@agent-cards/sdk 0.23.17 → 0.23.18

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7af6b8dae5c779ea1901a4deac135effd97b00ea0925db7a269c82330e110cc9
+// artifact-sha256: 7140b6eee18986c07c3393c1a950467cd13a86c32f47813ab57af11c7cd3fa02
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -394,6 +394,114 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["merchant_id", "agreement_id", "order_id", "amount", "currency"]
         }
     },
+    {
+        psp: "przelewy24",
+        // Przelewy24's pay wall (PayPro SA), where most Polish shops send a buyer to pay by card, bank transfer or
+        // BLIK. The merchant's SERVER registers the transaction (the amount, its URLs and a SHA-384 sign) and sends
+        // the buyer's browser to secure.przelewy24.pl/trnRequest/{token}, a 302 the browser follows with a GET. That
+        // ENTRY is the token alone: no card, no amount and no merchant, all of which Przelewy24 bound to the token on
+        // its own server. Przelewy24 answers with its pay wall under a session of its own, whose card method opens a
+        // card form posting to /card/p24form/{token} in that session, so a card form rebuilt away from that session
+        // has no transaction to pay (processors/przelewy24.js). The paused request is therefore the entry, a
+        // Document navigation that carries no card: the cardholder's device repeats it over the end-to-end TLS relay,
+        // picks the card method and fills the card form Przelewy24 returns to it in that same session, and the
+        // runtime resolves the paused navigation with the hosted_form notice. Only the entry is matched, exactly
+        // (processors/przelewy24.js isPrzelewy24EntryUrl): the method links, the card post and Przelewy24's Saferpay
+        // card routes share the host, and the SDK keeps the agent's browser off them, so no placeholder card ever
+        // reaches Przelewy24. The entry names no merchant, so a live one is paid only from a checkout origin
+        // Agentcard reviewed (processors/przelewy24.js przelewy24MerchantRefusal). sandbox.przelewy24.pl runs the
+        // same pay wall for a merchant's test account: a live row reaches only the live host and a test row only the
+        // sandbox, which receives only documented test cards (device-replay.js). Dark: served only to a client that
+        // declares the capability, and gated off for every org the operator has not allowlisted.
+        capability: "przelewy24_hosted_payment_page",
+        match: "(?:secure|sandbox)\\.przelewy24\\.pl/trnRequest/[0-9A-F]{10}-[0-9A-F]{6}-[0-9A-F]{6}-[0-9A-F]{10}",
+        hosts: ["^secure\\.przelewy24\\.pl$", "^sandbox\\.przelewy24\\.pl$"],
+        sandboxHosts: ["^sandbox\\.przelewy24\\.pl$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the card form the device fills on the pay wall, since the entry has no body. No
+        // captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into the pay
+        // wall's own form on the device. A client that pauses a GET only for a processor whose request it checks
+        // (the checkout SDK's isRecognizerRequest) never pauses this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        // Przelewy24 gives the merchant's server a reusable reference for the card of any payment on its pay wall
+        // (its card/info API: "a reference number that allows the card to be charged without CVV authorization"),
+        // which its card/charge API charges again without the cardholder, so the merchant keeps the card that pays,
+        // as on NMI. Only a card the person stored pays such a checkout: the API refuses a company's added card at
+        // create, card choice and lease (409 card_not_stored), and the approval says the merchant can keep it.
+        keepsCardOnFile: true,
+        hostedForm: {
+            // The card goes into the card form Przelewy24 returns to the device, never into the paused entry, which
+            // carries no body at all (processors/przelewy24.js checkPrzelewy24Entry). The device never posts a form
+            // of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/przelewy24.js checkPrzelewy24Entry): the create runs them, and naming
+            // them here makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "przelewy24",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // The pay wall card form's own fields, which the device fills on that page (never in the entry).
+            card: { number: "sfpCardNumber", month: "sfpCardExpiryMonth", year: "sfpCardExpiryYear", cvc: "CVC" },
+            // The token in the entry's URL names one registered transaction; the policy reads it there
+            // (checkPrzelewy24Entry's dedupe), since no form field holds it.
