@agent-cards/sdk 0.23.15 → 0.23.16

package/CHANGELOG.md

@@ -14,6 +14,8 @@
 
 - Pause Redsys's hosted payment page (the TPV Virtual redirect most Spanish banks give their merchants) for the cardholder's device. The sync now also asks for `capabilities=redsys_hosted_payment_page`, and the API serves Redsys's recognizer only for a company Agentcard turned Redsys on for. The SDK pauses the merchant's signed entry form to `sis.redsys.es/sis/realizarPago` (or `/sis/realizarPago/utf-8`), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Every other post your browser makes to Redsys, its card page's own post, its older page's 3-D Secure card lookup, InSite's card post and any post to Redsys's test platform, carries the card your agent typed or opens a page that asks for one: the SDK fails it and reads `unsupported` with reason `processor_card_page`. Your events and error messages name Redsys's session id, the `;jsessionid=` part of its paths, as `{session}`. Matching API and Vault releases are required. Redsys stays off for every company Agentcard has not turned it on for.
 
+- Keep a PayMongo checkout's session id out of your events and error messages. PayMongo's hosted checkout sends the card to its own page URL, `https://checkout.paymongo.com/<session>`, with no auth header and no cookie, so the session id is the only credential that request needs: anyone who holds it can open the checkout, its amount and its merchant, and pay it. `redactUrl`, every event and every error message now show it as `{session}` on that host, as in `https://checkout.paymongo.com/{session}`. The SDK does not pause a PayMongo payment yet. No API or Vault release is needed.
+
 - Pay a Paddle checkout whose card method names TokenEx, from Agentcard's own account only for now (dark launch): Agentcard turns it on for another company once it has confirmed that a card encrypted for one Paddle checkout cannot pay another. On such a checkout, Paddle's frame RSA-encrypts the card number and the CVV in the page itself, each on its own, under the account's TokenEx key, and posts them to `https://checkout-service.paddle.com/<checkout>/pay` (`https://sandbox-checkout-service.paddle.com/<checkout>/pay` in test) with the placeholder's first six and last four digits, expiry and brand. The SDK now pauses that `/pay`, and once the cardholder approves, the cardholder's device encrypts the real card under the key the SDK pins for that checkout's environment and the SDK writes the two ciphertexts and those five facts over the placeholder's, changing nothing else in the request. The full card number never reaches the agent's page. The sync now also asks for `capabilities=paddle_tokenex_pay`. The ciphertext goes only into the `/pay` the approval was created from, byte for byte, because the account's TokenEx key would decrypt it in any later `/pay` of that seller. A `/pay` that names no TokenEx card (PayPal, a wallet, a saved card) carries none of the cardholder's cards and continues untouched, and the SDK refuses a `/pay` that is not the frame's shape with `paddle_tokenex_pay_unsupported` before anything is sent. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
 - Pay a Lyra payment form (PayZen, Systempay or Sogecommerce) for a company Agentcard turned Lyra on for (dark launch): the SDK declares `lyra_krypton_payment`, pauses the form's card payment and hands the form Lyra's answer with the payment id its 3-D Secure step needs.
 - Keep a Lyra payment's session id out of your events and error messages. Lyra's Krypton payment form (PayZen, Systempay, Sogecommerce, Lyra Collect) sends its payment to `/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid=<id>` on the brand's API host, and that id, with the form token the page holds, continues the payment on Lyra's side. `redactUrl`, every event and every error message show it as `{session}`, as in `https://api.systempay.fr/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid={session}`. Lyra stays dark for every company Agentcard has not turned it on for, and no API or Vault release is needed.

package/LICENSE

@@ -35,4 +35,4 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED. IN NO EVENT SHALL AGENTCARD CORPORATION BE LIABLE FOR ANY CLAIM,
 DAMAGES OR OTHER LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
 
