@agent-cards/sdk 0.23.15 → 0.23.17

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Finish a Worldpay eProtect checkout that your code resumes itself. With `attachToCdp(…, { pauseOnly: true })`, you create the authorization, read it, and call `controller.resume(read)`. The read carries the card registration as Agentcard stored it, bare JSON, and earlier releases handed exactly that to the merchant's paused registration script. Worldpay's script reads its answer only through the callback the request named, so it never received the registration: the page waited until the merchant's timeout, and the checkout read `outcome_unknown` with reason `merchant_request_aborted` after the cardholder had approved. The SDK now answers the resumed registration as it answers one it created itself, with the registration inside the request's own callback under Worldpay's script type. The SDK never hands the page a read that is not this request's registration, such as one already inside a callback or another request's answer: `resume` rejects with `PaymentOutcomeUnknownError`, reason `eprotect_registration_unconfirmed`, and the paused request fails. A checkout whose authorization the SDK creates was already answered this way and does not change. No API or Vault release is needed.
+
 - Refuse a sandbox declaration whose endpoint is on agentcard.com, Agentcard's own domain, as one on agentcard.sh is already refused. A `sandboxMerchants` entry on `VaultClient` whose endpoint is agentcard.com or any host under it makes the constructor throw:
 
   ```text
@@ -14,6 +16,8 @@
 
 - Pause Redsys's hosted payment page (the TPV Virtual redirect most Spanish banks give their merchants) for the cardholder's device. The sync now also asks for `capabilities=redsys_hosted_payment_page`, and the API serves Redsys's recognizer only for a company Agentcard turned Redsys on for. The SDK pauses the merchant's signed entry form to `sis.redsys.es/sis/realizarPago` (or `/sis/realizarPago/utf-8`), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Every other post your browser makes to Redsys, its card page's own post, its older page's 3-D Secure card lookup, InSite's card post and any post to Redsys's test platform, carries the card your agent typed or opens a page that asks for one: the SDK fails it and reads `unsupported` with reason `processor_card_page`. Your events and error messages name Redsys's session id, the `;jsessionid=` part of its paths, as `{session}`. Matching API and Vault releases are required. Redsys stays off for every company Agentcard has not turned it on for.
 
+- Keep a PayMongo checkout's session id out of your events and error messages. PayMongo's hosted checkout sends the card to its own page URL, `https://checkout.paymongo.com/<session>`, with no auth header and no cookie, so the session id is the only credential that request needs: anyone who holds it can open the checkout, its amount and its merchant, and pay it. `redactUrl`, every event and every error message now show it as `{session}` on that host, as in `https://checkout.paymongo.com/{session}`. The SDK does not pause a PayMongo payment yet. No API or Vault release is needed.
+
 - Pay a Paddle checkout whose card method names TokenEx, from Agentcard's own account only for now (dark launch): Agentcard turns it on for another company once it has confirmed that a card encrypted for one Paddle checkout cannot pay another. On such a checkout, Paddle's frame RSA-encrypts the card number and the CVV in the page itself, each on its own, under the account's TokenEx key, and posts them to `https://checkout-service.paddle.com/<checkout>/pay` (`https://sandbox-checkout-service.paddle.com/<checkout>/pay` in test) with the placeholder's first six and last four digits, expiry and brand. The SDK now pauses that `/pay`, and once the cardholder approves, the cardholder's device encrypts the real card under the key the SDK pins for that checkout's environment and the SDK writes the two ciphertexts and those five facts over the placeholder's, changing nothing else in the request. The full card number never reaches the agent's page. The sync now also asks for `capabilities=paddle_tokenex_pay`. The ciphertext goes only into the `/pay` the approval was created from, byte for byte, because the account's TokenEx key would decrypt it in any later `/pay` of that seller. A `/pay` that names no TokenEx card (PayPal, a wallet, a saved card) carries none of the cardholder's cards and continues untouched, and the SDK refuses a `/pay` that is not the frame's shape with `paddle_tokenex_pay_unsupported` before anything is sent. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
 - Pay a Lyra payment form (PayZen, Systempay or Sogecommerce) for a company Agentcard turned Lyra on for (dark launch): the SDK declares `lyra_krypton_payment`, pauses the form's card payment and hands the form Lyra's answer with the payment id its 3-D Secure step needs.
 - Keep a Lyra payment's session id out of your events and error messages. Lyra's Krypton payment form (PayZen, Systempay, Sogecommerce, Lyra Collect) sends its payment to `/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid=<id>` on the brand's API host, and that id, with the form token the page holds, continues the payment on Lyra's side. `redactUrl`, every event and every error message show it as `{session}`, as in `https://api.systempay.fr/api-payment/V4/Charge/Public/ProcessPayment/2;jsessionid={session}`. Lyra stays dark for every company Agentcard has not turned it on for, and no API or Vault release is needed.
@@ -139,6 +143,8 @@
 
 - Pay a Wix checkout whose card goes to Wix's own tokenizer, from Agentcard's own account only for now (dark launch): Agentcard turns it on for another company once it checks that the site instance Wix's card frame sends belongs to the reviewed store. Every Wix checkout mounts Wix Cashier's card frame, and for Wix Payments and classic Stripe on Wix that frame posts the card to `https://cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens`. Wix's payment widget fails the payment 30 seconds after it asks the frame for a token, too soon for an approval after Pay, so the SDK pays a Wix checkout only through `prepare({ psp: 'wix_payments', environment: 'production' })`, at a store Agentcard reviewed (ParaHouse Magazine, Psalms & Potions and Alexandra Hagel today), with `amount` and `currency`, the total the cardholder approves: the request names none. Wix has no test environment, so a test client's `prepare()` fails with `live_host_on_sandbox_row`. The sync now also asks for `capabilities=wix_payments_tokenize`. Once the cardholder approves, the frame's request pauses, the cardholder's device sends the card through the checkout relay, and the frame receives Wix's token. The frame sends its card request once more under a fresh site instance after Wix answers 401 or 403: the SDK refuses that second request in the browser and never answers it from the first approval. The SDK fails a paused request the cardholder's device has not sent 20 seconds after the pause, of the 30 seconds Wix waits, with reason `wix_payments_send_window_closed`, as it fails a prepared Secure Acceptance token create, and the device sends nothing past its own earlier boundary.
