@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "sandboxHosts": ["^esqa\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }, { "psp": "gravy", "match": /api(\.sandbox)?\.[a-z0-9-]+\.gr4vy\.app\/checkout\/sessions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/fields/i, "hosts": ["^api\\.[a-z0-9-]+\\.gr4vy\\.app$", "^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "sandboxHosts": ["^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "encoding": "json", "passthroughHeaders": [] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "sandboxHosts": ["^esqa\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }, { "psp": "gravy", "match": /api(\.sandbox)?\.[a-z0-9-]+\.gr4vy\.app\/checkout\/sessions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/fields/i, "hosts": ["^api\\.[a-z0-9-]+\\.gr4vy\\.app$", "^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "sandboxHosts": ["^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "encoding": "json", "passthroughHeaders": [] }];

package/dist/card-endpoint-facts.d.ts

@@ -0,0 +1,96 @@
+import { type CardEndpointProfile } from './card-endpoint.js';
+/** How long a paused card request waits for a request on its checkout session that left before it and has not answered. */
+export declare const CARD_ENDPOINT_FACTS_WAIT_MS = 3000;
+/**
+ * How many recorded requests the watch keeps. Past it, the oldest request of the checkout
+ * session that holds the most goes first, so another checkout's requests never push this
+ * one's record out while this one holds the fewer. What a checkout lost can still refuse
+ * its capture (Lost).
+ */
+export declare const CARD_ENDPOINT_FACTS_KEPT = 32;
+/**
+ * How many checkout sessions the watch remembers a loss for. Past it, every capture refuses:
+ * a loss the watch forgot could let an older record through.
+ */
+export declare const CARD_ENDPOINT_FACTS_LOST_SESSIONS_KEPT = 256;
+/** The cut order record a create carries (merchant_card_endpoint.facts). */
+export interface CardEndpointFactsRecord {
+    method: string;
+    url: string;
+    state: unknown;
+}
+/** What capture() gives: the cut record, or why there is none to send (names no value). */
+export type CardEndpointFactsCapture = {
+    record: CardEndpointFactsRecord;
+    refusal?: undefined;
+} | {
+    refusal: string;
+    record?: undefined;
+};
+export declare class CardEndpointFactsWatch {
+    private readonly now;
+    private readonly origins;
+    private readonly sessionOf;
+    private readonly exchanges;
+    private readonly lost;
+    private lostTooMany;
+    private readonly waiters;
+    private ticks;
+    constructor(now?: () => number, origins?: readonly string[], sessionOf?: (url: string) => string | null);
+    /** Whether the watch records the request under this key. */
+    tracks(key: string): boolean;
+    /**
+     * A request left. Recorded only when it is a document, an XHR or a fetch (or of a type
+     * the adapter could not name) on the endpoint origin of a profile with facts.
+     */
+    sent(key: string, request: {
+        method: string;
+        url: string;
+        resourceType?: string | null;
+        networkId?: string | null;
+    }): void;
+    /** Drops the oldest request of the checkout session that holds the most (of two that hold as many, the one seen first). */
+    private evictOne;
+    /** Notes what dropping `exchange` takes from its checkout session (Lost). */
+    private remember;
+    /**
+     * The key a load-finished report belongs to: its own when recorded, else the recorded
+     * document with the same network id. Chrome reports an out-of-process frame's document
+     * request on the parent frame's session and its answer on the frame's own session.
+     */
+    keyFor(key: string, networkId: string | null | undefined): string | null;
+    /** The request's answer began to arrive, with its HTTP status: the first report stamps when. */
+    answered(key: string, status: unknown): void;
+    /**
+     * The request finished: the adapter reports it the moment the browser does, before it reads
+     * the text, so two answers keep the order they finished in however their texts come back.
+     */
+    finished(key: string): void;
+    /** The request finished and its text was read (null when it could not be, or was past the limit). */
+    read(key: string, text: string | null, completedAt?: number): void;
+    /** The request failed or was aborted: the page never read an answer from it. */
+    failed(key: string): void;
+    private settle;
+    /**
+     * The order record for a paused card request of `profile` at `cardUrl`, as of the pause.
