@agent-cards/sdk 0.23.14 → 0.23.16

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7d04123b22f392dd6a11848e8cf59b62efb1669527938a7dd1c83a34cb315621
+// artifact-sha256: 833d97716c57df725c942d14494012032a87b561ac7734676fe9dcb1d6be4819
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -365,8 +365,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -433,6 +433,9 @@ var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
     "captcha_version",
     "captcha_action"
 ]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
+var UNANSWERED_VERSIONS = /* @__PURE__ */ Object.freeze(["v0", "v1"]);
 var BODY_LIMIT3 = 8192;
 var URL_LIMIT = 256;
 var PAY_PATH = /^\/eng\/method\/CreditCard\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/pay$/;
@@ -495,18 +498,20 @@ function cardNetwork(number) {
         return "mastercard";
     return AMEX.test(number) ? "amex" : null;
 }
+var namesKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
 function judgeBody(body) {
     const pairs = readForm(body);
     if (pairs === null)
         return { code: "payfast_body_unsupported", pairs: null };
     if (pairs.some(([key]) => key === "cc_key"))
         return { code: "payfast_saved_card", pairs: null };
-    if (pairs.length !== PAYFAST_BODY_KEYS.length || !pairs.every(([key], at) => key === PAYFAST_BODY_KEYS[at])) {
+    const answered = namesKeys(pairs, PAYFAST_BODY_KEYS);
+    if (!answered && !namesKeys(pairs, UNANSWERED_KEYS))
         return { code: "payfast_body_unsupported", pairs: null };
-    }
     const value = Object.fromEntries(pairs);
-    const answer = value["g-recaptcha-response"];
-    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !(answer === "" || SOLVED_CAPTCHA2.test(answer)) || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
+    const answer = value[CAPTCHA_ANSWER];
+    const captcha = answered ? answer === "" || SOLVED_CAPTCHA2.test(answer) : UNANSWERED_VERSIONS.includes(value.captcha_version);
+    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !captcha || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
         return { code: "payfast_body_unsupported", pairs: null };
     }
     if (value.consent_check === "1")
@@ -666,10 +671,10 @@ var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
-    const pin3 = key && typeof key === "object" ? key.sha256 : void 0;
+    const pin4 = key && typeof key === "object" ? key.sha256 : void 0;
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse6("key");
-    if (typeof pin3 !== "string" || !SHA256_HEX.test(pin3))
+    if (typeof pin4 !== "string" || !SHA256_HEX.test(pin4))
         throw refuse6("key");
     let binary;
     try {
@@ -681,7 +686,7 @@ function parseRsaPublicKey(key) {
     if (btoa(binary) !== spki)
         throw refuse6("key");
     const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-    if (sha256Hex(der) !== pin3)
+    if (sha256Hex(der) !== pin4)
         throw refuse6("key");
     const outer = readElement(der, 0, 48);
     if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
@@ -770,8 +775,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1241,10 +1246,219 @@ var LYRA_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
         hosts: Object.freeze(["api.systempay.fr"])
     })
 ]);
+// src/wix-payments.js
+var WIX_PAYMENTS_PSP = "wix_payments";
+var WIX_PAYMENTS_TOKENIZE_URL = "https://cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens";
+var BODY_LIMIT5 = 8192;
+var ROOT_KEYS3 = /* @__PURE__ */ Object.freeze(["cvv", "creditCard"]);
+var CARD_KEYS5 = /* @__PURE__ */ Object.freeze(["number", "expiration", "additionalInformation", "billingAddress"]);
+var EXPIRATION_KEYS = /* @__PURE__ */ Object.freeze(["month", "year"]);
+var HOLDER_KEYS = /* @__PURE__ */ Object.freeze(["holderName"]);
+var CARD_NUMBER6 = /^[0-9]{12,19}$/;
+var SECURITY_CODE5 = /^[0-9]{3,4}$/;
+var FIRST_YEAR = 2e3;
+var LAST_YEAR = 2099;
+var FIELD_NAME = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+var MAX_FIELDS = 32;
+var MAX_NESTED_FIELDS = 8;
+var TEXT_LIMIT = 256;
+var CONTROL4 = /[\u0000-\u001f\u007f]/;
+var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys3 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
+var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD8 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isWixPaymentsTokenizeUrl(url) {
+    return url === WIX_PAYMENTS_TOKENIZE_URL;
+}
+function readBody3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT5)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record6(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+var billingText = (value) => value === null || plainText(value);
+function billingFields(value) {
