@agent-cards/sdk 0.20.0 → 0.22.0

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: b51ce95dc43d8ab4a7576f0cd0b2309802bb124e15197d5026a2202524d6ccf0
+// artifact-sha256: f3bee23e52b029d04c67ea1b9249334bd649c09b46367ee3c8afcb841a7cb50d
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -205,9 +205,10 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // Accept.js. PAN@ securePaymentContainerRequest.data.token.cardNumber.
         // Auth is body-level (merchantAuthentication: apiLoginID + clientKey) — nothing to replay.
         // NOTE: prod is api2, not api. `api.authorize.net` is the server-side AIM/API host and is
-        // deliberately NOT allowlisted — a browser never posts a PAN there. Legacy SIM/DPM
-        // (secure2.authorize.net/gateway/transact.dll) is excluded for the same reason plus: it is
-        // retired, and it is a top-level form POST rather than an XHR.
+        // deliberately NOT allowlisted: a browser never posts a PAN there. SIM and DPM
+        // (secure2.authorize.net/gateway/transact.dll) are deprecated by Authorize.Net, not retired, and
+        // post the card as a top-level form navigation rather than an XHR: the separate
+        // authorize_net_dpm entry (mode hosted_form) covers them, on hosts this entry never shares.
         // Coverage caveat: AcceptUI (the hosted lightbox) renders its fields inside an
         // accept.authorize.net iframe, so that POST is cross-origin to the merchant page and an
         // in-page hook cannot observe it. This entry covers the Accept.js custom-fields path, which
@@ -232,6 +233,35 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         encoding: "json",
         passthroughHeaders: ["^accept$"]
     },
+    {
+        psp: "worldpay_eprotect",
+        // Worldpay eProtect (Vantiv / Litle PayPage), not Access Worldpay above.
+        // The first card request that is a GET: the vendor's eProtect-api / litle-api scripts (and the
+        // Worldpay iframe, which runs them) inject ONE JSONP <script> whose query carries the PAN and CVV
+        // RSA-encrypted under the vendor's per-environment key. eprotect.js holds the query grammar,
+        // the pinned keys and the answer rules; recognition also requires isEprotectTokenRequest, so
+        // ppstats, script files, payframes and every other /eProtect/paypage query stay unrecognized.
+        // The alternation is wrapped (the EBANX rule) and the path has a right-edge guard for the SDK's
+        // unanchored test.
+        match: "(?:request\\.eprotect\\.vantivcnp\\.com|request\\.eprotect\\.vantivprelive\\.com)/eProtect/paypage(?![\\w/.-])",
+        hosts: ["^request\\.eprotect\\.vantivcnp\\.com$", "^request\\.eprotect\\.vantivprelive\\.com$"],
+        // Pre-live (certification) host: sandbox rows only, and only the guide's test cards on the device.
+        sandboxHosts: ["^request\\.eprotect\\.vantivprelive\\.com$"],
+        hostEnvironmentPinned: true,
+        // Ships dark: served only to an SDK that declares this capability, and gated off for every org
+        // until an operator allowlists one (CHECKOUT_GATED_PROCESSOR_ORGS).
+        capability: "worldpay_eprotect_jsonp",
+        // Merchant deadlines are 10 to 15 s with a 5 s failover, so the cardholder approves before Pay.
+        preparationRequired: true,
+        // `encoding` describes the query, since the request has no body. No captured header is ever
+        // replayed, and the card rides in the query of one GET whose answer is JSONP.
+        encoding: "form",
+        passthroughHeaders: [],
+        request: { method: "GET", cardIn: "query", response: "jsonp" },
+        // The api3 failover host re-sends the same query after 5 s. The SDK aborts it; it is never a
+        // destination, so it is in no `hosts`, manifest, CSP or relay list.
+        abortHosts: ["^secondary\\.eprotect\\.vantivcnp\\.com$"]
+    },
     {
         psp: "nuvei",
         // Safecharge Fields. PAN@ paymentOption.card.cardNumber.
@@ -247,7 +277,20 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"],
         sandboxHosts: ["^ppp-test\\.safecharge\\.com$"],
         encoding: "json",
-        passthroughHeaders: []
+        passthroughHeaders: [],
+        // Where Nuvei's own scripts put the card, read from safecharge.js and
+        // fields/sfc_inner_card.min.js: paymentOption.card on all three endpoints,
+        // and cardData when Nuvei Fields' getToken posts cardTokenization.do. The
+        // initPayment and clientPayment endpoints also pay without a card: with a
+        // ccTempToken the merchant's server issued (Air France completes its Nuvei
+        // payments this way, behind Amadeus), a saved userPaymentOptionId, a wallet
+        // or an APM. createPayment sends each of those to initPayment first and then
+        // to clientPayment, so both continue untouched. A tokenization without a
+        // card is refused. So is a payment without a card once the attachment has
+        // handed Nuvei the card: its token may be one Nuvei minted from the
+        // approved card (checkout client.ts withoutCard).
+        jsonCardFields: [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]],
+        passWithoutCard: "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do"
     },
     // bluesnap: DELIBERATELY NOT SHIPPED — it cannot be intercepted at all. Its tokenizer is a PUT, and isCardRequest
     // gates on POST — but accepting PUT is not enough on its own. hpf.js fires the
@@ -517,6 +560,139 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         encoding: "json",
         passthroughHeaders: ["^authorization$", "^x-gp-version$"]
     },
+    {
+        psp: "authorize_net_dpm",
+        // Authorize.Net Direct Post Method and SIM with a relay response: deprecated by Authorize.Net, still
+        // served, end of life "to be determined" (upgrade guide; SIM guide ch. 3 and app. C; sdk-php 1.9.9
+        // AuthorizeNetDPM, sdk-dotnet 1.8.1 DPMFormGenerator, sdk-ruby 1.8.1, sdk-java 1.8.0). The merchant's
+        // own card form (DPM), or Authorize.Net's hosted form the merchant frames (SIM, x_show_form=pf_receipt),
+        // posts ONE form navigation, application/x-www-form-urlencoded, to /gateway/transact.dll with the
+        // plaintext card in x_card_num, x_exp_date (one field: MMYY, MM/YY, MM-YY, MMYYYY, MM/YYYY or
+        // MM-YYYY) and, only when the merchant collects it, x_card_code. Beside it rides the merchant's
+        // fingerprint: x_login (the public API Login ID), x_fp_sequence, x_fp_timestamp and x_fp_hash, an HMAC
+        // over login^sequence^timestamp^amount^currency under the merchant's Signature Key. Authorize.Net
+        // refuses it after 1 hour (97), spends it once (98) and refuses a changed amount (99). It POSTs the
+        // result to x_relay_url server to server, then answers whichever browser submitted with the
+        // merchant's relay page. No cookie, no auth header and no encryption, so this is Tranzila's
+        // hosted_form: the cardholder's device rebuilds and submits the same form and the paused navigation
+        // resolves with the synthetic page. No relay and no prepare(): the create refuses a fingerprint more
+        // than 40 minutes old or more than 15 minutes ahead instead (authorize-net-dpm.js, with the rest of
+        // the template policy). Authorize.Net reads field names without regard to case (live forms post
+        // x_Background_URL and x_cust_ID), so every key comparison for this entry ignores case.
+        // The same URL without a card continues untouched: SIM step 1 (x_show_form=PAYMENT_FORM), an eCheck
+        // (x_method=ECHECK) and Visa Checkout on the SIM form. NOT here: api2 and apitest (Accept.js, the
+        // authorize_net entry); never armed: cardpresent., api., accept., captcha., account. and
+        // sandbox.authorize.net. Hosts are the three literal labels. test.authorize.net is Authorize.Net's
+        // sandbox gateway, pinned to test rows and documented test cards (S7).
