@agent-cards/sdk 0.23.17 → 0.23.19

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7af6b8dae5c779ea1901a4deac135effd97b00ea0925db7a269c82330e110cc9
+// artifact-sha256: 75a1d6551b8b0f5af53c9ce72e709e523f6911e0f96a1705fca0855b180d8532
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -394,6 +394,212 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["merchant_id", "agreement_id", "order_id", "amount", "currency"]
         }
     },
+    {
+        psp: "przelewy24",
+        // Przelewy24's pay wall (PayPro SA), where most Polish shops send a buyer to pay by card, bank transfer or
+        // BLIK. The merchant's SERVER registers the transaction (the amount, its URLs and a SHA-384 sign) and sends
+        // the buyer's browser to secure.przelewy24.pl/trnRequest/{token}, a 302 the browser follows with a GET. That
+        // ENTRY is the token alone: no card, no amount and no merchant, all of which Przelewy24 bound to the token on
+        // its own server. Przelewy24 answers with its pay wall under a session of its own, whose card method opens a
+        // card form posting to /card/p24form/{token} in that session, so a card form rebuilt away from that session
+        // has no transaction to pay (processors/przelewy24.js). The paused request is therefore the entry, a
+        // Document navigation that carries no card: the cardholder's device repeats it over the end-to-end TLS relay,
+        // picks the card method and fills the card form Przelewy24 returns to it in that same session, and the
+        // runtime resolves the paused navigation with the hosted_form notice. Only the entry is matched, exactly
+        // (processors/przelewy24.js isPrzelewy24EntryUrl): the method links, the card post and Przelewy24's Saferpay
+        // card routes share the host, and the SDK keeps the agent's browser off them, so no placeholder card ever
+        // reaches Przelewy24. The entry names no merchant, so a live one is paid only from a checkout origin
+        // Agentcard reviewed (processors/przelewy24.js przelewy24MerchantRefusal). sandbox.przelewy24.pl runs the
+        // same pay wall for a merchant's test account: a live row reaches only the live host and a test row only the
+        // sandbox, which receives only documented test cards (device-replay.js). Dark: served only to a client that
+        // declares the capability, and gated off for every org the operator has not allowlisted.
+        capability: "przelewy24_hosted_payment_page",
+        match: "(?:secure|sandbox)\\.przelewy24\\.pl/trnRequest/[0-9A-F]{10}-[0-9A-F]{6}-[0-9A-F]{6}-[0-9A-F]{10}",
+        hosts: ["^secure\\.przelewy24\\.pl$", "^sandbox\\.przelewy24\\.pl$"],
+        sandboxHosts: ["^sandbox\\.przelewy24\\.pl$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the card form the device fills on the pay wall, since the entry has no body. No
+        // captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into the pay
+        // wall's own form on the device. A client that pauses a GET only for a processor whose request it checks
+        // (the checkout SDK's isRecognizerRequest) never pauses this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        // Przelewy24 gives the merchant's server a reusable reference for the card of any payment on its pay wall
+        // (its card/info API: "a reference number that allows the card to be charged without CVV authorization"),
+        // which its card/charge API charges again without the cardholder, so the merchant keeps the card that pays,
+        // as on NMI. Only a card the person stored pays such a checkout: the API refuses a company's added card at
+        // create, card choice and lease (409 card_not_stored), and the approval says the merchant can keep it.
+        keepsCardOnFile: true,
+        hostedForm: {
+            // The card goes into the card form Przelewy24 returns to the device, never into the paused entry, which
+            // carries no body at all (processors/przelewy24.js checkPrzelewy24Entry). The device never posts a form
+            // of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/przelewy24.js checkPrzelewy24Entry): the create runs them, and naming
+            // them here makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "przelewy24",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // The pay wall card form's own fields, which the device fills on that page (never in the entry).
+            card: { number: "sfpCardNumber", month: "sfpCardExpiryMonth", year: "sfpCardExpiryYear", cvc: "CVC" },
+            // The token in the entry's URL names one registered transaction; the policy reads it there
+            // (checkPrzelewy24Entry's dedupe), since no form field holds it.
