@agent-cards/sdk 0.23.17 → 0.23.18

package/CHANGELOG.md

@@ -16,7 +16,7 @@
 
 - Pause Redsys's hosted payment page (the TPV Virtual redirect most Spanish banks give their merchants) for the cardholder's device. The sync now also asks for `capabilities=redsys_hosted_payment_page`, and the API serves Redsys's recognizer only for a company Agentcard turned Redsys on for. The SDK pauses the merchant's signed entry form to `sis.redsys.es/sis/realizarPago` (or `/sis/realizarPago/utf-8`), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Every other post your browser makes to Redsys, its card page's own post, its older page's 3-D Secure card lookup, InSite's card post and any post to Redsys's test platform, carries the card your agent typed or opens a page that asks for one: the SDK fails it and reads `unsupported` with reason `processor_card_page`. Your events and error messages name Redsys's session id, the `;jsessionid=` part of its paths, as `{session}`. Matching API and Vault releases are required. Redsys stays off for every company Agentcard has not turned it on for.
 
-- Keep a PayMongo checkout's session id out of your events and error messages. PayMongo's hosted checkout sends the card to its own page URL, `https://checkout.paymongo.com/<session>`, with no auth header and no cookie, so the session id is the only credential that request needs: anyone who holds it can open the checkout, its amount and its merchant, and pay it. `redactUrl`, every event and every error message now show it as `{session}` on that host, as in `https://checkout.paymongo.com/{session}`. The SDK does not pause a PayMongo payment yet. No API or Vault release is needed.
+- Keep a PayMongo checkout's session id out of your events and error messages. PayMongo's hosted checkout sends the card to its own page URL, `https://checkout.paymongo.com/<session>`, with no auth header and no cookie, so the session id is the only credential that request needs: anyone who holds it can open the checkout, its amount and its merchant, and pay it. `redactUrl`, every event and every error message now show it as `{session}` on that host, as in `https://checkout.paymongo.com/{session}`.
 
 - Pay a Paddle checkout whose card method names TokenEx, from Agentcard's own account only for now (dark launch): Agentcard turns it on for another company once it has confirmed that a card encrypted for one Paddle checkout cannot pay another. On such a checkout, Paddle's frame RSA-encrypts the card number and the CVV in the page itself, each on its own, under the account's TokenEx key, and posts them to `https://checkout-service.paddle.com/<checkout>/pay` (`https://sandbox-checkout-service.paddle.com/<checkout>/pay` in test) with the placeholder's first six and last four digits, expiry and brand. The SDK now pauses that `/pay`, and once the cardholder approves, the cardholder's device encrypts the real card under the key the SDK pins for that checkout's environment and the SDK writes the two ciphertexts and those five facts over the placeholder's, changing nothing else in the request. The full card number never reaches the agent's page. The sync now also asks for `capabilities=paddle_tokenex_pay`. The ciphertext goes only into the `/pay` the approval was created from, byte for byte, because the account's TokenEx key would decrypt it in any later `/pay` of that seller. A `/pay` that names no TokenEx card (PayPal, a wallet, a saved card) carries none of the cardholder's cards and continues untouched, and the SDK refuses a `/pay` that is not the frame's shape with `paddle_tokenex_pay_unsupported` before anything is sent. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
 - Pay a Lyra payment form (PayZen, Systempay or Sogecommerce) for a company Agentcard turned Lyra on for (dark launch): the SDK declares `lyra_krypton_payment`, pauses the form's card payment and hands the form Lyra's answer with the payment id its 3-D Secure step needs.
@@ -139,12 +139,20 @@
 
 - Keep a Payfast payment's id out of your events and error messages. Payfast's hosted payment page sends the card to `/eng/method/CreditCard/<uuid>/pay` on its own host (`payment.payfast.io`, `www.payfast.co.za`, `sandbox.payfast.co.za`) with no auth header, so the payment's uuid is the only credential that request needs: anyone who holds it can read the payment page, its amount and its merchant. `redactUrl`, every event and every error message now show it as `{uuid}` on every host Payfast owns, on every route of the page, as in `https://payment.payfast.io/eng/method/CreditCard/{uuid}/pay`. The SDK does not pause a Payfast payment yet. No API or Vault release is needed.
 