+    if (!record6(value))
+        return false;
+    const names = Object.keys(value);
+    if (names.length > MAX_FIELDS)
+        return false;
+    return names.every((name) => {
+        const field = value[name];
+        if (!FIELD_NAME.test(name))
+            return false;
+        if (!record6(field))
+            return billingText(field);
+        const nested = Object.keys(field);
+        return nested.length <= MAX_NESTED_FIELDS && nested.every((key) => FIELD_NAME.test(key) && billingText(field[key]));
+    });
+}
+function wixPaymentsBodyVerdict(body) {
+    const value = readBody3(body);
+    if (value === null || !sameKeys3(value, ROOT_KEYS3) || !record6(value.creditCard) || !sameKeys3(value.creditCard, CARD_KEYS5)) {
+        return refuse9("wix_payments_body_unsupported");
+    }
+    const card = value.creditCard;
+    const expiration = card.expiration;
+    const holder = card.additionalInformation;
+    if (typeof value.cvv !== "string" || !SECURITY_CODE5.test(value.cvv) || typeof card.number !== "string" || !CARD_NUMBER6.test(card.number) || !record6(expiration) || !sameKeys3(expiration, EXPIRATION_KEYS) || !Number.isInteger(expiration.month) || expiration.month < 1 || expiration.month > 12 || !Number.isInteger(expiration.year) || expiration.year < FIRST_YEAR || expiration.year > LAST_YEAR || !record6(holder) || !sameKeys3(holder, HOLDER_KEYS) || !plainText(holder.holderName) || !billingFields(card.billingAddress)) {
+        return refuse9("wix_payments_body_unsupported");
+    }
+    return CARD8;
+}
+var pin3 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin3({ id: "parahouse_magazine", merchant: "ParaHouse Magazine", origins: ["https://www.parahousemagazine.com"] }),
+    pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
+    pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
+]);
+// src/paymongo.js
+var PAYMONGO_PSP = "paymongo";
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var PAYMONGO_ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "details", "billing", "return_url"]);
+var PAYMONGO_CARD_KEYS = /* @__PURE__ */ Object.freeze(["card_number", "exp_month", "exp_year", "cvc"]);
+var PAYMONGO_BILLING_KEYS = /* @__PURE__ */ Object.freeze(["name", "email", "phone", "address"]);
+var PAYMONGO_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze(["line1", "line2", "city", "state", "country", "postal_code"]);
+var CLICK_TO_PAY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_transaction_id", "correlation_id", "x_src_cx_flow_id"]);
+var URL_LIMIT2 = 128;
+var BODY_LIMIT6 = 16384;
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+var SESSION2 = /^[A-Za-z0-9]{24}$/;
+var CHECKOUT_PATH = /^\/(?:cs_)?([A-Za-z0-9]{24})$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE6 = /^[0-9]{3,4}$/;
+var TEXT = /^[^\x00-\x1f\x7f]{1,256}$/;
+var UNDEFINED = "$undefined";
+var CARD_MEMBER = /^(?:card_?number|pan|cvc|cvv)$/i;
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var keysAre = (value, keys) => {
+    const names = Object.keys(value);
+    return names.length === keys.length && names.every((name, at) => name === keys[at]);
+};
+var refuse10 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD9 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE4 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function paymongoCheckoutSession(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYMONGO_CHECKOUT_HOST)
+        return null;
+    const match = CHECKOUT_PATH.exec(parsed.pathname);
+    return match ? match[1] : null;
+}
+function readJson2(body) {
+    if (typeof body !== "string" || body === "")
+        return { parsed: null, exact: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { parsed: null, exact: false };
+    }
+    let exact2 = false;
+    try {
+        exact2 = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+    }
+    catch {
+        exact2 = false;
+    }
+    return { parsed, exact: exact2 };
+}
+function billingValue(value) {
+    if (value === UNDEFINED)
+        return true;
+    if (typeof value !== "string" || !TEXT.test(value))
+        return false;
+    return value[0] !== "$" || value.startsWith("$$");
+}
+function judgeCardAttach(args, session) {
+    if (args.length !== 3 || typeof args[0] !== "string" || !args[0].startsWith("cs_") || !SESSION2.test(args[0].slice(3))) {
+        return "paymongo_body_unsupported";
+    }
+    const id = args[0].slice(3);
+    const attributes = args[1].data.attributes;
+    const details = attributes.details;
+    if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
+        return "paymongo_click_to_pay";
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+        return "paymongo_body_unsupported";