+            dedupe: ["(token)"]
+        }
+    },
+    {
+        psp: "transbank_webpay",
+        // Transbank's Webpay Plus, the card payment form most Chilean shops send a buyer to. The merchant's SERVER
+        // creates the transaction (its commerce code, the amount and its return_url) and sends the buyer's browser to
+        // webpay3g.transbank.cl/webpayserver/initTransaction?token_ws=<token>, a GET (the official WooCommerce plugin's
+        // redirect). That ENTRY is the token alone: no card, no amount and no merchant, all of which Transbank bound to
+        // the token on its own server. Webpay answers with a page whose form submits the token to init_transaction.cgi,
+        // which binds it to a Webpay session once, and then takes the card in that session (processors/transbank.js).
+        // The paused request is therefore the entry, a Document navigation that carries no card: the cardholder's
+        // device repeats it over the end-to-end TLS relay, holds Webpay's own transaction to the approved payment, fills
+        // Webpay's card steps in that same session, and hands the browser back to the merchant's return_url. Only the
+        // entry is matched, exactly (processors/transbank.js isTransbankEntryUrl): init_transaction.cgi, the card
+        // services under /webpayserver/wswebpay/ and the card post (bp_control.cgi) share the host, and the SDK keeps
+        // the agent's browser off them, so no placeholder card ever reaches Webpay and the token stays unspent for the
+        // device. The entry names no merchant, so a live payment is made only when Webpay's own transaction names a
+        // reviewed commerce (TRANSBANK_MERCHANTS). webpay3gint.transbank.cl is Transbank's integration environment: a
+        // live row reaches only the live host and a test row only the integration host, which receives only documented
+        // test cards (device-replay.js). Dark: served only to a client that declares the capability, and gated off for
+        // every org the operator has not allowlisted.
+        capability: "transbank_webpay_hosted_payment_page",
+        match: "webpay3g(?:int)?\\.transbank\\.cl/webpayserver/initTransaction",
+        hosts: ["^webpay3g\\.transbank\\.cl$", "^webpay3gint\\.transbank\\.cl$"],
+        sandboxHosts: ["^webpay3gint\\.transbank\\.cl$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the card post the device sends on Webpay's page, since the entry has no body. No
+        // captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into Webpay's own
+        // steps on the device. A client that pauses a GET only for a processor whose request it checks never pauses
+        // this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into Webpay's own steps on the device, never into the paused entry, which carries no body
+            // at all (processors/transbank.js checkTransbankEntry). The device never posts a form of its own: the
+            // Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/transbank.js checkTransbankEntry): the create runs them, and naming them
+            // here makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "transbank_webpay",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // Webpay's card post's own fields, which the device fills on Webpay's page (never in the entry).
+            card: { number: "TBK_NUMERO_TARJETA", month: "TBK_MES_EXPIRACION", year: "TBK_ANO_EXPIRACION", cvc: "TBK_CVV" },
+            // The token in the entry's URL names one transaction; the policy reads it there (checkTransbankEntry's
+            // dedupe), since no form field holds it.