+- Keep a processor's id out of your events and error messages however the URL spells the slashes in front of it. A path keeps a percent escape as it was written, so a slash can reach `redactUrl` as `%2F` or `%2f`, escaped twice as `%252F`, or doubled. Earlier releases showed the last digits of a Payfast payment, a CreditGuard transaction or a Gravy session written without its hyphens after an escaped slash, as in `https://payment.payfast.io/eng/method/CreditCard%{uuid}7f/pay`, and all of one written with its hyphens escaped, as of a Przelewy24 transaction's token. They showed a Stripe Checkout Session, a PayPal order, a GoPay card form's token, a Paddle checkout and a WSPay or Monri client secret whole behind a slash escaped twice or doubled, or behind a route whose own slash was escaped, a Lyra session behind an escaped `;` or `=`, and a Redsys session behind one escaped twice. `redactUrl`, every event and every error message now show each id as its label in every one of these spellings, as in `https://payment.payfast.io/eng/method/CreditCard%2F{uuid}/pay`. No API or Vault release is needed.
+
 - Pay a live Pelecard checkout, for a company Agentcard turned Pelecard on for. Pelecard's test and live terminals share `gateway21.pelecard.biz` and `gateway20.pelecard.biz`, and neither the payment page nor its request says which kind a page is on, so the API refused every live Pelecard create with `400 pelecard_live_unsupported`, before any row or prompt. On 2026-10-11 Agentcard accepted that a live payment page could sit on one of Pelecard's public test terminals, and a live create now parks like a test one. The cardholder approves under Pelecard's note, which says the merchant may have Pelecard keep the card, since a merchant can set `CreateToken` when it creates the payment page, and only a card the cardholder stored pays: the API refuses a card a company added as `card_not_stored`. A test-mode checkout still takes only a documented test card. No SDK upgrade is needed. A payment also needs the matching API, Vault and checkout relay releases, with `CHECKOUT_PELECARD_RELAY_ENABLED` on and the company listed for Pelecard.
 
 - Pay a Wix checkout whose card goes to Wix's own tokenizer, from Agentcard's own account only for now (dark launch): Agentcard turns it on for another company once it checks that the site instance Wix's card frame sends belongs to the reviewed store. Every Wix checkout mounts Wix Cashier's card frame, and for Wix Payments and classic Stripe on Wix that frame posts the card to `https://cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens`. Wix's payment widget fails the payment 30 seconds after it asks the frame for a token, too soon for an approval after Pay, so the SDK pays a Wix checkout only through `prepare({ psp: 'wix_payments', environment: 'production' })`, at a store Agentcard reviewed (ParaHouse Magazine, Psalms & Potions and Alexandra Hagel today), with `amount` and `currency`, the total the cardholder approves: the request names none. Wix has no test environment, so a test client's `prepare()` fails with `live_host_on_sandbox_row`. The sync now also asks for `capabilities=wix_payments_tokenize`. Once the cardholder approves, the frame's request pauses, the cardholder's device sends the card through the checkout relay, and the frame receives Wix's token. The frame sends its card request once more under a fresh site instance after Wix answers 401 or 403: the SDK refuses that second request in the browser and never answers it from the first approval. The SDK fails a paused request the cardholder's device has not sent 20 seconds after the pause, of the 30 seconds Wix waits, with reason `wix_payments_send_window_closed`, as it fails a prepared Secure Acceptance token create, and the device sends nothing past its own earlier boundary.
 
 - Keep a GoPay card form's token out of your events and error messages. GoPay's card frame sends the card to its own URL, `https://secure.gopay.com/gp-card-comm/h/<token>?lang=..&ver=..&SG=<signature>`, and that token, with the signature in the query, opens that payment's card form to anyone who holds it. `redactUrl`, every event and every error message now show it as `{token}` on GoPay's card frame hosts, as in `https://secure.gopay.com/gp-card-comm/h/{token}`, and drop the query as before. The SDK does not pause a GoPay payment yet. No API or Vault release is needed.
 