 
+- Keep a GoPay card form's token out of your events and error messages. GoPay's card frame sends the card to its own URL, `https://secure.gopay.com/gp-card-comm/h/<token>?lang=..&ver=..&SG=<signature>`, and that token, with the signature in the query, opens that payment's card form to anyone who holds it. `redactUrl`, every event and every error message now show it as `{token}` on GoPay's card frame hosts, as in `https://secure.gopay.com/gp-card-comm/h/{token}`, and drop the query as before. The SDK does not pause a GoPay payment yet. No API or Vault release is needed.
+
 ## 0.23.0
 
 ### Upgrading from 0.22.0

package/LICENSE

@@ -35,4 +35,4 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED. IN NO EVENT SHALL AGENTCARD CORPORATION BE LIABLE FOR ANY CLAIM,
 DAMAGES OR OTHER LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
 
-Questions: legal@agentcard.sh
+Questions: legal@agentcard.com

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d16bc471bdb814eb3e7b9da3834c9cbb5b1db7089ce91d3bbfb2215f81c1958d
+// artifact-sha256: 0fcc0e758acec92fba9d21092bcb3704b8a73ec864647ea194ca44eba57cb96d
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -357,8 +357,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -425,6 +425,9 @@ var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
     "captcha_version",
     "captcha_action"
 ]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
+var UNANSWERED_VERSIONS = /* @__PURE__ */ Object.freeze(["v0", "v1"]);
 var BODY_LIMIT3 = 8192;
 var URL_LIMIT = 256;
 var PAY_PATH = /^\/eng\/method\/CreditCard\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/pay$/;
@@ -487,18 +490,20 @@ function cardNetwork(number) {
         return "mastercard";
     return AMEX.test(number) ? "amex" : null;
 }
+var namesKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
 function judgeBody(body) {
     const pairs = readForm(body);
     if (pairs === null)
         return { code: "payfast_body_unsupported", pairs: null };
     if (pairs.some(([key]) => key === "cc_key"))
         return { code: "payfast_saved_card", pairs: null };
-    if (pairs.length !== PAYFAST_BODY_KEYS.length || !pairs.every(([key], at) => key === PAYFAST_BODY_KEYS[at])) {
+    const answered = namesKeys(pairs, PAYFAST_BODY_KEYS);
+    if (!answered && !namesKeys(pairs, UNANSWERED_KEYS))
         return { code: "payfast_body_unsupported", pairs: null };
-    }
     const value = Object.fromEntries(pairs);
-    const answer = value["g-recaptcha-response"];
-    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !(answer === "" || SOLVED_CAPTCHA2.test(answer)) || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
+    const answer = value[CAPTCHA_ANSWER];
+    const captcha = answered ? answer === "" || SOLVED_CAPTCHA2.test(answer) : UNANSWERED_VERSIONS.includes(value.captcha_version);
+    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !captcha || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
         return { code: "payfast_body_unsupported", pairs: null };
     }
     if (value.consent_check === "1")
@@ -762,8 +767,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1252,8 +1257,8 @@ var TEXT_LIMIT = 256;
 var CONTROL4 = /[\u0000-\u001f\u007f]/;
 var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys3 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1311,6 +1316,230 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_PSP = "paymongo";
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var PAYMONGO_ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "details", "billing", "return_url"]);
+var PAYMONGO_CARD_KEYS = /* @__PURE__ */ Object.freeze(["card_number", "exp_month", "exp_year", "cvc"]);
+var PAYMONGO_BILLING_KEYS = /* @__PURE__ */ Object.freeze(["name", "email", "phone", "address"]);
+var PAYMONGO_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze(["line1", "line2", "city", "state", "country", "postal_code"]);
+var CLICK_TO_PAY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_transaction_id", "correlation_id", "x_src_cx_flow_id"]);
+var URL_LIMIT2 = 128;
+var BODY_LIMIT6 = 16384;
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+var SESSION2 = /^[A-Za-z0-9]{24}$/;
+var CHECKOUT_PATH = /^\/(?:cs_)?([A-Za-z0-9]{24})$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE6 = /^[0-9]{3,4}$/;
+var TEXT = /^[^\x00-\x1f\x7f]{1,256}$/;
+var UNDEFINED = "$undefined";
+var CARD_MEMBER = /^(?:card_?number|pan|cvc|cvv)$/i;
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var keysAre = (value, keys) => {
+    const names = Object.keys(value);
+    return names.length === keys.length && names.every((name, at) => name === keys[at]);
+};
+var refuse10 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD9 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE4 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function paymongoCheckoutSession(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYMONGO_CHECKOUT_HOST)
+        return null;
+    const match = CHECKOUT_PATH.exec(parsed.pathname);
+    return match ? match[1] : null;
+}
+function readJson2(body) {
+    if (typeof body !== "string" || body === "")
+        return { parsed: null, exact: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { parsed: null, exact: false };
+    }
+    let exact = false;
+    try {
+        exact = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+    }
+    catch {
+        exact = false;
+    }
+    return { parsed, exact };
+}
+function billingValue(value) {
+    if (value === UNDEFINED)
+        return true;
+    if (typeof value !== "string" || !TEXT.test(value))
+        return false;
+    return value[0] !== "$" || value.startsWith("$$");
+}
+function judgeCardAttach(args, session) {
+    if (args.length !== 3 || typeof args[0] !== "string" || !args[0].startsWith("cs_") || !SESSION2.test(args[0].slice(3))) {
+        return "paymongo_body_unsupported";
