@agent-cards/sdk 0.23.13 → 0.23.15

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7e7a9b515128df56d149df50e0c275c7f6e8e522945ed818ca714ccac7eb1cd7
+// artifact-sha256: ce4887768a0ee59bbca5f329bce47a2831a24b06d7bea1d5517335f7afad75e0
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -298,6 +298,102 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             callbackUrls: ["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]
         }
     },
+    {
+        psp: "redsys",
+        // Redsys's hosted payment page, the TPV Virtual redirect most Spanish banks give their merchants. The
+        // merchant's page posts a signed ENTRY form top-level to sis.redsys.es/sis/realizarPago (or its
+        // /utf-8 twin): the amount, the merchant's FUC and terminal, its result URLs and an HMAC-SHA256 over
+        // them, and no card. Redsys answers with its own card page under a session of its own (a jsessionid
+        // in the page's form action), so a card form rebuilt away from that session has no order to pay
+        // (processors/redsys.js). The paused request is therefore the entry, a Document navigation that
+        // carries no card: the cardholder's device repeats it over the end-to-end TLS relay, fills the card
+        // into the page Redsys returns to it and posts it back in that same session, and the runtime resolves
+        // the paused navigation with the hosted_form notice. Only the two entry paths are matched, exactly
+        // (processors/redsys.js isRedsysEntryUrl: a query would reach Redsys's servlets as fields): the card
+        // post (/sis/pagoTarjeta), the older page's 3-D Secure card lookup and InSite's card post carry a
+        // card, and the SDK refuses them in the agent's browser, so no dummy card ever reaches Redsys.
+        // Redsys's test platform (sis-t.redsys.es) answers on port 25443 alone, which no recognizer takes,
+        // and isRedsysEntryUrl takes only the live host: it is listed so the live host classifies as live and
+        // the create refuses a test row there (live_host_on_sandbox_row), since no test row can reach a
+        // Redsys test host. Dark: served only to a client that declares the capability, and gated off for
+        // every org the operator has not allowlisted.
+        capability: "redsys_hosted_payment_page",
+        match: "sis\\.redsys\\.es/sis/realizarPago(?:/utf-8)?",
+        hosts: ["^sis\\.redsys\\.es$", "^sis-t\\.redsys\\.es$"],
+        sandboxHosts: ["^sis-t\\.redsys\\.es$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the page Redsys returns to the device, not into the paused entry, which must
+            // carry none (processors/redsys.js checkRedsysEntry). The device never posts a form of its own:
+            // the Vault's form-action policy leaves this host out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/redsys.js checkRedsysEntry), the reviewed merchants among them:
+            // the create runs them, and naming them here makes the cardholder's device run them again on the
+            // entry it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "redsys",
+            required: ["Ds_SignatureVersion", "Ds_MerchantParameters", "Ds_Signature"],
+            // Redsys's card page's own fields, which the device fills on that page (never in the entry).
+            card: { number: "Sis_Numero_Tarjeta", month: "Sis_Caducidad_Tarjeta_Mes", year: "Sis_Caducidad_Tarjeta_Anno", cvc: "Sis_Tarjeta_CVV2" },
+            // The FUC, terminal, order, amount and currency inside the signed Ds_MerchantParameters name one
+            // payment; the policy reads them there (checkRedsysEntry's dedupe), since no form field holds them.
+            dedupe: ["Ds_MerchantParameters"]
+        }
+    },
+    {
+        psp: "quickpay",
+        // QuickPay's hosted payment window, where most Danish and Nordic webshops send the buyer (DanDomain,
+        // SmartWeb, Shoporama and the WooCommerce, Magento and PrestaShop modules). The merchant's page posts a
+        // signed ENTRY form top-level to https://payment.quickpay.net/ (QuickPay's Form API v10): the amount, the
+        // merchant and agreement ids, its order id, its continue, cancel and callback URLs and an HMAC-SHA256
+        // checksum over them, and no card. QuickPay answers with its window under a session of its own (the
+        // window's path, /<32 hex>, and a hidden field of its card form), so a card form rebuilt away from that
+        // session has no payment to pay (processors/quickpay.js). The paused request is therefore the entry, a
+        // Document navigation that carries no card: the cardholder's device repeats it over the end-to-end TLS
+        // relay, fills the card into the window QuickPay returns to it and posts it back in that same session, and
+        // the runtime resolves the paused navigation with the hosted_form notice. Only the entry path is matched,
+        // exactly (processors/quickpay.js isQuickpayEntryUrl: a query would reach QuickPay's server as fields
+        // beside the signed body): the window's card post (/process_card), its fee lookup (/calculate_fee, which
+        // carries the card number) and its wallet token post carry a card, and the SDK refuses them in the agent's
+        // browser, so no dummy card ever reaches QuickPay. QuickPay has no test host: a test payment runs on this
+        // host with QuickPay's own test card numbers, so the host marks no environment. Dark: served only to a
+        // client that declares the capability, and gated off for every org the operator has not allowlisted.