+            dedupe: ["(token)"]
+        }
+    },
+    {
+        psp: "transbank_webpay",
+        // Transbank's Webpay Plus, the card payment form most Chilean shops send a buyer to. The merchant's SERVER
+        // creates the transaction (its commerce code, the amount and its return_url) and sends the buyer's browser to
+        // webpay3g.transbank.cl/webpayserver/initTransaction?token_ws=<token>, a GET (the official WooCommerce plugin's
+        // redirect). That ENTRY is the token alone: no card, no amount and no merchant, all of which Transbank bound to
+        // the token on its own server. Webpay answers with a page whose form submits the token to init_transaction.cgi,
+        // which binds it to a Webpay session once, and then takes the card in that session (processors/transbank.js).
+        // The paused request is therefore the entry, a Document navigation that carries no card: the cardholder's
+        // device repeats it over the end-to-end TLS relay, holds Webpay's own transaction to the approved payment, fills
+        // Webpay's card steps in that same session, and hands the browser back to the merchant's return_url. Only the
+        // entry is matched, exactly (processors/transbank.js isTransbankEntryUrl): init_transaction.cgi, the card
+        // services under /webpayserver/wswebpay/ and the card post (bp_control.cgi) share the host, and the SDK keeps
+        // the agent's browser off them, so no placeholder card ever reaches Webpay and the token stays unspent for the
+        // device. The entry names no merchant, so a live payment is made only when Webpay's own transaction names a
+        // reviewed commerce (TRANSBANK_MERCHANTS). webpay3gint.transbank.cl is Transbank's integration environment: a
+        // live row reaches only the live host and a test row only the integration host, which receives only documented
+        // test cards (device-replay.js). Dark: served only to a client that declares the capability, and gated off for
+        // every org the operator has not allowlisted.
+        capability: "transbank_webpay_hosted_payment_page",
+        match: "webpay3g(?:int)?\\.transbank\\.cl/webpayserver/initTransaction",
+        hosts: ["^webpay3g\\.transbank\\.cl$", "^webpay3gint\\.transbank\\.cl$"],
+        sandboxHosts: ["^webpay3gint\\.transbank\\.cl$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the card post the device sends on Webpay's page, since the entry has no body. No
+        // captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into Webpay's own
+        // steps on the device. A client that pauses a GET only for a processor whose request it checks never pauses
+        // this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into Webpay's own steps on the device, never into the paused entry, which carries no body
+            // at all (processors/transbank.js checkTransbankEntry). The device never posts a form of its own: the
+            // Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/transbank.js checkTransbankEntry): the create runs them, and naming them
+            // here makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "transbank_webpay",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // Webpay's card post's own fields, which the device fills on Webpay's page (never in the entry).
+            card: { number: "TBK_NUMERO_TARJETA", month: "TBK_MES_EXPIRACION", year: "TBK_ANO_EXPIRACION", cvc: "TBK_CVV" },
+            // The token in the entry's URL names one transaction; the policy reads it there (checkTransbankEntry's
+            // dedupe), since no form field holds it.
+            dedupe: ["(token)"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1743,6 +1851,125 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // The frame's own Accept rides as it sent it; origin, referer and cookies never do.
         passthroughHeaders: ["^accept$"],
         jsonCardFields: [["cardData", "cardNumber"]]
+    },
+    {
+        psp: "payrexx",
+        // Payrexx Pay (Payrexx AG, Switzerland): the card frame every Payrexx payment page loads from
+        // checkout.payrexx.com/?pspId=44&lang=<xx>, Payrexx's own card acceptance (`Native_PSP`; the page's
+        // config names Credorax as its acquirer). The frame posts the number, name, expiry and code with one
+        // axios XHR to its own URL, form encoded, no encryption, beside the merchant's instance, the provider
+        // id, the page's total in minor units, its currency, and four flags that say whether Payrexx keeps the
+        // card. payrexx.js holds the rule the pause decision reads: the exact frame URL and the first card
+        // request's body key for key, with a 3-D Secure resend, a Click to Pay card, another provider's card,
+        // a kept card and a hold each refused. A body with no card value (a wallet's own encryptedCard)
+        // continues untouched. The route answers no browser origin, so the card leaves only through the
+        // checkout relay. Payrexx Pay Plus sends its card to Stripe from Stripe's own frame, which the stripe
+        // entry covers.