+    }
+    const id = args[0].slice(3);
+    const attributes = args[1].data.attributes;
+    const details = attributes.details;
+    if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
+        return "paymongo_click_to_pay";
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+        return "paymongo_body_unsupported";
+    if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
+        return "paymongo_body_unsupported";
+    const billing = attributes.billing;
+    if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
+        return "paymongo_body_unsupported";
+    if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
+        return "paymongo_body_unsupported";
+    const third = args[2];
+    if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
+        return "paymongo_body_unsupported";
+    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+        return "paymongo_session_mismatch";
+    return null;
+}
+function namesCardValue(parsed) {
+    const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const key of Object.keys(node)) {
+            if (!Array.isArray(node) && CARD_MEMBER.test(key))
+                return true;
+            const value = node[key];
+            if (value !== null && typeof value === "object")
+                pending.push(value);
+        }
+    }
+    return false;
+}
+function attachType(parsed) {
+    if (!Array.isArray(parsed) || parsed.length < 2 || !record7(parsed[1]) || !record7(parsed[1].data) || !record7(parsed[1].data.attributes))
+        return null;
+    const type = parsed[1].data.attributes.payment_method_type;
+    return typeof type === "string" ? type : null;
+}
+function paymongoBodyVerdict(body, session) {
+    const { parsed, exact } = readJson2(body);
+    const type = parsed === null ? null : attachType(parsed);
+    if (type !== "card") {
+        if (parsed === null)
+            return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
+        return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
+    }
+    if (!exact)
+        return refuse10("paymongo_body_unsupported");
+    const code = judgeCardAttach(parsed, session);
+    return code === null ? CARD9 : refuse10(code);
+}
+// src/gopay.js
+var GOPAY_PSP = "gopay";
+var GOPAY_CARD_FORM_HOSTS = /* @__PURE__ */ Object.freeze({ "secure.gopay.com": "production", "secure.sandbox.gopay.com": "test" });
+var GOPAY_CARD_FORM_PATH = "/gp-card-comm/h/";
+var BODY_LIMIT7 = 1024;
+var ROOT_KEYS4 = /* @__PURE__ */ Object.freeze(["SG", "cardData", "type"]);
+var CARD_KEYS6 = /* @__PURE__ */ Object.freeze(["cardNumber", "cvc", "expiration"]);
+var TOKEN2 = /^[0-9A-Fa-f]{16,1024}$/;
+var SIGNATURE = /^[0-9A-Fa-f]{64}$/;
+var LANGUAGE = /^[a-z]{2}(?:-[A-Za-z]{2})?$/;
+var VERSION = /^[A-Za-z0-9]{1,16}$/;
+var QUERY_NAMES = /* @__PURE__ */ Object.freeze(["lang", "ver", "SG"]);
+var CARD_NUMBER7 = /^[0-9]{16}$/;
+var CODE = /^[0-9]{3}$/;
+var EXPIRATION = /^[0-9]{2}(?:0[1-9]|1[0-2])$/;
+var CARD_PAYMENT = "PAYMENT_CARD";
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys4 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var refuse11 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD10 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn(digits) {
+    let sum = 0;
+    for (let at = 0; at < digits.length; at += 1) {
+        let digit = Number(digits[digits.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function gopayCardFormUrl(url) {
+    if (typeof url !== "string" || url.length > 2048 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return null;
+    const environment = Object.prototype.hasOwnProperty.call(GOPAY_CARD_FORM_HOSTS, parsed.hostname) ? GOPAY_CARD_FORM_HOSTS[parsed.hostname] : null;
+    if (environment === null || !parsed.pathname.startsWith(GOPAY_CARD_FORM_PATH))
+        return null;
+    if (!TOKEN2.test(parsed.pathname.slice(GOPAY_CARD_FORM_PATH.length)))
+        return null;
+    const names = [...parsed.searchParams.keys()];
+    if (names.some((name) => !QUERY_NAMES.includes(name)) || new Set(names).size !== names.length)
+        return null;
+    const signature = parsed.searchParams.get("SG");
+    const language = parsed.searchParams.get("lang");
+    const version = parsed.searchParams.get("ver");
+    if (signature === null || !SIGNATURE.test(signature) || language !== null && !LANGUAGE.test(language) || version !== null && !VERSION.test(version))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment, signature });
+}
+function readBody4(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record8(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function gopayBodyVerdict(body, url) {
+    let target;
+    if (url !== void 0) {
+        target = gopayCardFormUrl(url);
+        if (target === null)
+            return refuse11("gopay_url_refused");
+    }
+    const value = readBody4(body);
+    if (value === null || !sameKeys4(value, ROOT_KEYS4) || !record8(value.cardData) || !sameKeys4(value.cardData, CARD_KEYS6)) {
+        return refuse11("gopay_body_unsupported");
+    }
+    const card = value.cardData;
+    if (typeof value.SG !== "string" || !SIGNATURE.test(value.SG) || typeof card.cardNumber !== "string" || !CARD_NUMBER7.test(card.cardNumber) || !luhn(card.cardNumber) || typeof card.cvc !== "string" || !CODE.test(card.cvc) || typeof card.expiration !== "string" || !EXPIRATION.test(card.expiration) || typeof value.type !== "string") {
+        return refuse11("gopay_body_unsupported");
+    }
+    if (value.type !== CARD_PAYMENT)
+        return refuse11("gopay_card_saving_refused");
+    if (target !== void 0 && value.SG !== target.signature)
+        return refuse11("gopay_signature_mismatch");
+    return CARD10;
+}
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1336,6 +1565,14 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paddle_tokenex_pay_unsupported" };
