@agent-cards/sdk 0.23.16 → 0.23.18

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: e4858832550c43f6e3cbef0c64facb820d7ae9b5118a2c8c4fcadb429c94b2b0
+// artifact-sha256: 0021d69ee6583030342d0f5ed625f1cb4bec88236f01fbf7450e41293f6f450d
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -663,10 +663,10 @@ var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
-    const pin4 = key && typeof key === "object" ? key.sha256 : void 0;
+    const pin5 = key && typeof key === "object" ? key.sha256 : void 0;
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse6("key");
-    if (typeof pin4 !== "string" || !SHA256_HEX.test(pin4))
+    if (typeof pin5 !== "string" || !SHA256_HEX.test(pin5))
         throw refuse6("key");
     let binary;
     try {
@@ -678,7 +678,7 @@ function parseRsaPublicKey(key) {
     if (btoa(binary) !== spki)
         throw refuse6("key");
     const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-    if (sha256Hex(der) !== pin4)
+    if (sha256Hex(der) !== pin5)
         throw refuse6("key");
     const outer = readElement(der, 0, 48);
     if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
@@ -1442,6 +1442,558 @@ function paymongoBodyVerdict(body, session) {
     const code = judgeCardAttach(parsed, session);
     return code === null ? CARD9 : refuse10(code);
 }
+// src/gopay.js
+var GOPAY_PSP = "gopay";
+var GOPAY_CARD_FORM_HOSTS = /* @__PURE__ */ Object.freeze({ "secure.gopay.com": "production", "secure.sandbox.gopay.com": "test" });
+var GOPAY_CARD_FORM_PATH = "/gp-card-comm/h/";
+var BODY_LIMIT7 = 1024;
+var ROOT_KEYS4 = /* @__PURE__ */ Object.freeze(["SG", "cardData", "type"]);
+var CARD_KEYS6 = /* @__PURE__ */ Object.freeze(["cardNumber", "cvc", "expiration"]);
+var TOKEN2 = /^[0-9A-Fa-f]{16,1024}$/;
+var SIGNATURE = /^[0-9A-Fa-f]{64}$/;
+var LANGUAGE = /^[a-z]{2}(?:-[A-Za-z]{2})?$/;
+var VERSION = /^[A-Za-z0-9]{1,16}$/;
+var QUERY_NAMES = /* @__PURE__ */ Object.freeze(["lang", "ver", "SG"]);
+var CARD_NUMBER7 = /^[0-9]{16}$/;
+var CODE = /^[0-9]{3}$/;
+var EXPIRATION = /^[0-9]{2}(?:0[1-9]|1[0-2])$/;
+var CARD_PAYMENT = "PAYMENT_CARD";
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys4 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var refuse11 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD10 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn(digits) {
+    let sum = 0;
+    for (let at = 0; at < digits.length; at += 1) {
+        let digit = Number(digits[digits.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function gopayCardFormUrl(url) {
+    if (typeof url !== "string" || url.length > 2048 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return null;
+    const environment = Object.prototype.hasOwnProperty.call(GOPAY_CARD_FORM_HOSTS, parsed.hostname) ? GOPAY_CARD_FORM_HOSTS[parsed.hostname] : null;
+    if (environment === null || !parsed.pathname.startsWith(GOPAY_CARD_FORM_PATH))
+        return null;
+    if (!TOKEN2.test(parsed.pathname.slice(GOPAY_CARD_FORM_PATH.length)))
+        return null;
+    const names = [...parsed.searchParams.keys()];
+    if (names.some((name) => !QUERY_NAMES.includes(name)) || new Set(names).size !== names.length)
+        return null;
+    const signature = parsed.searchParams.get("SG");
+    const language = parsed.searchParams.get("lang");
+    const version = parsed.searchParams.get("ver");
+    if (signature === null || !SIGNATURE.test(signature) || language !== null && !LANGUAGE.test(language) || version !== null && !VERSION.test(version))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment, signature });
+}