+- Pay PayMongo's hosted checkout through the checkout relay, for a company Agentcard turns PayMongo on for (dark launch). Every PayMongo payment link, Storefront page and Checkout Session opens one page, `https://checkout.paymongo.com/<session>`, whose Pay button posts the card to that page's own URL as a Next.js Server Action. This build declares `paymongo_checkout_pay` on every sync, and the API serves the PayMongo entry only to a company Agentcard turned PayMongo on for, so every other company's PayMongo payments go through untouched, as for an unsupported processor. For an enabled company the SDK pauses only the checkout page's own card attach. The attach names no price, so `authorize()` refuses one without `amount` above zero and `currency` (`AmountRequiredError`): send the total PayMongo's checkout shows, in Philippine pesos. The API reads the checkout session from PayMongo and refuses a total that is not the session's to the centavo (`amount_mismatch`), a test-mode session on live credentials or the reverse (`paymongo_environment_mismatch`), and a session that has expired, is already being paid, takes no cards or adds PayMongo's fee on top (`paymongo_checkout_unpayable`), and it names PayMongo's merchant, whatever `merchant` you send. The cardholder's device sends the card through the checkout relay, and the page gets PayMongo's own answer: the paid payment, or the step toward PayMongo's 3-D Secure page, which the page then runs in the agent's browser, where a challenge needs a person at that browser. A PayMongo payment also needs the matching API, Vault and checkout relay releases.
+
+- Keep a KOMOJU session's id out of your events and error messages. KOMOJU's Hosted Fields frame pays a session with `/api/v1/sessions/<id>/pay` on `komoju.com` under the merchant's publishable key, which is public, so the session id is what lets anyone read that session and pay it. `redactUrl`, every event and every error message show it as `{session}`, as in `https://komoju.com/api/v1/sessions/{session}/pay`. KOMOJU stays dark for every company Agentcard has not turned it on for, and no API or Vault release is needed.
+
+- Keep a Przelewy24 transaction's token out of your events and error messages. Przelewy24's pay wall names its transaction by one token in every path (`/trnRequest/<token>`, its method links, `/card/p24form/<token>`, `/trnResult/<token>`), with no auth header, so the token is all a browser needs to open that transaction's pay wall, with its merchant, its amount and its card form. `redactUrl`, every event and every error message now show it as `{token}` on Przelewy24's hosts, on every route, as in `https://secure.przelewy24.pl/trnRequest/{token}`. The SDK does not pause a Przelewy24 payment yet. No API or Vault release is needed.
+
 ## 0.23.0
 