+        // Ships dark: served only to a client that declares authorize_net_dpm_form, gated off for every org
+        // until an operator allowlists one, and never sent by autopilot (EXCLUDED_OPERATIONS).
+        capability: "authorize_net_dpm_form",
+        match: "(secure2|secure|test)\\.authorize\\.net/gateway/transact\\.dll(?![\\w/.-])",
+        hosts: ["^secure2\\.authorize\\.net$", "^secure\\.authorize\\.net$", "^test\\.authorize\\.net$"],
+        sandboxHosts: ["^test\\.authorize\\.net$"],
+        hostEnvironmentPinned: true,
+        // The endpoint is the bare URL: a query string or a fragment, even an empty one, is not this
+        // endpoint (recognition.js resolveRecognizerForUrl), so the create, the vault and the enclave all
+        // refuse it. transact.dll can read a query parameter as a form field, which would carry x_tran_key,
+        // x_type or x_relay_url past the template policy, and the URL is stored with the row.
+        bareEndpoint: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        caseInsensitiveFormKeys: true,
+        cardFields: ["x_card_num"],
+        passWithoutCard: "(secure2|secure|test)\\.authorize\\.net/gateway/transact\\.dll",
+        mode: "hosted_form",
+        hostedForm: {
+            required: ["x_login", "x_amount", "x_fp_sequence", "x_fp_timestamp", "x_fp_hash", "x_relay_response"],
+            // One composed expiry field, written in the width and separator of the agent's dummy.
+            card: { number: "x_card_num", expiry: "x_exp_date", cvc: "x_card_code" },
+            // Filled only when the template carries the key; never added.
+            optional: ["cvc"],
+            amount: { sum: "x_amount", currency: "x_currency_code" },
+            // Authorize.Net spends a fingerprint once, so the fingerprint is the submission.
+            dedupe: ["x_login", "x_fp_sequence", "x_fp_timestamp", "x_fp_hash"],
+            // Absent or empty also means AUTH_CAPTURE.
+            sale: { key: "x_type", values: ["AUTH_CAPTURE"] },
+            callbackUrls: ["x_relay_url", "x_receipt_link_url", "x_cancel_url"],
+            policy: "authorize_net_dpm"
+        }
+    },
+    {
+        psp: "primer",
+        // Primer Web SDK v2 (Headless Checkout and hosted fields): Printful (printful.com) loads
+        // sdk.primer.io/web/v2.63.0; GetYourGuide (getyourguide.com) tokenizes with Primer's hosted fields and
+        // Primer routes the token to Adyen, Checkout.com or J.P. Morgan server side. PAN@ paymentInstrument.number,
+        // with cvv, expirationMonth (MM) and expirationYear (YYYY) beside it. Primer's hidden api-controller iframe
+        // (origin https://sdk.primer.io) resolves the core's "$.cardNumber-card" placeholders and POSTs plaintext
+        // JSON to `${pciUrl}/payment-instruments`, with the session's primer-client-token and no client-side
+        // encryption. pciUrl comes from the session: sdk.api.sandbox.primer.io (Primer's iOS client-token fixture),
+        // sdk.api.primer.io (production, inferred from the same naming and DNS; confirmed on first observation).
+        // The same URL also tokenizes PayPal, Apple Pay, Google Pay and Klarna with no card: jsonCardFields and
+        // passWithoutCard let those continue untouched. The siblings on the host (/{id}/exchange for a saved card,
+        // /{id}/vault, /payments, /3ds, /three-d-secure, /client-session) never carry a new card, and the
+        // right-edge boundary and the exact-URL rule in resolveRecognizerForUrl keep them out. primer.js judges the
+        // whole request, refuses a body that asks Primer to save the card (tokenType MULTI_USE, paymentFlow VAULT),
+        // Primer Checkout's primer-js SDK (its request gives up after 30 s) and a preferredNetwork that is not the
+        // card's own, and writes only the card fields. Staging and dev hosts are deliberately absent, and the
+        // sandbox host is pinned (S7): a sandbox row sends only documented test cards there, a live row never
+        // points at it. The request names no amount: the token is charged later.
+        // Ships dark: served only to a client that declares `primer_payment_instruments`, gated off for every
+        // org until an operator allowlists one, and never replayed by autopilot (EXCLUDED_OPERATIONS). A client
+        // session can save the card with no sign in the request, so the API also refuses every live row at
+        // create until the cardholder can consent to that save; only a test row pays.
+        capability: "primer_payment_instruments",
+        match: "sdk\\.api(?:\\.sandbox)?\\.primer\\.io/payment-instruments(?![\\w/.-])",
+        hosts: ["^sdk\\.api\\.primer\\.io$", "^sdk\\.api\\.sandbox\\.primer\\.io$"],
+        sandboxHosts: ["^sdk\\.api\\.sandbox\\.primer\\.io$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // What Primer's controller sends beside the body; primer.js checks their shapes before any replay.
+        passthroughHeaders: [
+            "^primer-client-token$",
+            "^primer-sdk-client$",
+            "^primer-sdk-version$",
+            "^primer-sdk-checkout-session-id$",
+            "^x-api-version$",
+            "^x-request-id$"
+        ],
+        jsonCardFields: [["paymentInstrument", "number"]],
+        passWithoutCard: "sdk\\.api(?:\\.sandbox)?\\.primer\\.io/payment-instruments"
+    },
+    {
+        psp: "amadeus_checkout",
+        // Outpayce (Amadeus Payment Platform): Air France and KLM, one shared release.
+        // PAN@ data.mopdata.pan (JSON, plaintext inside TLS). Two card-bearing XHRs on one host:
+        //   1. Checkout Web SDK: the SDK hands {PPID, data, action} to its tunnel iframe
+        //      (prd.payment.amadeus.com/checkout/sdk/<v>/form-fields/tunnel.html), which swaps the pan and
+        //      CVV iframes' ids for the typed digits and posts it to ARIAPP/pay: text/plain, no cookies, a
+        //      30 s timeout, HTTP 200 only.
+        //   2. Data Collection Page (DCP): the page at /1ASIATP/ATPDCP/land/?DCPID= posts
+        //      {DCPID, action, data} to ATPDCP/collect, same-origin JSON, the whole card in one body.
+        // ONE URL, MANY ACTIONS. Only an add carrying a card mopid's pan, or a store carrying a pan, is a
+        // card request (amadeus-body.js, which card-fields.js asks for this psp); load, bin, prepare,
+        // obfees, installments, tdsinit, verify, fetch, cancel, the wallet actions and DCP bin_check,
+        // expired and back carry at most the agent's dummy and continue untouched (passWithoutCard).
+        // amadeus-checkout.js holds the exact-URL rule, the whole-request check, both fills and the answer
+        // judge (sources there). Hosts are the two literal paypages hosts, never a wildcard label:
+        // paypages.dev (1ASIATPD), the airline intranet hosts, the playground, paypages.*.payment.outpayce.com
+        // (resolves, but no shipped SDK allowlists it) and the hosted page's own origin are absent, and the
+        // test host takes no DCP store until one is observed. The test host is pinned (S7): a create
+        // refuses it on a live row, and the device sends it only documented test cards.