+function readBody4(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record8(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function gopayBodyVerdict(body, url) {
+    let target;
+    if (url !== void 0) {
+        target = gopayCardFormUrl(url);
+        if (target === null)
+            return refuse11("gopay_url_refused");
+    }
+    const value = readBody4(body);
+    if (value === null || !sameKeys4(value, ROOT_KEYS4) || !record8(value.cardData) || !sameKeys4(value.cardData, CARD_KEYS6)) {
+        return refuse11("gopay_body_unsupported");
+    }
+    const card = value.cardData;
+    if (typeof value.SG !== "string" || !SIGNATURE.test(value.SG) || typeof card.cardNumber !== "string" || !CARD_NUMBER7.test(card.cardNumber) || !luhn(card.cardNumber) || typeof card.cvc !== "string" || !CODE.test(card.cvc) || typeof card.expiration !== "string" || !EXPIRATION.test(card.expiration) || typeof value.type !== "string") {
+        return refuse11("gopay_body_unsupported");
+    }
+    if (value.type !== CARD_PAYMENT)
+        return refuse11("gopay_card_saving_refused");
+    if (target !== void 0 && value.SG !== target.signature)
+        return refuse11("gopay_signature_mismatch");
+    return CARD10;
+}
+// src/payrexx.js
+var PAYREXX_PSP = "payrexx";
+var PAYREXX_FRAME_HOST = "checkout.payrexx.com";
+var PAYREXX_PAY_PSP_ID = "44";
+var PAYREXX_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "instance",
+    "pspId",
+    "card[number]",
+    "card[cardholder]",
+    "card[exp_month]",
+    "card[exp_year]",
+    "card[cvc]",
+    "card[brand]",
+    "amount",
+    "currency",
+    "isTokenization",
+    "isSubscription",
+    "isPreAuthorization",
+    "isMoto",
+    "email"
+]);
+var BODY_LIMIT8 = 16384;
+var URL_LIMIT3 = 128;
+var FRAME_QUERY = /^\?pspId=([1-9][0-9]{0,3})&lang=([a-z]{2})$/;
+var GROUPED = /^[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4}$/;
+var VISA2 = /^4[0-9]{15}$/;
+var MASTERCARD2 = /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/;
+var SECURITY_CODE7 = /^[0-9]{3}$/;
+var MONTH3 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR3 = /^20[0-9]{2}$/;
+var HOLDER2 = /^[\p{L}\p{M}][\p{L}\p{M} '.-]{0,44}$/u;
+var INSTANCE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var AMOUNT2 = /^[1-9][0-9]{0,8}$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var EMAIL = /^[^\s@]{1,64}@[^\s@]{1,189}$/;
+var FLAGS = /* @__PURE__ */ Object.freeze(["isTokenization", "isSubscription", "isPreAuthorization", "isMoto"]);
+var CARD_DIGITS = /[0-9](?:[ -]?[0-9]){11}/;
+var THREE_DS_KEY = /^(?:threeDSServerTransID|threeDSVersion|postAuth|authData\[[A-Za-z]{1,32}\])$/;
+var refuse12 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD11 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE5 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function payrexxFrameTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT3 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYREXX_FRAME_HOST || parsed.pathname !== "/")
+        return null;
+    const query = FRAME_QUERY.exec(parsed.search);
+    return query ? Object.freeze({ pspId: query[1], lang: query[2] }) : null;
+}
+function readForm2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT8)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a form pair");
+            return [decodeURIComponent(chunk.slice(0, eq)), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+function cardNetwork2(digits) {
+    if (VISA2.test(digits))
+        return "visa";
+    return MASTERCARD2.test(digits) ? "mastercard" : null;
+}
+function judgeBody2(body) {
+    const pairs = readForm2(body);
+    if (pairs === null)
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    const keys = pairs.map(([key]) => key);