-Questions: legal@agentcard.sh
+Questions: legal@agentcard.com

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d16bc471bdb814eb3e7b9da3834c9cbb5b1db7089ce91d3bbfb2215f81c1958d
+// artifact-sha256: e4858832550c43f6e3cbef0c64facb820d7ae9b5118a2c8c4fcadb429c94b2b0
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -357,8 +357,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -425,6 +425,9 @@ var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
     "captcha_version",
     "captcha_action"
 ]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
+var UNANSWERED_VERSIONS = /* @__PURE__ */ Object.freeze(["v0", "v1"]);
 var BODY_LIMIT3 = 8192;
 var URL_LIMIT = 256;
 var PAY_PATH = /^\/eng\/method\/CreditCard\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/pay$/;
@@ -487,18 +490,20 @@ function cardNetwork(number) {
         return "mastercard";
     return AMEX.test(number) ? "amex" : null;
 }
+var namesKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
 function judgeBody(body) {
     const pairs = readForm(body);
     if (pairs === null)
         return { code: "payfast_body_unsupported", pairs: null };
     if (pairs.some(([key]) => key === "cc_key"))
         return { code: "payfast_saved_card", pairs: null };
-    if (pairs.length !== PAYFAST_BODY_KEYS.length || !pairs.every(([key], at) => key === PAYFAST_BODY_KEYS[at])) {
+    const answered = namesKeys(pairs, PAYFAST_BODY_KEYS);
+    if (!answered && !namesKeys(pairs, UNANSWERED_KEYS))
         return { code: "payfast_body_unsupported", pairs: null };
-    }
     const value = Object.fromEntries(pairs);
-    const answer = value["g-recaptcha-response"];
-    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !(answer === "" || SOLVED_CAPTCHA2.test(answer)) || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
+    const answer = value[CAPTCHA_ANSWER];
+    const captcha = answered ? answer === "" || SOLVED_CAPTCHA2.test(answer) : UNANSWERED_VERSIONS.includes(value.captcha_version);
+    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !captcha || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
         return { code: "payfast_body_unsupported", pairs: null };
     }
     if (value.consent_check === "1")
@@ -762,8 +767,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1252,8 +1257,8 @@ var TEXT_LIMIT = 256;
 var CONTROL4 = /[\u0000-\u001f\u007f]/;
 var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys3 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1311,6 +1316,132 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_PSP = "paymongo";
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var PAYMONGO_ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "details", "billing", "return_url"]);
+var PAYMONGO_CARD_KEYS = /* @__PURE__ */ Object.freeze(["card_number", "exp_month", "exp_year", "cvc"]);
+var PAYMONGO_BILLING_KEYS = /* @__PURE__ */ Object.freeze(["name", "email", "phone", "address"]);
+var PAYMONGO_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze(["line1", "line2", "city", "state", "country", "postal_code"]);
+var CLICK_TO_PAY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_transaction_id", "correlation_id", "x_src_cx_flow_id"]);
+var URL_LIMIT2 = 128;
+var BODY_LIMIT6 = 16384;
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+var SESSION2 = /^[A-Za-z0-9]{24}$/;
+var CHECKOUT_PATH = /^\/(?:cs_)?([A-Za-z0-9]{24})$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE6 = /^[0-9]{3,4}$/;
+var TEXT = /^[^\x00-\x1f\x7f]{1,256}$/;
+var UNDEFINED = "$undefined";
+var CARD_MEMBER = /^(?:card_?number|pan|cvc|cvv)$/i;
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var keysAre = (value, keys) => {
+    const names = Object.keys(value);
+    return names.length === keys.length && names.every((name, at) => name === keys[at]);
+};
+var refuse10 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD9 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE4 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function paymongoCheckoutSession(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYMONGO_CHECKOUT_HOST)
+        return null;
+    const match = CHECKOUT_PATH.exec(parsed.pathname);
+    return match ? match[1] : null;
+}
+function readJson2(body) {
+    if (typeof body !== "string" || body === "")
+        return { parsed: null, exact: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { parsed: null, exact: false };