+        capability: "quickpay_hosted_payment_page",
+        match: "payment\\.quickpay\\.net/",
+        hosts: ["^payment\\.quickpay\\.net$"],
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the window QuickPay returns to the device, not into the paused entry, which must
+            // carry none (processors/quickpay.js checkQuickpayEntry). The device never posts a form of its own: the
+            // Vault's form-action policy leaves this host out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/quickpay.js checkQuickpayEntry), the reviewed merchants among them:
+            // the create runs them, and naming them here makes the cardholder's device run them again on the entry
+            // it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "quickpay",
+            required: [
+                "version",
+                "merchant_id",
+                "agreement_id",
+                "order_id",
+                "amount",
+                "currency",
+                "continueurl",
+                "cancelurl",
+                "callbackurl",
+                "checksum"
+            ],
+            // The window's own card fields, which the device fills in the window (never in the entry).
+            card: { number: "cardnumber", month: "expiration[month]", year: "expiration[year]", cvc: "cvd" },
+            // The merchant, its agreement, its order and the amount name one payment, as QuickPay keys one payment
+            // per merchant on its order id.
+            dedupe: ["merchant_id", "agreement_id", "order_id", "amount", "currency"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1144,7 +1240,8 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // decides, and neither the request nor the page names it), so the S7 host rule has no test-only
         // host to pin, and the device's test-card rule cannot tell a test payment from a live one here.
         // A live row can therefore send a real card to a payment page created on a public test terminal,
-        // whose transactions anyone holding Pelecard's published demo credentials can read back.
+        // whose transactions anyone holding Pelecard's published demo credentials can read back. Agentcard
+        // accepted that on 2026-10-11 (pelecard.js header); a test row sends only a documented test card.
         // Ships dark: served only to a client that declares `pelecard_transaction`, gated off for every org
         // until an operator allowlists one, and never replayed by autopilot (EXCLUDED_OPERATIONS).
         capability: "pelecard_transaction",
@@ -1205,14 +1302,20 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // (SeboCalm). Its Angular transaction service posts the card to /services/v1/txn/<txId>/process as
         // same-origin JSON, no auth header, no cookie: the txId is the only credential and the submit is the
         // sale itself. PAN@ root `cardNumber` (expMonth MM, expYear YY, cvv, personalId) in plaintext, or one
-        // js-jose JWE in root `jwePayload` when the transaction carries a jwePublicKey (creditguard.js keeps
-        // that variant behind a flag). Sources: templates/cgt-basic/main.js on pps and ppsuat, reviewed
-        // 2026-09-25. /card/details, /card/details/dcc, /cc/ddc/init, /cg3ds/*, /otp/request and
-        // /applepay|paybox|pcp/process share the prefix, carry the agent's placeholder or no card, and fall
-        // out at the exact path; (?![\w/-]) is the right edge for the SDK's unanchored test. pps2 is a
+        // js-jose JWE in root `jwePayload` when the transaction carries a jwePublicKey (creditguard.js admits
+        // that variant only where a caller passes its flag). Sources: templates/cgt-basic/main.js on pps and
+        // ppsuat, reviewed 2026-09-25. /card/details, /card/details/dcc, /cc/ddc/init, /cg3ds/*, /otp/request
+        // and /applepay|paybox|pcp/process share the prefix, carry the agent's placeholder or no card, and
+        // fall out at the exact path; (?![\w/-]) is the right edge for the SDK's unanchored test. pps2 is a
         // production host (cg-safecharge-3ds envConfig: pps, pps2, cgmpi = prod). The legacy MPI page
         // (cgmpi.creditguard.co.il), pps-dev, ppsqa, pps-qa1 and cguat2 are deliberately absent.
         // creditguard.js judges the whole request before a card is written and fills only the card fields.
+        //   - deviceSteps: on a 3-D Secure transaction through Cardinal, the three calls the cardholder's
+        //     device sends with the real card before the submit, on the paused submit's own host and
+        //     transaction (creditguard.js creditguardDeviceStepUrl, which the transport checks with
+        //     request-policy.js assertAllowedDeviceStep). The SDK answers the page's own copies of them
+        //     with the placeholder, so those never leave the agent's browser. Definitions-only: the served
+        //     row does not carry them.
         // Ships dark: served only to a client that declares `creditguard_pps_process`, gated off for every
         // org until an operator allowlists one, never replayed by autopilot (EXCLUDED_OPERATIONS).
         capability: "creditguard_pps_process",
@@ -1230,7 +1333,12 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: [],
         // A /process body without either (Google Pay, a saved cardId, a js-jose object fallback) is not a
         // new card, and with no passWithoutCard it is refused instead of paused.