+    const value = Object.fromEntries(pairs);
+    if (!pairs.some(([key, entry]) => key.startsWith("card[") && key !== "card[brand]" && entry !== "")) {
+        return pairs.some(([key, entry]) => key !== "encryptedCard" && CARD_DIGITS.test(entry)) ? { verdict: refuse12("payrexx_body_unsupported"), pairs: null } : { verdict: CONTINUE5, pairs: null };
+    }
+    if (new Set(keys).size !== keys.length)
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    if (keys.includes("encryptedCard"))
+        return { verdict: refuse12("payrexx_wallet_card"), pairs: null };
+    if (keys.some((key) => THREE_DS_KEY.test(key)))
+        return { verdict: refuse12("payrexx_three_ds_resend"), pairs: null };
+    if (value.pspId !== PAYREXX_PAY_PSP_ID)
+        return { verdict: refuse12("payrexx_other_provider"), pairs: null };
+    if (keys.length !== PAYREXX_BODY_KEYS.length || !keys.every((key, at) => key === PAYREXX_BODY_KEYS[at])) {
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    }
+    const number = value["card[number]"];
+    const network = GROUPED.test(number) ? cardNetwork2(number.replace(/ /g, "")) : null;
+    if (network === null || value["card[brand]"] !== network || !SECURITY_CODE7.test(value["card[cvc]"]) || !MONTH3.test(value["card[exp_month]"]) || !YEAR3.test(value["card[exp_year]"]) || !HOLDER2.test(value["card[cardholder]"]) || !INSTANCE.test(value.instance) || !AMOUNT2.test(value.amount) || !CURRENCY.test(value.currency) || !(value.email === "" || value.email.length <= 254 && EMAIL.test(value.email)) || !FLAGS.every((flag) => value[flag] === "true" || value[flag] === "false")) {
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    }
+    if (value.isTokenization === "true" || value.isSubscription === "true")
+        return { verdict: refuse12("payrexx_keep_on_file"), pairs: null };
+    if (value.isPreAuthorization === "true" || value.isMoto === "true")
+        return { verdict: refuse12("payrexx_not_a_sale"), pairs: null };
+    return { verdict: CARD11, pairs };
+}
+function payrexxBodyVerdict(body) {
+    return judgeBody2(body).verdict;
+}
+function payrexxGateVerdict(url, body) {
+    const target = payrexxFrameTarget(url);
+    if (target === null)
+        return refuse12("payrexx_url_refused");
+    const verdict = payrexxBodyVerdict(body);
+    return verdict.verdict === "card" && target.pspId !== PAYREXX_PAY_PSP_ID ? refuse12("payrexx_other_provider") : verdict;
+}
+// src/komoju.js
+var KOMOJU_PSP = "komoju";
+var KOMOJU_HOST = "komoju.com";
+var KOMOJU_SECURE_TOKEN_URL = "https://komoju.com/api/v1/secure_tokens";
+var KOMOJU_TOKEN_URL = "https://komoju.com/api/v1/tokens";
+var KOMOJU_RETURN_URL_PREFIX = "https://multipay.komoju.com/secure-token-return.html?session_id=";
+var BODY_LIMIT9 = 4096;
+var URL_LIMIT4 = 128;
+var SESSION_ID = /^[a-z0-9]{25}$/;
+var SESSION_PAY_PATH = /^\/api\/v1\/sessions\/([a-z0-9]{25})\/pay$/;
+var TOKEN_ID = /^tok_[a-z0-9]{20,32}$/;
+var TOP_KEYS = /* @__PURE__ */ Object.freeze(["amount", "currency", "payment_details", "return_url"]);
+var KOMOJU_CARD_KEYS = /* @__PURE__ */ Object.freeze(["type", "name", "number", "month", "year", "verification_value", "email"]);
+var PAY_KEYS = /* @__PURE__ */ Object.freeze(["payment_details", "api_locale"]);
+var AMOUNT_MAX = 99999999;
+var CURRENCY2 = /^[A-Z]{3}$/;
+var NUMBER2 = /^[0-9]{12,19}$/;
+var MONTH4 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR4 = /^[0-9]{2}$/;
+var SECURITY_CODE8 = /^[0-9]{3,4}$/;
+var PAGE_NAME = /^[\x20-\x7e]{1,64}$/;
+var NAME_DIGITS_MAX = 11;
+var EMAIL2 = /^[\x21-\x7e]{1,64}@[\x21-\x7e]{1,189}$/;
+var LOCALE = /^[a-z]{2}(?:-[A-Za-z]{2,4})?$/;