+    }
+    let exact = false;
+    try {
+        exact = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+    }
+    catch {
+        exact = false;
+    }
+    return { parsed, exact };
+}
+function billingValue(value) {
+    if (value === UNDEFINED)
+        return true;
+    if (typeof value !== "string" || !TEXT.test(value))
+        return false;
+    return value[0] !== "$" || value.startsWith("$$");
+}
+function judgeCardAttach(args, session) {
+    if (args.length !== 3 || typeof args[0] !== "string" || !args[0].startsWith("cs_") || !SESSION2.test(args[0].slice(3))) {
+        return "paymongo_body_unsupported";
+    }
+    const id = args[0].slice(3);
+    const attributes = args[1].data.attributes;
+    const details = attributes.details;
+    if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
+        return "paymongo_click_to_pay";
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+        return "paymongo_body_unsupported";
+    if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
+        return "paymongo_body_unsupported";
+    const billing = attributes.billing;
+    if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
+        return "paymongo_body_unsupported";
+    if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
+        return "paymongo_body_unsupported";
+    const third = args[2];
+    if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
+        return "paymongo_body_unsupported";
+    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+        return "paymongo_session_mismatch";
+    return null;
+}
+function namesCardValue(parsed) {
+    const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const key of Object.keys(node)) {
+            if (!Array.isArray(node) && CARD_MEMBER.test(key))
+                return true;
+            const value = node[key];
+            if (value !== null && typeof value === "object")
+                pending.push(value);
+        }
+    }
+    return false;
+}
+function attachType(parsed) {
+    if (!Array.isArray(parsed) || parsed.length < 2 || !record7(parsed[1]) || !record7(parsed[1].data) || !record7(parsed[1].data.attributes))
+        return null;
+    const type = parsed[1].data.attributes.payment_method_type;
+    return typeof type === "string" ? type : null;
+}
+function paymongoBodyVerdict(body, session) {
+    const { parsed, exact } = readJson2(body);
+    const type = parsed === null ? null : attachType(parsed);
+    if (type !== "card") {
+        if (parsed === null)
+            return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
+        return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
+    }
+    if (!exact)
+        return refuse10("paymongo_body_unsupported");
+    const code = judgeCardAttach(parsed, session);
+    return code === null ? CARD9 : refuse10(code);
+}
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1336,6 +1467,12 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paddle_tokenex_pay_unsupported" };
         return paddleTokenexBodyVerdict(body, target ? target.line : void 0);
     }
+    if (recognizer && recognizer.psp === PAYMONGO_PSP) {
+        const session = url !== void 0 ? paymongoCheckoutSession(url) : void 0;
+        if (url !== void 0 && session === null)
+            return { verdict: "refuse", code: "paymongo_url_refused" };
+        return paymongoBodyVerdict(body, session);
+    }
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -1453,7 +1590,7 @@ function splitCardLeg(recognizer, body) {
     const absorb = list(split.absorb);
     const pass = list(split.pass);
     const sibling = list(split.siblingKeys);
-    const own = [];
+    const own2 = [];
     const seen = /* @__PURE__ */ new Set();
     for (const chunk of body.split("&")) {
         const eq = chunk.indexOf("=");
@@ -1470,13 +1607,13 @@ function splitCardLeg(recognizer, body) {
             return null;
         seen.add(key);
         if (!sibling.includes(key))
-            own.push(key);
+            own2.push(key);
     }
-    if (own.length === 0)
+    if (own2.length === 0)
         return null;
-    if (own.every((key) => absorb.includes(key)))
+    if (own2.every((key) => absorb.includes(key)))
         return "absorb";
-    if (own.every((key) => pass.includes(key)))
+    if (own2.every((key) => pass.includes(key)))
         return "pass";
     return null;
 }