         return paddleTokenexBodyVerdict(body, target ? target.line : void 0);
     }
+    if (recognizer && recognizer.psp === PAYMONGO_PSP) {
+        const session = url !== void 0 ? paymongoCheckoutSession(url) : void 0;
+        if (url !== void 0 && session === null)
+            return { verdict: "refuse", code: "paymongo_url_refused" };
+        return paymongoBodyVerdict(body, session);
+    }
+    if (recognizer && recognizer.psp === GOPAY_PSP)
+        return gopayBodyVerdict(body, url);
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -1453,7 +1690,7 @@ function splitCardLeg(recognizer, body) {
     const absorb = list(split.absorb);
     const pass = list(split.pass);
     const sibling = list(split.siblingKeys);
-    const own = [];
+    const own2 = [];
     const seen = /* @__PURE__ */ new Set();
     for (const chunk of body.split("&")) {
         const eq = chunk.indexOf("=");
@@ -1470,13 +1707,13 @@ function splitCardLeg(recognizer, body) {
             return null;
         seen.add(key);
         if (!sibling.includes(key))
-            own.push(key);
+            own2.push(key);
     }
-    if (own.length === 0)
+    if (own2.length === 0)
         return null;
-    if (own.every((key) => absorb.includes(key)))
+    if (own2.every((key) => absorb.includes(key)))
         return "absorb";
-    if (own.every((key) => pass.includes(key)))
+    if (own2.every((key) => pass.includes(key)))
         return "pass";
     return null;
 }

package/dist/cdp.js

@@ -7,7 +7,7 @@ import { MercadoCheckoutGate } from './mercado-checkout.js';
 import { MERCADO_CHECKOUT_PATTERN } from './mercado-checkout.generated.js';
 import { JuspayCheckoutGate } from './juspay-gate.js';
 import { ACI_CHECKOUT_REUSED, AciGate, playwrightReplacesNavigationBody } from './aci.js';
-import { EprotectGate } from './eprotect.js';
+import { EprotectGate, classifyEprotectRequest, eprotectScriptAnswer } from './eprotect.js';
 import { dispatchPreClaim, eventUrl, isArmedCreditguardCall } from './pre-claim.js';
 import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesGmo } from './gmo.js';
 import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
@@ -1549,6 +1549,23 @@ function replayOf(result, timeoutMs) {
     return { mode: 'token', authorizationId, status: response.status, headers: { ...response.headers }, body: response.body, amountVerified: null,
         ...(result.processor_context !== undefined ? { processorContext: result.processor_context } : {}), ...execution };
 }
+/**
+ * Worldpay eProtect's registration, resumed by the business. The read carries the registration as the API
+ * stored it, bare JSON, and the paused request is the vendor's JSONP <script>, which runs its answer and reads
+ * the registration only through the callback the paused URL named. So it gets the answer authorize() gives on
+ * the create path (client.ts): the registration inside that callback, under Worldpay's script type, and only a
+ * registration payment-core's judge accepts for that URL. A read in any other mode never answers it either. The
+ * paused URL alone decides, whatever recognizer claimed it. Any other request's replay passes as it came, and a
+ * create's replay never comes here, so no answer is wrapped twice.
+ */
+function eprotectResumedReplay(replay, request) {
+    if (classifyEprotectRequest(request.url, request.method)?.kind !== 'registration')
+        return replay;
+    const answer = replay.mode === 'token' ? eprotectScriptAnswer(request.url, replay) : null;
+    if (replay.mode !== 'token' || !answer)
+        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'eprotect_registration_unconfirmed');
+    return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
+}
 /** The recogniser that claimed a paused request, by processor name, so a caller never re-matches the URL; null on a duck-typed vault without the read. */
 function recognizerNameOf(opts, url, method) {
     const read = opts.vault.recognizerOf;
@@ -2763,7 +2780,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // through controller.resume; the replay it hands back goes down the same delivery path as a create's.
             const pause = opts.pauseOnly ? pauseForBusiness(opts, lifecycle, attempt.signal, { url: request.url, method: request.method, headers: request.headers ?? {}, body }, pageOrigin) : null;
             businessPause = pause;
-            const replay = pause ? await pause.replay : await opts.vault.authorize({
+            const replay = pause ? eprotectResumedReplay(await pause.replay, request) : await opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: opts.amount,

package/dist/client.d.ts

@@ -1174,6 +1174,8 @@ export declare class CheckoutAuthError extends Error {
  * On Lyra's API hosts the form token's session id reads `{session}`.
  * On PayPal's hosts an order id reads `{order}`:
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
+ * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
+ * On GoPay's card frame hosts the card form's token reads `{token}`: https://secure.gopay.com/gp-card-comm/h/{token}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */

package/dist/client.js

@@ -1102,6 +1102,31 @@ const LYRA_SESSION = /;jsessionid=[^/;?#]*/gi;
 function maskLyraSession(path) {
     return path.replace(LYRA_SESSION, ';jsessionid={session}');
 }
+/**
+ * PayMongo's hosted checkout sends its card form's attach to its own page URL,
+ * https://checkout.paymongo.com/<session> (payment-core paymongo.js), and the session id is the only
+ * credential there, no cookies: with it anyone can open that checkout, its amount and its merchant, and
+ * pay it. Every route of the host is a session page, so on it any run of 24 or more letters and digits,
+ * with or without its cs_ prefix, in any case, after an escaped slash or with any character
+ * percent-encoded (a path keeps %36 where it means 6), reads {session}.