 ### Upgrading from 0.22.0

package/README.md

@@ -289,7 +289,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,redsys_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,redsys_hosted_payment_page,paymongo_checkout_pay`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -313,6 +313,10 @@ NMI never sees the card your agent typed. Redsys's hosted payment page
 (`redsys_hosted_payment_page`) is served the same way: this build pauses the
 merchant's signed entry form to `sis.redsys.es/sis/realizarPago` for the
 cardholder's device and fails every other post your browser makes to Redsys.
+PayMongo's hosted checkout (`paymongo_checkout_pay`) is served on the same terms:
+this build pauses the checkout page's own card attach on `checkout.paymongo.com`,
+the cardholder's device sends it through the checkout relay, and the page gets
+PayMongo's answer.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 0fcc0e758acec92fba9d21092bcb3704b8a73ec864647ea194ca44eba57cb96d
+// artifact-sha256: 0021d69ee6583030342d0f5ed625f1cb4bec88236f01fbf7450e41293f6f450d
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -663,10 +663,10 @@ var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
-    const pin4 = key && typeof key === "object" ? key.sha256 : void 0;
+    const pin5 = key && typeof key === "object" ? key.sha256 : void 0;
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse6("key");
-    if (typeof pin4 !== "string" || !SHA256_HEX.test(pin4))
+    if (typeof pin5 !== "string" || !SHA256_HEX.test(pin5))
         throw refuse6("key");
     let binary;
     try {
@@ -678,7 +678,7 @@ function parseRsaPublicKey(key) {
     if (btoa(binary) !== spki)
         throw refuse6("key");
     const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-    if (sha256Hex(der) !== pin4)
+    if (sha256Hex(der) !== pin5)
         throw refuse6("key");
     const outer = readElement(der, 0, 48);
     if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
@@ -1540,6 +1540,460 @@ function gopayBodyVerdict(body, url) {
         return refuse11("gopay_signature_mismatch");
     return CARD10;
 }
+// src/payrexx.js
+var PAYREXX_PSP = "payrexx";
+var PAYREXX_FRAME_HOST = "checkout.payrexx.com";
+var PAYREXX_PAY_PSP_ID = "44";
+var PAYREXX_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "instance",
+    "pspId",
+    "card[number]",
+    "card[cardholder]",
+    "card[exp_month]",
+    "card[exp_year]",
+    "card[cvc]",
+    "card[brand]",
+    "amount",
+    "currency",
+    "isTokenization",
+    "isSubscription",
+    "isPreAuthorization",
+    "isMoto",
+    "email"
+]);
+var BODY_LIMIT8 = 16384;
+var URL_LIMIT3 = 128;
+var FRAME_QUERY = /^\?pspId=([1-9][0-9]{0,3})&lang=([a-z]{2})$/;
+var GROUPED = /^[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4}$/;
+var VISA2 = /^4[0-9]{15}$/;
+var MASTERCARD2 = /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/;
+var SECURITY_CODE7 = /^[0-9]{3}$/;
+var MONTH3 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR3 = /^20[0-9]{2}$/;
+var HOLDER2 = /^[\p{L}\p{M}][\p{L}\p{M} '.-]{0,44}$/u;
+var INSTANCE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var AMOUNT2 = /^[1-9][0-9]{0,8}$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var EMAIL = /^[^\s@]{1,64}@[^\s@]{1,189}$/;
+var FLAGS = /* @__PURE__ */ Object.freeze(["isTokenization", "isSubscription", "isPreAuthorization", "isMoto"]);
+var CARD_DIGITS = /[0-9](?:[ -]?[0-9]){11}/;
+var THREE_DS_KEY = /^(?:threeDSServerTransID|threeDSVersion|postAuth|authData\[[A-Za-z]{1,32}\])$/;
+var refuse12 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD11 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE5 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function payrexxFrameTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT3 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== PAYREXX_FRAME_HOST || parsed.pathname !== "/")
+        return null;
+    const query = FRAME_QUERY.exec(parsed.search);
+    return query ? Object.freeze({ pspId: query[1], lang: query[2] }) : null;
+}
+function readForm2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT8)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a form pair");
+            return [decodeURIComponent(chunk.slice(0, eq)), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+function cardNetwork2(digits) {
+    if (VISA2.test(digits))
+        return "visa";
+    return MASTERCARD2.test(digits) ? "mastercard" : null;
+}
+function judgeBody2(body) {
+    const pairs = readForm2(body);
+    if (pairs === null)
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    const keys = pairs.map(([key]) => key);
+    const value = Object.fromEntries(pairs);
+    if (!pairs.some(([key, entry]) => key.startsWith("card[") && key !== "card[brand]" && entry !== "")) {
+        return pairs.some(([key, entry]) => key !== "encryptedCard" && CARD_DIGITS.test(entry)) ? { verdict: refuse12("payrexx_body_unsupported"), pairs: null } : { verdict: CONTINUE5, pairs: null };
+    }
+    if (new Set(keys).size !== keys.length)
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    if (keys.includes("encryptedCard"))
+        return { verdict: refuse12("payrexx_wallet_card"), pairs: null };
+    if (keys.some((key) => THREE_DS_KEY.test(key)))
+        return { verdict: refuse12("payrexx_three_ds_resend"), pairs: null };
+    if (value.pspId !== PAYREXX_PAY_PSP_ID)
+        return { verdict: refuse12("payrexx_other_provider"), pairs: null };
+    if (keys.length !== PAYREXX_BODY_KEYS.length || !keys.every((key, at) => key === PAYREXX_BODY_KEYS[at])) {
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    }
+    const number = value["card[number]"];
+    const network = GROUPED.test(number) ? cardNetwork2(number.replace(/ /g, "")) : null;