package/dist/client.d.ts

@@ -1174,6 +1174,7 @@ export declare class CheckoutAuthError extends Error {
  * On Lyra's API hosts the form token's session id reads `{session}`.
  * On PayPal's hosts an order id reads `{order}`:
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
+ * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */

package/dist/client.js

@@ -1102,6 +1102,19 @@ const LYRA_SESSION = /;jsessionid=[^/;?#]*/gi;
 function maskLyraSession(path) {
     return path.replace(LYRA_SESSION, ';jsessionid={session}');
 }
+/**
+ * PayMongo's hosted checkout sends its card form's attach to its own page URL,
+ * https://checkout.paymongo.com/<session> (payment-core paymongo.js), and the session id is the only
+ * credential there, no cookies: with it anyone can open that checkout, its amount and its merchant, and
+ * pay it. Every route of the host is a session page, so on it any run of 24 or more letters and digits,
+ * with or without its cs_ prefix, in any case, after an escaped slash or with any character
+ * percent-encoded (a path keeps %36 where it means 6), reads {session}.
+ */
+const PAYMONGO_CHECKOUT_HOST = /^checkout\.paymongo\.com\.?$/i;
+const PAYMONGO_SESSION = /(?:cs_)?(?:[A-Za-z0-9]|%[0-9A-Fa-f]{2}){24,}/gi;
+function maskPaymongoSession(path) {
+    return path.replace(PAYMONGO_SESSION, '{session}');
+}
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
  * that send it, the text that names those hosts in a string that is not a URL, and the mask. The
@@ -1141,6 +1154,7 @@ const PATH_CREDENTIALS = [
     { host: REDSYS_HOST, named: /redsys\.es/i, mask: maskRedsysSession },
     { host: LYRA_HOST, named: /(?:payzen\.eu|systempay\.fr|societegenerale\.eu|lyra\.com)/i, mask: maskLyraSession },
     { host: PAYPAL_HOST, named: /paypal\.com/i, mask: maskPaypalOrder },
+    { host: PAYMONGO_CHECKOUT_HOST, named: /checkout\.paymongo\.com/i, mask: maskPaymongoSession },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1163,6 +1177,7 @@ const PATH_CREDENTIALS = [
  * On Lyra's API hosts the form token's session id reads `{session}`.
  * On PayPal's hosts an order id reads `{order}`:
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
+ * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 1d05273d23008e96c38c3be306ab215212b654fc275b96cf11e6452dee60c0d7
+// artifact-sha256: 833d97716c57df725c942d14494012032a87b561ac7734676fe9dcb1d6be4819
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -365,8 +365,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -433,6 +433,9 @@ var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
     "captcha_version",
     "captcha_action"
 ]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
+var UNANSWERED_VERSIONS = /* @__PURE__ */ Object.freeze(["v0", "v1"]);
 var BODY_LIMIT3 = 8192;
 var URL_LIMIT = 256;
 var PAY_PATH = /^\/eng\/method\/CreditCard\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/pay$/;
@@ -495,18 +498,20 @@ function cardNetwork(number) {
         return "mastercard";
     return AMEX.test(number) ? "amex" : null;
 }
+var namesKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
 function judgeBody(body) {
     const pairs = readForm(body);
     if (pairs === null)
         return { code: "payfast_body_unsupported", pairs: null };
     if (pairs.some(([key]) => key === "cc_key"))
         return { code: "payfast_saved_card", pairs: null };
-    if (pairs.length !== PAYFAST_BODY_KEYS.length || !pairs.every(([key], at) => key === PAYFAST_BODY_KEYS[at])) {
+    const answered = namesKeys(pairs, PAYFAST_BODY_KEYS);
+    if (!answered && !namesKeys(pairs, UNANSWERED_KEYS))
         return { code: "payfast_body_unsupported", pairs: null };
-    }
     const value = Object.fromEntries(pairs);
-    const answer = value["g-recaptcha-response"];
-    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !(answer === "" || SOLVED_CAPTCHA2.test(answer)) || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
+    const answer = value[CAPTCHA_ANSWER];
+    const captcha = answered ? answer === "" || SOLVED_CAPTCHA2.test(answer) : UNANSWERED_VERSIONS.includes(value.captcha_version);
+    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !captcha || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
         return { code: "payfast_body_unsupported", pairs: null };
     }
     if (value.consent_check === "1")
@@ -770,8 +775,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1260,8 +1265,8 @@ var TEXT_LIMIT = 256;
 var CONTROL4 = /[\u0000-\u001f\u007f]/;
 var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys3 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1319,6 +1324,132 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_PSP = "paymongo";
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var PAYMONGO_ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "details", "billing", "return_url"]);
+var PAYMONGO_CARD_KEYS = /* @__PURE__ */ Object.freeze(["card_number", "exp_month", "exp_year", "cvc"]);
+var PAYMONGO_BILLING_KEYS = /* @__PURE__ */ Object.freeze(["name", "email", "phone", "address"]);
+var PAYMONGO_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze(["line1", "line2", "city", "state", "country", "postal_code"]);
+var CLICK_TO_PAY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_transaction_id", "correlation_id", "x_src_cx_flow_id"]);
+var URL_LIMIT2 = 128;
+var BODY_LIMIT6 = 16384;
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+var SESSION2 = /^[A-Za-z0-9]{24}$/;
+var CHECKOUT_PATH = /^\/(?:cs_)?([A-Za-z0-9]{24})$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE6 = /^[0-9]{3,4}$/;
