The paused request is a Document navigation,
+        // not an XHR: the runtime cannot resume it with the real card, so the
+        // cardholder's device rebuilds and submits the SAME form itself, top-level
+        // from the vault origin (mode hosted_form), and the runtime resolves the
+        // paused navigation with a synthetic page once the device says the form
+        // left. The iframe page itself and Tranzila's /done/ result page share
+        // these hosts, carry no card, and are refused by `match`. Served only to
+        // SDKs that ask for hosted_form on sync: an older SDK would arm these
+        // hosts, pause the navigation, get a 400 and abort the frame.
+        match: "(direct\\.tranzila\\.com/process/n/|directng\\.tranzila\\.com/process/?)",
+        hosts: ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"],
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            required: ["sum", "supplier"],
+            card: { number: "ccno", month: "expmonth", year: "expyear", cvc: "mycvv", nationalId: "myid" },
+            amount: { sum: "sum", currency: "currency" },
+            // supplier (the terminal) + benid (the iframe session) + the amount:
+            // one submission, whatever nonce the form regenerated on a re-click.
+            dedupe: ["supplier", "benid", "sum", "currency"],
+            // One plain sale, reporting to the merchant the person sees: tranmode
+            // A (or absent) only (V verifies, K charges a token, C refunds, D
+            // forces), no TranzilaTK in either direction (`1` asks for a reusable
+            // token back, a token charges one), and every *_url_address on the
+            // merchant's host (Tranzila redirects the device there and POSTs the
+            // result there with the card's last four, expiry and ID number).
+            sale: { key: "tranmode", values: ["A"] },
+            token: "TranzilaTK",
+            callbackUrls: ["success_url_address", "fail_url_address", "notify_url_address"]
+        }
+    },
+    // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
+    // Each entry below was checked against the PSP's own shipped browser SDK or a
+    // live probe, then run through resolveRecognizerForUrl with positive, sibling
+    // and spoof URLs. Two rules the vectors keep proving, worth restating before
+    // anyone edits one of these:
+    //   1. Every dot in `hosts` is escaped. `^api.mercadopago.com$` admits the
+    //      REGISTRABLE domain apiamercadopago.com; the escape is the allowlist.
+    //   2. `hosts` is pinned to literal labels, never widened to a wildcard label
+    //      (`[a-z0-9-]+\.psp\.com`). Several of these vendors run wildcard DNS,
+    //      so "the hostname resolves" is not evidence that it receives cards.
+    {
+        psp: "square",
+        // PAN@ card_data.number. POST /v2/card-nonce (URL always carries ?_=&version=).
+        match: "pci-connect\\.squareup(?:sandbox)?\\.com/v2/card-nonce",
+        hosts: ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"],
+        encoding: "json",
+        passthroughHeaders: []
+        // auth = client_id in body; no auth header
+    },
+    {
+        psp: "authorize_net",
+        // Accept.js. PAN@ securePaymentContainerRequest.data.token.cardNumber.
+        // Auth is body-level (merchantAuthentication: apiLoginID + clientKey) — nothing to replay.
+        // NOTE: prod is api2, not api. `api.authorize.net` is the server-side AIM/API host and is
+        // deliberately NOT allowlisted — a browser never posts a PAN there. Legacy SIM/DPM
+        // (secure2.authorize.net/gateway/transact.dll) is excluded for the same reason plus: it is
+        // retired, and it is a top-level form POST rather than an XHR.
+        // Coverage caveat: AcceptUI (the hosted lightbox) renders its fields inside an
+        // accept.authorize.net iframe, so that POST is cross-origin to the merchant page and an
+        // in-page hook cannot observe it. This entry covers the Accept.js custom-fields path, which
+        // does run in the merchant page. /xml/v1/request.api is Authorize.Net's single monolithic
+        // endpoint (request type is chosen by the body root key), so the path pin admits sibling
+        // request types on the same URL — the body, not the URL, is what distinguishes them.
+        match: "(api2|apitest)\\.authorize\\.net/xml/v1/request\\.api",
+        hosts: ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"],
+        encoding: "json",
+        // JSON body; Content-Type is sometimes text/plain (preflight dodge), replayed as-is
+        passthroughHeaders: []
+    },
+    {
+        psp: "worldpay",
+        // Access Worldpay. PAN@ root key `cardNumber`. Accept is load-bearing:
+        // the two paths need DIFFERENT vendor media types; `application/json` → HTTP 406.
+        match: "(try\\.)?access\\.worldpay\\.com/(sessions/card|verifiedTokens/sessions)",
+        hosts: ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^accept$"]
+    },
+    {
+        psp: "nuvei",
+        // Safecharge Fields. PAN@ paymentOption.card.cardNumber.
+        // THREE PAN-bearing endpoints, not one. Nuvei picks between them from
+        // `sourceApplication`, and the covered one was the WRONG half of that
+        // branch: WEB_SDK (merchant holds the raw PAN in their own page) posts
+        // cardTokenization.do, while WEB_SDK_FIELDS (hosted fields, the
+        // PCI-conscious integration) posts websdk/initPaymentWithCardTokenization.do
+        // and clientPayment.do. Confirmed against sfc_inner_card.min.js, whose
+        // initPayment() opens initPaymentWithCardTokenization.do unconditionally
+        // with no branch back to the covered path.