+        // Ships dark: served only to a client that declares amadeus_checkout_actions.v1 (one that judges
+        // these bodies and prepares before the page's first request), gated off for every org until an
+        // operator allowlists one, prepared before Pay (S4: the tunnel abandons the add after 30 s), and
+        // never replayed by autopilot (EXCLUDED_OPERATIONS).
+        capability: "amadeus_checkout_actions.v1",
+        match: "(?:paypages\\.payment\\.amadeus\\.com/1ASIATP/(?:ARIAPP/pay|ATPDCP/collect)|paypages\\.test\\.payment\\.amadeus\\.com/1ASIATP[UMK]?/ARIAPP/pay)(?![\\w/.-])",
+        hosts: ["^paypages\\.payment\\.amadeus\\.com$", "^paypages\\.test\\.payment\\.amadeus\\.com$"],
+        sandboxHosts: ["^paypages\\.test\\.payment\\.amadeus\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        passthroughHeaders: ["^amadeus-checkout-sdk-version$", "^amadeus-checkout-sdk-host$", "^amadeus-checkout-sdk-flavor$"],
+        jsonCardFields: [["data", "mopdata", "pan"]],
+        passWithoutCard: "(?:paypages\\.payment\\.amadeus\\.com/1ASIATP/(?:ARIAPP/pay|ATPDCP/collect)|paypages\\.test\\.payment\\.amadeus\\.com/1ASIATP[UMK]?/ARIAPP/pay)"
+    },
     // ── Encrypted on the device under a pinned key ────────────────────────────
     {
         psp: "fiserv",
@@ -573,6 +749,38 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             fields: ["keyId", "encryptedKey", "encryptionBlock", "aesIv"]
         }
     },
+    {
+        psp: "verifone",
+        // Verifone eCommerce Secure Card Capture (verifone.js), The Container Store's card path. The
+        // merchant's page encrypts the card with OpenPGP under the merchant's own Verifone key and
+        // posts the blob to the MERCHANT's server, which calls Verifone: nothing card-bearing goes
+        // from the browser to a Verifone host. So this entry recognizes no URL and names no host: a
+        // Verifone card request is found only through a reviewed merchant profile
+        // (verifone-profiles.js), whose endpoint, body rules and pinned key (verifone-keys.js) the
+        // backend, the SDK and the Vault page read by the profile's id (verifone.js). `hosts` is empty
+        // and `match` never matches, so the registry, the enclave's destinations and the SDK's card
+        // patterns gain nothing, and resolveRecognizerForUrl never resolves a URL to verifone. The
+        // blob is a 15-minute bearer at the merchant and a 3-D Secure challenge needs the cardholder,
+        // so the cardholder approves every payment: dark until an org is allowlisted, and autopilot
+        // refuses verifone at all three gates.
+        capability: "verifone_card_capture",
+        // A Verifone card is encrypted only for a request the cardholder already approved through a
+        // prepare() for the same reviewed profile: the backend refuses an unprepared create (409
+        // preparation_required) and the SDK refuses locally before it prompts, as for Fiserv.
+        preparationRequired: true,
+        match: "(?!)",
+        hosts: [],
+        encoding: "json",
+        // The browser continues the merchant's own request with its own headers; none is stored.
+        passthroughHeaders: [],
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: {
+            // Where the blob sits is each profile's leg (holder and field), never one path for the psp.
+            at: "merchant_profile",
+            fields: ["encryptedCard"]
+        }
+    },
     {
         psp: "gravy",
         // Gravy (Gr4vy) payment orchestration, Secure Fields. PAN@ payment_method.number,
@@ -632,9 +840,395 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hostEnvironmentPinned: true,
         encoding: "json",
         passthroughHeaders: ["^x-mp-client-type$"]
+    },
+    {
+        psp: "cybersource_flex",
+        // CyberSource Flex Microform v2. ONE card-bearing request: a POST from a Microform field
+        // iframe (the loader picks the number or the securityCode iframe at random) to the capture
+        // context's flx.origin + flx.path, /flex/v2/tokens, sent as `application/jwt; charset=utf-8`
+        // with a 30 s XHR timeout. The body is a compact JWE the iframe seals under the context's own
+        // key, so it is opaque: no injector exists (injectCard and prepareDeviceReplay refuse this
+        // psp), and the device verifies the context, rebuilds the iframe's plaintext with the real
+        // card and seals it itself (cybersource-flex-replay.js). The same URL also carries Microform
+        // v0.11 and Flex API v2 direct traffic, so recognition is not coverage: the SDK creates only
+        // for a POST from a reviewed v2 field iframe whose fragment record it holds.
+        // Excluded on purpose: api/apitest.cybersource.com (server APIs, never a browser card),
+        // /flex/v1/tokens, /flex/v2/public-keys/*, /microform/bundle/* and flex.in.cybersource.com
+        // (it resolves but serves neither keys nor bundles). No other entry shares these hosts.
+        // `capability` names the capture-context sidecar a client must send on create (the reviewed
+        // "sidecar" negotiation term): the entry stays out of BUILTIN_REGISTRY, is served only to a
+        // client that declares it, and is off for every org until one is opted in. testflex is the
+        // sandbox host and the environment is pinned (S7): test kids and testflex only on sandbox rows.
+        capability: "capture_context",
+        match: "(?:test)?flex\\.cybersource\\.com/flex/v2/tokens(?![\\w/-])",
+        hosts: ["^flex\\.cybersource\\.com$", "^testflex\\.cybersource\\.com$"],
+        sandboxHosts: ["^testflex\\.cybersource\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "jwe",
+        passthroughHeaders: []
+    },
+    {
+        psp: "juspay",
+        // Juspay Express Checkout, the merchant-page card flow Swiggy web ships (reviewed bundle
+        // web-payments.7cf02545077d488.js, SHA-256 08336f74599b7f756e4b17ed8747af8caa5d248879f7c0dd3d89f0abd8347504).
+        // The page tokenizes the card at /card/tokenize and pays at /txns with the token; juspay.js
+        // holds the whole protocol and says why only /txns is taken over.
+        //   - Paused: the POST /txns that carries a synthetic token the SDK answered the placeholder
+        //     tokenize with (never the tokenize itself: a real ctkn_ needs no merchant secret and pays
+        //     any order of that merchant for 15 minutes). The SDK answers the placeholder tokenize and
+        //     refuses the /v2/card/fingerprint lookup, so the placeholder never reaches Juspay.
+        //   - deviceSteps.tokenize: the one other request the cardholder's device sends, the real
+        //     card's tokenize, on the paused request's own host (request-policy.js
+        //     assertAllowedDeviceStep). Definitions-only: the served row does not carry it.
+        //   - NOT here, on purpose: api.juspay.io and api-ns1.juspay.in. Juspay operates both and
+        //     serves the same API there, but no reviewed page was seen sending a card to either; the
+        //     SDK refuses a card-bearing request to them instead of pausing it.
+        //   - Headers: x-merchantid and x-routing-id only. client_auth_token can be scoped to a
+        //     customer and Swiggy's card legs never send it; the merchant's API key must never reach
+        //     a browser, so authorization is never passed.
+        //   - Dark: served only to a client that declares juspay_txns.v1, and off for every org
+        //     until one is allowlisted. The sandbox host takes only documented test cards (S7).
+        //   - Autopilot never replays it: the enclave sends one request and Juspay needs two.
