@agent-cards/sdk 0.23.10 → 0.23.12

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: bbfd8946fd3963bf32fe66d5c17ba50dd69e141187c1d5896ee60c33b3aa0e41
+// artifact-sha256: b3391e7d6137e269555a23062ce848aa7a7f6f02e626fd568b1e9597c02e5ce6
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -83,6 +83,7 @@ var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
@@ -138,7 +139,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");
@@ -347,8 +348,79 @@ function amadeusBodyKind(body) {
         return record2(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
     return "other";
 }
+// src/paddle-vgs.js
+var PADDLE_VGS_PSP = "paddle_vgs";
+var PADDLE_VGS_CARDS_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://vault.paddle.com/cards",
+    sandbox: "https://sandbox-vault.paddle.com/cards"
+});
+var BODY_LIMIT2 = 4096;
+var ROOT_KEYS2 = /* @__PURE__ */ Object.freeze(["data"]);
+var DATA_KEYS = /* @__PURE__ */ Object.freeze(["type", "attributes"]);
+var ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["pan", "cvc", "exp_month", "exp_year", "cardholder"]);
+var CARD_NUMBER4 = /^[0-9]{12,19}$/;
+var SECURITY_CODE2 = /^[0-9]{3,4}$/;
+var NAME_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
+var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paddleVgsEnvironment(url) {
+    if (url === PADDLE_VGS_CARDS_URLS.production)
+        return "production";
+    if (url === PADDLE_VGS_CARDS_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isPaddleVgsCardsUrl(url) {
+    return paddleVgsEnvironment(url) !== null;
+}
+function readBody2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record3(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function paddleVgsBodyVerdict(body) {
+    const value = readBody2(body);
+    if (value === null || !sameKeys(value, ROOT_KEYS2) || !record3(value.data) || !sameKeys(value.data, DATA_KEYS) || value.data.type !== "cards" || !record3(value.data.attributes) || !sameKeys(value.data.attributes, ATTRIBUTE_KEYS)) {
+        return refuse4("paddle_vgs_body_unsupported");
+    }
+    const card = value.data.attributes;
+    const holder = card.cardholder;
+    if (typeof card.pan !== "string" || !CARD_NUMBER4.test(card.pan) || typeof card.cvc !== "string" || !SECURITY_CODE2.test(card.cvc) || !Number.isInteger(card.exp_month) || card.exp_month < 1 || card.exp_month > 12 || !Number.isInteger(card.exp_year) || card.exp_year < 0 || card.exp_year > 99 || !record3(holder) || !sameKeys(holder, ["name"]) || typeof holder.name !== "string" || holder.name.length > NAME_LIMIT || CONTROL.test(holder.name) || cardLikeName(holder.name)) {
+        return refuse4("paddle_vgs_body_unsupported");
+    }
+    return CARD4;
+}
+var pin2 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin2({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
+    if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
+        if (url !== void 0 && !isPaddleVgsCardsUrl(url))
+            return { verdict: "refuse", code: "paddle_vgs_url_refused" };
+        return paddleVgsBodyVerdict(body);
+    }
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -469,12 +541,12 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT2 = 16384;
+var BODY_LIMIT3 = 16384;
 var RESPONSE_LIMIT = 32768;
-var ROOT_KEYS2 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
+var ROOT_KEYS3 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns4 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -497,7 +569,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT3)
         return null;
     let value;
     try {
@@ -506,12 +578,12 @@ function judgeBody(body) {
     catch {
         return null;
     }
-    if (!record3(value) || !roundTrips(value, body))
+    if (!record4(value) || !roundTrips(value, body))
         return null;
-    if (!Object.keys(value).every((key) => ROOT_KEYS2.includes(key)) || !owns4(value, "paymentInstrument"))
+    if (!Object.keys(value).every((key) => ROOT_KEYS3.includes(key)) || !owns4(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record3(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns4(instrument, key)))
+    if (!record4(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns4(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH, instrument.expirationMonth) || !exact(YEAR, instrument.expirationYear))
         return null;
@@ -539,7 +611,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record3(headers))
+    if (!record4(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -586,7 +658,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record3(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record4(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -601,7 +673,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record3(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record4(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -685,7 +757,7 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record3(value) ? value : null;
+        return record4(value) ? value : null;
     }
     catch {
         return null;
@@ -694,16 +766,16 @@ function readAnswer(body) {
 var tokenValue = (value) => exact(TOKEN, value) && !panLike(value);
 var optional = (value, key, check) => !owns4(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record3(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record4(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record3))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record4))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns4(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record3(data.binData)) {
+    if (record4(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns4(data.binData, key) || data.binData[key] === null)
@@ -719,7 +791,7 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record3(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record4(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -747,7 +819,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record3(value.error) ? value.error.errorId : null;
+    const id = value && record4(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 57dffa8575e71c819c694d818e272c955303add0ed4b083d69bab1606cd6150f
+// artifact-sha256: dd47d4d2d97c39acb2385272d1a2bf3e647741839234283b848b67fd5ce5c114
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -211,7 +211,18 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             // The result page Tranzila's card form names when the terminal set no
             // return URL of its own (read on both hosts on 2026-10-10): the result
             // goes back to Tranzila, which already holds it. Matched exactly.