+var TEXT = /^[^\x00-\x1f\x7f]{1,256}$/;
+var UNDEFINED = "$undefined";
+var CARD_MEMBER = /^(?:card_?number|pan|cvc|cvv)$/i;
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var keysAre = (value, keys) => {
+    const names = Object.keys(value);
+    return names.length === keys.length && names.every((name, at) => name === keys[at]);
+};
+var refuse10 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD9 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE4 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function paymongoCheckoutSession(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYMONGO_CHECKOUT_HOST)
+        return null;
+    const match = CHECKOUT_PATH.exec(parsed.pathname);
+    return match ? match[1] : null;
+}
+function readJson2(body) {
+    if (typeof body !== "string" || body === "")
+        return { parsed: null, exact: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { parsed: null, exact: false };
+    }
+    let exact2 = false;
+    try {
+        exact2 = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+    }
+    catch {
+        exact2 = false;
+    }
+    return { parsed, exact: exact2 };
+}
+function billingValue(value) {
+    if (value === UNDEFINED)
+        return true;
+    if (typeof value !== "string" || !TEXT.test(value))
+        return false;
+    return value[0] !== "$" || value.startsWith("$$");
+}
+function judgeCardAttach(args, session) {
+    if (args.length !== 3 || typeof args[0] !== "string" || !args[0].startsWith("cs_") || !SESSION2.test(args[0].slice(3))) {
+        return "paymongo_body_unsupported";
+    }
+    const id = args[0].slice(3);
+    const attributes = args[1].data.attributes;
+    const details = attributes.details;
+    if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
+        return "paymongo_click_to_pay";
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+        return "paymongo_body_unsupported";
+    if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
+        return "paymongo_body_unsupported";
+    const billing = attributes.billing;
+    if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
+        return "paymongo_body_unsupported";
+    if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
+        return "paymongo_body_unsupported";
+    const third = args[2];
+    if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
+        return "paymongo_body_unsupported";
+    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+        return "paymongo_session_mismatch";
+    return null;
+}
+function namesCardValue(parsed) {
+    const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const key of Object.keys(node)) {
+            if (!Array.isArray(node) && CARD_MEMBER.test(key))
+                return true;
+            const value = node[key];
+            if (value !== null && typeof value === "object")
+                pending.push(value);
+        }
+    }
+    return false;
+}
+function attachType(parsed) {
+    if (!Array.isArray(parsed) || parsed.length < 2 || !record7(parsed[1]) || !record7(parsed[1].data) || !record7(parsed[1].data.attributes))
+        return null;
+    const type = parsed[1].data.attributes.payment_method_type;
+    return typeof type === "string" ? type : null;
+}
+function paymongoBodyVerdict(body, session) {
+    const { parsed, exact: exact2 } = readJson2(body);
+    const type = parsed === null ? null : attachType(parsed);
+    if (type !== "card") {
+        if (parsed === null)
+            return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
+        return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
+    }
+    if (!exact2)
+        return refuse10("paymongo_body_unsupported");
+    const code = judgeCardAttach(parsed, session);
+    return code === null ? CARD9 : refuse10(code);
+}
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1344,6 +1475,12 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paddle_tokenex_pay_unsupported" };
         return paddleTokenexBodyVerdict(body, target ? target.line : void 0);
     }
+    if (recognizer && recognizer.psp === PAYMONGO_PSP) {
+        const session = url !== void 0 ? paymongoCheckoutSession(url) : void 0;
+        if (url !== void 0 && session === null)
+            return { verdict: "refuse", code: "paymongo_url_refused" };
+        return paymongoBodyVerdict(body, session);
+    }
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -1464,12 +1601,12 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT6 = 16384;
+var BODY_LIMIT7 = 16384;
 var RESPONSE_LIMIT = 32768;
 var ROOT_KEYS4 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns5 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text2 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -1492,7 +1629,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody2(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT6)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
         return null;
     let value;
     try {
@@ -1501,12 +1638,12 @@ function judgeBody2(body) {
     catch {
         return null;
     }
-    if (!record7(value) || !roundTrips(value, body))
+    if (!record8(value) || !roundTrips(value, body))
         return null;
     if (!Object.keys(value).every((key) => ROOT_KEYS4.includes(key)) || !owns5(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record7(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
+    if (!record8(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH3, instrument.expirationMonth) || !exact(YEAR3, instrument.expirationYear))
         return null;