+var PAN_LIKE3 = /(?:[0-9][ _.:-]*){12,}/;
+var record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys5 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var refuse13 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD12 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE6 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function komojuTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT4 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== KOMOJU_HOST)
+        return null;
+    if (url === KOMOJU_SECURE_TOKEN_URL)
+        return Object.freeze({ kind: "secure_token" });
+    if (url === KOMOJU_TOKEN_URL)
+        return Object.freeze({ kind: "token" });
+    const pay = SESSION_PAY_PATH.exec(parsed.pathname);
+    return pay ? Object.freeze({ kind: "session_pay", session: pay[1] }) : null;
+}
+function readJson3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT9)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record9(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function carriesCard(details) {
+    return record9(details) && Object.keys(details).some((key) => /^(?:number|card_?number|pan)$/i.test(key));
+}
+function judgeSecureToken(value) {
+    if (!sameKeys5(value, TOP_KEYS))
+        return "komoju_body_unsupported";
+    const details = value.payment_details;
+    if (!Number.isSafeInteger(value.amount) || value.amount < 0 || value.amount > AMOUNT_MAX || typeof value.currency !== "string" || !CURRENCY2.test(value.currency) || typeof value.return_url !== "string" || !value.return_url.startsWith(KOMOJU_RETURN_URL_PREFIX) || !SESSION_ID.test(value.return_url.slice(KOMOJU_RETURN_URL_PREFIX.length)) || !record9(details) || !sameKeys5(details, KOMOJU_CARD_KEYS) || details.type !== "credit_card" || typeof details.name !== "string" || !PAGE_NAME.test(details.name) || details.name.trim() === "" || details.name.replace(/[^0-9]/g, "").length > NAME_DIGITS_MAX || typeof details.number !== "string" || !NUMBER2.test(details.number) || typeof details.month !== "string" || !MONTH4.test(details.month) || typeof details.year !== "string" || !YEAR4.test(details.year) || typeof details.verification_value !== "string" || !SECURITY_CODE8.test(details.verification_value) || typeof details.email !== "string" || !EMAIL2.test(details.email) || PAN_LIKE3.test(details.email)) {
+        return "komoju_body_unsupported";
+    }
+    return value.amount === 0 ? "komoju_keeps_card" : null;
+}
+function tokenPay(value) {
+    const keys = Object.keys(value);
+    return (sameKeys5(value, PAY_KEYS) || keys.length === 1 && keys[0] === "payment_details") && typeof value.payment_details === "string" && TOKEN_ID.test(value.payment_details) && (value.api_locale === void 0 || typeof value.api_locale === "string" && LOCALE.test(value.api_locale));
+}
+function komojuBodyVerdict(body, url) {
+    let target = null;
+    if (url !== void 0) {
+        target = komojuTarget(url);
+        if (target === null)
+            return refuse13("komoju_url_refused");
+    }
+    const value = readJson3(body);
+    if (target !== null && target.kind !== "secure_token") {
+        if (value !== null && target.kind === "session_pay" && tokenPay(value))
+            return CONTINUE6;
+        return refuse13(value !== null && carriesCard(value.payment_details) ? "komoju_fallback_refused" : "komoju_body_unsupported");
+    }
+    if (value === null)
+        return refuse13("komoju_body_unsupported");
+    if (target === null && tokenPay(value))
+        return CONTINUE6;
+    if (target === null && !Object.prototype.hasOwnProperty.call(value, "return_url") && carriesCard(value.payment_details)) {