+        match: "(secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:cardTokenization|clientPayment|websdk/initPaymentWithCardTokenization)\\.do",
+        hosts: ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"],
+        encoding: "json",
+        passthroughHeaders: []
+    },
+    // bluesnap: DELIBERATELY NOT SHIPPED — it cannot be intercepted at all. Its tokenizer is a PUT, and isCardRequest
+    // gates on POST — but accepting PUT is not enough on its own. hpf.js fires the
+    // same token PUT SEVERAL TIMES per checkout (blur and submit each send a delta
+    // body), so intercepting it would raise one approval prompt per fire and hand the
+    // device partial card data. An entry that cannot actually be intercepted does not
+    // belong in an allowlist that advertises interception: it reads as support we do
+    // not have, and on the CDP path it arms Fetch.enable, gets refused by the POST
+    // gate, and is then continued straight to the PSP while the integrator believes
+    // the card was protected. Ship it when the multi-fire semantics are handled.
+    {
+        psp: "airwallex",
+        // PAN@ payment_method.card.number (payment_intents/confirm,
+        // payment_consents/verify) / card.number (payment_methods/create).
+        // ⚠ reference/bin/lookup is EXCLUDED. It egresses the PAN in an `x-pan` request
+        // HEADER, and it is a POST — so matching it would not merely "pause" it, it would
+        // intercept it and raise a real approval prompt for a bin lookup whose body holds
+        // no card. Handling header-borne PANs needs its own design; until then this
+        // header-aware handling, not the body cardFieldPath path. `x-pan` is deliberately NOT a
+        // passthrough header, so today the replay carries no PAN at all (inert, never a leak).
+        // `card/tokenize` was dropped from the candidate: an OPTIONS preflight on BOTH pci-api
+        // hosts returns the same 404 as a bogus control path, while real POST-only routes
+        // (payment_methods/create, payment_consents/create) answer 200 + Allow-Methods: POST.
+        // The trailing (\?|$) is a no-op server-side (pathname has no query) — it is the
+        // right-edge boundary for the SDK's UNANCHORED client-side test of the full URL.
+        match: "(checkout(\\.sandbox)?\\.airwallex\\.com|pci-api(\\.sandbox)?\\.airwallex\\.com)/api/v1/pa/(payment_intents/[^/?#]+/confirm|payment_consents/[^/?#]+/verify|payment_methods/create)(\\?|$)",
+        hosts: [
+            "^checkout\\.airwallex\\.com$",
+            "^checkout\\.sandbox\\.airwallex\\.com$",
+            "^pci-api\\.airwallex\\.com$",
+            "^pci-api\\.sandbox\\.airwallex\\.com$"
+        ],
+        encoding: "json",
+        passthroughHeaders: ["^client-secret$", "^authorization$", "^x-auth-token$", "^x-on-behalf-of$", "^x-api-version$"]
+    },
+    {
+        psp: "rapyd",
+        // PAN@ required_fields.number (hosted collect page) OR payment_method.fields.number
+        // (checkout page — it renders on checkout.rapyd.net/?token=checkout_… and posts cross-origin to
+        // api.rapyd.net). The checkout-id segment is pinned to the documented `checkout_` prefix: a bare
+        // [^/?#]+ also admitted /v1/checkout/collect and the encoded-slash smuggle
+        // /v1/checkout/checkout_x%2Fadmin. ⚠ /v1/checkout/{id} is ALSO the documented GET Retrieve
+        // Checkout Page (signature-authed, server-to-server, no card) — the POST gate is what splits them.
+        match: "(api|sandboxapi)\\.rapyd\\.net/v1/(?:hosted/collect/card/[^/?#]+/payment_method|checkout/checkout_[A-Za-z0-9]+)(?:[?#]|$)",
+        hosts: ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"],
+        encoding: "json",
+        passthroughHeaders: []
+        // auth rides the opaque hosted-page / checkout token in the URL
+    },
+    {
+        psp: "dlocal",
+        // Smart Fields cvault. PAN@ pan. Do NOT match /cvault/cvv/store (CVV only).
+        // Hosts are two literal labels (no wildcard/`[a-z]+` label), so there is no
+        // multi-tenant surface: `ppmcc` is dlocal-operated, not merchant-registrable.
+        match: "ppmcc(-sandbox)?\\.dlocal\\.com/cvault/credit-card/temporal",
+        hosts: ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^x-fields-api-key$", "^x-uow$", "^x-dlocal-infrav2$"]
+    },
+    {
+        psp: "ebanx",
+        compose: { card_due_date: "MM/YYYY" },
+        // PAN@ card.card_number. POST /ws/token. Body content-type is text/plain
+        // (CORS-preflight dodge) — replay it verbatim; encoding:json describes the body shape.
+        // The two domains SHARE one `/ws/token` tail on purpose: a bare top-level `|` (the shape
+        // this entry arrived in) degrades to `(^A)|(B$)` under any caller that anchors without
+        // re-grouping, admitting both `api.ebanx.com/ws/tokenizer_admin` and
+        // `evil.com/api-diamond.ebanxpay.com/ws/token`. Keep the alternation wrapped.
+        //
+        // `api.ebanxpay.com` / `sandbox.ebanxpay.com` are the hosts a STOCK integration
+        // actually uses: every published EBANX JS SDK (1.6.0 through 1.11.0, verified
+        // against the live bundles) hardcodes
+        //   path: () => config.isLive() ? 'https://api.ebanxpay.com/' : 'https://sandbox.ebanxpay.com/'
+        // Without them we recognized only the `.ebanx.com` and `api-diamond` variants, so
+        // an ordinary EBANX checkout was invisible to us and the cardholder was never asked.