+        // Ships dark: served only to a client that declares `payrexx_card_frame`, gated off for every org
+        // until an operator lists one (`payrexx:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). No sandbox host: Payrexx's test mode is chosen per merchant on
+        // this same host, so the device's test-card rule cannot tell a test payment from a live one here.
+        capability: "payrexx_card_frame",
+        match: "checkout\\.payrexx\\.com/",
+        hosts: ["^checkout\\.payrexx\\.com$"],
+        encoding: "form",
+        // axios's same-origin marker and its JSON Accept. Origin, Referer, cookies and the AWS WAF token never ride.
+        passthroughHeaders: ["^x-requested-with$", "^accept$"],
+        cardFields: ["card[number]"],
+        passWithoutCard: "checkout\\.payrexx\\.com/"
+    },
+    {
+        psp: "komoju",
+        // KOMOJU's Hosted Fields (Japan): the card inputs live in KOMOJU's own frame on multipay.komoju.com,
+        // which posts the card as JSON to https://komoju.com/api/v1/secure_tokens under the merchant's
+        // publishable key (Basic authorization) to mint a 3-D Secure token before any payment. PAN@
+        // payment_details.number, with month (MM), year (YY) and verification_value beside it; the body names
+        // the session's amount and currency, which the token binds and the API reads (backend.js requestAmount).
+        // komoju.js holds the rules: the pause decision reads the exact URL and the body byte for byte, a zero
+        // amount (a card check KOMOJU keeps for a customer) refused, and the device reads those and the frame's
+        // four headers before it writes the card. The issuer's 3-D Secure check runs after, in the
+        // buyer's browser, and the payment that follows carries only the token's id to the session's /pay, which
+        // continues untouched (passWithoutCard). The frame's sends without 3-D Secure (a card to the session's /pay
+        // or to /api/v1/tokens) only ever carry the agent's placeholder, so they are refused before they leave.
+        // KOMOJU's API answers any browser origin, so the card leaves the cardholder's device by a direct fetch.
+        // Test and live share komoju.com: the key's prefix (pk_test_, pk_live_) names the environment, never the
+        // host (no sandbox marker), and a test key takes only KOMOJU's test cards. Not here: KOMOJU's Hosted Page
+        // (komoju.com/sessions/<id>), which posts the card under its session cookie and CSRF token.
+        // KOMOJU answers a token it could not authenticate (ERRORED) inside HTTP 200, so its own judge reads every
+        // answer by its token (komoju.js komojuAnswerOutcome), never the shared status rule. No operator lists an org
+        // before the API's KOMOJU change lands: the device's request rule at create, the merchant pin per checkout
+        // origin, the session read for a card kept on file and for the card method's fee and currency, and an
+        // exception in the runtime's cancel rule, which reads a request that names an amount as a charge while a
+        // KOMOJU token charges nothing until the payment that spends it.
+        // Ships dark: served only to a client that declares `komoju_secure_token`, gated off for every org until
+        // an operator lists `komoju:<org>`, and autopilot never sends it (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path for a consumer that tests `match`
+        // unanchored.
+        capability: "komoju_secure_token",
+        match: "komoju\\.com/api/v1/(?:secure_tokens|tokens|sessions/[a-z0-9]{25}/pay)(?![\\w/.-])",
+        hosts: ["^komoju\\.com$"],
+        encoding: "json",
+        // The frame's publishable key, its JSON Accept and its own marker. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$", "^komoju-via$"],
+        jsonCardFields: [["payment_details", "number"]],
+        passWithoutCard: "komoju\\.com/api/v1/sessions/[a-z0-9]{25}/pay"
+    },
+    {
+        psp: "paygent",
+        // Paygent (Japan) token payments: the merchant's page hands its card fields to Paygent's own
+        // PaygentToken.js (Japanese universities' Fundex donation forms, EC-CUBE and Welcart shops), which sends
+        // them with one XHR to /n/token/request on token.paygent.co.jp (sandbox.paygent.co.jp in test), unencrypted,
+        // as text/plain;charset=UTF-8, a CORS simple request Paygent's sandbox answers with
+        // Access-Control-Allow-Origin * for any origin (the live host's answer is first read at an attended payment).