+        capability: "juspay_txns.v1",
+        match: "(api|sandbox)\\.juspay\\.in/txns(?![\\w/-])",
+        hosts: ["^api\\.juspay\\.in$", "^sandbox\\.juspay\\.in$"],
+        sandboxHosts: ["^sandbox\\.juspay\\.in$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: ["^x-merchantid$", "^x-routing-id$"],
+        deviceSteps: { tokenize: "(api|sandbox)\\.juspay\\.in/card/tokenize" }
+    },
+    {
+        psp: "datatrans",
+        // Datatrans / PCI Proxy Secure Fields 2.0.0 in TOKENIZE mode (field.js 3.24.602):
+        // British Airways's Nexus checkout (merchantId 3000024893) and legacy ba-sell (3000025858). PAN@
+        // cardNumber (form). Datatrans's own card-number iframe document on pay.datatrans.com sends the
+        // whole card as one jQuery XHR to its relative URL `paymentField`: form-encoded, with the CVV read
+        // from its same-origin CVV frame and the expiry (expm, expy) from the merchant page, plus mode,
+        // formId, paymentMethod, merchantId and usage; no amount, key, cookie or signature. The server keys
+        // the form by formId in the body, and the replay gate (PCI Proxy's public sandbox merchant) showed
+        // it accepts that body from another client with no cookie, origin or referer.
+        // paymentField/cardInfo is a 12-digit BIN lookup on the same host and must never match: the
+        // right-edge boundary and the exact-URL rule in resolveRecognizerForUrl keep it (and every query,
+        // port and case variant) out. Wallet, bank-account and CVV-only posts share the URL and carry no
+        // cardNumber: cardFields and passWithoutCard let them continue untouched. The GET that loads the
+        // iframe document shares the path, and the POST gate keeps it out. datatrans.js judges the whole
+        // request, refuses usage=REGISTRATION (card on file) until that decision is made and a
+        // paymentMethod that is not the card's own, and writes only cardNumber, cvv, expm and expy.
+        // Hosts are the two literal labels (never *.datatrans.com: api., 3d. and admin. are other
+        // services, and PCI Proxy's custom domains are not recognized); the sandbox host is pinned (S7):
+        // it takes only documented test cards, and a live row never points at it.
+        // Ships dark: served only to a client that declares `datatrans_secure_fields_tokenize`, gated off
+        // for every org until an operator allowlists one, and never replayed by autopilot
+        // (EXCLUDED_OPERATIONS).
+        capability: "datatrans_secure_fields_tokenize",
+        match: "pay(?:\\.sandbox)?\\.datatrans\\.com/upp/payment/SecureFields/paymentField(?:[?#]|$)",
+        hosts: ["^pay\\.datatrans\\.com$", "^pay\\.sandbox\\.datatrans\\.com$"],
+        sandboxHosts: ["^pay\\.sandbox\\.datatrans\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        // the replay gate needed none: no x-requested-with, cookie, origin or referer
+        cardFields: ["cardNumber"],
+        passWithoutCard: "pay(?:\\.sandbox)?\\.datatrans\\.com/upp/payment/SecureFields/paymentField"
+    },
+    {
+        psp: "pelecard",
+        // Pelecard Iframe/Redirect 2.0, the hosted payment page Uman tourist tax (aumantax.com)
+        // loads in an iframe. PAN@ root CreditCardNumber, expiry MMYY @ CreditCardDate, CVV @ CvvNumber.
+        // Pelecard's own page (/PaymentGW?transactionId=<guid>) posts the flat SubmitModel JSON with one
+        // jQuery XHR (Payment.js sendAjax, sha256 75c37541...a669caea) to generalParameters.urlTransaction,
+        // the same host's /PaymentGW/Transaction: no cookie, no auth header, no client-side encryption.
+        // The amount, currency, action type (J4 charge, J2 registration, J5 hold) and CreateToken are bound
+        // to the TransactionId at the merchant's server-side init and never ride in the request.
+        // The same URL also serves the wallet, Bit, PIN pad and bank tabs with no card: jsonCardFields and
+        // passWithoutCard let those continue untouched. pelecard.js checks the exact URL (also in
+        // resolveRecognizerForUrl), validates the whole body, writes only the card fields, and refuses a
+        // saved token, a track, installments, a buyer-typed total and a body that asks to keep the card.
+        // NOT here: /PaymentGW/TimeOutTransaction (the dwell timer posts the same card fields there),
+        // /PaymentGW/CheckCreditCard, EndOfProcess, init and the other PaymentGW routes; gateway20qa
+        // (Pelecard QA); the legacy 1.0 page on gateway.pelecard.biz (/PayProcess/Transaction, a top-level
+        // form). Hosts are the two literal labels, never a wildcard. No sandboxHosts: Pelecard's public test
+        // terminals run on the same gateway21 host as live ones (the terminal bound to the TransactionId
+        // decides, and neither the request nor the page names it), so the S7 host rule has no test-only
+        // host to pin, and the device's test-card rule cannot tell a test payment from a live one here.
+        // A live row can therefore send a real card to a payment page created on a public test terminal,
+        // whose transactions anyone holding Pelecard's published demo credentials can read back.
+        // Ships dark: served only to a client that declares `pelecard_transaction`, gated off for every org
+        // until an operator allowlists one, and never replayed by autopilot (EXCLUDED_OPERATIONS).
+        capability: "pelecard_transaction",
+        match: "(?:gateway21|gateway20)\\.pelecard\\.biz/PaymentGW/Transaction(?![\\w/.-])",
+        hosts: ["^gateway21\\.pelecard\\.biz$", "^gateway20\\.pelecard\\.biz$"],
+        encoding: "json",
+        // jQuery's own same-origin marker, pinned to `XMLHttpRequest` by pelecard.js; nothing else rides.
+        passthroughHeaders: ["^x-requested-with$"],
+        jsonCardFields: [["CreditCardNumber"]],
+        passWithoutCard: "(?:gateway21|gateway20)\\.pelecard\\.biz/PaymentGW/Transaction"
+    },
+    {
+        psp: "aci",
+        // ACI Worldwide Open Payment Platform, COPYandPAY widget (Halfords). PAN@ card.number (form, dot keys).
+        // Each PCI iframe (/v1/pciIframe.html) posts the one field it holds, as a jQuery form XHR, to
+        // POST /v1/checkouts/{id} (no suffix); ACI merges them on the checkout. aci.js holds the leg
+        // rules, the fill and the answer judge (sources there). The id segment is the documented
+        // <32 hex>.<cluster>-vm-tx<nn>; (?![\w/.-]) is the right edge for the SDK's unanchored test and
+        // keeps /payment, /bins and /registration out of `match`. Hosts are the four literal hosts ACI
+        // serves the widget from, never a wildcard label; white-label OPP hosts need their own evidence.
+        // Ships dark: served only to a client that declares aci_split_card.v1 (one that holds the
+        // sibling legs below), gated off for every org until an operator allowlists one, and never
+        // replayed by autopilot (EXCLUDED_OPERATIONS).
+        capability: "aci_split_card.v1",
+        match: "(?:eu-prod\\.oppwa\\.com|oppwa\\.com|eu-test\\.oppwa\\.com|test\\.oppwa\\.com)/v1/checkouts/[0-9A-F]{32}\\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}(?![\\w/.-])",
+        hosts: ["^eu-prod\\.oppwa\\.com$", "^oppwa\\.com$", "^eu-test\\.oppwa\\.com$", "^test\\.oppwa\\.com$"],
+        // eu-test and test.oppwa.com are ACI's INTEGRATOR_TEST hosts. Pinned (S7): a create refuses a
+        // test host on a live row and a live host on a test row, and the device sends only documented
+        // test cards (ACI's own included, aci.js ACI_TEST_PANS) to a test host.