+     * It reads every recorded request on the same checkout session sent no later than
+     * `pausedAt` that is a record or an unread call (payment-core
+     * merchantCardEndpointFactsRole); the card request and every earlier one to its URL
+     * answer with the payment's outcome, and an inert call changes nothing the record holds,
+     * so neither is waited for or read. One still loading is waited for, up to
+     * CARD_ENDPOINT_FACTS_WAIT_MS, and refuses once that runs out: the page was still
+     * changing the order when it sent the card request. Then the record whose answer
+     * finished last, in the order the watch saw them finish (the one the page shows), is cut
+     * by payment-core; one that holds no record (the /payment-context
+     * answer) is passed over for the one before it, and one that holds a record in another
+     * layout, or did not succeed, refuses. Last, the record refuses when the page sent an
+     * unread call, or a record call other than a GET that gave no record, after it arrived.
+     *
+     * A checkout that sent more requests than the watch keeps refuses whenever what it lost
+     * could change that answer: a request still loading when it went, or one that finished
+     * after the record or was sent after the record arrived. Every request payment-core gives
+     * a role for this card request is on the card request's own session
+     * (cardEndpointFactsSession), so its losses are the only ones read.
+     */
+    capture(profile: CardEndpointProfile, cardUrl: string, pausedAt: number, signal?: AbortSignal): Promise<CardEndpointFactsCapture>;
+}

package/dist/card-endpoint-facts.js

@@ -0,0 +1,275 @@
+// The merchant's own record of the order, for a reviewed card endpoint whose merchant
+// keeps one (profile.facts; payment-core merchant-card-endpoint-facts.js says what it
+// proves and what it does not).
+//
+// FastSpring's popup posts the card with no amount. Its page keeps the order it shows in
+// the popup document (script#viewdata) and replaces it with every JSON answer it reads
+// from the session URL, tax included. From attach on, the adapters tell this watch about
+// every request that leaves, every answer and every failure; it keeps, read-only, the
+// documents, XHRs and fetches on the endpoint origin of a profile with facts, and nothing
+// else, a bounded number of them, the busiest checkout session's oldest going first; what a
+// checkout lost to that bound can still refuse its capture. When that profile's card request
+// pauses, capture() waits briefly for any request on the same checkout session that left
+// before the pause, then takes the order record whose answer finished last, the one the page
+// shows, cut by payment-core to the values its reader reads (the total with tax, the
+// currency, test mode and the renewal marks). The create carries that cut record; the client
+// and the API read it with the same rules.
+//
+// A record holds the order only if the page changed nothing after it. payment-core's
+// merchantCardEndpointFactsRole names what each request is to the card request: a call
+// the reader never reads ('unread'), or one of the record's own calls that wrote and gave
+// no record (it failed, or answered without one), sent once the newest record's answer
+// began to arrive or still unanswered when the wait ends, leaves the order unknown, and
+// capture() refuses. "Once" is the order in which the watch saw the events, never a
+// clock, which can give two of them one millisecond. A GET of the record's shapes that
+// answers without one changes nothing, and an inert call (customer recognition) is never read.
+//
+// Nothing here writes to the page, sends a request of its own or keeps a response it was
+// not asked about. A response body is cardholder data by association (it carries the
+// merchant's session id in its URL and the buyer's name and address in its text): it
+// stays in this process, is cut before it leaves, and is dropped with the oldest entries.
+import { MERCHANT_CARD_ENDPOINT_FACTS_TEXT_MAX as SHARED_TEXT_MAX, merchantCardEndpointFactsRole as sharedRole, projectMerchantCardEndpointFacts as sharedProject, } from './merchant-card-endpoints.generated.js';
+import { cardEndpointFactsOrigins, cardEndpointFactsSession } from './card-endpoint.js';
+/** How long a paused card request waits for a request on its checkout session that left before it and has not answered. */
+export const CARD_ENDPOINT_FACTS_WAIT_MS = 3_000;
+/**
+ * How many recorded requests the watch keeps. Past it, the oldest request of the checkout
+ * session that holds the most goes first, so another checkout's requests never push this
+ * one's record out while this one holds the fewer. What a checkout lost can still refuse
+ * its capture (Lost).
+ */
+export const CARD_ENDPOINT_FACTS_KEPT = 32;
+/**
+ * How many checkout sessions the watch remembers a loss for. Past it, every capture refuses:
+ * a loss the watch forgot could let an older record through.