-            processorResultUrls: ["https://direct.tranzila.com/done/", "https://directng.tranzila.com/process/fail"]
+            processorResultUrls: ["https://direct.tranzila.com/done/", "https://directng.tranzila.com/process/fail"],
+            // Tranzila's own ALTCHA proof of work, on every card form read on both
+            // hosts on 2026-10-10 (altcha 1.0.7, SHA-256, searched up to 50,000):
+            // Tranzila's script hashes the page's challenge until it finds the
+            // number, writes base64 JSON {algorithm, challenge, number, salt,
+            // signature, took} into `altcha`, and only then submits the form.
+            // Nobody answers anything and the proof names no browser, cookie or
+            // address, so it rides the device's one send as the page wrote it, once
+            // the create finds it is one solved proof (backend.js isAltchaProof).
+            // Every other challenge field is still refused (hosted_form_gated).
+            // Removing this line refuses `altcha` again.
+            proofOfWork: "altcha"
         }
     },
     {
@@ -1407,6 +1418,33 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             // A checked "remember" asks Worldline to keep the card for later purchases.
             token: "remember"
         }
+    },
+    {
+        psp: "paddle_vgs",
+        // Paddle's checkout frame (buy.paddle.com) on a checkout whose card method names VGS as its
+        // tokenizer: one JSON:API POST to /cards on vault.paddle.com, a VGS inbound proxy Paddle runs
+        // (sandbox-vault.paddle.com in test), with the checkout's own bearer JWT. PAN@
+        // data.attributes.pan, with cvc, exp_month (1 to 12) and exp_year (two digits) beside it, all
+        // numbers but the pan and the cvc. paddle-vgs.js holds the request rule the pause decision, the
+        // API's create, the prepared bind and the device all read: exactly one of the two URLs, the
+        // frame's Content-Type and bearer, and the frame's body byte for byte. VGS answers with the
+        // stored card's id, which the frame sends on to Paddle's /pay. The frame aborts this request
+        // after 10 seconds and sends it once more, so the lane is prepared only (preparationRequired):
+        // the cardholder approves before the agent clicks Pay. The card leaves the cardholder's device
+        // by a direct fetch, since the proxy answers any origin. The checkouts that name TokenEx or
+        // Spreedly send the card elsewhere and are not this entry.
+        // Ships dark: served only to a client that declares `paddle_vgs_cards`, gated off for every org
+        // until an operator lists one (`paddle_vgs:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7):
+        // sandbox-vault only on test rows and only with documented test cards, vault only on live rows.