+        sandboxHosts: ["^eu-test\\.oppwa\\.com$", "^test\\.oppwa\\.com$"],
+        hostEnvironmentPinned: true,
+        // ACI's widget abandons Pay after its 60 s channel timeout, so the cardholder unlocks first (S4).
+        preparationRequired: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        // no auth header; X-Requested-With is not replayed (it would force a CORS preflight)
+        cardFields: ["card.number"],
+        // One card, several legs on one checkout id. `absorb` legs (the page's CVC and expiry, dummy
+        // values) are held and answered with the approved leg's answer, never forwarded; `pass` legs
+        // (the holder) continue untouched; `siblingKeys` may ride any leg. `continuation` is the merchant
+        // form's /payment submission, which continues with `remove` taken out after `brandField` is
+        // checked against the approved card's network and every other key against the ones the widget
+        // sends (aci.js prepareAciContinuation).
+        splitCard: {
+            absorb: ["card.cvv", "card.expiryMonth", "card.expiryYear"],
+            pass: ["card.holder"],
+            siblingKeys: ["customParameters[SHOPPER_EndToEndIdentity]"],
+            continuation: {
+                match: "(?:eu-prod\\.oppwa\\.com|oppwa\\.com|eu-test\\.oppwa\\.com|test\\.oppwa\\.com)/v1/checkouts/[0-9A-F]{32}\\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}/payment(?![\\w/.-])",
+                remove: ["card.expiryMonth", "card.expiryYear"],
+                brandField: "paymentBrand"
+            }
+        }
+    },
+    {
+        psp: "creditguard",
+        // Hyp CreditGuard PPS, the hosted page merchants frame at https://pps.creditguard.co.il/?txId=<uuid>
+        // (SeboCalm). Its Angular transaction service posts the card to /services/v1/txn/<txId>/process as
+        // same-origin JSON, no auth header, no cookie: the txId is the only credential and the submit is the
+        // sale itself. PAN@ root `cardNumber` (expMonth MM, expYear YY, cvv, personalId) in plaintext, or one
+        // js-jose JWE in root `jwePayload` when the transaction carries a jwePublicKey (creditguard.js keeps
+        // that variant behind a flag). Sources: templates/cgt-basic/main.js on pps and ppsuat, reviewed
+        // 2026-09-25. /card/details, /card/details/dcc, /cc/ddc/init, /cg3ds/*, /otp/request and
+        // /applepay|paybox|pcp/process share the prefix, carry the agent's placeholder or no card, and fall
+        // out at the exact path; (?![\w/-]) is the right edge for the SDK's unanchored test. pps2 is a
+        // production host (cg-safecharge-3ds envConfig: pps, pps2, cgmpi = prod). The legacy MPI page
+        // (cgmpi.creditguard.co.il), pps-dev, ppsqa, pps-qa1 and cguat2 are deliberately absent.
+        // creditguard.js judges the whole request before a card is written and fills only the card fields.
+        // Ships dark: served only to a client that declares `creditguard_pps_process`, gated off for every
+        // org until an operator allowlists one, never replayed by autopilot (EXCLUDED_OPERATIONS).
+        capability: "creditguard_pps_process",
+        match: "(?:pps|pps2|ppsuat)\\.creditguard\\.co\\.il/services/v1/txn/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/process(?![\\w/-])",
+        hosts: ["^pps\\.creditguard\\.co\\.il$", "^pps2\\.creditguard\\.co\\.il$", "^ppsuat\\.creditguard\\.co\\.il$"],
+        // ppsuat is CreditGuard's UAT page. Pinned (S7): a create refuses it on a live row and pps or pps2
+        // on a test row, and the device sends only documented test cards to it.
+        sandboxHosts: ["^ppsuat\\.creditguard\\.co\\.il$"],
+        hostEnvironmentPinned: true,
+        // S4: the submit names no amount, so a card is sent only after the cardholder approved a
+        // prepare() that read the transaction (GET /services/v1/txn/<txId>, creditguard.js).
+        preparationRequired: true,
+        encoding: "json",
+        // The device sends Content-Type (and Accept) JSON itself; nothing the page sent is replayed.
+        passthroughHeaders: [],
+        // A /process body without either (Google Pay, a saved cardId, a js-jose object fallback) is not a
+        // new card, and with no passWithoutCard it is refused instead of paused.
+        jsonCardFields: [["cardNumber"], ["jwePayload"]]
+    },
+    {
+        psp: "payrails",
+        // Payrails web SDK v6 (assets.payrails.io/web-sdk/v6/payrails.js 6.5.0), Blacklane's consumer
+        // booking checkout: cardForm.tokenize() POSTs vaultConfiguration.links.saveInstrument.href. Body
+        // (JSON.stringify, sent as text/plain): {holderReference, paymentMethod:'card', storeInstrument,
+        // futureUsage, data:{encryptedData, vaultProviderConfigId}}. encryptedData is a compact JWE
+        // (RSA-OAEP-256 + A256CBC-HS512, no kid) of {holderName, cardNumber, expiryMonth, expiryYear,
+        // securityCode, holderReference}, built in the assets.payrails.io secure frame under the
+        // session's vaultConfiguration.encryptionPublicKey. That key is per session, reaches us only
+        // through the agent's page and cannot be pinned, so the mode is device_encrypt: the cardholder's
+        // device encrypts the real card and sends this request itself (payrails-replay.js), and the
+        // ciphertext never returns to the page. Dynamic payment-method forms save non-card instruments
+        // on the same URL with no data.encryptedData: jsonCardFields claims only a card save and
+        // passWithoutCard lets the rest continue untouched. payrails.js holds the request guard, the
+        // card-on-file policy, the session-key and workspace checks and the answer rules. NOT here:
+        // /public/payment/instruments/tokenize (web-cse used directly), api.payrails.io and the
+        // execution authorize links (card-form payments, stored-card CVC), and assets.payrails.io.
+        // `capability` keeps the entry out of BUILTIN_REGISTRY and every org until one opts in; the API
+        // serves it only to a client that also asks for modes=device_encrypt. The two staging hosts are
+        // pinned to sandbox rows (S7). Autopilot refuses it by operation (payrails.device_encrypted_card).
+        capability: "payrails_device_encrypt",
+        match: "(?:api-pub|api-pub\\.staging|sandbox-api-pub\\.staging)\\.payrails\\.io/public/payment/instruments(?![\\w/.-])",
+        hosts: ["^api-pub\\.payrails\\.io$", "^api-pub\\.staging\\.payrails\\.io$", "^sandbox-api-pub\\.staging\\.payrails\\.io$"],
+        sandboxHosts: ["^api-pub\\.staging\\.payrails\\.io$", "^sandbox-api-pub\\.staging\\.payrails\\.io$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // body shape; the SDK sends text/plain, replayed verbatim
+        passthroughHeaders: ["^authorization$", "^x-idempotency-key$", "^x-client-version$", "^x-client-type$"],
+        jsonCardFields: [["data", "encryptedData"]],
+        passWithoutCard: "(?:api-pub|api-pub\\.staging|sandbox-api-pub\\.staging)\\.payrails\\.io/public/payment/instruments",
+        clientSideEncrypted: true,
+        // older SDKs read this and refuse locally
+        mode: "device_encrypt",
+        deviceEncrypt: {
+            scheme: "payrails-jwe",
+            // RSA-OAEP-256 + A256CBC-HS512, compact
+            key: "session",
+            // from the init payload the runtime captured, never pinned
+            at: ["data", "encryptedData"],
+            keyBits: [2048, 3072, 4096],
+            // e = 65537; the wrapped key's length must equal the modulus length
+            futureUsage: ["CardOnFile", "UnscheduledCardOnFile"],
+            expiryYear: "YY"
+            // Blacklane's single MM/YY field
+        }
+    },
+    {
+        psp: "elavon_converge",
+        // Elavon Converge Hosted Payment Page (redirect, pageType hpp), NY DMV. Converge's
+        // own AngularJS page posts the card as same-origin JSON to /hosted-payments/service/payment/hpp/process.