+ */
+const PAYMONGO_CHECKOUT_HOST = /^checkout\.paymongo\.com\.?$/i;
+const PAYMONGO_SESSION = /(?:cs_)?(?:[A-Za-z0-9]|%[0-9A-Fa-f]{2}){24,}/gi;
+function maskPaymongoSession(path) {
+    return path.replace(PAYMONGO_SESSION, '{session}');
+}
+/**
+ * GoPay's card frame posts the card to its own URL,
+ * https://secure.gopay.com/gp-card-comm/h/<hex token>?lang=..&ver=..&SG=<64 hex> (payment-core gopay.js). The
+ * token names that payment's card form, and with the SG, which redactUrl drops with the query, anyone who holds
+ * the URL can open the form and post a card to it. On GoPay's two card frame hosts the segment after /h/, in any
+ * case or after an escaped slash, reads {token}: https://secure.gopay.com/gp-card-comm/h/{token}.
+ */
+const GOPAY_CARD_FORM_HOST = /^secure(?:\.sandbox)?\.gopay\.com\.?$/i;
+const GOPAY_CARD_FORM_TOKEN = /(\/h(?:\/|%2f))[^/?#]*/gi;
+function maskGopayToken(path) {
+    return path.replace(GOPAY_CARD_FORM_TOKEN, '$1{token}');
+}
 /**
  * The processors whose card request carries its own credential in the URL path, with the hosts
  * that send it, the text that names those hosts in a string that is not a URL, and the mask. The
@@ -1141,6 +1166,8 @@ const PATH_CREDENTIALS = [
     { host: REDSYS_HOST, named: /redsys\.es/i, mask: maskRedsysSession },
     { host: LYRA_HOST, named: /(?:payzen\.eu|systempay\.fr|societegenerale\.eu|lyra\.com)/i, mask: maskLyraSession },
     { host: PAYPAL_HOST, named: /paypal\.com/i, mask: maskPaypalOrder },
+    { host: PAYMONGO_CHECKOUT_HOST, named: /checkout\.paymongo\.com/i, mask: maskPaymongoSession },
+    { host: GOPAY_CARD_FORM_HOST, named: /secure(?:\.sandbox)?\.gopay\.com/i, mask: maskGopayToken },
 ];
 /**
  * A URL as it may appear in an error message: origin + path only. A paused
@@ -1163,6 +1190,8 @@ const PATH_CREDENTIALS = [
  * On Lyra's API hosts the form token's session id reads `{session}`.
  * On PayPal's hosts an order id reads `{order}`:
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
+ * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
+ * On GoPay's card frame hosts the card form's token reads `{token}`: https://secure.gopay.com/gp-card-comm/h/{token}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 1d05273d23008e96c38c3be306ab215212b654fc275b96cf11e6452dee60c0d7
+// artifact-sha256: c3b720efaa20837c1bf50cc511610282f324867e9fe5538ac155b2ff79f2d9b4
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -365,8 +365,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -433,6 +433,9 @@ var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
     "captcha_version",
     "captcha_action"
 ]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
+var UNANSWERED_VERSIONS = /* @__PURE__ */ Object.freeze(["v0", "v1"]);
 var BODY_LIMIT3 = 8192;
 var URL_LIMIT = 256;
 var PAY_PATH = /^\/eng\/method\/CreditCard\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/pay$/;
@@ -495,18 +498,20 @@ function cardNetwork(number) {
         return "mastercard";
     return AMEX.test(number) ? "amex" : null;
 }
+var namesKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
 function judgeBody(body) {
     const pairs = readForm(body);
     if (pairs === null)
         return { code: "payfast_body_unsupported", pairs: null };
     if (pairs.some(([key]) => key === "cc_key"))
         return { code: "payfast_saved_card", pairs: null };
-    if (pairs.length !== PAYFAST_BODY_KEYS.length || !pairs.every(([key], at) => key === PAYFAST_BODY_KEYS[at])) {
+    const answered = namesKeys(pairs, PAYFAST_BODY_KEYS);
+    if (!answered && !namesKeys(pairs, UNANSWERED_KEYS))
         return { code: "payfast_body_unsupported", pairs: null };
-    }
     const value = Object.fromEntries(pairs);
-    const answer = value["g-recaptcha-response"];
-    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !(answer === "" || SOLVED_CAPTCHA2.test(answer)) || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
+    const answer = value[CAPTCHA_ANSWER];
+    const captcha = answered ? answer === "" || SOLVED_CAPTCHA2.test(answer) : UNANSWERED_VERSIONS.includes(value.captcha_version);
+    if (cardNetwork(value.card_number) === null || !SECURITY_CODE3.test(value.cvv) || !MONTH.test(value.expiry_month) || !YEAR.test(value.expiry_year) || value.cardholder_name.length > HOLDER_LIMIT || !HOLDER.test(value.cardholder_name) || !captcha || !CAPTCHA_VERSIONS.includes(value.captcha_version) || value.captcha_action !== "checkout") {
         return { code: "payfast_body_unsupported", pairs: null };
     }
     if (value.consent_check === "1")
@@ -770,8 +775,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1260,8 +1265,8 @@ var TEXT_LIMIT = 256;
 var CONTROL4 = /[\u0000-\u001f\u007f]/;
 var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys3 = (value, keys) => {
-    const own = Object.keys(value);
-    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
 };
 var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1319,6 +1324,230 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_PSP = "paymongo";
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var PAYMONGO_ATTRIBUTE_KEYS = /* @__PURE__ */ Object.freeze(["payment_method_type", "details", "billing", "return_url"]);
+var PAYMONGO_CARD_KEYS = /* @__PURE__ */ Object.freeze(["card_number", "exp_month", "exp_year", "cvc"]);
+var PAYMONGO_BILLING_KEYS = /* @__PURE__ */ Object.freeze(["name", "email", "phone", "address"]);
+var PAYMONGO_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze(["line1", "line2", "city", "state", "country", "postal_code"]);
+var CLICK_TO_PAY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_transaction_id", "correlation_id", "x_src_cx_flow_id"]);
+var URL_LIMIT2 = 128;
+var BODY_LIMIT6 = 16384;
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+var SESSION2 = /^[A-Za-z0-9]{24}$/;
+var CHECKOUT_PATH = /^\/(?:cs_)?([A-Za-z0-9]{24})$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE6 = /^[0-9]{3,4}$/;
+var TEXT = /^[^\x00-\x1f\x7f]{1,256}$/;
+var UNDEFINED = "$undefined";
+var CARD_MEMBER = /^(?:card_?number|pan|cvc|cvv)$/i;
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var keysAre = (value, keys) => {
+    const names = Object.keys(value);
+    return names.length === keys.length && names.every((name, at) => name === keys[at]);
+};
+var refuse10 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD9 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE4 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function paymongoCheckoutSession(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYMONGO_CHECKOUT_HOST)