+        capability: "paddle_vgs_cards",
+        match: "(?:sandbox-)?vault\\.paddle\\.com/cards",
+        hosts: ["^vault\\.paddle\\.com$", "^sandbox-vault\\.paddle\\.com$"],
+        sandboxHosts: ["^sandbox-vault\\.paddle\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        passthroughHeaders: ["^authorization$"]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1509,6 +1547,15 @@ var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fiel
 var MONERIS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin({ id: "jack_org_raisin", merchant: "Jack.org", origins: ["https://jack.akaraisin.com"], profileIds: ["htL7TR9H7ICYN2B"] })
 ]);
+// src/paddle-vgs.js
+var pin2 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sellerClaim: fields.sellerClaim ? Object.freeze({ ...fields.sellerClaim }) : null
+});
+var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin2({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -1596,6 +1643,7 @@ var ALLOWED_MEDIA_TYPES = {
     jwe: ["application/jwt"]
 };
 var JWE_CONTENT_TYPE = "application/jwt; charset=utf-8";
+var PADDLE_VGS_MEDIA_TYPE = "application/vnd.api+json";
 function contentTypeFor(pspOrEntry, headers) {
     const rec = trustedClientRecognizer(pspOrEntry);
     if (rec.encoding === "jwe") {
@@ -1605,6 +1653,13 @@ function contentTypeFor(pspOrEntry, headers) {
             throw new Error("Refusing to pay: this processor takes its sealed card only as application/jwt.");
         return JWE_CONTENT_TYPE;
     }
+    if (rec.psp === "paddle_vgs") {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        if (!captured || typeof captured[1] !== "string" || captured[1].trim().toLowerCase() !== PADDLE_VGS_MEDIA_TYPE) {
+            throw new Error("Refusing to pay: this processor takes its card only as application/vnd.api+json.");
+        }
+        return PADDLE_VGS_MEDIA_TYPE;
+    }
     const encoding = rec && rec.encoding === "form" ? "form" : "json";
     const allowed = ALLOWED_MEDIA_TYPES[encoding];
     const fallback = allowed[0];
@@ -1624,6 +1679,8 @@ function replayHeaders(pspOrEntry, captured = {}) {
     const headers = { "content-type": contentTypeFor(rec, captured) };
     if (rec.psp === "creditguard")
         headers.accept = "application/json";
+    if (rec.psp === "paddle_vgs")
+        headers.accept = PADDLE_VGS_MEDIA_TYPE;
     for (const [name, value] of Object.entries(captured)) {
         if (rec.headers.some((pattern) => pattern.test(name)) && !HEADER_NEVER_FORWARD.test(name))
             headers[name] = value;

package/dist/worldline-mycheckout.d.ts

@@ -0,0 +1,27 @@
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export declare function isWorldlineMyCheckoutEndpoint(url: string): boolean;
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = "worldline_mycheckout_product_changed";
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export declare const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = "worldline_mycheckout_product_missing";
+export type WorldlineMyCheckoutRefusal = typeof WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED | typeof WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export declare class WorldlineMyCheckoutProducts {
+    private readonly chosen;
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url: string, body: string | null): WorldlineMyCheckoutRefusal | null;
+    private remember;
+}

package/dist/worldline-mycheckout.generated.d.ts

@@ -0,0 +1,29 @@
+declare var WORLDLINE_MYCHECKOUT_PSP: string;
+declare var WORLDLINE_MYCHECKOUT_CAPABILITY: string;
+declare var WORLDLINE_MYCHECKOUT_ENDPOINTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare function worldlineMyCheckoutEnvironment(url: any): "production" | "sandbox" | undefined;
+declare function isWorldlineMyCheckoutUrl(url: any): boolean;
+declare var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS: Readonly<{
+    visa: readonly string[];
+    mastercard: readonly string[];
+    amex: readonly string[];
+    discover: readonly string[];
+    jcb: readonly string[];
+    diners: readonly string[];
+}>;