+        // PAN@ paymentData.ssl_card_number (digits), expiry@ paymentData.ssl_exp_date (MMYY), CVC@
+        // paymentData.ssl_cvv2cvc2. No client-side encryption; the session rides in the body (`context`).
+        // Sources: assets/hpp-2.505.07.js, byte-identical on both hosts, reviewed 2026-09-25. The same URL
+        // carries wallet, ACH and loan payments and the follow-ups after 3DS2, Pay Defense or a surcharge
+        // quote: the Converge body gate decides (elavon-converge.js convergeBodyVerdict, which card-fields.js
+        // asks first, so the SDK's generated copy carries it). The lightbox (hpm/process), Checkout.js
+        // (hpe/process) and every other hpp/ call fall out at the exact path; (?![\w/.%-]) is the right edge
+        // for the SDK's unanchored test. Hosts are two literal labels, never *.convergepay.com (www and demo
+        // are the merchant web UI).
+        // Ships dark: served only to a client that declares `converge_hpp_process`, gated off for every org
+        // until an operator allowlists one, never replayed by autopilot (EXCLUDED_OPERATIONS).
+        capability: "converge_hpp_process",
+        match: "api(?:\\.demo)?\\.convergepay\\.com/hosted-payments/service/payment/hpp/process(?![\\w/.%-])",
+        hosts: ["^api\\.convergepay\\.com$", "^api\\.demo\\.convergepay\\.com$"],
+        // api.demo is Converge's demo environment. Pinned (S7): a create refuses it on a live row and the
+        // production host on a test row, and the device sends only documented test cards to it.
+        sandboxHosts: ["^api\\.demo\\.convergepay\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The device sends Content-Type JSON itself; no Origin, Cookie, Referer or XSRF header is replayed.
+        passthroughHeaders: [],
+        jsonCardFields: [["paymentData", "ssl_card_number"]],
+        // An electronic check or financing payment on the same URL carries no card and continues untouched.
+        passWithoutCard: "api(?:\\.demo)?\\.convergepay\\.com/hosted-payments/service/payment/hpp/process"
+    },
+    {
+        psp: "wspay",
+        // WSPay Components (WSPay's build of Monri Components 1.6.0), Valamar's booking payment.
+        // PAN@ payment_method.data.pan, expiry YYMM @ .expiration_date, cvv @ .cvv. The processor
+        // iframe (/v2/js/payment-method-component-dynamic.html) XHRs POST /v2/payment/{client_secret}/confirm
+        // with `Authorization: WP3-v2-Client <authenticity token>` (proxy /dist/monri.js sha256 33fb5b45...).
+        // /confirm is the only card route the proxy serves: /v2/payment/{cs}/token and /v2/temp-tokenize
+        // answer 404 exactly like bogus control paths (card-free probes, 2026-09-23). The same URL also
+        // carries saved_card and temp_card_id bodies with no new card, so wspay.js validates the whole
+        // body, writes only the three card fields and never uses the generic walk; there is no `compose`
+        // on purpose (it widens what the generic walk would call a card). The client_secret segment is a
+        // per-payment bearer secret. (?![\w/-]) is the right edge for the SDK's unanchored test.
+        // NOT here: ipg.monri.com / ipgtest.monri.com (Monri direct: no CORS headers, behind Cloudflare,
+        // needs the relay; a separate `monri` entry), ipgdev.monri.com, the ipg[test].webteh.hr hosts in
+        // the bundle's whitelist (they do not resolve) and form[test].wspay.biz (WSPay Form, another product).
+        // Ships dark: the recognizer is served only to a client that declares `wspay_confirm` for an
+        // org an operator allowlisted, the processor is gated off for every other org, and autopilot
+        // never replays it (EXCLUDED_OPERATIONS). GET /coverage and POST /coverage/assess describe it
+        // on the same rule; only the preflight rules, which identify its scripts and frames, name
+        // WSPay to every client. A confirm that asks WSPay to keep the card on file is refused unless
+        // the caller carries the cardholder's consent (wspay.js).
+        capability: "wspay_confirm",
+        match: "proxy(?:-test)?\\.wspay\\.biz/v2/payment/[A-Za-z0-9_-]{1,128}/confirm(?![\\w/-])",
+        hosts: ["^proxy\\.wspay\\.biz$", "^proxy-test\\.wspay\\.biz$"],
+        // proxy-test is WSPay's test platform. Pinned (S7): a create refuses it on a live row and
+        // proxy.wspay.biz on a test row, and the device sends it only the shared public network test
+        // cards (test-pans.js), never a real card. WSPay's own test card list is unverified.
+        sandboxHosts: ["^proxy-test\\.wspay\\.biz$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The iframe's own Accept is load-bearing (Worldpay precedent); cookie/origin/referer never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"]
+    },
+    {
+        psp: "shiji_sts",
+        // Shiji Payment Solutions STS, the card leg of the MyCheck Wallet V3 (Shiji Group) that La Quinta
+        // by Wyndham loads in its booking page. sts.proxy.v2.1.js encrypts the PAN digits and the "MM/YY"
+        // expiry, each on its own, with JSEncrypt (RSAES-PKCS1-v1_5) under the RSA-1024 key it hardcodes,
+        // and fetch-POSTs application/json {accessToken, pan, expires, keySequence?} to /v1/token/getTokenId;
+        // after MyCheck's payment-methods call it posts {accessToken, cvv, keySequence?} to
+        // /v1/token/getCvvId. ONE entry covers both paths: they share the host, and resolveRecognizerForUrl
+        // takes the first definition by host, so a second entry would never be reached. shiji-sts.js judges
+        // which a request is: getTokenId is the one prompt, getCvvId a companion that never prompts and is
+        // continued only when bound to the getTokenId the runtime continued. The device encrypts under the
+        // key shiji-sts.js pins (SPKI SHA-256 c7846a0f...5a469ff7), never one from a row, a request or a
+        // page, and the runtime swaps the ciphertexts at the body root: cse.at '' is the root, which the
+        // Adyen substitution refuses, so only substituteShijiSts writes this body. No auth header: the
+        // accessToken rides in the body. NOT allowlisted: iframe.vault.cn.{prod,uat}.shijipayment.cn (in the
+        // proxy's table, never chosen by the wallet) and api.vault.eu.prod.shijipayment.com (not the
+        // browser's host). `capability` keeps the entry out of BUILTIN_REGISTRY, serves it only to a client
+        // that declares shiji_sts_pinned_key, and leaves it off for every org until one is opted in. The UAT
+        // host is the sandbox host and the environment is pinned (S7): UAT only on sandbox rows, with
+        // documented test cards. Every getTokenId is refused as card on file (a hotel guarantee) until the
+        // consent decision is made (shiji-sts.js SHIJI_STS_KEEP_ON_FILE). `(?![\w/-])` ends the path as
+        // on mercado_pago and paysafe: a consumer that tests `match` unanchored never takes
+        // /v1/token/getTokenIdX or /v1/token/getTokenId/x for a card request.