+    if (network === null || value["card[brand]"] !== network || !SECURITY_CODE7.test(value["card[cvc]"]) || !MONTH3.test(value["card[exp_month]"]) || !YEAR3.test(value["card[exp_year]"]) || !HOLDER2.test(value["card[cardholder]"]) || !INSTANCE.test(value.instance) || !AMOUNT2.test(value.amount) || !CURRENCY.test(value.currency) || !(value.email === "" || value.email.length <= 254 && EMAIL.test(value.email)) || !FLAGS.every((flag) => value[flag] === "true" || value[flag] === "false")) {
+        return { verdict: refuse12("payrexx_body_unsupported"), pairs: null };
+    }
+    if (value.isTokenization === "true" || value.isSubscription === "true")
+        return { verdict: refuse12("payrexx_keep_on_file"), pairs: null };
+    if (value.isPreAuthorization === "true" || value.isMoto === "true")
+        return { verdict: refuse12("payrexx_not_a_sale"), pairs: null };
+    return { verdict: CARD11, pairs };
+}
+function payrexxBodyVerdict(body) {
+    return judgeBody2(body).verdict;
+}
+function payrexxGateVerdict(url, body) {
+    const target = payrexxFrameTarget(url);
+    if (target === null)
+        return refuse12("payrexx_url_refused");
+    const verdict = payrexxBodyVerdict(body);
+    return verdict.verdict === "card" && target.pspId !== PAYREXX_PAY_PSP_ID ? refuse12("payrexx_other_provider") : verdict;
+}
+// src/komoju.js
+var KOMOJU_PSP = "komoju";
+var KOMOJU_HOST = "komoju.com";
+var KOMOJU_SECURE_TOKEN_URL = "https://komoju.com/api/v1/secure_tokens";
+var KOMOJU_TOKEN_URL = "https://komoju.com/api/v1/tokens";
+var KOMOJU_RETURN_URL_PREFIX = "https://multipay.komoju.com/secure-token-return.html?session_id=";
+var BODY_LIMIT9 = 4096;
+var URL_LIMIT4 = 128;
+var SESSION_ID = /^[a-z0-9]{25}$/;
+var SESSION_PAY_PATH = /^\/api\/v1\/sessions\/([a-z0-9]{25})\/pay$/;
+var TOKEN_ID = /^tok_[a-z0-9]{20,32}$/;
+var TOP_KEYS = /* @__PURE__ */ Object.freeze(["amount", "currency", "payment_details", "return_url"]);
+var KOMOJU_CARD_KEYS = /* @__PURE__ */ Object.freeze(["type", "name", "number", "month", "year", "verification_value", "email"]);
+var PAY_KEYS = /* @__PURE__ */ Object.freeze(["payment_details", "api_locale"]);
+var AMOUNT_MAX = 99999999;
+var CURRENCY2 = /^[A-Z]{3}$/;
+var NUMBER2 = /^[0-9]{12,19}$/;
+var MONTH4 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR4 = /^[0-9]{2}$/;
+var SECURITY_CODE8 = /^[0-9]{3,4}$/;
+var PAGE_NAME = /^[\x20-\x7e]{1,64}$/;
+var NAME_DIGITS_MAX = 11;
+var EMAIL2 = /^[\x21-\x7e]{1,64}@[\x21-\x7e]{1,189}$/;
+var LOCALE = /^[a-z]{2}(?:-[A-Za-z]{2,4})?$/;
+var PAN_LIKE3 = /(?:[0-9][ _.:-]*){12,}/;
+var record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys5 = (value, keys) => {
+    const own2 = Object.keys(value);
+    return own2.length === keys.length && own2.every((key, at) => key === keys[at]);
+};
+var refuse13 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD12 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE6 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function komojuTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT4 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hostname !== KOMOJU_HOST)
+        return null;
+    if (url === KOMOJU_SECURE_TOKEN_URL)
+        return Object.freeze({ kind: "secure_token" });
+    if (url === KOMOJU_TOKEN_URL)
+        return Object.freeze({ kind: "token" });
+    const pay = SESSION_PAY_PATH.exec(parsed.pathname);
+    return pay ? Object.freeze({ kind: "session_pay", session: pay[1] }) : null;
+}
+function readJson3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT9)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record9(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function carriesCard(details) {
+    return record9(details) && Object.keys(details).some((key) => /^(?:number|card_?number|pan)$/i.test(key));
+}
+function judgeSecureToken(value) {
+    if (!sameKeys5(value, TOP_KEYS))
+        return "komoju_body_unsupported";
+    const details = value.payment_details;
+    if (!Number.isSafeInteger(value.amount) || value.amount < 0 || value.amount > AMOUNT_MAX || typeof value.currency !== "string" || !CURRENCY2.test(value.currency) || typeof value.return_url !== "string" || !value.return_url.startsWith(KOMOJU_RETURN_URL_PREFIX) || !SESSION_ID.test(value.return_url.slice(KOMOJU_RETURN_URL_PREFIX.length)) || !record9(details) || !sameKeys5(details, KOMOJU_CARD_KEYS) || details.type !== "credit_card" || typeof details.name !== "string" || !PAGE_NAME.test(details.name) || details.name.trim() === "" || details.name.replace(/[^0-9]/g, "").length > NAME_DIGITS_MAX || typeof details.number !== "string" || !NUMBER2.test(details.number) || typeof details.month !== "string" || !MONTH4.test(details.month) || typeof details.year !== "string" || !YEAR4.test(details.year) || typeof details.verification_value !== "string" || !SECURITY_CODE8.test(details.verification_value) || typeof details.email !== "string" || !EMAIL2.test(details.email) || PAN_LIKE3.test(details.email)) {
+        return "komoju_body_unsupported";
+    }
+    return value.amount === 0 ? "komoju_keeps_card" : null;
+}
+function tokenPay(value) {
+    const keys = Object.keys(value);
+    return (sameKeys5(value, PAY_KEYS) || keys.length === 1 && keys[0] === "payment_details") && typeof value.payment_details === "string" && TOKEN_ID.test(value.payment_details) && (value.api_locale === void 0 || typeof value.api_locale === "string" && LOCALE.test(value.api_locale));
+}
+function komojuBodyVerdict(body, url) {
+    let target = null;
+    if (url !== void 0) {
+        target = komojuTarget(url);
+        if (target === null)
+            return refuse13("komoju_url_refused");
+    }
+    const value = readJson3(body);
+    if (target !== null && target.kind !== "secure_token") {
+        if (value !== null && target.kind === "session_pay" && tokenPay(value))