+        // The answer is a single-use token the merchant's server charges later, after EMV 3-D Secure in the
+        // buyer's browser; the request names no amount, so the agent's amount is the price the cardholder
+        // approves. paygent.js holds the rule the pause decision and the device read: the exact URL, the
+        // script's content type, and createToken's seven keys in its order and spelling with the token key
+        // held to the host's environment; createCvcToken (a stored card's code) is refused. The script
+        // abandons the XHR after 35 s; the preparation that moves the approval before the press comes with
+        // the API's Paygent change, which sets `preparationRequired` with it.
+        // Paygent's hosted payment page (link.paygent.co.jp) carries the card on other paths and is not paused.
+        // Paygent answers a refused card inside HTTP 200, so its own judge reads every answer by its body
+        // (paygent.js paygentAnswerOutcome), never the shared status rule. No operator lists an org before the
+        // API's Paygent change lands: the amount the request does not name, the merchant pin per checkout
+        // origin, the refusal of a second card request on one checkout, and the preparation for the 35 s window.
+        // Ships dark: served only to a client that declares `paygent_token`, gated off for every org until an
+        // operator lists one (`paygent:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.paygent.co.jp only on
+        // test rows and only with documented test cards.
+        capability: "paygent_token",
+        match: "(?:token|sandbox)\\.paygent\\.co\\.jp/n/token/request(?![\\w/.-])",
+        hosts: ["^token\\.paygent\\.co\\.jp$", "^sandbox\\.paygent\\.co\\.jp$"],
+        sandboxHosts: ["^sandbox\\.paygent\\.co\\.jp$"],
+        hostEnvironmentPinned: true,
+        // The body's shape is a form's (key=value pairs); its wire type stays the script's text/plain
+        // (request-policy.js contentTypeFor). No header but the content type rides.
+        encoding: "form",
+        passthroughHeaders: [],
+        cardFields: ["card_number"]
+    },
+    {
+        psp: "pay_nl",
+        // Pay.'s card token (pay.nl, the Dutch processor), as Weeztix's ticket shops send it from their card form
+        // frame (cse-shop.openticket.tech) as soon as the four card fields are complete: one POST to
+        // payment.pay.nl/v1/Payment/getCardToken/json, a fetch with a FormData body (multipart/form-data under
+        // the browser's boundary), no other header, no credentials, unencrypted. The card sits in
+        // payment[card][number], [name], [cvc], [expire_month] and [expire_year] beside the shop's Pay. sales
+        // location (serviceId) and the request token its server minted. The request names no amount: the shop's
+        // server charges the token Pay. answers for its own order total, so the agent's amount is the figure the
+        // cardholder approves. pay-nl.js holds the rule the pause decision, the API and the device read: the
+        // exact URL, the multipart type whose boundary is the body's own, and the frame's eight parts in its order
+        // (multipart-form.js reads the form and refuses a file, an unknown part or a card part sent twice), and
+        // a live request only for a sales location pinned for the checkout's own origin. Pay. serves no separate
+        // test host, so no environment is pinned.