+ */
+export const CARD_ENDPOINT_FACTS_LOST_SESSIONS_KEPT = 256;
+const TEXT_MAX = SHARED_TEXT_MAX;
+const RECORDED_TYPES = new Set(['document', 'xhr', 'fetch']);
+export class CardEndpointFactsWatch {
+    now;
+    origins;
+    sessionOf;
+    exchanges = new Map();
+    lost = new Map();
+    lostTooMany = false;
+    waiters = new Set();
+    ticks = 0;
+    constructor(now = Date.now, origins = cardEndpointFactsOrigins(), sessionOf = cardEndpointFactsSession) {
+        this.now = now;
+        this.origins = origins;
+        this.sessionOf = sessionOf;
+    }
+    /** Whether the watch records the request under this key. */
+    tracks(key) { return this.exchanges.has(key); }
+    /**
+     * A request left. Recorded only when it is a document, an XHR or a fetch (or of a type
+     * the adapter could not name) on the endpoint origin of a profile with facts.
+     */
+    sent(key, request) {
+        if (this.origins.length === 0 || typeof request.url !== 'string' || typeof request.method !== 'string')
+            return;
+        let origin;
+        try {
+            origin = new URL(request.url).origin;
+        }
+        catch {
+            return;
+        }
+        if (!this.origins.includes(origin))
+            return;
+        const type = typeof request.resourceType === 'string' ? request.resourceType.toLowerCase() : '';
+        if (type !== '' && !RECORDED_TYPES.has(type))
+            return;
+        this.ticks += 1;
+        this.exchanges.set(key, { method: request.method.toUpperCase(), url: request.url, session: this.sessionOf(request.url) ?? origin,
+            networkId: request.networkId ?? null, document: type === 'document', sentTick: this.ticks, answeredTick: null, finishedTick: null,
+            sentAt: this.now(), status: null, body: null, completedAt: null, failed: false });
+        while (this.exchanges.size > CARD_ENDPOINT_FACTS_KEPT)
+            this.evictOne();
+    }
+    /** Drops the oldest request of the checkout session that holds the most (of two that hold as many, the one seen first). */
+    evictOne() {
+        const counts = new Map();
+        for (const exchange of this.exchanges.values())
+            counts.set(exchange.session, (counts.get(exchange.session) ?? 0) + 1);
+        let fullest = null;
+        for (const [session, count] of counts)
+            if (fullest === null || count > counts.get(fullest))
+                fullest = session;
+        for (const [key, exchange] of this.exchanges) {
+            if (exchange.session === fullest) {
+                this.exchanges.delete(key);
+                this.remember(exchange);
+                return;
+            }
+        }
+    }
+    /** Notes what dropping `exchange` takes from its checkout session (Lost). */
+    remember(exchange) {
+        let lost = this.lost.get(exchange.session);
+        if (!lost) {
+            if (this.lost.size >= CARD_ENDPOINT_FACTS_LOST_SESSIONS_KEPT) {
+                this.lostTooMany = true;
+                return;
+            }
+            lost = { loading: false, sentTick: 0, finishedTick: 0 };
+            this.lost.set(exchange.session, lost);
+        }
+        lost.loading ||= exchange.completedAt === null;
+        lost.sentTick = Math.max(lost.sentTick, exchange.sentTick);
+        lost.finishedTick = Math.max(lost.finishedTick, exchange.finishedTick ?? 0);
+    }
+    /**
+     * The key a load-finished report belongs to: its own when recorded, else the recorded
+     * document with the same network id. Chrome reports an out-of-process frame's document
+     * request on the parent frame's session and its answer on the frame's own session.
+     */
+    keyFor(key, networkId) {
+        if (this.exchanges.has(key))
+            return key;
+        if (!networkId)
+            return null;
+        for (const [recorded, exchange] of this.exchanges) {
+            if (exchange.document && exchange.networkId === networkId && exchange.completedAt === null)
+                return recorded;
+        }
+        return null;
+    }
+    /** The request's answer began to arrive, with its HTTP status: the first report stamps when. */
+    answered(key, status) {
+        const exchange = this.exchanges.get(key);
+        if (!exchange)
+            return;
+        if (Number.isInteger(status))
+            exchange.status = status;
+        exchange.answeredTick ??= ++this.ticks;
+    }
+    /**
+     * The request finished: the adapter reports it the moment the browser does, before it reads
+     * the text, so two answers keep the order they finished in however their texts come back.