-        jsonCardFields: [["cardNumber"], ["jwePayload"]]
+        jsonCardFields: [["cardNumber"], ["jwePayload"]],
+        deviceSteps: {
+            ddc_init: "(?:pps|pps2|ppsuat)\\.creditguard\\.co\\.il/services/v1/txn/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/cc/ddc/init",
+            threeds_init: "(?:pps|pps2|ppsuat)\\.creditguard\\.co\\.il/services/v1/txn/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/cg3ds/process/init",
+            threeds_outcome: "(?:pps|pps2|ppsuat)\\.creditguard\\.co\\.il/services/v1/txn/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/cg3ds/process/outcome"
+        }
     },
     {
         psp: "payrails",
@@ -1458,6 +1566,125 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         preparationRequired: true,
         encoding: "json",
         passthroughHeaders: ["^authorization$"]
+    },
+    {
+        psp: "payfast",
+        // Payfast by Network's hosted payment page (South Africa), which every Payfast Pay Now button,
+        // payment link, plugin redirect and Onsite modal opens at payment.payfast.io/eng/process/payment/<uuid>
+        // (www.payfast.co.za serves the same uuid and routes). The card tab posts the card with one jQuery
+        // XHR to /eng/method/CreditCard/<uuid>/pay on the page's own host, form encoded, no encryption:
+        // card_number, cvv, expiry_month and expiry_year beside the name, the consent box and the
+        // page's reCAPTCHA fields. The request names no amount: the merchant's entry bound it to the uuid,
+        // so the agent's amount is the price the cardholder approves. payfast.js holds the rule the pause
+        // decision reads: the exact URL, and the card tab's body byte for byte, with a saved card (cc_key)
+        // and a pay that stores the card (consent_check 1) refused. The route answers no browser origin,
+        // so the card leaves only through the checkout relay. 3-D Secure, the currency switch and the
+        // other methods carry no card and use other paths, which `match` leaves out.
+        // Ships dark: served only to a client that declares `payfast_card_pay`, gated off for every org
+        // until an operator lists one (`payfast:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7):
+        // sandbox.payfast.co.za only on test rows and only with documented test cards.
+        capability: "payfast_card_pay",
+        match: "(?:payment\\.payfast\\.io|www\\.payfast\\.co\\.za|sandbox\\.payfast\\.co\\.za)/eng/method/CreditCard/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/pay",
+        hosts: ["^payment\\.payfast\\.io$", "^www\\.payfast\\.co\\.za$", "^sandbox\\.payfast\\.co\\.za$"],
+        sandboxHosts: ["^sandbox\\.payfast\\.co\\.za$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        // jQuery's same-origin marker and its JSON Accept: with them Payfast answers its JSON, a refusal
+        // included. The CSRF header, Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^x-requested-with$", "^accept$"],
+        cardFields: ["card_number"]
+    },
+    {
+        psp: "paddle_tokenex",
+        // Paddle's checkout frame (buy.paddle.com) on a checkout whose card method names TokenEx as its
+        // tokenizer: the frame RSA-encrypts the number and the CVV itself (JSEncrypt, RSAES-PKCS1-v1_5,
+        // base64) under the account-level TokenEx public key the checkout serves, and carries both inside
+        // its own pay call, so /pay IS the card request. One JSON POST to /pay on checkout-service.paddle.com
+        // (sandbox-checkout-service.paddle.com in test), Classic at /checkout/<id>/pay ("CARD") and Billing at
+        // /transaction-checkout/<che_...>/pay ("card"). The card sits at
+        // data.payment_method_data.card.tokenex_card.{encrypted_card_number, encrypted_cvv}, beside metadata
+        // the frame read from the typed card. paddle-tokenex.js holds the request rule the pause decision, the
+        // API's create, the device and the substitution read: the exact /pay URL, the frame's body shape, and
+        // the two ciphertexts under the key pinned per environment (paddle-keys.js). cse mode, as GMO and
+        // Shiji STS ship: the cardholder's device re-encrypts the real card under the pin and the runtime
+        // swaps the two ciphertexts and the five metadata facts into the paused /pay (substitutePaddleTokenex),
+        // and the agent's page continues the /pay (production checkout-service refuses a cross-origin /pay from
+        // the Vault's own origin, so the device cannot send it). A /pay that names no tokenex_card (PayPal, a
+        // wallet, a saved card, a VGS or Spreedly token pay) carries none of the cardholder's cards and
+        // continues untouched (passWithoutCard, read by card-fields.js paddleTokenexBodyVerdict).
+        // Ships dark: served only to a client that declares `paddle_tokenex_pay`, gated off for every org
+        // until an operator lists one (`paddle_tokenex:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox-checkout-
+        // service only on test rows and only with documented test cards, checkout-service only on live rows.