+            dedupe: ["(token)"]
+        }
+    },
+    {
+        psp: "comgate",
+        // ComGate's payment gateway, where most Czech and Slovak e-shops send the buyer (ComGate's own WooCommerce,
+        // Shoptet, PrestaShop and Magento modules). The merchant's server creates the payment at ComGate, which keeps
+        // the amount, the currency and the merchant on its side, and sends the buyer's browser to the gateway URL
+        // ComGate answered with, https://payN.comgate.cz/init?id=<transaction id> (processors/comgate.js). The
+        // gateway is an app that takes the card in ComGate's own card frames (sec.comgate.cz), encrypts it there
+        // under the payment's own RSA key and posts the ciphertext to ComGate's API (payments.comgate.cz, or
+        // payments-gcp.comgate.cz behind pay3 and pay4). The paused request is therefore the entry, a GET Document
+        // navigation that carries no card and no body: the cardholder's device makes the gateway's own API calls
+        // for that payment over the end-to-end TLS relay, holds the payment ComGate returns to what the person
+        // approved, encrypts the card under the payment's key as the card frame does and posts it, and the runtime
+        // resolves the paused navigation with the hosted_form notice. Only the entry is matched, exactly
+        // (processors/comgate.js isComgateEntryUrl: the one `id` parameter, nothing else). The card post
+        // (/client/instructions/card-process), the BIN lookup (/bin-checker, /client/instructions/check-card) and
+        // the Web Checkout SDK's /checkout/provider calls carry a card or part of one, already encrypted in ComGate's
+        // frame, so no body rule can see it: this lane's SDK change aborts every call to those paths in the agent's
+        // browser, as it pauses the entry, and no dummy card ever reaches ComGate. ComGate has no test host for merchants: a test
+        // payment runs on these hosts and says so in the payment the API returns, so the hosts mark no environment.
+        // Dark: served only to a client that declares the capability, and gated off for every org the operator has
+        // not allowlisted. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "comgate_hosted_payment_page",
+        match: "pay[1-4]\\.comgate\\.cz/init(?![\\w/.%-])",
+        hosts: ["^pay1\\.comgate\\.cz$", "^pay2\\.comgate\\.cz$", "^pay3\\.comgate\\.cz$", "^pay4\\.comgate\\.cz$"],
+        // The entry has no body; `encoding` names none, and the card rides the JSON the device builds.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The paused request is the navigation itself, a GET with the payment's id in its one query parameter.
+        request: { method: "GET", cardIn: "processor_page", response: "document" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into ComGate's API from the device, not into the paused entry, which carries none. The
+            // device never posts a form of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/comgate.js checkComgateEntry), the reviewed merchants among them: the
+            // create runs them, and naming them here makes the cardholder's device run them again on the entry it is
+            // about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "comgate",
+            required: [],
+            // The members of ComGate's card-process body the device writes, each the card frame's own ciphertext:
+            // the number, the expiry and the security code (`secret` in ComGate's names).
+            card: { number: "number", expiry: "expiry", cvc: "secret" },
+            // The payment's id names one payment (checkComgateEntry's dedupe): the entry's only parameter.
+            dedupe: ["id"]
+        }
+    },
+    {
+        psp: "paytrail",
+        // Paytrail's card method, the one Visa and Mastercard form on the payment wall most Finnish webshops send
+        // the buyer to (WooCommerce, MyCashflow, Vilkas and the merchants' own pages render the same forms). The
+        // merchant's page, or Paytrail's own wall, posts a card-free ENTRY top-level to
+        // https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect: seven checkout-
+        // fields Paytrail signed for the merchant (its account, the transaction, a timestamp, a nonce and an HMAC).
+        // Paytrail answers with a loading page that re-posts them to .../initialize-payment, which sends the
+        // browser to Payment Highway's card page (v1.api.paymenthighway.io, Paytrail's card platform) under a
+        // session of its own, so a card post made away from that session has no payment to pay
+        // (processors/paytrail.js). The paused request is therefore the entry, a Document navigation that carries
+        // no card: the cardholder's device repeats it over the end-to-end TLS relay, follows it to the card page,
+        // posts the card there in that same session, and the runtime resolves the paused navigation with the
+        // hosted_form notice. Only the entry path is matched, exactly (processors/paytrail.js isPaytrailEntryUrl:
+        // a query would reach Paytrail's server beside the signed body). The card page and its card, wallet and
+        // card-number lookups live on Payment Highway's host, which no recognizer takes; the SDK's pause, a later
+        // change, refuses them in the agent's browser, so no dummy card reaches Payment Highway. The entry names no amount: Paytrail
+        // holds it, so the cardholder approves the agent's amount and the device holds it to the amount the card
+        // page names. Paytrail's public test merchant shares this host, so the host marks no environment. Dark:
+        // served only to a client that declares the capability, and gated off for every org the operator has not
+        // allowlisted.