+        return null;
+    const match = CHECKOUT_PATH.exec(parsed.pathname);
+    return match ? match[1] : null;
+}
+function readJson2(body) {
+    if (typeof body !== "string" || body === "")
+        return { parsed: null, exact: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { parsed: null, exact: false };
+    }
+    let exact2 = false;
+    try {
+        exact2 = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+    }
+    catch {
+        exact2 = false;
+    }
+    return { parsed, exact: exact2 };
+}
+function billingValue(value) {
+    if (value === UNDEFINED)
+        return true;
+    if (typeof value !== "string" || !TEXT.test(value))
+        return false;
+    return value[0] !== "$" || value.startsWith("$$");
+}
+function judgeCardAttach(args, session) {
+    if (args.length !== 3 || typeof args[0] !== "string" || !args[0].startsWith("cs_") || !SESSION2.test(args[0].slice(3))) {
+        return "paymongo_body_unsupported";
+    }
+    const id = args[0].slice(3);
+    const attributes = args[1].data.attributes;
+    const details = attributes.details;
+    if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
+        return "paymongo_click_to_pay";
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+        return "paymongo_body_unsupported";
+    if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
+        return "paymongo_body_unsupported";
+    const billing = attributes.billing;
+    if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
+        return "paymongo_body_unsupported";
+    if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
+        return "paymongo_body_unsupported";
+    const third = args[2];
+    if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
+        return "paymongo_body_unsupported";
+    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+        return "paymongo_session_mismatch";
+    return null;
+}
+function namesCardValue(parsed) {
+    const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        for (const key of Object.keys(node)) {
+            if (!Array.isArray(node) && CARD_MEMBER.test(key))
+                return true;
+            const value = node[key];
+            if (value !== null && typeof value === "object")
+                pending.push(value);
+        }
+    }
+    return false;
+}
+function attachType(parsed) {
+    if (!Array.isArray(parsed) || parsed.length < 2 || !record7(parsed[1]) || !record7(parsed[1].data) || !record7(parsed[1].data.attributes))
+        return null;
+    const type = parsed[1].data.attributes.payment_method_type;
+    return typeof type === "string" ? type : null;
+}
+function paymongoBodyVerdict(body, session) {
+    const { parsed, exact: exact2 } = readJson2(body);
+    const type = parsed === null ? null : attachType(parsed);
+    if (type !== "card") {
+        if (parsed === null)
+            return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
+        return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
+    }
+    if (!exact2)
+        return refuse10("paymongo_body_unsupported");
+    const code = judgeCardAttach(parsed, session);
+    return code === null ? CARD9 : refuse10(code);
+}
+// src/gopay.js
+var GOPAY_PSP = "gopay";
+var GOPAY_CARD_FORM_HOSTS = /* @__PURE__ */ Object.freeze({ "secure.gopay.com": "production", "secure.sandbox.gopay.com": "test" });
+var GOPAY_CARD_FORM_PATH = "/gp-card-comm/h/";
+var BODY_LIMIT7 = 1024;
+var ROOT_KEYS4 = /* @__PURE__ */ Object.freeze(["SG", "cardData", "type"]);
+var CARD_KEYS6 = /* @__PURE__ */ Object.freeze(["cardNumber", "cvc", "expiration"]);
+var TOKEN2 = /^[0-9A-Fa-f]{16,1024}$/;
+var SIGNATURE = /^[0-9A-Fa-f]{64}$/;
+var LANGUAGE = /^[a-z]{2}(?:-[A-Za-z]{2})?$/;
+var VERSION = /^[A-Za-z0-9]{1,16}$/;
+var QUERY_NAMES = /* @__PURE__ */ Object.freeze(["lang", "ver", "SG"]);
+var CARD_NUMBER7 = /^[0-9]{16}$/;
+var CODE = /^[0-9]{3}$/;
+var EXPIRATION = /^[0-9]{2}(?:0[1-9]|1[0-2])$/;
+var CARD_PAYMENT = "PAYMENT_CARD";
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys4 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var refuse11 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD10 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn(digits2) {
+    let sum = 0;
+    for (let at = 0; at < digits2.length; at += 1) {
+        let digit = Number(digits2[digits2.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function gopayCardFormUrl(url) {
+    if (typeof url !== "string" || url.length > 2048 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return null;
+    const environment = Object.prototype.hasOwnProperty.call(GOPAY_CARD_FORM_HOSTS, parsed.hostname) ? GOPAY_CARD_FORM_HOSTS[parsed.hostname] : null;
+    if (environment === null || !parsed.pathname.startsWith(GOPAY_CARD_FORM_PATH))
+        return null;
+    if (!TOKEN2.test(parsed.pathname.slice(GOPAY_CARD_FORM_PATH.length)))
+        return null;
+    const names = [...parsed.searchParams.keys()];
+    if (names.some((name) => !QUERY_NAMES.includes(name)) || new Set(names).size !== names.length)
+        return null;
+    const signature = parsed.searchParams.get("SG");
+    const language = parsed.searchParams.get("lang");
+    const version = parsed.searchParams.get("ver");
+    if (signature === null || !SIGNATURE.test(signature) || language !== null && !LANGUAGE.test(language) || version !== null && !VERSION.test(version))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment, signature });
+}
+function readBody4(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record8(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function gopayBodyVerdict(body, url) {
+    let target;
+    if (url !== void 0) {
+        target = gopayCardFormUrl(url);
+        if (target === null)
+            return refuse11("gopay_url_refused");
+    }
+    const value = readBody4(body);
+    if (value === null || !sameKeys4(value, ROOT_KEYS4) || !record8(value.cardData) || !sameKeys4(value.cardData, CARD_KEYS6)) {
+        return refuse11("gopay_body_unsupported");
+    }
+    const card = value.cardData;
+    if (typeof value.SG !== "string" || !SIGNATURE.test(value.SG) || typeof card.cardNumber !== "string" || !CARD_NUMBER7.test(card.cardNumber) || !luhn(card.cardNumber) || typeof card.cvc !== "string" || !CODE.test(card.cvc) || typeof card.expiration !== "string" || !EXPIRATION.test(card.expiration) || typeof value.type !== "string") {
+        return refuse11("gopay_body_unsupported");