+declare function worldlineMyCheckoutProductNetwork(productId: any): string | null;
+declare function parseWorldlineMyCheckoutForm(body: any): {
+    refusal: string;
+    pairs?: undefined;
+} | {
+    pairs: string[][];
+    refusal?: undefined;
+};
+declare function worldlineMyCheckoutCardholderName(name: any): string | null;
+declare function worldlineMyCheckoutTemplateRefusal(body: any): string | null;
+declare function worldlineMyCheckoutRequestRefusal(request: any): string | null;
+declare var WORLDLINE_MYCHECKOUT_DEDUPE: readonly string[];
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.generated.js

@@ -0,0 +1,162 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 486a32aa0f96f59666d4a43e42fee9f493cd3059b27ad3f92b97ad6b249133f5
+// src/worldline-mycheckout.js
+var WORLDLINE_MYCHECKOUT_PSP = "worldline_mycheckout";
+var WORLDLINE_MYCHECKOUT_CAPABILITY = "worldline_mycheckout_form";
+var WORLDLINE_MYCHECKOUT_ENDPOINTS = /* @__PURE__ */ Object.freeze({
+    production: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.checkout.worldline-solutions.com/checkout"
+    ]),
+    sandbox: /* @__PURE__ */ Object.freeze([
+        "https://payment.pay1.preprod.checkout.worldline-solutions.com/checkout",
+        "https://payment.pay2.preprod.checkout.worldline-solutions.com/checkout"
+    ])
+});
+function worldlineMyCheckoutEnvironment(url) {
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.production.includes(url))
+        return "production";
+    if (WORLDLINE_MYCHECKOUT_ENDPOINTS.sandbox.includes(url))
+        return "sandbox";
+    return void 0;
+}
+function isWorldlineMyCheckoutUrl(url) {
+    return worldlineMyCheckoutEnvironment(url) !== void 0;
+}
+var WORLDLINE_MYCHECKOUT_CARD_PRODUCTS = /* @__PURE__ */ Object.freeze({
+    visa: /* @__PURE__ */ Object.freeze(["1", "114", "122"]),
+    mastercard: /* @__PURE__ */ Object.freeze(["3", "119"]),
+    amex: /* @__PURE__ */ Object.freeze(["2"]),
+    discover: /* @__PURE__ */ Object.freeze(["128"]),
+    jcb: /* @__PURE__ */ Object.freeze(["125"]),
+    diners: /* @__PURE__ */ Object.freeze(["132"])
+});
+function worldlineMyCheckoutProductNetwork(productId) {
+    for (const [network, ids] of Object.entries(WORLDLINE_MYCHECKOUT_CARD_PRODUCTS)) {
+        if (ids.includes(productId))
+            return network;
+    }
+    return null;
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var FIELDS = {
+    publicMerchantId: /^[1-9]\d{0,9}$/,
+    variantCode: /^\d{1,10}$/,
+    locale: /^[a-z]{2}_[A-Z]{2}$/,
+    idempotenceKey: UUID,
+    // <merchant id>-<32 hex>:<hosted checkout id>:<32 hex>, the hosted checkout's own id.
+    token: /^[1-9]\d{0,9}-[0-9a-f]{32}:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}$/,
+    requestToken: UUID,
+    isPaymentProductDetailsShown: /^(?:true|false)$/,
+    isPaymentProductFiscalNumberShown: /^(?:true|false)$/,
+    jsEnabled: /^true$/,
+    isFramed: /^(?:true|false)$/,
+    paymentProductId: /^\d{1,4}$/,
+    paymentProductGroupId: /^cards$/,
+    colorDepth: /^\d{0,3}$/,
+    screenHeight: /^\d{0,5}$/,
+    screenWidth: /^\d{0,5}$/,
+    innerHeight: /^\d{0,5}$/,
+    innerWidth: /^\d{0,5}$/,
+    timezoneOffsetUtcMinutes: /^-?\d{0,4}$/,
+    browserLocale: /^[A-Za-z0-9-]{0,35}$/,
+    javaEnabled: /^(?:true|false)?$/,
+    cardNumber: /^[0-9 ]{12,23}$/,
+    // MM/YY as the page's mask writes it; the delimiter may be absent or padded.
+    expiryDate: /^(?:0[1-9]|1[0-2])(?: ?\/ ?)?\d{2}$/,
+    cvv: /^\d{3,4}$/,
+    cardholderName: /^[^\u0000-\u001f\u007f<>]{0,100}$/,
+    // The autofill helpers the page folds into expiryDate and then empties.
+    expiryDateMonth: /^$/,
+    expiryDateYear: /^$/,
+    // A checked "remember" asks Worldline to keep the card for later purchases.
+    remember: /^$/,
+    // Present, empty, on a page that offers Click to Pay; a value is a Click to Pay payment.
+    clickToPayCheckoutResponseSignature: /^$/,
+    // The Pay button's own pair. The click handler writes it into #buttonValue and appends one
+    // more copy per click, so it may repeat, always as doPayment=doPayment.