+     */
+    finished(key) {
+        const exchange = this.exchanges.get(key);
+        if (exchange)
+            exchange.finishedTick ??= ++this.ticks;
+    }
+    /** The request finished and its text was read (null when it could not be, or was past the limit). */
+    read(key, text, completedAt = this.now()) {
+        const exchange = this.exchanges.get(key);
+        if (!exchange)
+            return;
+        exchange.finishedTick ??= ++this.ticks;
+        exchange.body = typeof text === 'string' && text.length <= TEXT_MAX ? text : null;
+        exchange.completedAt = completedAt;
+        this.settle();
+    }
+    /** The request failed or was aborted: the page never read an answer from it. */
+    failed(key) {
+        const exchange = this.exchanges.get(key);
+        if (!exchange)
+            return;
+        exchange.failed = true;
+        exchange.completedAt ??= this.now();
+        this.settle();
+    }
+    settle() {
+        for (const wake of [...this.waiters])
+            wake();
+    }
+    /**
+     * The order record for a paused card request of `profile` at `cardUrl`, as of the pause.
+     * It reads every recorded request on the same checkout session sent no later than
+     * `pausedAt` that is a record or an unread call (payment-core
+     * merchantCardEndpointFactsRole); the card request and every earlier one to its URL
+     * answer with the payment's outcome, and an inert call changes nothing the record holds,
+     * so neither is waited for or read. One still loading is waited for, up to
+     * CARD_ENDPOINT_FACTS_WAIT_MS, and refuses once that runs out: the page was still
+     * changing the order when it sent the card request. Then the record whose answer
+     * finished last, in the order the watch saw them finish (the one the page shows), is cut
+     * by payment-core; one that holds no record (the /payment-context
+     * answer) is passed over for the one before it, and one that holds a record in another
+     * layout, or did not succeed, refuses. Last, the record refuses when the page sent an
+     * unread call, or a record call other than a GET that gave no record, after it arrived.
+     *
+     * A checkout that sent more requests than the watch keeps refuses whenever what it lost
+     * could change that answer: a request still loading when it went, or one that finished
+     * after the record or was sent after the record arrived. Every request payment-core gives
+     * a role for this card request is on the card request's own session
+     * (cardEndpointFactsSession), so its losses are the only ones read.
+     */
+    async capture(profile, cardUrl, pausedAt, signal) {
+        if (!profile.facts)
+            return { refusal: `Agentcard reads no order record for ${profile.merchant}` };
+        const session = this.sessionOf(cardUrl);
+        const lostNow = () => (this.lostTooMany ? 'untracked' : (session === null ? null : this.lost.get(session) ?? null));
+        const lostRefusal = (lost) => (lost === 'untracked'
+            ? { refusal: `this runtime lost track of the checkouts on ${profile.merchant}'s page, so the order the card would pay is not known` }
+            : { refusal: `${profile.merchant}'s page sent more requests on this checkout than this runtime keeps, so the order the card would pay is not known` });
+        const before = lostNow();
+        if (before === 'untracked' || before?.loading)
+            return lostRefusal(before);
+        const roleOf = (exchange) => {
+            try {
+                return sharedRole(profile.id, cardUrl, { method: exchange.method, url: exchange.url });
+            }
+            catch {
+                return null;
+            }
+        };
+        const read = () => [...this.exchanges.values()].filter((exchange) => exchange.sentAt <= pausedAt)
+            .map((exchange) => ({ exchange, role: roleOf(exchange) })).filter(({ role }) => role === 'record' || role === 'unread');
+        // The wait runs on the real clock, whatever clock stamps the requests.
+        const deadline = Date.now() + CARD_ENDPOINT_FACTS_WAIT_MS;
+        while (read().some(({ exchange }) => exchange.completedAt === null)) {
+            const left = deadline - Date.now();
+            if (left <= 0 || signal?.aborted) {
+                return read().some(({ exchange, role }) => role === 'record' && exchange.completedAt === null)
+                    ? { refusal: `${profile.merchant}'s record of this checkout was still loading when the card request left` }
+                    : { refusal: `${profile.merchant}'s page was still waiting on a request on this checkout when the card request left, so the order the card would pay is not known` };
+            }
+            await new Promise((resolve) => {
+                const wake = () => { clearTimeout(timer); this.waiters.delete(wake); signal?.removeEventListener('abort', wake); resolve(); };
+                const timer = setTimeout(wake, left);
+                this.waiters.add(wake);
+                signal?.addEventListener('abort', wake, { once: true });
+            });
+        }
+        const seen = read();
+        // The page may have sent more while the wait ran.