+    }
+    if (value.type !== CARD_PAYMENT)
+        return refuse11("gopay_card_saving_refused");
+    if (target !== void 0 && value.SG !== target.signature)
+        return refuse11("gopay_signature_mismatch");
+    return CARD10;
+}
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1344,6 +1573,14 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paddle_tokenex_pay_unsupported" };
         return paddleTokenexBodyVerdict(body, target ? target.line : void 0);
     }
+    if (recognizer && recognizer.psp === PAYMONGO_PSP) {
+        const session = url !== void 0 ? paymongoCheckoutSession(url) : void 0;
+        if (url !== void 0 && session === null)
+            return { verdict: "refuse", code: "paymongo_url_refused" };
+        return paymongoBodyVerdict(body, session);
+    }
+    if (recognizer && recognizer.psp === GOPAY_PSP)
+        return gopayBodyVerdict(body, url);
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -1464,12 +1701,12 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT6 = 16384;
+var BODY_LIMIT8 = 16384;
 var RESPONSE_LIMIT = 32768;
-var ROOT_KEYS4 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
+var ROOT_KEYS5 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns5 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text2 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
@@ -1492,7 +1729,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody2(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT6)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT8)
         return null;
     let value;
     try {
@@ -1501,12 +1738,12 @@ function judgeBody2(body) {
     catch {
         return null;
     }
-    if (!record7(value) || !roundTrips(value, body))
+    if (!record9(value) || !roundTrips(value, body))
         return null;
-    if (!Object.keys(value).every((key) => ROOT_KEYS4.includes(key)) || !owns5(value, "paymentInstrument"))
+    if (!Object.keys(value).every((key) => ROOT_KEYS5.includes(key)) || !owns5(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record7(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
+    if (!record9(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns5(instrument, key)))
         return null;
     if (!digits(instrument.number, 12, 19) || !digits(instrument.cvv, 3, 4) || !exact(MONTH3, instrument.expirationMonth) || !exact(YEAR3, instrument.expirationYear))
         return null;
@@ -1534,7 +1771,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record7(headers))
+    if (!record9(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -1581,7 +1818,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record7(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record9(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -1596,7 +1833,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record7(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record9(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -1655,9 +1892,9 @@ function injectPrimerCard(body, card) {
     }
     return { body: JSON.stringify(judged.value), where };
 }
-var TOKEN2 = /^[A-Za-z0-9_-]{8,256}$/;
+var TOKEN3 = /^[A-Za-z0-9_-]{8,256}$/;
 var ERROR_ID = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
-var CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+var CODE2 = /^[A-Z][A-Z0-9_]{0,63}$/;
 var NETWORK_NAME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
 var RESPONSE_MONTH = /^(?:0?[1-9]|1[0-2])$/;
 var RESPONSE_YEAR = /^(?:[0-9]{2}|20[0-9]{2})$/;
@@ -1680,25 +1917,25 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record7(value) ? value : null;
+        return record9(value) ? value : null;
     }
     catch {
         return null;
     }
 }
-var tokenValue = (value) => exact(TOKEN2, value) && !panLike(value);
+var tokenValue = (value) => exact(TOKEN3, value) && !panLike(value);
 var optional = (value, key, check) => !owns5(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record7(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
+    if (!record9(data) || !exact(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record7))
+    if (!optional(data, "first6Digits", (v) => exact(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain(v, 256)) || !optional(data, "network", (v) => exact(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record9))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns5(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record7(data.binData)) {
+    if (record9(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns5(data.binData, key) || data.binData[key] === null)
@@ -1714,7 +1951,7 @@ function cardDetails(data) {
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record7(value) || !exact(CODE, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record9(value) || !exact(CODE2, value.responseCode) || !optional(value, "reasonCode", (v) => exact(CODE2, v)) || !optional(value, "reasonText", (v) => plain(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -1742,7 +1979,7 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record7(value.error) ? value.error.errorId : null;
+    const id = value && record9(value.error) ? value.error.errorId : null;
     return exact(ERROR_ID, id) && !panLike(id) ? id : null;
 }
 function matchesCard(details, card) {

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: ce4887768a0ee59bbca5f329bce47a2831a24b06d7bea1d5517335f7afad75e0
+// artifact-sha256: 7af6b8dae5c779ea1901a4deac135effd97b00ea0925db7a269c82330e110cc9
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1685,6 +1685,64 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         preparationRequired: true,
         encoding: "json",
         passthroughHeaders: ["^authorization$", "^x-wix-client-artifact-id$", "^commonconfig$", "^x-wix-brand$", "^consent-policy$", "^x-wix-linguist$"]
+    },
+    {
+        psp: "paymongo",
+        // PayMongo's hosted checkout (Philippines) at checkout.paymongo.com/<session>, which every PayMongo
+        // payment link, Storefront page, Shopify hosted app, WooCommerce hosted plugin and Checkout Session
+        // API opens. The card form's Pay click runs the page's Next.js Server Action attachCheckout: a POST
+        // to the page's own URL under its Next-Action id, Accept text/x-component, the body React's
+        // encodeReply writes as text/plain: [session, {data: {attributes: {payment_method_type: "card",
+        // details: {card_number, exp_month, exp_year, cvc}, billing, return_url}}}, {viewerAccept}].