+            return CONTINUE6;
+        return refuse13(value !== null && carriesCard(value.payment_details) ? "komoju_fallback_refused" : "komoju_body_unsupported");
+    }
+    if (value === null)
+        return refuse13("komoju_body_unsupported");
+    if (target === null && tokenPay(value))
+        return CONTINUE6;
+    if (target === null && !Object.prototype.hasOwnProperty.call(value, "return_url") && carriesCard(value.payment_details)) {
+        return refuse13("komoju_fallback_refused");
+    }
+    const code = judgeSecureToken(value);
+    return code === null ? CARD12 : refuse13(code);
+}
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_TOKEN_PATH = "/n/token/request";
+var PAYGENT_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "merchant_id",
+    "token_generate_key",
+    "card_number",
+    "card_expire_year",
+    "card_expire_month",
+    "card_cvc",
+    "card_name"
+]);
+var BODY_LIMIT10 = 2048;
+var URL_LIMIT5 = 128;
+var MERCHANT_ID = /^[0-9]{5,6}$/;
+var LIVE_KEY = /^live_[A-Za-z0-9]{24}$/;
+var SANDBOX_KEY = /^(?!live_)[a-z]{1,8}_[A-Za-z0-9]{24}$/;
+var NUMBER3 = /^[0-9]{12,19}$/;
+var YEAR5 = /^[0-9]{2}$/;
+var MONTH5 = /^(?:0?[1-9]|1[0-2])$/;
+var SECURITY_CODE9 = /^[0-9]{3,4}$/;
+var PAGE_HOLDER = /^(?:[A-Za-z][A-Za-z .'-]{0,44})?$/;
+var refuse14 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD13 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paygentEnvironment(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT5 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.pathname !== PAYGENT_TOKEN_PATH)
+        return null;
+    if (PAYGENT_TOKEN_HOSTS.production.includes(parsed.hostname))
+        return "production";
+    if (PAYGENT_TOKEN_HOSTS.sandbox.includes(parsed.hostname))
+        return "sandbox";
+    return null;
+}
+function readBody5(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT10)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a pair");
+            return [chunk.slice(0, eq), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+var CVC_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_id", "token_generate_key", "card_cvc", "cvc_only_flg"]);
+var sameKeys6 = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function judgeBody3(body) {
+    const pairs = readBody5(body);
+    if (pairs === null)
+        return { code: "paygent_body_unsupported", pairs: null };
+    if (sameKeys6(pairs, CVC_ONLY_KEYS))
+        return { code: "paygent_cvc_only", pairs: null };
+    if (!sameKeys6(pairs, PAYGENT_BODY_KEYS))
+        return { code: "paygent_body_unsupported", pairs: null };
+    const value = Object.fromEntries(pairs);
+    if (!MERCHANT_ID.test(value.merchant_id) || !(LIVE_KEY.test(value.token_generate_key) || SANDBOX_KEY.test(value.token_generate_key)) || !NUMBER3.test(value.card_number) || !YEAR5.test(value.card_expire_year) || !MONTH5.test(value.card_expire_month) || !SECURITY_CODE9.test(value.card_cvc) || !PAGE_HOLDER.test(value.card_name)) {
+        return { code: "paygent_body_unsupported", pairs: null };
+    }
+    return { code: null, pairs };
+}
+function paygentBodyVerdict(body) {
+    const { code } = judgeBody3(body);
+    return code === null ? CARD13 : refuse14(code);
+}
+function paygentRequestVerdict(url, body) {
+    const environment = paygentEnvironment(url);
+    if (environment === null)
+        return refuse14("paygent_url_refused");
+    const { code, pairs } = judgeBody3(body);
+    if (code !== null)
+        return refuse14(code);
+    const key = pairs[1][1];
+    return (environment === "production" ? LIVE_KEY : SANDBOX_KEY).test(key) ? CARD13 : refuse14("paygent_key_environment");
+}
+// src/multipart-form.js
+var BODY_LIMIT11 = 65536;
+var CRLF = "\r\n";
+var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
+var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
+var CONTENT_TYPE = new RegExp(`^multipart/form-data; ?boundary=(${BOUNDARY_CHARACTERS})$`, "i");
+var DISPOSITION = /^content-disposition: ?form-data; name="([^"\\\r\n]*)"$/i;
+var FILE_HINT = /^content-disposition:.*;\s*filename\*?=|^content-type:/i;
+var refusal = (code) => Object.freeze({ refusal: code });
+var listed = (list, name) => Array.isArray(list) && list.includes(name);
+function multipartBoundary(contentType) {
+    const match = typeof contentType === "string" ? CONTENT_TYPE.exec(contentType) : null;
+    return match ? match[1] : null;
+}
+function boundaryOf(body, contentType) {
+    const lineEnd = body.indexOf(CRLF);
+    const firstLine = body.startsWith("--") && lineEnd !== -1 ? body.slice(2, lineEnd) : null;
+    if (firstLine === null || !BOUNDARY.test(firstLine))
+        return null;
+    if (contentType === void 0 || contentType === null)
+        return firstLine;
+    return multipartBoundary(contentType) === firstLine ? firstLine : null;
+}
+function readMultipartForm(body, contentType) {
+    if (typeof body !== "string" || body.length > BODY_LIMIT11)
+        return refusal("multipart_not_form");
+    const boundary = boundaryOf(body, contentType);
+    if (boundary === null)
+        return refusal("multipart_not_form");
+    const dash = `--${boundary}`;
+    const delimiter = `${CRLF}${dash}`;
+    const parts = [];
+    let position = dash.length + CRLF.length;
+    for (;;) {
+        const headerEnd = body.indexOf(`${CRLF}${CRLF}`, position);
+        if (headerEnd === -1)
+            return refusal("multipart_not_form");
+        const headers = body.slice(position, headerEnd).split(CRLF);
+        if (headers.some((line) => FILE_HINT.test(line)))
+            return refusal("multipart_file_part");
+        const disposition = headers.length === 1 ? DISPOSITION.exec(headers[0]) : null;
+        if (!disposition)
+            return refusal("multipart_not_form");