+    doPayment: /^doPayment$/
+};
+var REPEATABLE = /* @__PURE__ */ new Set(["doPayment"]);
+var REQUIRED = ["publicMerchantId", "token", "requestToken", "idempotenceKey", "doPayment", "cardNumber", "expiryDate", "cvv"];
+var NOT_A_CARD_SALE = /* @__PURE__ */ new Set(["cancelPayment", "encryptedPaymentData", "mobileCardholderName"]);
+var BODY_LIMIT = 16384;
+var VALUE_LIMIT = 2048;
+function parseWorldlineMyCheckoutForm(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT || /[^\x21-\x7e]/.test(body))
+        return { refusal: "body" };
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            return { refusal: "body" };
+        let key;
+        let value;
+        try {
+            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return { refusal: "body" };
+        }
+        if (value.length > VALUE_LIMIT || /[\u0000-\u001f\u007f]/.test(value))
+            return { refusal: "body" };
+        if (seen.has(key) && !REPEATABLE.has(key))
+            return { refusal: "body" };
+        seen.add(key);
+        pairs.push([key, value]);
+    }
+    return { pairs };
+}
+var SESSION_FIELDS = /* @__PURE__ */ new Set(["publicMerchantId", "token", "requestToken", "idempotenceKey"]);
+var CARD_FIELDS = /* @__PURE__ */ new Set(["cardNumber", "expiryDate", "cvv", "cardholderName", "expiryDateMonth", "expiryDateYear"]);
+function worldlineMyCheckoutCardholderName(name) {
+    if (typeof name !== "string")
+        return null;
+    const trimmed = name.trim();
+    return trimmed !== "" && FIELDS.cardholderName.test(trimmed) ? trimmed : null;
+}
+function worldlineMyCheckoutTemplateRefusal(body) {
+    const parsed = parseWorldlineMyCheckoutForm(body);
+    if (parsed.refusal)
+        return parsed.refusal;
+    const values = /* @__PURE__ */ new Map();
+    for (const [key, value] of parsed.pairs) {
+        if (NOT_A_CARD_SALE.has(key) || key === "clickToPayCheckoutResponseSignature" && value !== "")
+            return "not_a_card_sale";
+        if (key === "remember" && value !== "")
+            return "stored_card";
+        if (!Object.hasOwn(FIELDS, key))
+            return "unknown_field";
+        values.set(key, value);
+    }
+    for (const key of REQUIRED)
+        if (!values.has(key))
+            return "missing_field";
+    for (const [key, value] of parsed.pairs) {
+        if (FIELDS[key].test(value))
+            continue;
+        return SESSION_FIELDS.has(key) ? "session" : CARD_FIELDS.has(key) ? "card_fields" : "field_value";
+    }
+    if (values.get("token").split("-")[0] !== values.get("publicMerchantId"))
+        return "session";
+    const product = values.get("paymentProductId");
+    if (product === void 0 ? !values.has("paymentProductGroupId") : worldlineMyCheckoutProductNetwork(product) === null)
+        return "product";
+    return null;
+}
+function worldlineMyCheckoutRequestRefusal(request) {
+    if (!request || typeof request !== "object" || !isWorldlineMyCheckoutUrl(request.url))
+        return "endpoint";
+    if (request.method !== "POST")
+        return "method";
+    const headers = request.headers && typeof request.headers === "object" ? request.headers : {};
+    const types = Object.entries(headers).filter(([name]) => name.toLowerCase() === "content-type");
+    if (types.length !== 1 || typeof types[0][1] !== "string" || !/^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(types[0][1].trim()))
+        return "content_type";
+    return worldlineMyCheckoutTemplateRefusal(request.body);
+}
+var WORLDLINE_MYCHECKOUT_DEDUPE = /* @__PURE__ */ Object.freeze(["publicMerchantId", "token"]);
+export { WORLDLINE_MYCHECKOUT_CAPABILITY, WORLDLINE_MYCHECKOUT_CARD_PRODUCTS, WORLDLINE_MYCHECKOUT_DEDUPE, WORLDLINE_MYCHECKOUT_ENDPOINTS, WORLDLINE_MYCHECKOUT_PSP, isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm, worldlineMyCheckoutCardholderName, worldlineMyCheckoutEnvironment, worldlineMyCheckoutProductNetwork, worldlineMyCheckoutRequestRefusal, worldlineMyCheckoutTemplateRefusal };

package/dist/worldline-mycheckout.js

@@ -0,0 +1,93 @@
+// Worldline Connect MyCheckout (psp `worldline_mycheckout`): the hosted payment page whose card
+// form posts the card as a top-level navigation to /checkout on Worldline's own host. The form
+// rules are payment-core's (worldline-mycheckout.generated.ts): the API applies them at create,
+// and the cardholder's device applies them again before it rebuilds the form with the real card.
+// This module holds the one thing only the SDK can decide: which card product the page chose.