+        const lost = lostNow();
+        if (lost === 'untracked' || lost?.loading)
+            return lostRefusal(lost);
+        // Newest by when it finished, in the order the watch saw them finish: two in one millisecond
+        // keep that order, whichever of them was sent first.
+        const done = seen.filter(({ exchange, role }) => role === 'record' && !exchange.failed)
+            .sort((a, b) => (b.exchange.finishedTick ?? 0) - (a.exchange.finishedTick ?? 0));
+        for (const { exchange } of done) {
+            let cut;
+            try {
+                cut = sharedProject(profile.id, cardUrl, { method: exchange.method, url: exchange.url, status: exchange.status ?? 0, body: exchange.body });
+            }
+            catch {
+                return { refusal: `${profile.merchant}'s record of this checkout could not be read` };
+            }
+            if (cut.none)
+                continue;
+            if (cut.refusal)
+                return { refusal: cut.refusal };
+            // Anything the page sent once this record's answer began to arrive could have changed the
+            // order unseen: an unread call, or a record call other than a GET, which gave no record of
+            // its own (one that did would be newer than this one). A record the reader read had its
+            // status reported, and with it the moment its answer began.
+            const arrived = exchange.answeredTick ?? exchange.sentTick;
+            if (seen.some(({ exchange: later, role }) => later.sentTick > arrived && (role === 'unread' || later.method !== 'GET'))) {
+                return { refusal: `${profile.merchant}'s page sent a request on this checkout after its newest record of the order, so the order the card would pay is not known` };
+            }
+            // A request the bound took that finished after this record could have been a newer one,
+            // and one sent after this record arrived could have changed the order after it.
+            if (lost && (lost.finishedTick > (exchange.finishedTick ?? 0) || lost.sentTick > arrived))
+                return lostRefusal(lost);
+            return { record: cut.record };
+        }
+        return { refusal: `this runtime saw no record of this checkout from ${profile.merchant}'s page` };
+    }
+}

package/dist/card-endpoint-page.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The page a paused card form navigation is answered with when Agentcard stops it
+ * (card-endpoint.ts, a profile whose `navigation` is 'top' or 'frame').
+ *
+ * A merchant's form that the page submits as a page load leaves the agent's browser
+ * waiting for a page, so an aborted request is the wrong answer: it renders an error
+ * screen or nothing, and invites another click on Pay (the hosted_form lesson,
+ * hosted-form.ts). The page says what happened in one of three outcomes, and nothing else:
+ *
+ * - `stopped_before_send`: the card never left the cardholder's device, the merchant
+ *   received nothing, and no other payment for this checkout is waiting or may have
+ *   reached the merchant, so nothing was charged;
+ * - `sent_answer_not_shown`: the card reached the merchant and its answer cannot be
+ *   shown here (withheld because it could carry card data, or a redirect that would
+ *   make the browser send the form again), so the payment has to be checked with the
+ *   merchant before paying again;
+ * - `payment_in_progress`: a payment for this checkout is waiting for the cardholder's
+ *   approval or may have reached the merchant: an approval still outstanding (a card
+ *   endpoint's device sends the card before it approves), an earlier payment this
+ *   attachment handed over or cannot account for, one whose outcome the API could not
+ *   confirm, or one the API holds for the same checkout (merchant_checkout_in_use). The
+ *   form must not be sent again until that payment is checked with the merchant.
+ *
+ * Self-contained HTML: no external resource, no script that runs (the one `<script>` is
+ * `application/json`), readable by a person in one paragraph and by an agent through the
+ * meta tag, the header and the JSON block. It never carries the endpoint URL, the paused
+ * body or the merchant's answer: only the profile's own merchant name, escaped.
+ */
+import type { SyntheticPage } from './hosted-form.js';
+import type { CheckoutState } from './lifecycle.js';
+export type CardEndpointStoppedOutcome = 'stopped_before_send' | 'sent_answer_not_shown' | 'payment_in_progress';
+/** Why the navigation was stopped, in the words an agent reads from the JSON block. */
+export type CardEndpointStoppedReason = 'not_enabled' | 'request_unsupported' | 'not_approved' | 'blocked' | 'checkout_in_use' | 'answer_withheld' | 'redirect_repeats_post' | 'redirect_location_invalid' | 'outcome_unknown';
+/**
+ * The outcome for a card form navigation refused before its own card could leave. While
+ * an approval is outstanding (a card endpoint's device sends the card before it approves)
+ * or once the controller says a payment may exist, the page never says that nothing was
+ * sent, which would invite a second payment: it reads `payment_in_progress`. Otherwise
+ * nothing has left, and it reads `stopped_before_send`.