+        match: "(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\\.ebanx\\.com|(?:api-diamond|api|sandbox)\\.ebanxpay\\.com)/ws/token",
+        hosts: [
+            "^customer\\.ebanx\\.com$",
+            "^customer-frontier\\.ebanx\\.com$",
+            "^api\\.ebanx\\.com$",
+            "^sandbox\\.ebanx\\.com$",
+            "^api-local-latam\\.ebanx\\.com$",
+            "^sandbox-local-latam\\.ebanx\\.com$",
+            "^api-diamond\\.ebanxpay\\.com$",
+            "^api\\.ebanxpay\\.com$",
+            "^sandbox\\.ebanxpay\\.com$"
+        ],
+        encoding: "json",
+        passthroughHeaders: []
+    },
+    {
+        psp: "mercado_pago",
+        // PAN@ card_number. POST api.mercadopago.com/v1/card_tokens — the ONLY
+        // PAN egress in sdk.mercadopago.com/js/v2 (verified against the live bundle). No sandbox host:
+        // test mode is the TEST-* public_key. Auth + attribution ride the QUERY (the SDK's
+        // defaultQueries appends public_key, locale, js_version, referer), so replay the URL verbatim
+        // and never give `match` a trailing `$` — the SDK tests it unanchored against the raw URL.
+        // Same endpoint also serves saved-card {card_id,security_code} (no PAN) → check body before swap.
+        // (?![\w/-]) pins the exact endpoint: the `/card_tokens/{id}` sibling is a PUT carrying only
+        // {security_code,expiration_*} (no PAN), and the guard stops the SDK pausing it or /{id}/clone.
+        match: "api\\.mercadopago\\.com/v1/card_tokens(?![\\w/-])",
+        hosts: ["^api\\.mercadopago\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^x-product-id$"]
+        // SDK sets X-Product-Id on the tokenize POST
+    },
+    {
+        psp: "payu",
+        // GPO Secure Forms. PAN@ card.number.
+        match: "(secure\\.payu\\.com|(merch-prod|secure)\\.snd\\.payu\\.com)/api/front/tokens",
+        hosts: ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"],
+        encoding: "json",
+        passthroughHeaders: []
+    },
+    {
+        psp: "razorpay",
+        // PAN@ card[number] (form). Body carries risk/fingerprint fields — replay
+        // body verbatim, swap only card[*]. Auth = ?key_id= (or ?x_entity_id=) in the URL.
+        // THREE sinks, all POST, all carrying the SAME payload object. checkout-frame.js builds
+        // them as ib(r,"payments/create/ajax") and ib(r,"payments/create/"+(fees?"fees":"checkout")):
+        //   /ajax     XHR, standard flow
+        //   /checkout form-POST redirect flow
+        //   /fees     form-POST, customer-fee-bearer merchants
+        // `fees` is NOT optional: it is the same card body behind a boolean (vS(this.r, t.fees)),
+        // so dropping it silently un-intercepts every fee-bearer merchant.
+        // The optional `standard_checkout/` segment appears when a session_token is present
+        // (builder: api + "v1/" + "standard_checkout" + "/" + path).
+        // NOT matched, deliberately: the pg_router shape (api + "pg_router/" + "v1/" +
+        // "standard_checkout" + path — note the MISSING slash before the path). Every ib() call
+        // site passes only 2 args, so that flag is always false and the shape is unreachable for
+        // card paths. If Razorpay ever enables it we go inert (fail-closed), never leaky.
+        // NOT allowlisted, deliberately: api-<region>.razorpay.com. checkout.js only builds that
+        // when the merchant page sets Razorpay.config.api="" — page-controlled input must never
+        // widen a card allowlist.
+        match: "api\\.razorpay\\.com/v1/(?:standard_checkout/)?payments/create/(?:ajax|checkout|fees)",
+        hosts: ["^api\\.razorpay\\.com$"],
+        encoding: "form",
+        passthroughHeaders: ["^x-razorpay-sessionid$", "^x-customer-access-token$"]
+    },
+    {
+        psp: "mollie",
+        // Components v1+v2. PAN@ cardNumber. No sandbox host (body `testmode` boolean).
+        match: "api\\.cc\\.mollie\\.com/v1/card-tokens",
+        hosts: ["^api\\.cc\\.mollie\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        compose: { cardExpiryDate: "MM/YY" }
+    },
+    {
+        psp: "paysafe",
+        // Paysafe.js. PAN@ card.cardNum, expiry@ card.cardExpiry.{month,year}.
+        // `paymenthub/v1/singleusepaymenthandles` was pinned from the docs and
+        // has NEVER been observed in a capture; every run of the live SDK posts to
+        // `/js/api/v1/tokenize` instead, from hosted.paysafe.com's own iframe. Both are kept:
+        // the SUPH path may be reachable on integrations we have not exercised.
+        // Auth travels as `x-paysafe-credentials` on the observed path (NOT `Authorization`,
+        // which the docs describe for SUPH), so both are declared — replaying the wrong one
+        // gets the tokenization rejected.
+        // Token boundary is `(?![\w/-])`, not `(?!/)`: the server anchors `match` with ^(?:…)$
+        // so either works there, but the SDK compiles `match` with `i` ALONE (unanchored), and
+        // `(?!/)` lets `…/singleusepaymenthandlesEVIL` satisfy the browser-side pause test.
+        // NOTE: legacy Paysafe.js v1 (/customervault/v1/singleusetokens, same two hosts) is
+        // deliberately NOT covered here — it needs its own verification pass before adding.
+        // Checkout 1.8 uses a separate hosted origin, with the same nested card shape.
+        // Verified from https://hosted.test.paysafe.com/checkout/1.8.0/main.bundle.js
+        // and its byte-identical production sibling (SHA-256 e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c).
+        // Its native LIVE/TEST environment map selects exactly hosted[.test].paysafe.com.
+        // Keep host/path pairs separate: details/log are not card requests;
+        // card/tokenize uses a saved paymentToken, and 3DS-specific paths are unverified.