+        capability: "paddle_tokenex_pay",
+        match: "(?:sandbox-)?checkout-service\\.paddle\\.com/(?:checkout|transaction-checkout)/[A-Za-z0-9_-]{1,64}/pay(?![\\w/.-])",
+        hosts: ["^checkout-service\\.paddle\\.com$", "^sandbox-checkout-service\\.paddle\\.com$"],
+        sandboxHosts: ["^sandbox-checkout-service\\.paddle\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [],
+        // The card the device fills sits here; card-fields.js reads the whole /pay through paddleTokenexBodyVerdict
+        // (a tokenex_card /pay is a card request, a /pay without it continues), and this path keeps the catalog's
+        // "passWithoutCard beside a card field" invariant and tells a cardFields-aware client which member is the card.
+        jsonCardFields: [["data", "payment_method_data", "card", "tokenex_card", "encrypted_card_number"]],
+        passWithoutCard: "(?:sandbox-)?checkout-service\\.paddle\\.com/(?:checkout|transaction-checkout)/[A-Za-z0-9_-]{1,64}/pay",
+        // The two ciphertexts, by role, so the client table carries the same encrypted-field set the approve
+        // leg accepts (vault-allowlist-drift). The generic Adyen substitution refuses these, as it does Shiji's,
+        // because they are RSA base64, not a JWE: only substitutePaddleTokenex writes this body, dispatched by psp.
+        encryptedCardFields: { number: "encrypted_card_number", cvc: "encrypted_cvv" },
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-pkcs1v15", at: "data.payment_method_data.card.tokenex_card", fields: ["encrypted_card_number", "encrypted_cvv"] }
+    },
+    {
+        psp: "lyra",
+        // Lyra's Krypton embedded form (PayZen, Systempay, Sogecommerce, Lyra Collect): the hidden checkout
+        // frame on static.<brand> posts the card as JSON (Content-Type text/plain) to ProcessPayment/2 on the
+        // brand's API host, with the form token's session id as a `;jsessionid=` path parameter. PAN@
+        // paymentForm.pan, expiry MM @ .expiryMonth and YYYY @ .expiryYear, code @ .securityCode. lyra.js
+        // holds the one body rule: the frame's card body under a form token that pays once is a card
+        // request; the same URL's card-free 3-D Secure follow-up (instructionResult) continues untouched
+        // (passWithoutCard); everything else is refused before any approval. TEST and PRODUCTION share these
+        // hosts, so the key and the token name the environment, never the host (no sandbox marker). Lyra's API
+        // refuses a POST that names none of its own static origins, so the card can leave the cardholder's
+        // device only through the checkout relay. Ships dark: served only to a client that declares
+        // `lyra_krypton_payment`, gated off for every org until an operator lists `lyra:<org>`, and autopilot
+        // never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/;.%-])` ends the path for a
+        // consumer that tests `match` unanchored. Not here: Lyra's hosted payment page (vads-payment), and its
+        // other brands' hosts (Scellius, Clic&Pay, Mi Cuenta Web and the rest of the bundle's table).
+        capability: "lyra_krypton_payment",
+        match: "api(?:\\.payzen\\.eu|\\.systempay\\.fr|-sogecommerce\\.societegenerale\\.eu|\\.lyra\\.com)/api-payment/V4/Charge/Public/ProcessPayment/2(?:;jsessionid=[A-Za-z0-9._-]{1,128})?(?![\\w/;.%-])",
+        hosts: ["^api\\.payzen\\.eu$", "^api\\.systempay\\.fr$", "^api-sogecommerce\\.societegenerale\\.eu$", "^api\\.lyra\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["paymentForm", "pan"]],
+        passWithoutCard: "api(?:\\.payzen\\.eu|\\.systempay\\.fr|-sogecommerce\\.societegenerale\\.eu|\\.lyra\\.com)/api-payment/V4/Charge/Public/ProcessPayment/2(?:;jsessionid=[A-Za-z0-9._-]{1,128})?"
+    },
+    {
+        psp: "wix_payments",
+        // Wix Cashier's card frame (cashier-pci.wixapps.net/card-form), which every Wix checkout mounts: for
+        // Wix Payments and classic Stripe on Wix it posts the card as one JSON body to Wix's own tokenizer,
+        // under the site's signed app instance. PAN@ creditCard.number, CVV@ cvv at the root, the expiry as
+        // creditCard.expiration.month and .year (numbers, the year in four digits). wix-payments.js holds the
+        // request rule the pause decision, the API's create, the prepared bind and the device all read: exactly
+        // this URL (never /v2/credit-cards, which saves a card, or a saved card's token URL), a JSON
+        // Content-Type, the instance, and the frame's body byte for byte. Wix's payment widget fails the
+        // payment 30 seconds after it asks the frame for a token, so the lane is prepared only
+        // (preparationRequired): the cardholder approves before the agent clicks Pay. The tokenizer answers no
+        // browser origin, so the card leaves the cardholder's device only through the checkout relay. Wix's
+        // other headers ride beside the instance, as the frame sends them. No sandbox host: a Wix site in test
+        // mode answers inside the frame with a fake token and sends nothing, so the lane takes production only,
+        // and the API refuses a test-mode client before any row (wix-payments.js wixPaymentsMerchantRefusal).