+        const start = headerEnd + 2 * CRLF.length;
+        const end = body.indexOf(delimiter, start);
+        if (end === -1)
+            return refusal("multipart_not_form");
+        parts.push(Object.freeze({ name: disposition[1], value: body.slice(start, end), start, end }));
+        position = end + delimiter.length;
+        if (body.startsWith("--", position)) {
+            const rest = body.slice(position + 2);
+            return rest === "" || rest === CRLF ? Object.freeze({ boundary, parts: Object.freeze(parts) }) : refusal("multipart_not_form");
+        }
+        if (!body.startsWith(CRLF, position))
+            return refusal("multipart_not_form");
+        position += CRLF.length;
+    }
+}
+function soundRule(rule) {
+    if (!rule || typeof rule !== "object" || !Array.isArray(rule.parts) || !Array.isArray(rule.card) || rule.card.length === 0)
+        return false;
+    const names = [...rule.parts, ...rule.card];
+    if (!names.every((name) => typeof name === "string" && name !== ""))
+        return false;
+    return new Set(rule.card).size === rule.card.length && rule.card.every((name) => rule.parts.includes(name));
+}
+function judge(body, contentType, rule) {
+    if (!soundRule(rule))
+        throw new TypeError("A multipart rule lists its part names and, among them, its card parts.");
+    const read = readMultipartForm(body, contentType);
+    if (read.refusal)
+        return read;
+    if (read.parts.some((part) => !listed(rule.parts, part.name)))
+        return refusal("multipart_unknown_part");
+    for (const name of rule.card) {
+        const count = read.parts.filter((part) => part.name === name).length;
+        if (count === 0)
+            return refusal("multipart_missing_card_part");
+        if (count > 1)
+            return refusal("multipart_duplicate_card_part");
+    }
+    return read;
+}
+function multipartFormRefusal(body, contentType, rule) {
+    const read = judge(body, contentType, rule);
+    return read.refusal ?? null;
+}
+// src/pay-nl.js
+var PAY_NL_PSP = "pay_nl";
+var PAY_NL_TOKEN_URL = "https://payment.pay.nl/v1/Payment/getCardToken/json";
+var PAY_NL_PARTS = /* @__PURE__ */ Object.freeze([
+    "serviceId",
+    "requestToken",
+    "payment[method]",
+    "payment[card][number]",
+    "payment[card][name]",
+    "payment[card][cvc]",
+    "payment[card][expire_month]",
+    "payment[card][expire_year]"
+]);
+var PAY_NL_CARD_PARTS = /* @__PURE__ */ Object.freeze([
+    "payment[card][number]",
+    "payment[card][name]",
+    "payment[card][cvc]",
+    "payment[card][expire_month]",
+    "payment[card][expire_year]"
+]);
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+]);
+var RULE = /* @__PURE__ */ Object.freeze({ parts: PAY_NL_PARTS, card: PAY_NL_CARD_PARTS });
+var SERVICE_ID = /^SL-\d{4}-\d{4}$/;
+var REQUEST_TOKEN = /^[0-9a-f]{40}$/i;
+var NUMBER4 = /^[0-9]{8,19}$/;
+var HOLDER3 = /^\p{L}+(?: \p{L}+)*$/u;
+var HOLDER_LIMIT2 = 256;
+var SECURITY_CODE10 = /^[0-9]{3,4}$/;
+var MONTH6 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR6 = /^[0-9]{2}$/;
+var refuse15 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD14 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isPayNlTokenUrl(url) {
+    return url === PAY_NL_TOKEN_URL;
+}
+function readBody6(body, contentType) {
+    if (multipartFormRefusal(body, contentType, RULE) !== null)
+        return null;
+    const { parts } = readMultipartForm(body, contentType);
+    if (parts.length !== PAY_NL_PARTS.length || !parts.every((part, at) => part.name === PAY_NL_PARTS[at]))
+        return null;
+    const value = Object.fromEntries(parts.map((part) => [part.name, part.value]));
+    const name = value["payment[card][name]"];
+    if (!SERVICE_ID.test(value.serviceId) || !REQUEST_TOKEN.test(value.requestToken) || value["payment[method]"] !== "card" || !NUMBER4.test(value["payment[card][number]"]) || name.length > HOLDER_LIMIT2 || !HOLDER3.test(name) || !SECURITY_CODE10.test(value["payment[card][cvc]"]) || !MONTH6.test(value["payment[card][expire_month]"]) || !YEAR6.test(value["payment[card][expire_year]"]))
+        return null;
+    return value;
+}
+function payNlBodyVerdict(body, contentType) {
+    return readBody6(body, contentType) === null ? refuse15("pay_nl_body_unsupported") : CARD14;
+}
+var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
+var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
     if (recognizer && recognizer.psp === LYRA_PSP)
@@ -1549,6 +2003,8 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "wix_payments_url_refused" };
         return wixPaymentsBodyVerdict(body);
     }
+    if (recognizer && recognizer.psp === KOMOJU_PSP)
+        return komojuBodyVerdict(body, url);
     if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
         if (url !== void 0 && !isPaddleVgsCardsUrl(url))
             return { verdict: "refuse", code: "paddle_vgs_url_refused" };
@@ -1559,6 +2015,17 @@ function processorGate(recognizer, url, body) {
             return { verdict: "refuse", code: "payfast_url_refused" };
         return payfastBodyVerdict(body);
     }
+    if (recognizer && recognizer.psp === PAYREXX_PSP) {
+        return url !== void 0 ? payrexxGateVerdict(url, body) : payrexxBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYGENT_PSP) {
+        return url !== void 0 ? paygentRequestVerdict(url, body) : paygentBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAY_NL_PSP) {
+        if (url !== void 0 && !isPayNlTokenUrl(url))
+            return { verdict: "refuse", code: "pay_nl_url_refused" };
+        return payNlBodyVerdict(body);
+    }
     if (recognizer && recognizer.psp === PADDLE_TOKENEX_PSP) {
         const target = url !== void 0 ? paddleTokenexPayTarget(url) : null;
         if (url !== void 0 && target === null)