+        match: "(?:api(\\.test)?\\.paysafe\\.com/(?:paymenthub/v1/singleusepaymenthandles|js/api/v1/tokenize)|hosted(\\.test)?\\.paysafe\\.com/checkout/api/v1/tokenize)(?![\\w/-])",
+        hosts: ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^authorization$", "^x-paysafe-credentials$", "^correlationid$"]
+    },
+    {
+        psp: "recurly",
+        // PAN@ number (form-encoded POST). recurly.js hardcodes exactly TWO API bases:
+        // "https://api.recurly.com/js/v1" and "https://api.eu.recurly.com/js/v1". EU is auto-selected
+        // when the public key starts with `fra-`. No sandbox host: sandbox sites reuse api.recurly.com
+        // with a sandbox public key.
+        // WARNING: never widen these to [a-z0-9-]+\.recurly\.com. *.recurly.com is WILDCARD DNS (every
+        // merchant subdomain resolves to the same LB), so a broad host pattern is a card-exfil hole.
+        // (?![\w-]) excludes the live /js/v1/tokens sibling (iban/bacs/becs bank accounts + 3DS action
+        // results, no PAN); /js/v1/payment_methods/token is APM/wallet ({currency,amount}) and is
+        // excluded by the anchored path too.
+        // WARNING: the opt-in `cors:false` legacy path tokenizes over a JSONP GET, which the POST gate
+        // in isCardRequest cannot intercept. Default is `cors:true` (XHR POST), so this entry is live.
+        match: "api(\\.eu)?\\.recurly\\.com/js/v1/token(?![\\w-])",
+        hosts: ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"],
+        encoding: "form",
+        passthroughHeaders: ["^recurly-credential-checkout-hostname$"]
+        // only in configure({hostname}) mode
+    },
+    {
+        psp: "moneris",
+        compose: { input_exp: "MMYY" },
+        // Hosted Tokenization. VERIFIED live against hpp_common.js on all six
+        // hosts: the iframe does `request.open('POST', 'request.php')` (XHR, relative to
+        // /HPPtoken/index.php) with Content-Type application/x-www-form-urlencoded and
+        // PAN@ input_data. It sets no auth header (the HT profile is the ?id= on the iframe
+        // URL), so passthroughHeaders is correctly empty. hpp_common.js references exactly
+        // one URL and one method, so there is no second tokenization path to cover.
+        // NOTE: do NOT add Moneris Checkout (chkt/) as a separate entry. It shares these
+        // hosts and resolveRecognizerForUrl .find()s on host first, so one would permanently
+        // shadow the other; chkt/ instead falls out at the path check (refused, not leaked).
+        match: "(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\\.moneris\\.com/HPPtoken/request\\.php",
+        hosts: [
+            "^www3\\.moneris\\.com$",
+            "^esqa\\.moneris\\.com$",
+            "^gateway\\.moneris\\.com$",
+            "^gatewayqa\\.moneris\\.com$",
+            "^gatewayt\\.moneris\\.com$",
+            "^gatewaydev\\.moneris\\.com$"
+        ],
+        encoding: "form",
+        passthroughHeaders: []
+    },
+    {
+        psp: "bambora",
+        // Bambora NA / Worldline Custom Checkout. PAN@ number. POST. Content-Type is
+        // text/plain (preflight dodge) — replay verbatim; `encoding: 'json'` describes the body shape.
+        // No sandbox host: test mode rides the same host, decided by merchant id + API key.
+        // api.bam.shift4api.net is the post-migration host (Dec-2026 cutover); both hosts are pinned
+        // exact — never widen to the docs' *.bam.shift4api.net wildcard. api.na.bambora.com CNAMEs to
+        // the legacy beanstream.com origin; do NOT add www.beanstream.com, the browser SDK never calls it.
+        match: "(api\\.na\\.bambora\\.com|api\\.bam\\.shift4api\\.net)/scripts/tokenization/tokens",
+        hosts: ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"],
+        encoding: "json",
+        passthroughHeaders: []
+    },
+    {
+        psp: "global_payments",
+        // GlobalPayments.js, two gateways behind one PSP id. PAN@ card.number on
+        // both (verified in the shipped js.globalpay.com/v1/globalpayments.js, actionTokenize$3/$4).
+        // Heartland/Portico: prod api.heartlandportico.com/SecureSubmit.v1/api/token, sandbox
+        //   cert.api2.heartlandportico.com/Hps.Exchange.PosGateway.Hpf.v1/api/token. The host/path
+        //   pairing is ASYMMETRIC (prod is not api2, sandbox is not SecureSubmit.v1). That is the
+        //   vendor's own domains$4/urls$4 table, not a typo, so do not "correct" it. Auth is ?api_key=
+        //   in the URL, so there is nothing to replay in headers. api2.heartlandportico.com is
+        //   deliberately absent: it is the server-side PHP SDK's endpoint, never a browser call.
+        // GP-API/UCP: apis[.sandbox][.eu].globalpay.com/ucp/[merchants/{id}/]payment-methods, auth via
+        //   Authorization Bearer + X-GP-Version. All four hosts verified live and serving cross-origin
+        //   POST. accounts/{id}/ is deliberately NOT accepted: the tokenizer only ever prefixes
+        //   merchants/{id}/, so allowing it would widen the path with no endpoint behind it.
+        // Both gateways POST application/json, so isCardRequest's POST gate lets them through.