+//
+// A MyCheckout page that offers several card products asks the shopper to choose one first (its
+// select-payment-product page: Visa 1, Mastercard 3, Visa Electron 122, and so on). That choice
+// posts to the same /checkout URL with no card, and continues untouched. The card form it opens
+// then looks the typed number's IIN up with Worldline and, when the answer names another product
+// the page offers, switches its own paymentProductId to that product. With the agent's placeholder
+// typed, the answer describes the placeholder, never the card that pays: on 2026-10-12 CLZ's page
+// read the SDK's Visa placeholder (411111) as Visa Electron (122) and switched the form from the
+// Visa (1) the agent chose. The cardholder's device checks only that the product belongs to the
+// real card's network (Visa takes 1, 114 and 122), so it would have submitted a Visa credit card
+// as Visa Electron. The device never sees the choice and the API stores only the card form; this
+// attachment sees both posts, so the SDK holds the card submit to the product chosen for its
+// hosted checkout.
+//
+// The processor ships dark: the API serves the recognizer only to a build that declares
+// `worldline_mycheckout_form`, for an org Agentcard turned Worldline on for. Without it no
+// MyCheckout post pauses, and none reaches this module.
+import { isWorldlineMyCheckoutUrl, parseWorldlineMyCheckoutForm } from './worldline-mycheckout.generated.js';
+/** Whether `url` is one of MyCheckout's four card-form endpoints, written exactly (payment-core's rule). */
+export function isWorldlineMyCheckoutEndpoint(url) {
+    return isWorldlineMyCheckoutUrl(url) === true;
+}
+/** The `blocked` detail for a card submit whose product is not the one its page chose. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED = 'worldline_mycheckout_product_changed';
+/** The `blocked` detail for a card submit that names no product, on a hosted checkout whose page chose one. */
+export const WORLDLINE_MYCHECKOUT_PRODUCT_MISSING = 'worldline_mycheckout_product_missing';
+/** How many hosted checkouts one attachment remembers a choice for; the oldest is forgotten first. */
+const REMEMBERED_CHECKOUTS = 32;
+const PRODUCT_ID = /^\d{1,4}$/;
+/**
+ * The card products one attachment saw chosen, per hosted checkout: its `publicMerchantId` and
+ * `token`, the pair payment-core's duplicate guard reads as one hosted checkout
+ * (WORLDLINE_MYCHECKOUT_DEDUPE).
+ */
+export class WorldlineMyCheckoutProducts {
+    chosen = new Map();
+    /**
+     * Read one POST to a card-form endpoint. A product selection (no card, and neither the Pay nor
+     * the cancel pair) records the product it chose for its hosted checkout, or forgets the choice
+     * when it picks the card group, which leaves the product to the card. A card submit is judged:
+     * WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED when its paymentProductId is another product than the one
+     * chosen for its hosted checkout, WORLDLINE_MYCHECKOUT_PRODUCT_MISSING when it names none. Null for
+     * every other post, and for a card submit on the card group or on a hosted checkout whose choice
+     * this attachment never saw: the API and the device judge those as before. A body payment-core
+     * cannot read is never judged here either.
+     */
+    judge(url, body) {
+        if (typeof body !== 'string' || !isWorldlineMyCheckoutUrl(url))
+            return null;
+        const parsed = parseWorldlineMyCheckoutForm(body);
+        if (!parsed.pairs)
+            return null;
+        const values = new Map();
+        for (const [key, value] of parsed.pairs)
+            if (!values.has(key))
+                values.set(key, value);
+        const merchant = values.get('publicMerchantId');
+        const token = values.get('token');
+        if (!merchant || !token)
+            return null;
+        const checkout = JSON.stringify([merchant, token]);
+        const product = values.get('paymentProductId');
+        // A card is a non-empty cardNumber, as the recognizer's card fields read it (card-fields.js).
+        if (!values.get('cardNumber')) {
+            if (values.has('doPayment') || values.has('cancelPayment'))
+                return null;
+            if (product !== undefined && PRODUCT_ID.test(product))
+                this.remember(checkout, product);
+            else if (values.get('paymentProductGroupId') === 'cards')
+                this.chosen.delete(checkout);
+            return null;
+        }
+        if (values.has('paymentProductGroupId'))
+            return null;
+        const chosen = this.chosen.get(checkout);
+        if (chosen === undefined)
+            return null;
+        if (!product)
+            return WORLDLINE_MYCHECKOUT_PRODUCT_MISSING;
+        return product === chosen ? null : WORLDLINE_MYCHECKOUT_PRODUCT_CHANGED;
+    }
+    remember(checkout, product) {
+        this.chosen.delete(checkout);
+        this.chosen.set(checkout, product);
+        while (this.chosen.size > REMEMBERED_CHECKOUTS)
+            this.chosen.delete(this.chosen.keys().next().value);
+    }
+}