@@ -1534,7 +1671,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record7(headers))
+    if (!record8(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -1581,7 +1718,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record7(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record8(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -1596,7 +1733,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record7(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record8(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -1680,7 +1817,7 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record7(value) ? value : null;
+        return record8(value) ? value : null;
     }
     catch {
         return null;
@@ -1689,16 +1826,16 @@ function readAnswer(body) {
 var tokenValue = (value) => exact(TOKEN2, value) && !panLike(value);
 var optional = (value, key, check) => !owns5(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record7(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record8(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record7))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record8))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns5(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record7(data.binData)) {
+    if (record8(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns5(data.binData, key) || data.binData[key] === null)
@@ -1714,7 +1851,7 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record7(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record8(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -1742,7 +1879,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record7(value.error) ? value.error.errorId : null;
+    const id = value && record8(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: ce4887768a0ee59bbca5f329bce47a2831a24b06d7bea1d5517335f7afad75e0
+// artifact-sha256: 3e73afac7d2a16c36e81a7ddca5ea143be4880e056cb31558d31d3d4d72d84b1
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1685,6 +1685,36 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         preparationRequired: true,
         encoding: "json",
         passthroughHeaders: ["^authorization$", "^x-wix-client-artifact-id$", "^commonconfig$", "^x-wix-brand$", "^consent-policy$", "^x-wix-linguist$"]
+    },
+    {
+        psp: "paymongo",
+        // PayMongo's hosted checkout (Philippines) at checkout.paymongo.com/<session>, which every PayMongo
+        // payment link, Storefront page, Shopify hosted app, WooCommerce hosted plugin and Checkout Session
+        // API opens. The card form's Pay click runs the page's Next.js Server Action attachCheckout: a POST
+        // to the page's own URL under its Next-Action id, Accept text/x-component, the body React's
+        // encodeReply writes as text/plain: [session, {data: {attributes: {payment_method_type: "card",
+        // details: {card_number, exp_month, exp_year, cvc}, billing, return_url}}}, {viewerAccept}].
+        // Unencrypted. The request names no amount: the session bound its line items (always PHP) when the
+        // merchant created it. paymongo.js holds the rule the pause decision reads: the exact URL, the Server
+        // Action's headers, and the card form's attach for that URL's session, key by key, with a Click to Pay
+        // attach and any other card shape refused. Every other action of the page (polling, fees, another
+        // method's attach) carries no card on the same URL and continues untouched (passWithoutCard). Next
+        // refuses an action whose Origin names another host, and the page answers no other origin's preflight,
+        // so the card leaves only through the checkout relay. 3-D Secure follows the answer on
+        // secure-authentication.paymongo.com with no card. Test mode and live mode share the host (a session's
+        // livemode, not its host, separates them), so no sandbox host is marked.
+        // Ships dark: served only to a client that declares `paymongo_checkout_pay`, gated off for every org
+        // until an operator lists one (`paymongo:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "paymongo_checkout_pay",
+        match: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}",
+        hosts: ["^checkout\\.paymongo\\.com$"],
+        encoding: "json",
+        // Next answers a Server Action only under its id, renders with the page's router state, and the page
+        // reads the answer only as an RSC stream. Origin, Referer and cookies never ride (none is needed).
+        passthroughHeaders: ["^next-action$", "^next-router-state-tree$", "^accept$"],
+        jsonCardFields: [[1, "data", "attributes", "details", "card_number"]],
+        passWithoutCard: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}"
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1807,6 +1837,19 @@ var PAYFAST_PAY_HOSTS = /* @__PURE__ */ Object.freeze({
     production: Object.freeze(["payment.payfast.io", "www.payfast.co.za"]),
     sandbox: Object.freeze(["sandbox.payfast.co.za"])
 });
+var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "card_number",
+    "cardholder_name",
+    "consent_check",
+    "cvv",
+    "expiry_month",
+    "expiry_year",
+    "g-recaptcha-response",
+    "captcha_version",
+    "captcha_action"
+]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
 // src/rsa-pkcs1v15.js
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
@@ -1849,6 +1892,9 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.15",
+  "version": "0.23.16",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",