+        match: "(?:api\\.heartlandportico\\.com/SecureSubmit\\.v1/api/token|cert\\.api2\\.heartlandportico\\.com/Hps\\.Exchange\\.PosGateway\\.Hpf\\.v1/api/token|apis(?:\\.sandbox)?(?:\\.eu)?\\.globalpay\\.com/ucp/(?:merchants/[^/]+/)?payment-methods)",
+        hosts: [
+            "^api\\.heartlandportico\\.com$",
+            "^cert\\.api2\\.heartlandportico\\.com$",
+            "^apis\\.globalpay\\.com$",
+            "^apis\\.sandbox\\.globalpay\\.com$",
+            "^apis\\.eu\\.globalpay\\.com$",
+            "^apis\\.sandbox\\.eu\\.globalpay\\.com$"
+        ],
+        encoding: "json",
+        passthroughHeaders: ["^authorization$", "^x-gp-version$"]
+    }
+]);
+var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, ...definition }) => definition));
+var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
+    psp: definition.psp,
+    match: new RegExp(definition.match, "i"),
+    hosts: definition.hosts.map((source) => new RegExp(source, "i")),
+    encoding: definition.encoding,
+    headers: definition.passthroughHeaders.map((source) => new RegExp(source, "i")),
+    ...definition.mode ? { mode: definition.mode } : {},
+    ...definition.clientSideEncrypted ? { clientSideEncrypted: true } : {},
+    ...definition.compose ? { compose: definition.compose } : {},
+    ...definition.encryptedCardFields ? { cse: { fields: definition.encryptedCardFields } } : {},
+    ...definition.hostedForm ? { form: definition.hostedForm.card } : {}
+})));
+var BUILTIN_REGISTRY = deepFreeze(PSP_RECOGNIZERS.map(({ cse, hostedForm, ...definition }) => ({
+    ...definition,
+    match: new RegExp(definition.match, "i"),
+    passthroughHeaders: definition.passthroughHeaders.map((source) => new RegExp(source, "i"))
+})));
+var CHECKOUT_MODES = deepFreeze(["token", "cse", "hosted_form"]);
+function recognizerByPsp(psp) {
+    return typeof psp === "string" ? PSP_CLIENT_TABLE.find((entry) => entry.psp === psp) ?? null : null;
+}
+function trustedClientRecognizer(pspOrEntry) {
+    const psp = typeof pspOrEntry === "string" ? pspOrEntry : pspOrEntry?.psp;
+    const definition = recognizerByPsp(psp);
+    if (!definition)
+        throw new Error("Refusing to pay: unknown payment processor.");
+    return definition;
+}
+// src/request-policy.js
+var HEADER_NEVER_FORWARD = /^(cookie|set-cookie|authorization2|proxy-authorization|host|content-length|origin|referer)$/i;
+var ALLOWED_MEDIA_TYPES = {
+    json: ["application/json", "text/plain"],
+    form: ["application/x-www-form-urlencoded"]
+};
+function contentTypeFor(pspOrEntry, headers) {
+    const rec = trustedClientRecognizer(pspOrEntry);
+    const encoding = rec && rec.encoding === "form" ? "form" : "json";
+    const allowed = ALLOWED_MEDIA_TYPES[encoding];
+    const fallback = allowed[0];
+    const entry = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+    const raw = entry && entry[1];
+    if (typeof raw !== "string")
+        return fallback;
+    const base = raw.split(";")[0].trim().toLowerCase();
+    const worldpaySessionType = rec.psp === "worldpay" && encoding === "json" && base === "application/vnd.worldpay.sessions-v1.hal+json";
+    if (!allowed.includes(base) && !worldpaySessionType)
+        return fallback;
+    const charset = raw.match(/;\s*charset=([\w-]+)/i);
+    return charset ? `${base}; charset=${charset[1]}` : base;
+}
+function replayHeaders(pspOrEntry, captured = {}) {
+    const rec = trustedClientRecognizer(pspOrEntry);
+    const headers = { "content-type": contentTypeFor(rec, captured) };
+    for (const [name, value] of Object.entries(captured)) {
+        if (rec.headers.some((pattern) => pattern.test(name)) && !HEADER_NEVER_FORWARD.test(name))
+            headers[name] = value;
+    }
+    return headers;
+}
+var replayPolicy = Object.freeze({ contentTypeFor, HEADER_NEVER_FORWARD });
+// src/stripe-checkout.js
+var STRIPE_CHECKOUT_OPERATION = "stripe.device_checkout_confirm.v1";
+var STRIPE_CHECKOUT_CONTEXT_HEADER = "x-agentcard-stripe-checkout-context";
+var SESSION = /^cs_(?:test|live)_[A-Za-z0-9]{1,200}(?![\s\S])/;
+var KEY = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
+var SYNTHETIC = /^pm_agentcard_checkout_[A-Za-z0-9_-]{16,80}(?![\s\S])/;
+var reject = () => {
+    throw new Error("stripe_checkout_rejected");
+};
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var opaque = (value) => typeof value === "string" && value.length <= 8192 && !/[\x00-\x1f\x7f]/.test(value);
+var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function validateStripeCheckoutIdentity(value) {
+    if (!object(value) || !["test", "production"].includes(value.environment ?? "test") || value.environment === null || !["sessionId", "publishableKey", "livemode"].some((key) => Object.hasOwn(value, key)))
+        reject();
+    const environment = value.environment ?? "test", livemode = environment === "production";
+    const mode = livemode ? "live" : "test";
+    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
+        reject();
+    return Object.freeze({ environment, livemode });
+}
+var TEST_CARDS = ["4242424242424242", "4000000000000002", "4000002500003155"];
+var SYNTHETIC_CARDS = [...TEST_CARDS, "4111111111111111"];
+function validateStripeCheckoutCard(card, environment = "test") {
+    if (!["test", "production"].includes(environment) || !object(card) || typeof card.number !== "string" || typeof card.cvc !== "string" || !/^(?:0?[1-9]|1[0-2])(?![\s\S])/.test(String(card.month)) || !/^(?:\d{2}|\d{4})(?![\s\S])/.test(String(card.year)) || card.name !== void 0 && !opaque(card.name))