+        // Ships dark: served only to a client that declares `wix_payments_tokenize`, gated off for every org
+        // until an operator lists one (`wix_payments:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "wix_payments_tokenize",
+        match: "cashier-pci\\.wixapps\\.net/_api/payment-gateway-web/tokenize/v2/tokens",
+        hosts: ["^cashier-pci\\.wixapps\\.net$"],
+        preparationRequired: true,
+        encoding: "json",
+        passthroughHeaders: ["^authorization$", "^x-wix-client-artifact-id$", "^commonconfig$", "^x-wix-brand$", "^consent-policy$", "^x-wix-linguist$"]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1511,9 +1738,13 @@ var DATATRANS_HOSTS = Object.freeze(["pay.datatrans.com", "pay.sandbox.datatrans
 var DATATRANS_REFUSAL_REASONS = Object.freeze(["unsupported", "card_on_file", "brand_mismatch", "unregistered_merchant"]);
 var DATATRANS_REGISTRATION_POLICIES = Object.freeze(["refuse", "disclose", "agentcard_single_use"]);
 var DATATRANS_REVIEWED_MERCHANT_IDS = Object.freeze({
-    "pay.datatrans.com": Object.freeze([]),
+    "pay.datatrans.com": Object.freeze(["3000022877"]),
     "pay.sandbox.datatrans.com": Object.freeze(["1110022968", "1100007006"])
 });
+var DATATRANS_MERCHANT_ACCOUNT_NAMES = Object.freeze({
+    "pay.datatrans.com": Object.freeze({ "3000022877": "RaiseNow" }),
+    "pay.sandbox.datatrans.com": Object.freeze({})
+});
 var DATATRANS_PAYMENT_METHODS = Object.freeze(["VIS", "ECA", "AMX", "DIN", "DIS", "JCB", "CUP", "MAU", "UAP", "DNK"]);
 var DATATRANS_TEST_PANS = Object.freeze([
     "4242424242424242",
@@ -1571,6 +1802,53 @@ var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 ]);
 var FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
+// src/payfast.js
+var PAYFAST_PAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["payment.payfast.io", "www.payfast.co.za"]),
+    sandbox: Object.freeze(["sandbox.payfast.co.za"])
+});
+// src/rsa-pkcs1v15.js
+var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
+var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
+// src/paddle-keys.js
+var PADDLE_TOKENEX_KEYS = /* @__PURE__ */ Object.freeze({
+    sandbox: Object.freeze({
+        spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWpIQFjQQCPpaIlJKpegirp5kLkzLB1AxHmnLk73D3TJbAGqr1QmlsWDBtMPMRpdzzUM7ZwX3kzhIuATV4Pe7RKp3nZlVmcrT0YCQXBrTwqZNh775z58GP2kZs+gVfNqBampJPzSB/hB62KkByhECn6grrRjiAVwJyZVEvs/2vrxaEpO+aE16emtX12RgI5JdzdOiNyZEQteU6zRBRJEocPWVxExaOpVVVJ5+UnW0LcalzA+lRGRTrQJ5JguAPiAOzRPTK/lYFFpCAl/F8wtoAVG1c8zO2NcQ0Pko+fmeidRFxJ/did2btV+9Mkze3mBphwFmvnxa35LF+Cs/XJHDwIDAQAB",
+        sha256: "877d29a008ed9998d6035032870c63dcc4cbf37ca22cb50b0cc9fe2250a9e3dc"
+    }),
+    production: Object.freeze({
+        spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8gGPMwBRPuVyJReZGIkWH/+Bf5pnpDN1bSR2cLYLXVT8CaSnTw74qeboSnktgYCi1D9R3Bj2fYzTIwGGZb8KinLdxwbqZmHwrE9cFhCaHbG/E0PbqQGhXP2vbniZTT4M0i0Cbi7ES3Bw5zqNbIZZnX041QEpxLvIyWPKZCX+fBogNMhWfCF779aclChjHkwZMsufThVWE9xklWGxXiytx5aL4I5JPxq0I7cAkZGGs4aF/GxWwPaq7R3wPikJQ0YHnCMfcURzl2Hnw/inqyMy+JB6djTq2/BdzMAhWTh3cDWq9Xu+gEkb/QCd0n1yYIdKuDISlk/AfHdWe34IvzhVyQIDAQAB",
+        sha256: "92529bd289bb24d52a1bdcc42edc9ac0bb1dacbb58f7568573d44771e1287762"
+    })
+});
+// src/paddle-tokenex.js
+var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
+var METADATA_KEYS2 = /* @__PURE__ */ Object.freeze(["cardholder_name", ...PADDLE_TOKENEX_FACT_KEYS]);
+var CARD_PATH = /* @__PURE__ */ Object.freeze(["data", "payment_method_data", "card"]);
+var TOKENEX_PATH = /* @__PURE__ */ Object.freeze([...CARD_PATH, "tokenex_card"]);
+// src/lyra.js
+var LYRA_HOSTS = /* @__PURE__ */ Object.freeze({