+    if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
+        return "paymongo_body_unsupported";
+    const billing = attributes.billing;
+    if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
+        return "paymongo_body_unsupported";
+    if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
+        return "paymongo_body_unsupported";
+    const third = args[2];
+    if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
+        return "paymongo_body_unsupported";
+    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+        return "paymongo_session_mismatch";
+    return null;
+}
+function namesCardValue(parsed) {
+    const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const key of Object.keys(node)) {
+            if (!Array.isArray(node) && CARD_MEMBER.test(key))
+                return true;
+            const value = node[key];
+            if (value !== null && typeof value === "object")
+                pending.push(value);
+        }
+    }
+    return false;
+}
+function attachType(parsed) {
+    if (!Array.isArray(parsed) || parsed.length < 2 || !record7(parsed[1]) || !record7(parsed[1].data) || !record7(parsed[1].data.attributes))
+        return null;
+    const type = parsed[1].data.attributes.payment_method_type;
+    return typeof type === "string" ? type : null;
+}
+function paymongoBodyVerdict(body, session) {
+    const { parsed, exact: exact2 } = readJson2(body);
+    const type = parsed === null ? null : attachType(parsed);
+    if (type !== "card") {
+        if (parsed === null)
+            return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
+        return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
+    }
+    if (!exact2)
+        return refuse10("paymongo_body_unsupported");
+    const code = judgeCardAttach(parsed, session);
+    return code === null ? CARD9 : refuse10(code);
+}
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
         return lyraBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === WIX_PAYMENTS_PSP) {
+        if (url !== void 0 && !isWixPaymentsTokenizeUrl(url))
+            return { verdict: "refuse", code: "wix_payments_url_refused" };
+        return wixPaymentsBodyVerdict(body);
+    }
     if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
         if (url !== void 0 && !isPaddleVgsCardsUrl(url))
             return { verdict: "refuse", code: "paddle_vgs_url_refused" };
@@ -1261,6 +1475,12 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paddle_tokenex_pay_unsupported" };
         return paddleTokenexBodyVerdict(body, target ? target.line : void 0);
     }
+    if (recognizer && recognizer.psp === PAYMONGO_PSP) {
+        const session = url !== void 0 ? paymongoCheckoutSession(url) : void 0;
+        if (url !== void 0 && session === null)
+            return { verdict: "refuse", code: "paymongo_url_refused" };
+        return paymongoBodyVerdict(body, session);
+    }
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -1381,12 +1601,12 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT5 = 16384;
+var BODY_LIMIT7 = 16384;
 var RESPONSE_LIMIT = 32768;
-var ROOT_KEYS3 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
+var ROOT_KEYS4 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns5 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text2 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -1409,7 +1629,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody2(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT5)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
         return null;
     let value;
     try {
@@ -1418,12 +1638,12 @@ function judgeBody2(body) {
     catch {
         return null;
     }
-    if (!record6(value) || !roundTrips(value, body))
+    if (!record8(value) || !roundTrips(value, body))
         return null;
-    if (!Object.keys(value).every((key) => ROOT_KEYS3.includes(key)) || !owns5(value, "paymentInstrument"))
+    if (!Object.keys(value).every((key) => ROOT_KEYS4.includes(key)) || !owns5(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record6(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
+    if (!record8(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH3, instrument.expirationMonth) || !exact(YEAR3, instrument.expirationYear))
         return null;
@@ -1451,7 +1671,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record6(headers))
+    if (!record8(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -1498,7 +1718,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record6(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record8(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -1513,7 +1733,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record6(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record8(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -1597,7 +1817,7 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record6(value) ? value : null;