+        capability: "paytrail_hosted_payment_page",
+        match: "services\\.paytrail\\.com/payments/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/click-to-pay/loading-and-redirect",
+        hosts: ["^services\\.paytrail\\.com$"],
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into Payment Highway's card page, which the device reaches from the entry, never into the
+            // paused entry, which must carry none (processors/paytrail.js checkPaytrailEntry). The device never posts
+            // a form of its own: the Vault's form-action policy leaves this host out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/paytrail.js checkPaytrailEntry), the reviewed merchants among them:
+            // the create runs them, and naming them here makes the cardholder's device run them again on the entry
+            // it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "paytrail",
+            required: [
+                "checkout-transaction-id",
+                "checkout-account",
+                "checkout-method",
+                "checkout-algorithm",
+                "checkout-timestamp",
+                "checkout-nonce",
+                "signature"
+            ],
+            // The card page's own card members, which the device writes into the page's JSON card post (never into
+            // the entry).
+            card: { number: "pan", month: "expiry_month", year: "expiry_year", cvc: "cvc" },
+            // The merchant's account and the transaction name one payment.
+            dedupe: ["checkout-account", "checkout-transaction-id"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1743,6 +1949,190 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // The frame's own Accept rides as it sent it; origin, referer and cookies never do.
         passthroughHeaders: ["^accept$"],
         jsonCardFields: [["cardData", "cardNumber"]]
+    },
+    {
+        psp: "payrexx",
+        // Payrexx Pay (Payrexx AG, Switzerland): the card frame every Payrexx payment page loads from
+        // checkout.payrexx.com/?pspId=44&lang=<xx>, Payrexx's own card acceptance (`Native_PSP`; the page's
+        // config names Credorax as its acquirer). The frame posts the number, name, expiry and code with one
+        // axios XHR to its own URL, form encoded, no encryption, beside the merchant's instance, the provider
+        // id, the page's total in minor units, its currency, and four flags that say whether Payrexx keeps the
+        // card. payrexx.js holds the rule the pause decision reads: the exact frame URL and the first card
+        // request's body key for key, with a 3-D Secure resend, a Click to Pay card, another provider's card,
+        // a kept card and a hold each refused. A body with no card value (a wallet's own encryptedCard)
+        // continues untouched. The route answers no browser origin, so the card leaves only through the
+        // checkout relay. Payrexx Pay Plus sends its card to Stripe from Stripe's own frame, which the stripe
+        // entry covers.
+        // Ships dark: served only to a client that declares `payrexx_card_frame`, gated off for every org
+        // until an operator lists one (`payrexx:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). No sandbox host: Payrexx's test mode is chosen per merchant on
+        // this same host, so the device's test-card rule cannot tell a test payment from a live one here.
+        capability: "payrexx_card_frame",
+        match: "checkout\\.payrexx\\.com/",
+        hosts: ["^checkout\\.payrexx\\.com$"],
+        encoding: "form",
+        // axios's same-origin marker and its JSON Accept. Origin, Referer, cookies and the AWS WAF token never ride.
+        passthroughHeaders: ["^x-requested-with$", "^accept$"],
+        cardFields: ["card[number]"],
+        passWithoutCard: "checkout\\.payrexx\\.com/"
+    },
+    {
+        psp: "komoju",
+        // KOMOJU's Hosted Fields (Japan): the card inputs live in KOMOJU's own frame on multipay.komoju.com,
+        // which posts the card as JSON to https://komoju.com/api/v1/secure_tokens under the merchant's
+        // publishable key (Basic authorization) to mint a 3-D Secure token before any payment. PAN@
+        // payment_details.number, with month (MM), year (YY) and verification_value beside it; the body names
+        // the session's amount and currency, which the token binds and the API reads (backend.js requestAmount).