+        return refuse13("komoju_fallback_refused");
+    }
+    const code = judgeSecureToken(value);
+    return code === null ? CARD12 : refuse13(code);
+}
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_TOKEN_PATH = "/n/token/request";
+var PAYGENT_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "merchant_id",
+    "token_generate_key",
+    "card_number",
+    "card_expire_year",
+    "card_expire_month",
+    "card_cvc",
+    "card_name"
+]);
+var BODY_LIMIT10 = 2048;
+var URL_LIMIT5 = 128;
+var MERCHANT_ID = /^[0-9]{5,6}$/;
+var LIVE_KEY = /^live_[A-Za-z0-9]{24}$/;
+var SANDBOX_KEY = /^(?!live_)[a-z]{1,8}_[A-Za-z0-9]{24}$/;
+var NUMBER3 = /^[0-9]{12,19}$/;
+var YEAR5 = /^[0-9]{2}$/;
+var MONTH5 = /^(?:0?[1-9]|1[0-2])$/;
+var SECURITY_CODE9 = /^[0-9]{3,4}$/;
+var PAGE_HOLDER = /^(?:[A-Za-z][A-Za-z .'-]{0,44})?$/;
+var refuse14 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD13 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paygentEnvironment(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT5 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.pathname !== PAYGENT_TOKEN_PATH)
+        return null;
+    if (PAYGENT_TOKEN_HOSTS.production.includes(parsed.hostname))
+        return "production";
+    if (PAYGENT_TOKEN_HOSTS.sandbox.includes(parsed.hostname))
+        return "sandbox";
+    return null;
+}
+function readBody5(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT10)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a pair");
+            return [chunk.slice(0, eq), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+var CVC_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_id", "token_generate_key", "card_cvc", "cvc_only_flg"]);
+var sameKeys6 = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function judgeBody3(body) {
+    const pairs = readBody5(body);
+    if (pairs === null)
+        return { code: "paygent_body_unsupported", pairs: null };
+    if (sameKeys6(pairs, CVC_ONLY_KEYS))
+        return { code: "paygent_cvc_only", pairs: null };
+    if (!sameKeys6(pairs, PAYGENT_BODY_KEYS))
+        return { code: "paygent_body_unsupported", pairs: null };
+    const value = Object.fromEntries(pairs);
+    if (!MERCHANT_ID.test(value.merchant_id) || !(LIVE_KEY.test(value.token_generate_key) || SANDBOX_KEY.test(value.token_generate_key)) || !NUMBER3.test(value.card_number) || !YEAR5.test(value.card_expire_year) || !MONTH5.test(value.card_expire_month) || !SECURITY_CODE9.test(value.card_cvc) || !PAGE_HOLDER.test(value.card_name)) {
+        return { code: "paygent_body_unsupported", pairs: null };
+    }
+    return { code: null, pairs };
+}
+function paygentBodyVerdict(body) {
+    const { code } = judgeBody3(body);
+    return code === null ? CARD13 : refuse14(code);
+}
+function paygentRequestVerdict(url, body) {
+    const environment = paygentEnvironment(url);
+    if (environment === null)
+        return refuse14("paygent_url_refused");
+    const { code, pairs } = judgeBody3(body);
+    if (code !== null)
+        return refuse14(code);
+    const key = pairs[1][1];
+    return (environment === "production" ? LIVE_KEY : SANDBOX_KEY).test(key) ? CARD13 : refuse14("paygent_key_environment");
+}
+// src/multipart-form.js
+var BODY_LIMIT11 = 65536;
+var CRLF = "\r\n";
+var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
+var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
+var CONTENT_TYPE = new RegExp(`^multipart/form-data; ?boundary=(${BOUNDARY_CHARACTERS})$`, "i");
+var DISPOSITION = /^content-disposition: ?form-data; name="([^"\\\r\n]*)"$/i;
+var FILE_HINT = /^content-disposition:.*;\s*filename\*?=|^content-type:/i;