package/dist/client.d.ts

@@ -249,6 +249,14 @@ export declare const SUPPORTED_REGISTRY_FEATURES: readonly string[];
  * Wix's token. A second card request from the frame, which Wix's frame sends after a 401
  * or 403 under a fresh instance, is never answered from the same approval. Served on the
  * same terms: only to a build that lists it, for a company Agentcard turned Wix on for.
+ *
+ * `paymongo_checkout_pay`: the card attach PayMongo's hosted checkout sends to its own page
+ * URL (checkout.paymongo.com/<session>) as a Next.js Server Action. This build pauses only the
+ * page's own card attach and answers it with PayMongo's answer as the API recorded it, under the
+ * RSC type the page reads: a paid payment intent, or the step toward PayMongo's 3-D Secure page
+ * that the page then runs in the agent's browser. The cardholder's device sends the card through
+ * the checkout relay. Served on the same terms: only to a build that lists it, for a company
+ * Agentcard turned PayMongo on for.
  */
 export declare const SUPPORTED_CAPABILITIES: readonly string[];
 /**
@@ -1176,6 +1184,9 @@ export declare class CheckoutAuthError extends Error {
  * https://www.paypal.com/v2/checkout/orders/{order}/confirm-payment-source.
  * On PayMongo's checkout host the session id reads `{session}`: https://checkout.paymongo.com/{session}.
  * On GoPay's card frame hosts the card form's token reads `{token}`: https://secure.gopay.com/gp-card-comm/h/{token}.
+ * On komoju.com a session id reads `{session}`: https://komoju.com/api/v1/sessions/{session}/pay.
+ * On Przelewy24's hosts the transaction's token reads `{token}`:
+ * https://secure.przelewy24.pl/trnRequest/{token}.
  * A string that is not a URL keeps the part before any `?` or `#`, with the
  * same segments masked.
  */