+        // komoju.js holds the rules: the pause decision reads the exact URL and the body byte for byte, a zero
+        // amount (a card check KOMOJU keeps for a customer) refused, and the device reads those and the frame's
+        // four headers before it writes the card. The issuer's 3-D Secure check runs after, in the
+        // buyer's browser, and the payment that follows carries only the token's id to the session's /pay, which
+        // continues untouched (passWithoutCard). The frame's sends without 3-D Secure (a card to the session's /pay
+        // or to /api/v1/tokens) only ever carry the agent's placeholder, so they are refused before they leave.
+        // KOMOJU's API answers any browser origin, so the card leaves the cardholder's device by a direct fetch.
+        // Test and live share komoju.com: the key's prefix (pk_test_, pk_live_) names the environment, never the
+        // host (no sandbox marker), and a test key takes only KOMOJU's test cards. Not here: KOMOJU's Hosted Page
+        // (komoju.com/sessions/<id>), which posts the card under its session cookie and CSRF token.
+        // KOMOJU answers a token it could not authenticate (ERRORED) inside HTTP 200, so its own judge reads every
+        // answer by its token (komoju.js komojuAnswerOutcome), never the shared status rule. No operator lists an org
+        // before the API's KOMOJU change lands: the device's request rule at create, the merchant pin per checkout
+        // origin, the session read for a card kept on file and for the card method's fee and currency, and an
+        // exception in the runtime's cancel rule, which reads a request that names an amount as a charge while a
+        // KOMOJU token charges nothing until the payment that spends it.
+        // Ships dark: served only to a client that declares `komoju_secure_token`, gated off for every org until
+        // an operator lists `komoju:<org>`, and autopilot never sends it (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path for a consumer that tests `match`
+        // unanchored.
+        capability: "komoju_secure_token",
+        match: "komoju\\.com/api/v1/(?:secure_tokens|tokens|sessions/[a-z0-9]{25}/pay)(?![\\w/.-])",
+        hosts: ["^komoju\\.com$"],
+        encoding: "json",
+        // The frame's publishable key, its JSON Accept and its own marker. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$", "^komoju-via$"],
+        jsonCardFields: [["payment_details", "number"]],
+        passWithoutCard: "komoju\\.com/api/v1/sessions/[a-z0-9]{25}/pay"
+    },
+    {
+        psp: "paygent",
+        // Paygent (Japan) token payments: the merchant's page hands its card fields to Paygent's own
+        // PaygentToken.js (Japanese universities' Fundex donation forms, EC-CUBE and Welcart shops), which sends
+        // them with one XHR to /n/token/request on token.paygent.co.jp (sandbox.paygent.co.jp in test), unencrypted,
+        // as text/plain;charset=UTF-8, a CORS simple request Paygent's sandbox answers with
+        // Access-Control-Allow-Origin * for any origin (the live host's answer is first read at an attended payment).
+        // The answer is a single-use token the merchant's server charges later, after EMV 3-D Secure in the
+        // buyer's browser; the request names no amount, so the agent's amount is the price the cardholder
+        // approves. paygent.js holds the rule the pause decision and the device read: the exact URL, the
+        // script's content type, and createToken's seven keys in its order and spelling with the token key
+        // held to the host's environment; createCvcToken (a stored card's code) is refused. The script
+        // abandons the XHR after 35 s; the preparation that moves the approval before the press comes with
+        // the API's Paygent change, which sets `preparationRequired` with it.
+        // Paygent's hosted payment page (link.paygent.co.jp) carries the card on other paths and is not paused.
+        // Paygent answers a refused card inside HTTP 200, so its own judge reads every answer by its body
+        // (paygent.js paygentAnswerOutcome), never the shared status rule. No operator lists an org before the
+        // API's Paygent change lands: the amount the request does not name, the merchant pin per checkout
+        // origin, the refusal of a second card request on one checkout, and the preparation for the 35 s window.
+        // Ships dark: served only to a client that declares `paygent_token`, gated off for every org until an
+        // operator lists one (`paygent:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.paygent.co.jp only on
+        // test rows and only with documented test cards.