+var refusal = (code) => Object.freeze({ refusal: code });
+var listed = (list, name) => Array.isArray(list) && list.includes(name);
+function multipartBoundary(contentType) {
+    const match = typeof contentType === "string" ? CONTENT_TYPE.exec(contentType) : null;
+    return match ? match[1] : null;
+}
+function boundaryOf(body, contentType) {
+    const lineEnd = body.indexOf(CRLF);
+    const firstLine = body.startsWith("--") && lineEnd !== -1 ? body.slice(2, lineEnd) : null;
+    if (firstLine === null || !BOUNDARY.test(firstLine))
+        return null;
+    if (contentType === void 0 || contentType === null)
+        return firstLine;
+    return multipartBoundary(contentType) === firstLine ? firstLine : null;
+}
+function readMultipartForm(body, contentType) {
+    if (typeof body !== "string" || body.length > BODY_LIMIT11)
+        return refusal("multipart_not_form");
+    const boundary = boundaryOf(body, contentType);
+    if (boundary === null)
+        return refusal("multipart_not_form");
+    const dash = `--${boundary}`;
+    const delimiter = `${CRLF}${dash}`;
+    const parts = [];
+    let position = dash.length + CRLF.length;
+    for (;;) {
+        const headerEnd = body.indexOf(`${CRLF}${CRLF}`, position);
+        if (headerEnd === -1)
+            return refusal("multipart_not_form");
+        const headers = body.slice(position, headerEnd).split(CRLF);
+        if (headers.some((line) => FILE_HINT.test(line)))
+            return refusal("multipart_file_part");
+        const disposition = headers.length === 1 ? DISPOSITION.exec(headers[0]) : null;
+        if (!disposition)
+            return refusal("multipart_not_form");
+        const start = headerEnd + 2 * CRLF.length;
+        const end = body.indexOf(delimiter, start);
+        if (end === -1)
+            return refusal("multipart_not_form");
+        parts.push(Object.freeze({ name: disposition[1], value: body.slice(start, end), start, end }));
+        position = end + delimiter.length;
+        if (body.startsWith("--", position)) {
+            const rest = body.slice(position + 2);
+            return rest === "" || rest === CRLF ? Object.freeze({ boundary, parts: Object.freeze(parts) }) : refusal("multipart_not_form");
+        }
+        if (!body.startsWith(CRLF, position))
+            return refusal("multipart_not_form");
+        position += CRLF.length;
+    }
+}
+function soundRule(rule) {
+    if (!rule || typeof rule !== "object" || !Array.isArray(rule.parts) || !Array.isArray(rule.card) || rule.card.length === 0)
+        return false;
+    const names = [...rule.parts, ...rule.card];
+    if (!names.every((name) => typeof name === "string" && name !== ""))
+        return false;
+    return new Set(rule.card).size === rule.card.length && rule.card.every((name) => rule.parts.includes(name));
+}
+function judge(body, contentType, rule) {
+    if (!soundRule(rule))
+        throw new TypeError("A multipart rule lists its part names and, among them, its card parts.");
+    const read = readMultipartForm(body, contentType);
+    if (read.refusal)
+        return read;
+    if (read.parts.some((part) => !listed(rule.parts, part.name)))
+        return refusal("multipart_unknown_part");
+    for (const name of rule.card) {
+        const count = read.parts.filter((part) => part.name === name).length;
+        if (count === 0)
+            return refusal("multipart_missing_card_part");
+        if (count > 1)
+            return refusal("multipart_duplicate_card_part");
+    }
+    return read;
+}
+function multipartFormRefusal(body, contentType, rule) {
+    const read = judge(body, contentType, rule);
+    return read.refusal ?? null;