+    "api.payzen.eu": Object.freeze({ staticOrigin: "https://static.payzen.eu", prefixes: Object.freeze(["01", "02"]) }),
+    "api.systempay.fr": Object.freeze({ staticOrigin: "https://static.systempay.fr", prefixes: Object.freeze(["24", "25"]) }),
+    "api-sogecommerce.societegenerale.eu": Object.freeze({ staticOrigin: "https://static-sogecommerce.societegenerale.eu", prefixes: Object.freeze(["06", "07"]) }),
+    "api.lyra.com": Object.freeze({ staticOrigin: "https://static.lyra.com", prefixes: Object.freeze(["10", "11"]) })
+});
+var LYRA_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({
+        id: "le_mas_lyon",
+        merchant: "Association Le MAS",
+        origins: Object.freeze(["https://www.mas-asso.fr"]),
+        shopIds: Object.freeze(["95120524"]),
+        hosts: Object.freeze(["api.systempay.fr"])
+    })
+]);
+// src/wix-payments.js
+var pin3 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin3({ id: "parahouse_magazine", merchant: "ParaHouse Magazine", origins: ["https://www.parahousemagazine.com"] }),
+    pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
+    pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -1639,6 +1917,213 @@ var DECLINE_LABELS = Object.freeze(["label_error_payment", "label_error_bin", "l
 var EXPIRED_LABELS = Object.freeze(["session_timeout", "ppid_expired"]);
 var REF_KEYS = Object.freeze(["recloc", "orderId", "mopId", "pri", "approvalcode", "externalId", "paymentMerchantReference", "prr"]);
 var PAYMENT_INFORMATION_KEYS = Object.freeze(["approvalcode", "pri", "externalId", "mopId"]);
+// src/processors/ekashu.js
+var EKASHU_HOSTS = Object.freeze(["live.ekashu.com", "test.ekashu.com"]);
+var EKASHU_TEST_PANS = Object.freeze(["4100000000000100", "5100000000000107"]);
+var EKASHU_SIGNED_FIELDS = Object.freeze([
+    "ekashu_3d_secure_verify",
+    "ekashu_amount",
+    "ekashu_amount_format",
+    "ekashu_auto_confirm",
+    "ekashu_callback_failure_url",
+    "ekashu_callback_include_post",
+    "ekashu_callback_success_url",
+    "ekashu_card_address_editable",
+    "ekashu_card_address_required",
+    "ekashu_card_address_verify",
+    "ekashu_card_email_address_mandatory",
+    "ekashu_card_phone_number_mandatory",
+    "ekashu_card_title_mandatory",
+    "ekashu_card_zip_code_verify",
+    "ekashu_currency",
+    "ekashu_delivery_address_editable",
+    "ekashu_delivery_address_required",
+    "ekashu_delivery_email_address_mandatory",
+    "ekashu_delivery_phone_number_mandatory",
+    "ekashu_delivery_title_mandatory",
+    "ekashu_description",
+    "ekashu_device",
+    "ekashu_duplicate_check",
+    "ekashu_duplicate_minutes",
+    "ekashu_failure_return_text",
+    "ekashu_failure_url",
+    "ekashu_hash_code_format",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_include_post",
+    "ekashu_invoice_address_editable",
+    "ekashu_invoice_address_required",
+    "ekashu_invoice_email_address_mandatory",
+    "ekashu_invoice_phone_number_mandatory",
+    "ekashu_invoice_title_mandatory",
+    "ekashu_locale",
+    "ekashu_payment_methods",
+    "ekashu_reference",
+    "ekashu_request_type",
+    "ekashu_return_text",
+    "ekashu_seller_address",
+    "ekashu_seller_email_address",
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_seller_name",
+    "ekashu_shortcut_icon",
+    "ekashu_style_sheet",
+    "ekashu_success_url",
+    "ekashu_title",
+    "ekashu_verification_value_mask",
+    "ekashu_verification_value_verify",
+    "ekashu_viewport"
+]);
+var REQUIRED = Object.freeze([
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_amount",
+    "ekashu_currency",
+    "ekashu_reference",
+    "ekashu_hash_code",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_success_url",
+    "ekashu_failure_url",