+        capability: "paygent_token",
+        match: "(?:token|sandbox)\\.paygent\\.co\\.jp/n/token/request(?![\\w/.-])",
+        hosts: ["^token\\.paygent\\.co\\.jp$", "^sandbox\\.paygent\\.co\\.jp$"],
+        sandboxHosts: ["^sandbox\\.paygent\\.co\\.jp$"],
+        hostEnvironmentPinned: true,
+        // The body's shape is a form's (key=value pairs); its wire type stays the script's text/plain
+        // (request-policy.js contentTypeFor). No header but the content type rides.
+        encoding: "form",
+        passthroughHeaders: [],
+        cardFields: ["card_number"]
+    },
+    {
+        psp: "pay_nl",
+        // Pay.'s card token (pay.nl, the Dutch processor), as Weeztix's ticket shops send it from their card form
+        // frame (cse-shop.openticket.tech) as soon as the four card fields are complete: one POST to
+        // payment.pay.nl/v1/Payment/getCardToken/json, a fetch with a FormData body (multipart/form-data under
+        // the browser's boundary), no other header, no credentials, unencrypted. The card sits in
+        // payment[card][number], [name], [cvc], [expire_month] and [expire_year] beside the shop's Pay. sales
+        // location (serviceId) and the request token its server minted. The request names no amount: the shop's
+        // server charges the token Pay. answers for its own order total, so the agent's amount is the figure the
+        // cardholder approves. pay-nl.js holds the rule the pause decision, the API and the device read: the
+        // exact URL, the multipart type whose boundary is the body's own, and the frame's eight parts in its order
+        // (multipart-form.js reads the form and refuses a file, an unknown part or a card part sent twice), and
+        // a live request only for a sales location pinned for the checkout's own origin. Pay. serves no separate
+        // test host, so no environment is pinned.
+        // Ships dark: served only to a client that declares `pay_nl_card_token`, gated off for every org until
+        // an operator lists one (`pay_nl:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "pay_nl_card_token",
+        match: "payment\\.pay\\.nl/v1/Payment/getCardToken/json",
+        hosts: ["^payment\\.pay\\.nl$"],
+        encoding: "multipart",
+        passthroughHeaders: []
+    },
+    {
+        psp: "revolut",
+        // Revolut Business's online checkout (Revolut Merchant, UK and EEA): the card field and card popup
+        // RevolutCheckout.js mounts as frames from merchant.revolut.com, for an order the merchant's server made,
+        // on the merchant's own page (the WooCommerce plugin among them) or Revolut's hosted checkout page. The
+        // frame's pay posts the card as one JSON body to its own origin's /api/public/orders/<order token>/payments,
+        // the token a lowercase uuid. PAN@ payment_method.number, the expiry as numbers @ .expiry_month and
+        // .expiry_year (four digits), the code @ .cvv, beside the order's amount in minor units. Unencrypted.
+        // revolut.js holds the rule the pause decision, the API's create and the device all read: exactly this
+        // URL, the frame's own headers, and its card payment body byte for byte, with a payment that keeps the
+        // card on file (save_for CUSTOMER or MERCHANT) refused by its own code. A payment with another method
+        // (Apple Pay, Google Pay, Revolut Pay, open banking) carries no card on the same URL and continues
+        // untouched (passWithoutCard). merchant.revolut.com answers the Vault's origin, so the cardholder's device
+        // sends the request itself. 3-D Secure follows the answer in the agent's page, card free. The environment
+        // is pinned (S7): sandbox-merchant.revolut.com only on test rows and only with test cards (revolut.js
+        // REVOLUT_TEST_CARDS), merchant.revolut.com only on live rows.
+        // Ships dark: served only to a client that declares `revolut_card_field`, gated off for every org until an
+        // operator lists one (`revolut:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // order the payment names is bound to what the cardholder approves (backend config.ts REVOLUT_ORDER_BOUND_TO_APPROVAL).