+        // Ships dark: served only to a client that declares `pay_nl_card_token`, gated off for every org until
+        // an operator lists one (`pay_nl:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "pay_nl_card_token",
+        match: "payment\\.pay\\.nl/v1/Payment/getCardToken/json",
+        hosts: ["^payment\\.pay\\.nl$"],
+        encoding: "multipart",
+        passthroughHeaders: []
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1923,6 +2150,28 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+// src/multipart-form.js
+var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
+var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
+var CONTENT_TYPE = new RegExp(`^multipart/form-data; ?boundary=(${BOUNDARY_CHARACTERS})$`, "i");
+function multipartBoundary(contentType) {
+    const match = typeof contentType === "string" ? CONTENT_TYPE.exec(contentType) : null;
+    return match ? match[1] : null;
+}
+// src/pay-nl.js
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+]);
+var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
+var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2198,6 +2447,37 @@ var AUTH_FIELDS = Object.freeze([
     "[auth]threeDSCompInd"
 ]);
 var QUICKPAY_REFUSALS = Object.freeze(["quickpay_card_page", "quickpay_3ds_challenge", "quickpay_cancelled"]);
+// src/processors/przelewy24.js
+var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
+var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
+var PRZELEWY24_MERCHANTS = Object.freeze([]);
+var MAX_PAGE4 = 256 * 1024;
+var CURRENCIES3 = Object.freeze(["PLN", "EUR", "GBP", "USD", "CZK", "CHF", "DKK", "NOK", "SEK", "RON", "BGN", "HUF"]);
+var PRZELEWY24_AJAX_HEADERS = Object.freeze({ Accept: "*/*", "X-Requested-With": "XMLHttpRequest" });
+var MONTHS = Object.freeze(["01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12"]);
+var CARD_TYPES = Object.freeze([
+    { type: "amex", lengths: [13, 15, 16], pattern: /^3[47]/ },
+    { type: "dinersclub", lengths: [14], pattern: /^(36|38|30[0-5])/ },
+    { type: "discover", lengths: [16], pattern: /^(6011|65|64[4-9]|622)/ },
+    { type: "jcb", lengths: [16], pattern: /^35(28|29|[3-8])/ },
+    { type: "laser", lengths: [16, 17, 18, 19], pattern: /^(6706|6771|6709)/ },
+    { type: "maestro", lengths: [12, 13, 14, 15, 16, 17, 18, 19], pattern: /^(5018|5020|5038|6304|6759|676[1-3])/ },
+    { type: "mastercard", lengths: [16], pattern: /^(5[1-5]|^2(?:2(?:2[1-9])|[3-6]|7(?:[01]|20)))/ },
+    { type: "unionpay", lengths: [16, 17, 18, 19], pattern: /^62/ },
+    { type: "visa", lengths: [16], pattern: /^4/ }
+]);
+var OWN_PAGES = Object.freeze(["/trnrequest/", "/trnresult/", "/saferpay/cardpaymentendpointresolver/", "/blik/", "/blikstatus/"]);
+var PRZELEWY24_REFUSALS = Object.freeze(["przelewy24_card_page", "przelewy24_3ds_challenge"]);
+// src/processors/transbank.js
+var TRANSBANK_HOSTS = Object.freeze(["webpay3g.transbank.cl", "webpay3gint.transbank.cl"]);
+var TRANSBANK_SANDBOX_HOSTS = Object.freeze(["webpay3gint.transbank.cl"]);
+var TOKEN = "[0-9a-f]{64}";
+var ENTRY_QUERY = new RegExp(`^\\?token_ws=(${TOKEN})$`);
+var TRANSBANK_MERCHANTS = Object.freeze([]);
+var MAX_PAGE5 = 64 * 1024;
+var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
+var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
+var TRANSBANK_REFUSALS = Object.freeze(["transbank_3ds_challenge", "transbank_aborted", "transbank_error"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -2234,6 +2514,20 @@ function contentTypeFor(pspOrEntry, headers) {
         }
         return PADDLE_VGS_MEDIA_TYPE;
     }
+    if (rec.psp === PAYGENT_PSP) {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        if (!captured || typeof captured[1] !== "string" || !/^text\/plain; ?charset=utf-8$/i.test(captured[1].trim())) {
+            throw new Error("Refusing to pay: Paygent's token script sends its card only as text/plain in UTF-8.");
+        }
+        return PAYGENT_CONTENT_TYPE;
+    }
+    if (rec.encoding === "multipart") {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        const value = captured && typeof captured[1] === "string" ? captured[1] : "";
+        if (multipartBoundary(value) === null)
+            throw new Error("Refusing to pay: this processor takes its card form only as multipart/form-data with its own boundary.");
+        return value;
+    }
     const encoding = rec && rec.encoding === "form" ? "form" : "json";
     const allowed = ALLOWED_MEDIA_TYPES[encoding];
     const fallback = allowed[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.17",
+  "version": "0.23.18",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",