+        return record8(value) ? value : null;
     }
     catch {
         return null;
@@ -1606,16 +1826,16 @@ function readAnswer(body) {
 var tokenValue = (value) => exact(TOKEN2, value) && !panLike(value);
 var optional = (value, key, check) => !owns5(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record6(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record8(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record6))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record8))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns5(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record6(data.binData)) {
+    if (record8(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns5(data.binData, key) || data.binData[key] === null)
@@ -1631,7 +1851,7 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record6(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record8(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -1659,7 +1879,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record6(value.error) ? value.error.errorId : null;
+    const id = value && record8(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: eaa31e10104ec55a9914d5b874f25cb17e713de912b48ef41d7f987786e65785
+// artifact-sha256: 3e73afac7d2a16c36e81a7ddca5ea143be4880e056cb31558d31d3d4d72d84b1
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1660,6 +1660,61 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: [],
         jsonCardFields: [["paymentForm", "pan"]],
         passWithoutCard: "api(?:\\.payzen\\.eu|\\.systempay\\.fr|-sogecommerce\\.societegenerale\\.eu|\\.lyra\\.com)/api-payment/V4/Charge/Public/ProcessPayment/2(?:;jsessionid=[A-Za-z0-9._-]{1,128})?"
+    },
+    {
+        psp: "wix_payments",
+        // Wix Cashier's card frame (cashier-pci.wixapps.net/card-form), which every Wix checkout mounts: for
+        // Wix Payments and classic Stripe on Wix it posts the card as one JSON body to Wix's own tokenizer,
+        // under the site's signed app instance. PAN@ creditCard.number, CVV@ cvv at the root, the expiry as
+        // creditCard.expiration.month and .year (numbers, the year in four digits). wix-payments.js holds the
+        // request rule the pause decision, the API's create, the prepared bind and the device all read: exactly
+        // this URL (never /v2/credit-cards, which saves a card, or a saved card's token URL), a JSON
+        // Content-Type, the instance, and the frame's body byte for byte. Wix's payment widget fails the
+        // payment 30 seconds after it asks the frame for a token, so the lane is prepared only
+        // (preparationRequired): the cardholder approves before the agent clicks Pay. The tokenizer answers no
+        // browser origin, so the card leaves the cardholder's device only through the checkout relay. Wix's
+        // other headers ride beside the instance, as the frame sends them. No sandbox host: a Wix site in test
+        // mode answers inside the frame with a fake token and sends nothing, so the lane takes production only,
+        // and the API refuses a test-mode client before any row (wix-payments.js wixPaymentsMerchantRefusal).
+        // Ships dark: served only to a client that declares `wix_payments_tokenize`, gated off for every org
+        // until an operator lists one (`wix_payments:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "wix_payments_tokenize",
+        match: "cashier-pci\\.wixapps\\.net/_api/payment-gateway-web/tokenize/v2/tokens",
+        hosts: ["^cashier-pci\\.wixapps\\.net$"],
+        preparationRequired: true,
+        encoding: "json",
+        passthroughHeaders: ["^authorization$", "^x-wix-client-artifact-id$", "^commonconfig$", "^x-wix-brand$", "^consent-policy$", "^x-wix-linguist$"]
+    },
+    {
+        psp: "paymongo",
+        // PayMongo's hosted checkout (Philippines) at checkout.paymongo.com/<session>, which every PayMongo
+        // payment link, Storefront page, Shopify hosted app, WooCommerce hosted plugin and Checkout Session
+        // API opens. The card form's Pay click runs the page's Next.js Server Action attachCheckout: a POST
+        // to the page's own URL under its Next-Action id, Accept text/x-component, the body React's
+        // encodeReply writes as text/plain: [session, {data: {attributes: {payment_method_type: "card",
+        // details: {card_number, exp_month, exp_year, cvc}, billing, return_url}}}, {viewerAccept}].