+        // Autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "revolut_card_field",
+        match: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments",
+        hosts: ["^merchant\\.revolut\\.com$", "^sandbox-merchant\\.revolut\\.com$"],
+        sandboxHosts: ["^sandbox-merchant\\.revolut\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's own headers: the API version Revolut reads the body by, its device id and the widget's
+        // version (the four the preflight allows, with the content type), and the JSON Accept. Origin, Referer
+        // and cookies never ride (the frame's own fetch carries Revolut's cookies only because it is same origin).
+        passthroughHeaders: ["^revolut-api-version$", "^revolut-device-id$", "^revolut-client-version$", "^accept$"],
+        jsonCardFields: [["payment_method", "number"]],
+        passWithoutCard: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments"
+    },
+    {
+        psp: "sumup",
+        // SumUp's online payments (UK, EEA, US, Latin America): the Payment Widget
+        // (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) that SumUp's WooCommerce plugin, its Payment Links, Online
+        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page serves every
+        // merchant from one origin). Each card field is a frame on gateway.sumup.com, and a
+        // hidden form frame there sends the card in one PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>:
+        // JSON {"payment_type":"card","device_information":..,"card":{"name","number","expiry_month":"MM",
+        // "expiry_year":"YY" or "YYYY","cvv"},"installments":1,..}, unencrypted, with X-Sumup-Correlation-Id naming
+        // the same checkout. sumup.js holds the request rule the pause decision, the API's create and the device all
+        // read: exactly that URL, a JSON Content-Type, the correlation id, and the widget's body byte for byte, with
+        // a body that carries a recurring mandate, which keeps the card at SumUp, refused. The body names no
+        // amount and no merchant: the checkout the merchant's server created holds both, so a live request is taken
+        // only for a checkout origin a reviewed pin lists. The request carries no cookie and no Authorization
+        // header (the checkout id is its credential), and the API answers any browser origin's preflight with
+        // credentials omitted. The answer is the checkout: PAID, FAILED, or PENDING with a 3-D Secure step the
+        // widget then runs in the page. SumUp's sandbox merchants share the live host, so no sandbox host is
+        // marked and the lane takes production rows only.
+        // Ships dark: served only to a client that declares `sumup_checkout_process`, gated off for every org until
+        // an operator lists one (`sumup:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match`
+        // unanchored, so the checkout's apple-pay-session sibling is never matched.
+        capability: "sumup_checkout_process",
+        match: "api\\.sumup\\.com/v0\\.2/checkouts/[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}(?![\\w/.%-])",
+        hosts: ["^api\\.sumup\\.com$"],
+        encoding: "json",
+        // The widget's correlation and session ids ride as it sent them, each held to its own shape (sumup.js);
+        // origin, referer and cookies never do (the widget sends no cookie).
+        passthroughHeaders: ["^x-sumup-correlation-id$", "^x-sumup-widget-session-id$"],
+        jsonCardFields: [["card", "number"]],
+        request: { method: "PUT", cardIn: "body", response: "json" }
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -1923,6 +2313,28 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+// src/multipart-form.js
+var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
+var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
+var CONTENT_TYPE = new RegExp(`^multipart/form-data; ?boundary=(${BOUNDARY_CHARACTERS})$`, "i");
+function multipartBoundary(contentType) {
+    const match = typeof contentType === "string" ? CONTENT_TYPE.exec(contentType) : null;