+}
+// src/pay-nl.js
+var PAY_NL_PSP = "pay_nl";
+var PAY_NL_TOKEN_URL = "https://payment.pay.nl/v1/Payment/getCardToken/json";
+var PAY_NL_PARTS = /* @__PURE__ */ Object.freeze([
+    "serviceId",
+    "requestToken",
+    "payment[method]",
+    "payment[card][number]",
+    "payment[card][name]",
+    "payment[card][cvc]",
+    "payment[card][expire_month]",
+    "payment[card][expire_year]"
+]);
+var PAY_NL_CARD_PARTS = /* @__PURE__ */ Object.freeze([
+    "payment[card][number]",
+    "payment[card][name]",
+    "payment[card][cvc]",
+    "payment[card][expire_month]",
+    "payment[card][expire_year]"
+]);
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+]);
+var RULE = /* @__PURE__ */ Object.freeze({ parts: PAY_NL_PARTS, card: PAY_NL_CARD_PARTS });
+var SERVICE_ID = /^SL-\d{4}-\d{4}$/;
+var REQUEST_TOKEN = /^[0-9a-f]{40}$/i;
+var NUMBER4 = /^[0-9]{8,19}$/;
+var HOLDER3 = /^\p{L}+(?: \p{L}+)*$/u;
+var HOLDER_LIMIT2 = 256;
+var SECURITY_CODE10 = /^[0-9]{3,4}$/;
+var MONTH6 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR6 = /^[0-9]{2}$/;
+var refuse15 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD14 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isPayNlTokenUrl(url) {
+    return url === PAY_NL_TOKEN_URL;
+}
+function readBody6(body, contentType) {
+    if (multipartFormRefusal(body, contentType, RULE) !== null)
+        return null;
+    const { parts } = readMultipartForm(body, contentType);
+    if (parts.length !== PAY_NL_PARTS.length || !parts.every((part, at) => part.name === PAY_NL_PARTS[at]))
+        return null;
+    const value = Object.fromEntries(parts.map((part) => [part.name, part.value]));
+    const name = value["payment[card][name]"];
+    if (!SERVICE_ID.test(value.serviceId) || !REQUEST_TOKEN.test(value.requestToken) || value["payment[method]"] !== "card" || !NUMBER4.test(value["payment[card][number]"]) || name.length > HOLDER_LIMIT2 || !HOLDER3.test(name) || !SECURITY_CODE10.test(value["payment[card][cvc]"]) || !MONTH6.test(value["payment[card][expire_month]"]) || !YEAR6.test(value["payment[card][expire_year]"]))
+        return null;
+    return value;
+}
+function payNlBodyVerdict(body, contentType) {
+    return readBody6(body, contentType) === null ? refuse15("pay_nl_body_unsupported") : CARD14;
+}
+var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
+var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1451,6 +2003,8 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "wix_payments_url_refused" };
         return wixPaymentsBodyVerdict(body);
     }
+    if (recognizer && recognizer.psp === KOMOJU_PSP)
+        return komojuBodyVerdict(body, url);
     if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
         if (url !== void 0 && !isPaddleVgsCardsUrl(url))
             return { verdict: "refuse", code: "paddle_vgs_url_refused" };
@@ -1461,6 +2015,17 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "payfast_url_refused" };
         return payfastBodyVerdict(body);
     }
+    if (recognizer && recognizer.psp === PAYREXX_PSP) {
+        return url !== void 0 ? payrexxGateVerdict(url, body) : payrexxBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYGENT_PSP) {
+        return url !== void 0 ? paygentRequestVerdict(url, body) : paygentBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAY_NL_PSP) {
+        if (url !== void 0 && !isPayNlTokenUrl(url))
+            return { verdict: "refuse", code: "pay_nl_url_refused" };
+        return payNlBodyVerdict(body);
+    }
     if (recognizer && recognizer.psp === PADDLE_TOKENEX_PSP) {
         const target = url !== void 0 ? paddleTokenexPayTarget(url) : null;