+        // Unencrypted. The request names no amount: the session bound its line items (always PHP) when the
+        // merchant created it. paymongo.js holds the rule the pause decision reads: the exact URL, the Server
+        // Action's headers, and the card form's attach for that URL's session, key by key, with a Click to Pay
+        // attach and any other card shape refused. Every other action of the page (polling, fees, another
+        // method's attach) carries no card on the same URL and continues untouched (passWithoutCard). Next
+        // refuses an action whose Origin names another host, and the page answers no other origin's preflight,
+        // so the card leaves only through the checkout relay. 3-D Secure follows the answer on
+        // secure-authentication.paymongo.com with no card. Test mode and live mode share the host (a session's
+        // livemode, not its host, separates them), so no sandbox host is marked.
+        // Ships dark: served only to a client that declares `paymongo_checkout_pay`, gated off for every org
+        // until an operator lists one (`paymongo:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "paymongo_checkout_pay",
+        match: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}",
+        hosts: ["^checkout\\.paymongo\\.com$"],
+        encoding: "json",
+        // Next answers a Server Action only under its id, renders with the page's router state, and the page
+        // reads the answer only as an RSC stream. Origin, Referer and cookies never ride (none is needed).
+        passthroughHeaders: ["^next-action$", "^next-router-state-tree$", "^accept$"],
+        jsonCardFields: [[1, "data", "attributes", "details", "card_number"]],
+        passWithoutCard: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}"
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1782,6 +1837,19 @@ var PAYFAST_PAY_HOSTS = /* @__PURE__ */ Object.freeze({
     production: Object.freeze(["payment.payfast.io", "www.payfast.co.za"]),
     sandbox: Object.freeze(["sandbox.payfast.co.za"])
 });
+var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "card_number",
+    "cardholder_name",
+    "consent_check",
+    "cvv",
+    "expiry_month",
+    "expiry_year",
+    "g-recaptcha-response",
+    "captcha_version",
+    "captcha_action"
+]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
 // src/rsa-pkcs1v15.js
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
@@ -1817,6 +1885,16 @@ var LYRA_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
         hosts: Object.freeze(["api.systempay.fr"])
     })
 ]);
+// src/wix-payments.js
+var pin3 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin3({ id: "parahouse_magazine", merchant: "ParaHouse Magazine", origins: ["https://www.parahousemagazine.com"] }),
+    pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
+    pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
+]);
+// src/paymongo.js
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;

package/dist/wix-payments.generated.d.ts

@@ -0,0 +1,42 @@
+declare var WIX_PAYMENTS_PSP: string;
+declare var WIX_PAYMENTS_CAPABILITY: string;
+declare var WIX_PAYMENTS_OPERATION: string;
+declare var WIX_PAYMENTS_HOST: string;
+declare var WIX_PAYMENTS_TOKENIZE_URL: string;
+declare var WIX_PAYMENTS_REFUSAL_CODES: readonly string[];
+declare function isWixPaymentsTokenizeUrl(url: any): boolean;
+declare function wixPaymentsBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function wixPaymentsRequestRefusal(request: any): any;
+declare function isPreparedWixPaymentsRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare var WIX_PAYMENTS_MERCHANT_PINS: readonly any[];
+declare function wixPaymentsMerchantPin(merchantOrigin: any, pins?: readonly any[]): any;
+declare function wixPaymentsMerchantRefusal(environment: any, merchantOrigin: any, pins?: readonly any[]): "unsupported_environment" | "wix_payments_merchant_unreviewed" | null;
+declare function wixPaymentsRefusalMessage(code: any): any;
+declare function injectWixPaymentsCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isWixPaymentsDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function wixPaymentsRefusalCode(text: any): string | null;
+declare function wixPaymentsAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { WIX_PAYMENTS_CAPABILITY, WIX_PAYMENTS_HOST, WIX_PAYMENTS_MERCHANT_PINS, WIX_PAYMENTS_OPERATION, WIX_PAYMENTS_PSP, WIX_PAYMENTS_REFUSAL_CODES, WIX_PAYMENTS_TOKENIZE_URL, injectWixPaymentsCard, isPreparedWixPaymentsRequest, isWixPaymentsDeviceRequest, isWixPaymentsTokenizeUrl, wixPaymentsAnswerOutcome, wixPaymentsBodyVerdict, wixPaymentsMerchantPin, wixPaymentsMerchantRefusal, wixPaymentsRefusalCode, wixPaymentsRefusalMessage, wixPaymentsRequestRefusal };