+    "ekashu_callback_success_url"
+]);
+var CARD_KEYS = Object.freeze([
+    "ekashu_card_number",
+    "ekashu_expires_end_month",
+    "ekashu_expires_end_year",
+    "ekashu_verification_value",
+    "ekashu_valid_from_month",
+    "ekashu_valid_from_year",
+    "ekashu_issue_number"
+]);
+var PAGE_KEYS = Object.freeze(["ekashu_stage", "ekashu_context", "ekashu_submission_id"]);
+var STORED_KEYS = Object.freeze(["ekashu_card_hash", "ekashu_card_reference", "ekashu_cof_initiated_by", "ekashu_cof_reason", "ekashu_cof_id"]);
+var REDIRECT_KEYS = Object.freeze(["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]);
+var CALLBACK_KEYS = Object.freeze(["ekashu_callback_success_url", "ekashu_callback_failure_url"]);
+var MAX_ENTRY = 16 * 1024;
+var MAX_PAGE = 256 * 1024;
+var EKASHU_SELLERS = Object.freeze([
+    Object.freeze({ sellerId: "25060100", merchant: "Heathrow Drop-off", entryHost: "heathrowdropoff.apcoa.com", callbackHost: "incomingapi.apcoa.co.uk" })
+]);
+var CARD_FIELDS = Object.freeze({
+    number: "ekashu_card_number",
+    month: "ekashu_expires_end_month",
+    year: "ekashu_expires_end_year",
+    cvc: "ekashu_verification_value"
+});
+var NAME_FIELDS = Object.freeze({ first: "ekashu_card_first_name", last: "ekashu_card_last_name" });
+var LEFT_EMPTY = Object.freeze(["ekashu_card_title", "ekashu_valid_from_month", "ekashu_valid_from_year", "ekashu_issue_number"]);
+var VISIBLE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS), ...Object.values(NAME_FIELDS), ...LEFT_EMPTY]);
+// src/processors/redsys.js
+var REDSYS_HOSTS = Object.freeze(["sis.redsys.es"]);
+var REDSYS_ENTRY_PATHS = Object.freeze(["/sis/realizarPago", "/sis/realizarPago/utf-8"]);
+var REDSYS_MERCHANTS = Object.freeze([]);
+var MAX_ENTRY2 = 16 * 1024;
+var MAX_PARAMETERS = 8 * 1024;
+var ENTRY_KEYS = Object.freeze(["Ds_SignatureVersion", "Ds_MerchantParameters", "Ds_Signature"]);
+var REQUIRED2 = Object.freeze([
+    "DS_MERCHANT_AMOUNT",
+    "DS_MERCHANT_CURRENCY",
+    "DS_MERCHANT_MERCHANTCODE",
+    "DS_MERCHANT_ORDER",
+    "DS_MERCHANT_TERMINAL",
+    "DS_MERCHANT_TRANSACTIONTYPE",
+    "DS_MERCHANT_MERCHANTURL",
+    "DS_MERCHANT_URLOK",
+    "DS_MERCHANT_URLKO"
+]);
+var STORED = Object.freeze([
+    "DS_MERCHANT_IDENTIFIER",
+    "DS_MERCHANT_GROUP",
+    "DS_MERCHANT_COF_INI",
+    "DS_MERCHANT_COF_TYPE",
+    "DS_MERCHANT_COF_TXNID"
+]);
+var SPECIAL = Object.freeze([
+    "DS_MERCHANT_DIRECTPAYMENT",
+    "DS_MERCHANT_SUMTOTAL",
+    "DS_MERCHANT_DATEFRECUENCY",
+    "DS_MERCHANT_CHARGEEXPIRYDATE",
+    "DS_MERCHANT_IDOPER"
+]);
+var CARD_PARAMETERS = Object.freeze(["DS_MERCHANT_PAN", "DS_MERCHANT_EXPIRYDATE", "DS_MERCHANT_CVV2"]);
+var CURRENCIES = Object.freeze({ 978: "eur", 840: "usd", 826: "gbp", 756: "chf" });
+var MAX_PAGE2 = 256 * 1024;
+var CARD_FIELDS2 = Object.freeze({
+    shown: "Sis_card-number",
+    expiry: "SIS_card-expiration",
+    cvc: "Sis_Tarjeta_CVV2",
+    holder: "cardholderName",
+    number: "Sis_Numero_Tarjeta",
+    month: "Sis_Caducidad_Tarjeta_Mes",
+    year: "Sis_Caducidad_Tarjeta_Anno"
+});
+var BROWSER_FIELDS = Object.freeze([
+    "browserJavaEnabled",
+    "browserJavascriptEnabled",
+    "browserLanguage",
+    "browserColorDepth",
+    "browserScreenHeight",
+    "browserScreenWidth",
+    "browserTZ",
+    "browserUserAgent"
+]);
+var AS_SERVED = Object.freeze(["cvvObligatorio", "threeDSCompInd", "fuc", "terminal", "merchantOrder", "bcancel"]);
+var CARD_PAGE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS2), ...BROWSER_FIELDS, ...AS_SERVED]);
+var VISIBLE2 = /* @__PURE__ */ new Set([CARD_FIELDS2.shown, CARD_FIELDS2.expiry, CARD_FIELDS2.cvc, CARD_FIELDS2.holder]);
+var METHOD_PAGE = /* @__PURE__ */ new Set(["resultadoMethod", ...BROWSER_FIELDS, "threeDSCompInd"]);