+        // Unencrypted. The request names no amount: the session bound its line items (always PHP) when the
+        // merchant created it. paymongo.js holds the rule the pause decision reads: the exact URL, the Server
+        // Action's headers, and the card form's attach for that URL's session, key by key, with a Click to Pay
+        // attach and any other card shape refused. Every other action of the page (polling, fees, another
+        // method's attach) carries no card on the same URL and continues untouched (passWithoutCard). Next
+        // refuses an action whose Origin names another host, and the page answers no other origin's preflight,
+        // so the card leaves only through the checkout relay. 3-D Secure follows the answer on
+        // secure-authentication.paymongo.com with no card. Test mode and live mode share the host (a session's
+        // livemode, not its host, separates them), so no sandbox host is marked.
+        // Ships dark: served only to a client that declares `paymongo_checkout_pay`, gated off for every org
+        // until an operator lists one (`paymongo:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "paymongo_checkout_pay",
+        match: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}",
+        hosts: ["^checkout\\.paymongo\\.com$"],
+        encoding: "json",
+        // Next answers a Server Action only under its id, renders with the page's router state, and the page
+        // reads the answer only as an RSC stream. Origin, Referer and cookies never ride (none is needed).
+        passthroughHeaders: ["^next-action$", "^next-router-state-tree$", "^accept$"],
+        jsonCardFields: [[1, "data", "attributes", "details", "card_number"]],
+        passWithoutCard: "checkout\\.paymongo\\.com/(?:cs_)?[A-Za-z0-9]{24}"
+    },
+    {
+        psp: "gopay",
+        // GoPay's payment gateway (Czech Republic and Slovakia), which a shop opens as a page or as an overlay frame
+        // (embed.js). The gateway loads GoPay's card frame from https://secure.gopay.com/gp-card-comm/h/<hex
+        // token>?lang=..&ver=..&SG=<64 hex>, and on Pay the frame posts the card as one JSON body to its own URL:
+        // {"SG":<the URL's SG>,"cardData":{"cardNumber":<16 digits>,"cvc":<3 digits>,"expiration":<YYMM>},
+        // "type":"PAYMENT_CARD"}, unencrypted. gopay.js holds the request rule the pause decision, the API's create
+        // and the device all read: exactly a card frame URL, a JSON Content-Type, and the frame's body byte for byte,
+        // with a body that names Click to Pay (the frame's "save the card" box) refused. The body names no amount
+        // and no shop: the payment GoPay keeps on its side holds both, so a live request is taken only for a
+        // checkout origin a reviewed pin lists. The frame's host answers no browser origin, so the card leaves the
+        // cardholder's device only through the checkout relay. The answer tells the gateway only whether GoPay took
+        // the card; the gateway then reads the payment's end from its own API and runs 3-D Secure by redirect.
+        // secure.sandbox.gopay.com is GoPay's sandbox: pinned (S7) to test rows, which send only test cards.
+        // Ships dark: served only to a client that declares `gopay_card_form`, gated off for every org until an
+        // operator lists one (`gopay:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match`
+        // unanchored.
+        capability: "gopay_card_form",
+        match: "secure(?:\\.sandbox)?\\.gopay\\.com/gp-card-comm/h/[0-9A-Fa-f]{16,1024}(?![\\w/.%-])",
+        hosts: ["^secure\\.gopay\\.com$", "^secure\\.sandbox\\.gopay\\.com$"],
+        sandboxHosts: ["^secure\\.sandbox\\.gopay\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's own Accept rides as it sent it; origin, referer and cookies never do.
+        passthroughHeaders: ["^accept$"],
+        jsonCardFields: [["cardData", "cardNumber"]]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1807,6 +1865,19 @@ var PAYFAST_PAY_HOSTS = /* @__PURE__ */ Object.freeze({
     production: Object.freeze(["payment.payfast.io", "www.payfast.co.za"]),
     sandbox: Object.freeze(["sandbox.payfast.co.za"])
 });
+var PAYFAST_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "card_number",
+    "cardholder_name",
+    "consent_check",
+    "cvv",
+    "expiry_month",
+    "expiry_year",
+    "g-recaptcha-response",
+    "captcha_version",
+    "captcha_action"
+]);
+var CAPTCHA_ANSWER = "g-recaptcha-response";
+var UNANSWERED_KEYS = /* @__PURE__ */ Object.freeze(PAYFAST_BODY_KEYS.filter((key) => key !== CAPTCHA_ANSWER));
 // src/rsa-pkcs1v15.js
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
@@ -1849,6 +1920,9 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin3({ id: "psalms_and_potions", merchant: "Psalms & Potions", origins: ["https://www.psalmsandpotions.com"] }),
     pin3({ id: "alexandra_hagel", merchant: "Alexandra Hagel, LLC", origins: ["https://www.alexandrahagel.com"] })
 ]);
+// src/paymongo.js
+var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
+var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.15",
+  "version": "0.23.17",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",