+        capability: "shiji_sts_pinned_key",
+        encryptedCardFields: { number: "pan", expiry: "expires", cvc: "cvv" },
+        match: "iframe\\.vault\\.eu\\.(?:prod|uat)\\.shijipayment\\.com/v1/token/(?:getTokenId|getCvvId)(?![\\w/-])",
+        hosts: ["^iframe\\.vault\\.eu\\.prod\\.shijipayment\\.com$", "^iframe\\.vault\\.eu\\.uat\\.shijipayment\\.com$"],
+        sandboxHosts: ["^iframe\\.vault\\.eu\\.uat\\.shijipayment\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [],
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-pkcs1v15", at: "", fields: ["pan", "expires", "cvv"] }
+    },
+    {
+        psp: "worldline_mycheckout",
+        // Worldline Connect MyCheckout, the hosted payment page DHL Express's MyDHL+ sends its card
+        // payments to. The page submits the card as a top-level form POST to /checkout on its own host
+        // (a Document navigation, like Tranzila's), so the cardholder's device rebuilds that form with
+        // the real card and submits it itself (mode hosted_form) and the paused navigation is
+        // answered with the submission notice. The same URL takes the page's cancel and every non-card
+        // payment product; only a body with cardNumber is a card request, and the rest continue
+        // untouched (cardFields, passWithoutCard). A card body is taken over only in the one plain
+        // shape worldline-mycheckout.js admits (worldlineMyCheckoutRequestRefusal): no card kept for
+        // later, no wallet, a covered card product. The form names no amount (the merchant fixed it
+        // when it created the hosted checkout), so the agent's amount is the price the cardholder
+        // approves. `payment.` is the subdomain Worldline says always works, on pay1 (Europe) and pay2
+        // (US) and their pre-production twins; a merchant's own MyCheckout subdomain is not admitted.
+        // resolveRecognizerForUrl takes only the four endpoints written exactly. `capability` keeps
+        // the entry out of BUILTIN_REGISTRY, serves it only to a client that declares
+        // worldline_mycheckout_form, and leaves it off for every org until one is opted in; the
+        // pre-production hosts take only test rows and documented test cards (hostEnvironmentPinned).
+        capability: "worldline_mycheckout_form",
+        match: "payment\\.pay[12](?:\\.preprod)?\\.checkout\\.worldline-solutions\\.com/checkout(?![\\w/.-])",
+        hosts: [
+            "^payment\\.pay1\\.checkout\\.worldline-solutions\\.com$",
+            "^payment\\.pay2\\.checkout\\.worldline-solutions\\.com$",
+            "^payment\\.pay1\\.preprod\\.checkout\\.worldline-solutions\\.com$",
+            "^payment\\.pay2\\.preprod\\.checkout\\.worldline-solutions\\.com$"
+        ],
+        sandboxHosts: ["^payment\\.pay1\\.preprod\\.checkout\\.worldline-solutions\\.com$", "^payment\\.pay2\\.preprod\\.checkout\\.worldline-solutions\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        cardFields: ["cardNumber"],
+        passWithoutCard: "payment\\.pay[12](?:\\.preprod)?\\.checkout\\.worldline-solutions\\.com/checkout",
+        mode: "hosted_form",
+        hostedForm: {
+            required: ["publicMerchantId", "token", "requestToken", "idempotenceKey", "doPayment"],
+            // expiryDate is one MM/YY field; the device writes it in the page's own delimiter.
+            card: { number: "cardNumber", expiry: "expiryDate", cvc: "cvv" },
+            // The merchant and the hosted checkout: one prompt per hosted checkout.
+            dedupe: ["publicMerchantId", "token"],
+            // A checked "remember" asks Worldline to keep the card for later purchases.
+            token: "remember"
+        }
     }
 ]);
-var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, ...definition }) => definition));
+var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
 var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
     psp: definition.psp,
     match: new RegExp(definition.match, "i"),
@@ -643,21 +1237,30 @@ var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
     headers: definition.passthroughHeaders.map((source) => new RegExp(source, "i")),
     ...definition.sandboxHosts ? { sandboxHosts: definition.sandboxHosts.map((source) => new RegExp(source, "i")) } : {},
     ...definition.hostEnvironmentPinned ? { hostEnvironmentPinned: true } : {},
+    ...definition.request ? { request: definition.request } : {},
     ...definition.mode ? { mode: definition.mode } : {},
     ...definition.clientSideEncrypted ? { clientSideEncrypted: true } : {},
     ...definition.compose ? { compose: definition.compose } : {},
     ...definition.encryptedCardFields ? { cse: { fields: definition.encryptedCardFields } } : {},
-    ...definition.hostedForm ? { form: definition.hostedForm.card } : {}
+    ...definition.caseInsensitiveFormKeys ? { caseInsensitiveFormKeys: true } : {},
+    // The device's copy of the form's card keys (forms.js hostedFormPairs), with the card roles a
+    // template may lack (`optional`), so the vault fills exactly what the definition names.
+    ...definition.hostedForm ? { form: {
+            ...definition.hostedForm.card,
+            ...definition.hostedForm.optional ? { optional: definition.hostedForm.optional } : {}
+        } } : {},
+    ...definition.deviceSteps ? { deviceSteps: Object.fromEntries(Object.entries(definition.deviceSteps).map(([step, source]) => [step, new RegExp(source, "i")])) } : {},
+    ...definition.deviceEncrypt ? { deviceEncrypt: definition.deviceEncrypt } : {}
 })));
 function buildBuiltinRegistry(recognizers) {
-    return recognizers.filter((definition) => !definition.capability).map(({ cse, hostedForm, ...definition }) => ({
+    return recognizers.filter((definition) => !definition.capability).map(({ cse, hostedForm, deviceEncrypt, ...definition }) => ({
         ...definition,
         match: new RegExp(definition.match, "i"),
         passthroughHeaders: definition.passthroughHeaders.map((source) => new RegExp(source, "i"))
     }));
 }
 var BUILTIN_REGISTRY = deepFreeze(buildBuiltinRegistry(PSP_RECOGNIZERS));
-var CHECKOUT_MODES = deepFreeze(["token", "cse", "hosted_form"]);
+var CHECKOUT_MODES = deepFreeze(["token", "cse", "hosted_form", "card_endpoint", "device_encrypt"]);
 function recognizerByPsp(psp) {
     return typeof psp === "string" ? PSP_CLIENT_TABLE.find((entry) => entry.psp === psp) ?? null : null;
 }
@@ -668,6 +1271,116 @@ function trustedClientRecognizer(pspOrEntry) {
         throw new Error("Refusing to pay: unknown payment processor.");
     return definition;
 }
+// src/datatrans.js
+var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans.com"]);
+var DATATRANS_REFUSAL_REASONS = Object.freeze(["unsupported", "card_on_file", "brand_mismatch", "unregistered_merchant"]);
+var DATATRANS_REGISTRATION_POLICIES = Object.freeze(["refuse", "disclose", "agentcard_single_use"]);
+var DATATRANS_REVIEWED_MERCHANT_IDS = Object.freeze({
+    "pay.datatrans.com": Object.freeze([]),
+    "pay.sandbox.datatrans.com": Object.freeze(["1110022968", "1100007006"])
+});
+var DATATRANS_PAYMENT_METHODS = Object.freeze(["VIS", "ECA", "AMX", "DIN", "DIS", "JCB", "CUP", "MAU", "UAP", "DNK"]);
+var DATATRANS_TEST_PANS = Object.freeze([
+    "4242424242424242",
+    "4900000000000086",
+    "4900000000000003",
+    "5404000000000001",
+    "5200000000000007",
+    "5200000000000080",
+    "375811111111115",
+    "375000000000007",
+    "375811111111123",
+    "36168002586009",
+    "36167719110012",
+    "6011000000000004",
+    "3569990010030442",
+    "3569990010030400",
+    "6362970000457013",
+    "3841000000000007",
+    "6200104444444447",
+    "6210946888060008",
+    "6759000000000018",
+    "6759000000000026",
+    "4000001000000034",
+    "4000001000000018",
+    "4000001000000042",
+    "4000001000000026",
+    "5100001000000022",
+    "5100001000000048",
+    "5100001000000014",
+    "5100001000000030",
+    "340000100000024",
+    "340000100000040",
+    "340000100000016",
+    "340000100000032",
+    "36000010000022",
+    "3550998599961037"
+]);
+// src/amadeus-checkout.js
+var AMADEUS_CARD_URLS = Object.freeze({
+    production: Object.freeze({
+        sdk: Object.freeze(["https://paypages.payment.amadeus.com/1ASIATP/ARIAPP/pay"]),
+        dcp: Object.freeze(["https://paypages.payment.amadeus.com/1ASIATP/ATPDCP/collect"])
+    }),
+    // pdt, uat, mig and skl. DCP was seen on the production path only, so the test host takes no store.