+var REDSYS_REFUSALS = Object.freeze(["redsys_card_page", "redsys_3ds_challenge", "redsys_declined"]);
+// src/processors/quickpay.js
+var QUICKPAY_HOSTS = Object.freeze(["payment.quickpay.net"]);
+var QUICKPAY_MERCHANTS = Object.freeze([]);
+var MAX_ENTRY3 = 16 * 1024;
+var REQUIRED3 = Object.freeze([
+    "version",
+    "merchant_id",
+    "agreement_id",
+    "order_id",
+    "amount",
+    "currency",
+    "continueurl",
+    "cancelurl",
+    "callbackurl",
+    "checksum"
+]);
+var SCALARS = /* @__PURE__ */ new Set([
+    ...REQUIRED3,
+    "type",
+    "language",
+    "autocapture",
+    "autofee",
+    "subscription",
+    "description",
+    "payment_methods",
+    "acquirer",
+    "branding_id",
+    "google_analytics_tracking_id",
+    "google_analytics_client_id",
+    "deadline",
+    "text_on_statement",
+    "customer_email",
+    "invoice_address_selection",
+    "shipping_address_selection"
+]);
+var CURRENCIES2 = Object.freeze({ DKK: "dkk", EUR: "eur", USD: "usd", SEK: "sek", NOK: "nok", GBP: "gbp", CHF: "chf", PLN: "pln" });
+var MAX_PAGE3 = 256 * 1024;
+var CARD_FIELDS3 = Object.freeze({ number: "cardnumber", month: "expiration[month]", year: "expiration[year]", cvc: "cvd", holder: "cardholder" });
+var TYPED = /* @__PURE__ */ new Set([CARD_FIELDS3.number, CARD_FIELDS3.month, CARD_FIELDS3.year, CARD_FIELDS3.cvc]);
+var CARD_PAGE2 = /* @__PURE__ */ new Set(["session_id", ...TYPED]);
+var OPTIONAL = Object.freeze({ brand: "radio", "3d": "checkbox", cardholder: "text" });
+var AUTH_FIELDS = Object.freeze([
+    "[auth]browserColorDepth",
+    "[auth]browserJavaEnabled",
+    "[auth]browserLanguage",
+    "[auth]browserScreenHeight",
+    "[auth]browserScreenWidth",
+    "[auth]browserTZ",
+    "[auth]threeDSCompInd"
+]);
+var QUICKPAY_REFUSALS = Object.freeze(["quickpay_card_page", "quickpay_3ds_challenge", "quickpay_cancelled"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"

package/dist/wix-payments.generated.d.ts

@@ -0,0 +1,42 @@
+declare var WIX_PAYMENTS_PSP: string;
+declare var WIX_PAYMENTS_CAPABILITY: string;
+declare var WIX_PAYMENTS_OPERATION: string;
+declare var WIX_PAYMENTS_HOST: string;
+declare var WIX_PAYMENTS_TOKENIZE_URL: string;
+declare var WIX_PAYMENTS_REFUSAL_CODES: readonly string[];
+declare function isWixPaymentsTokenizeUrl(url: any): boolean;
+declare function wixPaymentsBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function wixPaymentsRequestRefusal(request: any): any;
+declare function isPreparedWixPaymentsRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare var WIX_PAYMENTS_MERCHANT_PINS: readonly any[];
+declare function wixPaymentsMerchantPin(merchantOrigin: any, pins?: readonly any[]): any;
+declare function wixPaymentsMerchantRefusal(environment: any, merchantOrigin: any, pins?: readonly any[]): "unsupported_environment" | "wix_payments_merchant_unreviewed" | null;
+declare function wixPaymentsRefusalMessage(code: any): any;
+declare function injectWixPaymentsCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isWixPaymentsDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function wixPaymentsRefusalCode(text: any): string | null;
+declare function wixPaymentsAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_HOST, WIX_PAYMENTS_MERCHANT_PINS, WIX_PAYMENTS_OPERATION, WIX_PAYMENTS_PSP, WIX_PAYMENTS_REFUSAL_CODES, WIX_PAYMENTS_TOKENIZE_URL, injectWixPaymentsCard, isPreparedWixPaymentsRequest, isWixPaymentsDeviceRequest, isWixPaymentsTokenizeUrl, wixPaymentsAnswerOutcome, wixPaymentsBodyVerdict, wixPaymentsMerchantPin, wixPaymentsMerchantRefusal, wixPaymentsRefusalCode, wixPaymentsRefusalMessage, wixPaymentsRequestRefusal };