         if (url !== void 0 && target === null)
@@ -1473,6 +2038,8 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "paymongo_url_refused" };
         return paymongoBodyVerdict(body, session);
     }
+    if (recognizer && recognizer.psp === GOPAY_PSP)
+        return gopayBodyVerdict(body, url);
     if (recognizer && recognizer.psp === GRAVY_PSP)
         return gravyBodyVerdict(body);
     if (recognizer && recognizer.psp === MONERIS_PSP) {

package/dist/cdp.js

@@ -7,7 +7,7 @@ import { MercadoCheckoutGate } from './mercado-checkout.js';
 import { MERCADO_CHECKOUT_PATTERN } from './mercado-checkout.generated.js';
 import { JuspayCheckoutGate } from './juspay-gate.js';
 import { ACI_CHECKOUT_REUSED, AciGate, playwrightReplacesNavigationBody } from './aci.js';
-import { EprotectGate } from './eprotect.js';
+import { EprotectGate, classifyEprotectRequest, eprotectScriptAnswer } from './eprotect.js';
 import { dispatchPreClaim, eventUrl, isArmedCreditguardCall } from './pre-claim.js';
 import { GMO_TOKEN_V1_PATTERNS, gmoRequestShop, isGmoTokenV1Request, recognizesGmo } from './gmo.js';
 import { isPaddleVgsCardsUrl } from './paddle-vgs.generated.js';
@@ -1549,6 +1549,23 @@ function replayOf(result, timeoutMs) {
     return { mode: 'token', authorizationId, status: response.status, headers: { ...response.headers }, body: response.body, amountVerified: null,
         ...(result.processor_context !== undefined ? { processorContext: result.processor_context } : {}), ...execution };
 }
+/**
+ * Worldpay eProtect's registration, resumed by the business. The read carries the registration as the API
+ * stored it, bare JSON, and the paused request is the vendor's JSONP <script>, which runs its answer and reads
+ * the registration only through the callback the paused URL named. So it gets the answer authorize() gives on
+ * the create path (client.ts): the registration inside that callback, under Worldpay's script type, and only a
+ * registration payment-core's judge accepts for that URL. A read in any other mode never answers it either. The
+ * paused URL alone decides, whatever recognizer claimed it. Any other request's replay passes as it came, and a
+ * create's replay never comes here, so no answer is wrapped twice.
+ */
+function eprotectResumedReplay(replay, request) {
+    if (classifyEprotectRequest(request.url, request.method)?.kind !== 'registration')
+        return replay;
+    const answer = replay.mode === 'token' ? eprotectScriptAnswer(request.url, replay) : null;
+    if (replay.mode !== 'token' || !answer)
+        throw new PaymentOutcomeUnknownError(replay.authorizationId, 'eprotect_registration_unconfirmed');
+    return { ...replay, status: answer.status, headers: answer.headers, body: answer.body };
+}
 /** The recogniser that claimed a paused request, by processor name, so a caller never re-matches the URL; null on a duck-typed vault without the read. */
 function recognizerNameOf(opts, url, method) {
     const read = opts.vault.recognizerOf;
@@ -2763,7 +2780,7 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             // through controller.resume; the replay it hands back goes down the same delivery path as a create's.
             const pause = opts.pauseOnly ? pauseForBusiness(opts, lifecycle, attempt.signal, { url: request.url, method: request.method, headers: request.headers ?? {}, body }, pageOrigin) : null;
             businessPause = pause;
-            const replay = pause ? await pause.replay : await opts.vault.authorize({
+            const replay = pause ? eprotectResumedReplay(await pause.replay, request) : await opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: opts.amount,