+    sandbox: Object.freeze({
+        sdk: Object.freeze([
+            "https://paypages.test.payment.amadeus.com/1ASIATP/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPU/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPM/ARIAPP/pay",
+            "https://paypages.test.payment.amadeus.com/1ASIATPK/ARIAPP/pay"
+        ]),
+        dcp: Object.freeze([])
+    })
+});
+var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
+var AMADEUS_REFUSAL_REASONS = Object.freeze([
+    "unsupported",
+    "card_on_file",
+    "split_tender",
+    "installments",
+    "currency_conversion",
+    "amadeus_3ds",
+    "saved_card",
+    "vendor_mismatch",
+    "header_binding",
+    "merchant_held_expiry",
+    "dcp_field_config_unreviewed"
+]);
+var MESSAGES = Object.freeze({
+    unsupported: "Refusing to pay: unsupported Amadeus card request.",
+    card_on_file: "Refusing to pay: this Amadeus payment would let the merchant keep your card on file, which needs your consent first. Nothing was sent.",
+    split_tender: "Refusing to pay: this Amadeus payment splits the total across more than one payment method. Nothing was sent.",
+    installments: "Refusing to pay: this Amadeus payment asks to pay in installments. Nothing was sent.",
+    currency_conversion: "Refusing to pay: this Amadeus payment converts the total into another currency. Nothing was sent.",
+    amadeus_3ds: "Refusing to pay: this Amadeus payment set up its card check for a different card. Nothing was sent.",
+    saved_card: "Refusing to pay: this Amadeus payment uses a card saved with the merchant, not your Vault card. Nothing was sent.",
+    vendor_mismatch: "Refusing to pay: this Amadeus payment names a card network that is not your card's. Nothing was sent.",
+    header_binding: "Refusing to pay: this Amadeus card form does not belong to the merchant you approved. Nothing was sent.",
+    merchant_held_expiry: "Refusing to pay: this merchant sends your card's expiry date separately, which Agentcard cannot fill yet. Nothing was sent.",
+    dcp_field_config_unreviewed: "Refusing to pay: Agentcard has not reviewed this merchant's Amadeus card form yet. Nothing was sent."
+});
+var SDK_FLAVORS = Object.freeze(["Core-Sdk", "Angular-Web-Sdk"]);
+var LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var SDK_HOST = new RegExp(`^${LABEL}(?:\\.${LABEL})+(?::[0-9]{1,5})?$`, "i");
+var SDK_HEADERS = Object.freeze(["amadeus-checkout-sdk-version", "amadeus-checkout-sdk-host", "amadeus-checkout-sdk-flavor"]);
+var SDK_DATA_KEYS = Object.freeze(["mopid", "mopdata", "fingerprint"]);
+var SDK_MOPDATA_KEYS = Object.freeze(["pan", "CVV", "holdername", "expmonth", "expyear", "vendor", "address", "contact"]);
+var SDK_MOPDATA_REFUSALS = Object.freeze({
+    prefill_index: "saved_card",
+    installmentPlansID: "installments",
+    selectedInstallmentPlan: "installments",
+    options: "currency_conversion",
+    tdsSessionId: "amadeus_3ds",
+    tdsDeviceInformation: "amadeus_3ds"
+});
+var AMADEUS_DCP_REVIEWED_KEYS = Object.freeze(["vendor", "pan", "expdate", "owner", "cvv", "address", "city", "zipCode", "country", "state"]);
+var DCP_TEXT_KEYS = Object.freeze(["address", "city", "zipCode", "country", "state"]);
+var NETWORKS = Object.freeze(["visa", "mastercard", "amex"]);
+var DECLINE_LABELS = Object.freeze(["label_error_payment", "label_error_bin", "label_error_bin_vendor", "label_error_bin_type"]);
+var EXPIRED_LABELS = Object.freeze(["session_timeout", "ppid_expired"]);
+var REF_KEYS = Object.freeze(["recloc", "orderId", "mopId", "pri", "approvalcode", "externalId", "paymentMerchantReference", "prr"]);
+var PAYMENT_INFORMATION_KEYS = Object.freeze(["approvalcode", "pri", "externalId", "mopId"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -678,14 +1391,24 @@ var WITHOUT_CHECKOUT_SESSIONS = Object.freeze({
         passWithoutCard: "api\\.stripe\\.com/v1/(sources|confirmation_tokens)"
     })
 });
+var ONLY_WITH_CARD_FIELDS = Object.freeze(["amadeus_checkout"]);
 // src/request-policy.js
 var HEADER_NEVER_FORWARD = /^(cookie|set-cookie|authorization2|proxy-authorization|host|content-length|origin|referer)$/i;
 var ALLOWED_MEDIA_TYPES = {
     json: ["application/json", "text/plain"],
-    form: ["application/x-www-form-urlencoded"]
+    form: ["application/x-www-form-urlencoded"],
+    jwe: ["application/jwt"]
 };
+var JWE_CONTENT_TYPE = "application/jwt; charset=utf-8";
 function contentTypeFor(pspOrEntry, headers) {
     const rec = trustedClientRecognizer(pspOrEntry);
+    if (rec.encoding === "jwe") {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        const base2 = captured && typeof captured[1] === "string" ? captured[1].split(";")[0].trim().toLowerCase() : "";
+        if (!ALLOWED_MEDIA_TYPES.jwe.includes(base2))
+            throw new Error("Refusing to pay: this processor takes its sealed card only as application/jwt.");
+        return JWE_CONTENT_TYPE;
+    }
     const encoding = rec && rec.encoding === "form" ? "form" : "json";
     const allowed = ALLOWED_MEDIA_TYPES[encoding];
     const fallback = allowed[0];
@@ -703,6 +1426,8 @@ function contentTypeFor(pspOrEntry, headers) {
 function replayHeaders(pspOrEntry, captured = {}) {
     const rec = trustedClientRecognizer(pspOrEntry);
     const headers = { "content-type": contentTypeFor(rec, captured) };
+    if (rec.psp === "creditguard")
+        headers.accept = "application/json";
     for (const [name, value] of Object.entries(captured)) {
         if (rec.headers.some((pattern) => pattern.test(name)) && !HEADER_NEVER_FORWARD.test(name))
             headers[name] = value;