+        reject();
+    if (environment === "test") {
+        if (!TEST_CARDS.includes(card.number) || card.cvc !== "123")
+            reject();
+    }
+    else {
+        if (!/^\d{13,19}(?![\s\S])/.test(card.number) || /^(\d)\1+(?![\s\S])/.test(card.number) || !/^\d{3,4}(?![\s\S])/.test(card.cvc) || SYNTHETIC_CARDS.includes(card.number))
+            reject();
+        let sum = 0, double = false;
+        for (let i = card.number.length - 1; i >= 0; i--) {
+            let digit = Number(card.number[i]);
+            if (double) {
+                digit *= 2;
+                if (digit > 9)
+                    digit -= 9;
+            }
+            sum += digit;
+            double = !double;
+        }
+        if (sum % 10 !== 0)
+            reject();
+    }
+    return true;
+}
+function isStripeCheckoutHostedMode(value) {
+    return value === "hosted" || value === "hosted_page";
+}
+function encodeAscii(value) {
+    let result = "", bits = 0, count = 0;
+    for (const char of value) {
+        bits = bits << 8 | char.charCodeAt(0);
+        count += 8;
+        while (count >= 6) {
+            count -= 6;
+            result += alphabet[bits >>> count & 63];
+        }
+    }
+    return result + (count ? alphabet[bits << 6 - count & 63] : "");
+}
+function context(value) {
+    if (!object(value) || Object.keys(value).length !== 3 || value.version !== 1 || !["version", "session_id", "synthetic_payment_method_id"].every((key) => Object.hasOwn(value, key)) || !SESSION.test(value.session_id) || !SYNTHETIC.test(value.synthetic_payment_method_id))
+        reject();
+    return { version: 1, session_id: value.session_id, synthetic_payment_method_id: value.synthetic_payment_method_id };
+}
+function encodeStripeCheckoutContext(value) {
+    return encodeAscii(JSON.stringify(context(value)));
+}
+function hasStripeCheckoutMarker(request) {
+    return object(request?.headers) && Object.keys(request.headers).some((key) => key.toLowerCase() === STRIPE_CHECKOUT_CONTEXT_HEADER);
+}
+function parseStripeCheckoutContext(request) {
+    const entries = Object.entries(request?.headers ?? {}).filter(([key]) => key.toLowerCase() === STRIPE_CHECKOUT_CONTEXT_HEADER);
+    if (!entries.length)
+        return null;
+    if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
+        reject();
+    const encoded = entries[0][1];
+    let text = "", bits = 0, count = 0;
+    for (const char of encoded) {
+        bits = bits << 6 | alphabet.indexOf(char);
+        count += 6;
+        if (count >= 8) {
+            count -= 8;
+            text += String.fromCharCode(bits >>> count & 255);
+        }
+    }
+    let value;
+    try {
+        value = context(JSON.parse(text));
+    }
+    catch {
+        reject();
+    }
+    if (encodeStripeCheckoutContext(value) !== encoded)
+        reject();
+    return value;
+}
+function endpoint(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.origin !== "https://api.stripe.com" || url.port || url.username || url.password || url.search || url.hash)
+        return null;
+    return url;
+}
+function isStripeCheckoutEndpoint(raw) {
+    const url = endpoint(raw);
+    const match = url && /^\/v1\/payment_pages\/(cs_(?:test|live)_[A-Za-z0-9]+)\/confirm$/.exec(url.pathname);
+    return !!match && SESSION.test(match[1]);
+}
+var finalFields = /* @__PURE__ */ new Set([
+    "payment_method",
+    "key",
+    "expected_amount",
+    "expected_payment_method_type",
+    "payment_method_data[billing_details][email]",
+    "init_checksum",
+    "js_checksum",
+    "version",
+    "rv_timestamp",
+    "eid",
+    "link_brand",
+    "guid",
+    "muid",
+    "sid",
+    "passive_captcha_token",
+    "passive_captcha_ekey",
+    ...[
+        "checkout_config_id",
+        "checkout_session_id",
+        "client_session_id",
+        "merchant_integration_source",
+        "merchant_integration_version",
+        "payment_method_selection_flow"
+    ].map((key) => `client_attribution_metadata[${key}]`),
+    ...["shipping_rate_amount", "subtotal", "total_discount_amount", "total_exclusive_tax", "total_inclusive_tax"].map((key) => `last_displayed_line_item_group_details[${key}]`)
+]);
+var addressFields = ["city", "country", "line1", "line2", "postal_code", "state"];
+var tokenFields = /* @__PURE__ */ new Set([
+    "type",
+    "key",
+    "card[number]",
+    "card[cvc]",
+    "card[exp_month]",
+    "card[exp_year]",
+    "billing_details[name]",
+    "billing_details[email]",
+    "billing_details[phone]",
+    "allow_redisplay",
+    ...addressFields.map((key) => `billing_details[address][${key}]`),
+    "guid",
+    "muid",
+    "sid",
+    "payment_user_agent",
+    "referrer",
+    "time_on_page",
+    ...[
+        "checkout_config_id",
+        "checkout_session_id",
+        "client_session_id",
+        "merchant_integration_source",
+        "merchant_integration_version",
+        "payment_method_selection_flow"
+    ].map((key) => `client_attribution_metadata[${key}]`)
+]);
+function form(request, fields) {
+    if (!object(request) || request.method !== "POST" || typeof request.body !== "string" || request.body.length > 2e4 || !object(request.headers) || Object.keys(request.headers).length > 40 || Object.values(request.headers).some((value) => !opaque(value)))
+        reject();
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const raw of request.body.split("&")) {
+        const index = raw.indexOf("=");
+        if (index < 1)
+            reject();
+        let key, value;
+        try {
+            key = decodeURIComponent(raw.slice(0, index).replace(/\+/g, " "));