+ */
+export declare function refusedNavigationOutcome(state: {
+    awaitingApproval: boolean;
+    status: CheckoutState['status'];
+}): CardEndpointStoppedOutcome;
+export interface CardEndpointStoppedPageInput {
+    outcome: CardEndpointStoppedOutcome;
+    reason: CardEndpointStoppedReason;
+    /** The profile's own merchant name (never the integrator's or the page's). */
+    merchant: string;
+    /** The authorization, once one exists. */
+    authorizationId?: string | null;
+}
+/** The stopped page for a paused card form navigation: status 200, HTML, never cached. */
+export declare function cardEndpointStoppedPage(input: CardEndpointStoppedPageInput): SyntheticPage;

package/dist/card-endpoint-page.js

@@ -0,0 +1,69 @@
+/**
+ * The controller statuses (lifecycle.ts) in which a payment for the attachment's checkout
+ * may exist: its card was handed over, a step-up holds it, or its outcome is not known.
+ */
+const PAYMENT_MAY_EXIST = new Set(['awaiting_merchant', 'completed', 'requires_user_action', 'outcome_unknown']);
+/**
+ * The outcome for a card form navigation refused before its own card could leave. While
+ * an approval is outstanding (a card endpoint's device sends the card before it approves)
+ * or once the controller says a payment may exist, the page never says that nothing was
+ * sent, which would invite a second payment: it reads `payment_in_progress`. Otherwise
+ * nothing has left, and it reads `stopped_before_send`.
+ */
+export function refusedNavigationOutcome(state) {
+    return state.awaitingApproval || PAYMENT_MAY_EXIST.has(state.status) ? 'payment_in_progress' : 'stopped_before_send';
+}
+function escapeHtml(s) {
+    return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+const TEXT = {
+    stopped_before_send: (merchant) => ({
+        title: 'Payment stopped',
+        body: `Agentcard stopped this payment before your card reached ${merchant}. Nothing was sent and nothing was charged.`,
+        next: 'nothing reached the merchant; start the checkout again or pay another way',
+    }),
+    sent_answer_not_shown: (merchant) => ({
+        title: 'Check this payment',
+        body: `Your card was sent to ${merchant}, and its answer cannot be shown here. Do not submit this form again. Check the payment with ${merchant} before paying again.`,
+        next: "check the payment with the merchant; never resubmit this form",
+    }),
+    payment_in_progress: (merchant) => ({
+        title: 'Check this payment',
+        body: `A payment for this checkout is waiting for approval or may have reached ${merchant}. Do not submit this form again. Check that payment with ${merchant} before paying again.`,
+        next: 'a payment for this checkout is waiting or may have reached the merchant; check it with the merchant; never resubmit this form',
+    }),
+};
+/** The stopped page for a paused card form navigation: status 200, HTML, never cached. */
+export function cardEndpointStoppedPage(input) {
+    const merchant = String(input.merchant ?? '');
+    const text = TEXT[input.outcome](escapeHtml(merchant));
+    const record = {
+        outcome: input.outcome,
+        reason: input.reason,
+        merchant,
+        ...(input.authorizationId ? { authorization_id: String(input.authorizationId) } : {}),
+        next: text.next,
+    };
+    const json = JSON.stringify(record).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
+    const body = [
+        '<!doctype html>',
+        '<html lang="en">',
+        '<head>',
+        '<meta charset="utf-8">',
+        `<meta name="agentcard-checkout" content="${input.outcome}">`,
+        '<meta name="robots" content="noindex">',
+        `<title>${text.title}</title>`,
+        '</head>',
+        '<body>',
+        `<p>${text.body}</p>`,
+        `<script type="application/json" id="agentcard-checkout">${json}</script>`,
+        '</body>',
+        '</html>',
+        '',
+    ].join('\n');
+    return {
+        status: 200,
+        headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'x-agentcard-checkout': input.outcome },
+        body,
+    };
+}