+            value = decodeURIComponent(raw.slice(index + 1).replace(/\+/g, " "));
+        }
+        catch {
+            reject();
+        }
+        if (!fields.has(key) || seen.has(key) || !opaque(value))
+            reject();
+        seen.add(key);
+        pairs.push({ key, value, raw });
+    }
+    return { pairs, values: new Map(pairs.map(({ key, value }) => [key, value])) };
+}
+function keyFor(request, values, expected) {
+    const authorization = Object.entries(request.headers).filter(([key2]) => key2.toLowerCase() === "authorization");
+    if (authorization.length > 1)
+        reject();
+    let headerKey;
+    if (authorization.length) {
+        const match = /^Bearer (pk_(?:test|live)_[A-Za-z0-9_]{1,256})$/.exec(authorization[0][1]);
+        if (!match)
+            reject();
+        headerKey = match[1];
+    }
+    const key = values.get("key") || headerKey;
+    if (!KEY.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
+        reject();
+    return key;
+}
+var billingEmail = (value) => value === null || typeof value === "string" && value.length > 0 && value.length <= 320 && opaque(value);
+function captureStripeCheckoutBilling(request, options) {
+    const phase = classifyStripeCheckoutRequest(request, options);
+    if (phase?.phase !== "tokenization" || !SYNTHETIC.test(options?.syntheticPaymentMethodId))
+        reject();
+    const email = form(request, tokenFields).values.get("billing_details[email]") ?? null;
+    if (!billingEmail(email))
+        reject();
+    return Object.freeze({
+        session_id: phase.session_id,
+        synthetic_payment_method_id: options.syntheticPaymentMethodId,
+        email
+    });
+}
+function attachStripeCheckoutBilling(request, captured, options) {
+    const phase = classifyStripeCheckoutRequest(request, options);
+    if (phase?.phase !== "final" || !object(captured) || Object.keys(captured).length !== 3 || !["session_id", "synthetic_payment_method_id", "email"].every((key) => Object.hasOwn(captured, key)) || captured.session_id !== phase.session_id || captured.synthetic_payment_method_id !== phase.synthetic_payment_method_id || !billingEmail(captured.email))
+        reject();
+    const field = "payment_method_data[billing_details][email]";
+    const existing = form(request, finalFields).values.get(field);
+    if (existing !== void 0 && existing !== captured.email)
+        reject();
+    if (captured.email === null || existing !== void 0)
+        return { ...request };
+    const body = `${request.body}&${encodeURIComponent(field)}=${encodeURIComponent(captured.email)}`;
+    const result = { ...request, body };
+    classifyStripeCheckoutRequest(result, options);
+    return result;
+}
+function classifyStripeCheckoutRequest(request, options = {}) {
+    const url = endpoint(request?.url);
+    if (!url) {
+        if (hasStripeCheckoutMarker(request))
+            reject();
+        return null;
+    }
+    const final = isStripeCheckoutEndpoint(request.url);
+    const token = url.pathname === "/v1/payment_methods";
+    if (!final && !token) {
+        if (hasStripeCheckoutMarker(request))
+            reject();
+        return null;
+    }
+    if (token && options.sessionId === void 0 && !hasStripeCheckoutMarker(request))
+        return null;
+    const marker = parseStripeCheckoutContext(request);
+    const sessionId = final ? url.pathname.split("/")[3] : options.sessionId;
+    if (!SESSION.test(sessionId) || options.sessionId !== void 0 && options.sessionId !== sessionId || marker && marker.session_id !== sessionId)
+        reject();
+    const { values } = form(request, final ? finalFields : tokenFields);
+    const key = keyFor(request, values, options.publishableKey);
+    validateStripeCheckoutIdentity({ environment: options.environment, sessionId, publishableKey: key });
+    const attributionSession = values.get("client_attribution_metadata[checkout_session_id]");
+    if (attributionSession !== void 0 && attributionSession !== sessionId)
+        reject();
+    if (token) {
+        const number = values.get("card[number]");
+        if (values.get("type") !== "card" || typeof number !== "string" || number.length > 64 || /[^0-9 -]/.test(number) || !["4111111111111111", "4242424242424242"].includes(number.replace(/[ -]/g, "")) || !/^\d{3}$/.test(values.get("card[cvc]") ?? "") || !/^(?:0?[1-9]|1[0-2])$/.test(values.get("card[exp_month]") ?? "") || !/^(?:\d{2}|\d{4})$/.test(values.get("card[exp_year]") ?? "") || values.has("allow_redisplay") && values.get("allow_redisplay") !== "unspecified")
+            reject();
+        return { phase: "tokenization", session_id: sessionId, publishable_key: key };
+    }
+    const amount = values.get("expected_amount");
+    const syntheticId = values.get("payment_method");
+    const email = values.get("payment_method_data[billing_details][email]");
+    if (email !== void 0 && !billingEmail(email))
+        reject();
+    if (!/^[1-9]\d{0,11}$/.test(amount ?? "") || !Number.isSafeInteger(Number(amount)) || options.amountCents !== void 0 && options.amountCents !== Number(amount) || values.get("expected_payment_method_type") !== "card" || !SYNTHETIC.test(syntheticId) || ["init_checksum", "js_checksum", "version", "rv_timestamp"].some((key2) => !values.get(key2)) || options.syntheticPaymentMethodId !== void 0 && options.syntheticPaymentMethodId !== syntheticId || marker && marker.synthetic_payment_method_id !== syntheticId)
+        reject();
+    return {
+        phase: "final",
+        session_id: sessionId,
+        publishable_key: key,
+        synthetic_payment_method_id: syntheticId,
+        amount_cents: Number(amount),
+        currency: "usd"
+    };
+}
+function createStripeCheckoutTokenizationStub(request, options) {
+    const phase = classifyStripeCheckoutRequest(request, options);
+    if (phase?.phase !== "tokenization" || !SYNTHETIC.test(options?.syntheticPaymentMethodId))
+        reject();
+    const { values } = form(request, tokenFields);
+    const address = Object.fromEntries(addressFields.filter((key) => values.has(`billing_details[address][${key}]`)).map((key) => [key, values.get(`billing_details[address][${key}]`)]));
+    const billing = Object.fromEntries(["name", "email", "phone"].filter((key) => values.has(`billing_details[${key}]`)).map((key) => [key, values.get(`billing_details[${key}]`)]));
+    const year = values.get("card[exp_year]");
+    return { status: 200, headers: { "content-type": "application/json" }, body: JSON.stringify({
+            id: options.syntheticPaymentMethodId,
+            object: "payment_method",
+            type: "card",
+            livemode: validateStripeCheckoutIdentity({ environment: options.environment, sessionId: phase.session_id }).livemode,
+            billing_details: { ...billing, address },
+            card: {
+                brand: "visa",
+                last4: "4242",
+                exp_month: Number(values.get("card[exp_month]")),
+                exp_year: Number(year.length === 2 ? `20${year}` : year),
+                funding: "credit",
+                country: "US"
+            }
+        }) };
+}
+var terminalFields = /* @__PURE__ */ new Set([
+    "id",
+    "object",
+    "state",
+    "status",
+    "payment_status",
+    "currency",
+    "livemode",
+    "session_id",
+    "mode",
+    "ui_mode",
+    "success_url",
+    "return_url"
+]);
+function parseStripeCheckoutResponse(raw, options) {
+    let value;
+    try {
+        value = typeof raw === "string" ? JSON.parse(raw) : raw;
+        validateStripeCheckoutIdentity({ environment: options?.environment, sessionId: options?.sessionId, livemode: value?.livemode });
+    }
+    catch {
+        return null;
+    }
+    if (!object(value) || !SESSION.test(options?.sessionId) || value.session_id !== options.sessionId || Object.keys(value).some((key) => !terminalFields.has(key)) || !["id", "object", "state", "status", "payment_status", "currency", "livemode", "session_id", "mode", "ui_mode"].every((key) => Object.hasOwn(value, key)) || typeof value.id !== "string" || !/^[A-Za-z0-9_]{1,256}(?![\s\S])/.test(value.id) || value.object !== "checkout.session" || value.state !== "succeeded" || value.status !== "complete" || value.payment_status !== "paid" || value.currency !== "usd" || value.mode !== "payment" || !isStripeCheckoutHostedMode(value.ui_mode))
+        return null;
+    for (const key of ["success_url", "return_url"]) {
+        if (!Object.hasOwn(value, key) || value[key] === null)
+            continue;
+        if (typeof value[key] !== "string" || value[key].length > 2048)
+            return null;
+        let url;
+        try {
+            url = new URL(value[key]);
+        }
+        catch {
+            return null;
+        }
+        let parameters;
+        try {
+            parameters = decodeURIComponent(url.search + url.hash);
+        }
+        catch {
+            return null;
+        }
+        if (url.protocol !== "https:" || url.username || url.password || options.returnOrigin !== void 0 && url.origin !== options.returnOrigin || /(?:client_secret|payment_method|secret_)/i.test(parameters))
+            return null;
+    }
+    return { ...value };
+}
+function prepareStripeCheckoutReplay(request, card, options = {}) {
+    const marker = parseStripeCheckoutContext(request);
+    if (!marker)
+        reject();
+    const phase = classifyStripeCheckoutRequest(request, {
+        ...options,
+        sessionId: marker.session_id,
+        syntheticPaymentMethodId: marker.synthetic_payment_method_id
+    });
+    if (phase?.phase !== "final" || options.amountCents !== void 0 && phase.amount_cents !== options.amountCents || options.sessionId !== void 0 && options.sessionId !== marker.session_id || !validateStripeCheckoutCard(card, options.environment))
+        reject();
+    const replacements = {
+        "payment_method_data[type]": "card",
+        "payment_method_data[card][number]": card.number,
+        "payment_method_data[card][cvc]": card.cvc,
+        "payment_method_data[card][exp_month]": String(card.month),
+        "payment_method_data[card][exp_year]": String(card.year),
+        ...card.name ? { "payment_method_data[billing_details][name]": card.name } : {}
+    };
+    const inline = Object.entries(replacements).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+    const body = form(request, finalFields).pairs.map((pair) => pair.key === "payment_method" ? inline : pair.raw).join("&");
+    return {
+        psp: "stripe",
+        request: { url: request.url, method: "POST", headers: replayHeaders("stripe", request.headers), body },
+        where: Object.keys(replacements)
+    };
+}
+export { STRIPE_CHECKOUT_CONTEXT_HEADER, STRIPE_CHECKOUT_OPERATION, attachStripeCheckoutBilling, captureStripeCheckoutBilling, classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, hasStripeCheckoutMarker, isStripeCheckoutEndpoint, isStripeCheckoutHostedMode, parseStripeCheckoutContext, parseStripeCheckoutResponse, prepareStripeCheckoutReplay, validateStripeCheckoutCard, validateStripeCheckoutIdentity };