+    return match ? match[1] : null;
+}
+// src/pay-nl.js
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+]);
+var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
+var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2198,6 +2610,70 @@ var AUTH_FIELDS = Object.freeze([
     "[auth]threeDSCompInd"
 ]);
 var QUICKPAY_REFUSALS = Object.freeze(["quickpay_card_page", "quickpay_3ds_challenge", "quickpay_cancelled"]);
+// src/processors/comgate.js
+var COMGATE_GATEWAY_HOSTS = Object.freeze({
+    "pay1.comgate.cz": "payments.comgate.cz",
+    "pay2.comgate.cz": "payments.comgate.cz",
+    "pay3.comgate.cz": "payments-gcp.comgate.cz",
+    "pay4.comgate.cz": "payments-gcp.comgate.cz"
+});
+var COMGATE_MERCHANTS = Object.freeze([]);
+var MAX_LOAD = 1024 * 1024;
+var MAX_ANSWER = 64 * 1024;
+var HEADER_NAMES = Object.freeze(["content-type", "x-cg-origin", "origin"]);
+var COMGATE_REFUSALS = Object.freeze(["comgate_3ds_challenge", "comgate_declined"]);
+// src/processors/przelewy24.js
+var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
+var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
+var PRZELEWY24_MERCHANTS = Object.freeze([]);
+var MAX_PAGE4 = 256 * 1024;
+var CURRENCIES3 = Object.freeze(["PLN", "EUR", "GBP", "USD", "CZK", "CHF", "DKK", "NOK", "SEK", "RON", "BGN", "HUF"]);
+var PRZELEWY24_AJAX_HEADERS = Object.freeze({ Accept: "*/*", "X-Requested-With": "XMLHttpRequest" });
+var MONTHS = Object.freeze(["01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12"]);
+var CARD_TYPES = Object.freeze([
+    { type: "amex", lengths: [13, 15, 16], pattern: /^3[47]/ },
+    { type: "dinersclub", lengths: [14], pattern: /^(36|38|30[0-5])/ },
+    { type: "discover", lengths: [16], pattern: /^(6011|65|64[4-9]|622)/ },
+    { type: "jcb", lengths: [16], pattern: /^35(28|29|[3-8])/ },
+    { type: "laser", lengths: [16, 17, 18, 19], pattern: /^(6706|6771|6709)/ },
+    { type: "maestro", lengths: [12, 13, 14, 15, 16, 17, 18, 19], pattern: /^(5018|5020|5038|6304|6759|676[1-3])/ },
+    { type: "mastercard", lengths: [16], pattern: /^(5[1-5]|^2(?:2(?:2[1-9])|[3-6]|7(?:[01]|20)))/ },
+    { type: "unionpay", lengths: [16, 17, 18, 19], pattern: /^62/ },
+    { type: "visa", lengths: [16], pattern: /^4/ }
+]);
+var OWN_PAGES = Object.freeze(["/trnrequest/", "/trnresult/", "/saferpay/cardpaymentendpointresolver/", "/blik/", "/blikstatus/"]);
+var PRZELEWY24_REFUSALS = Object.freeze(["przelewy24_card_page", "przelewy24_3ds_challenge"]);
+// src/processors/transbank.js
+var TRANSBANK_HOSTS = Object.freeze(["webpay3g.transbank.cl", "webpay3gint.transbank.cl"]);
+var TRANSBANK_SANDBOX_HOSTS = Object.freeze(["webpay3gint.transbank.cl"]);
+var TOKEN = "[0-9a-f]{64}";
+var ENTRY_QUERY = new RegExp(`^\\?token_ws=(${TOKEN})$`);
+var TRANSBANK_MERCHANTS = Object.freeze([]);
+var MAX_PAGE5 = 64 * 1024;
+var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
+var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
+var TRANSBANK_REFUSALS = Object.freeze(["transbank_3ds_challenge", "transbank_aborted", "transbank_error"]);
+// src/processors/paytrail.js
+var PAYTRAIL_HOSTS = Object.freeze(["services.paytrail.com"]);
+var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
+    "checkout-transaction-id",
+    "checkout-account",
+    "checkout-method",
+    "checkout-algorithm",
+    "checkout-timestamp",
+    "checkout-nonce",
+    "signature"
+]);
+var PAYTRAIL_MERCHANTS = Object.freeze([]);
+var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var UUID = new RegExp(`^${UUID_SOURCE}$`);
+var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
+var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
+var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
+var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`);
+var MAX_PAGE6 = 256 * 1024;
+var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
+var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -2234,6 +2710,20 @@ function contentTypeFor(pspOrEntry, headers) {
         }
         return PADDLE_VGS_MEDIA_TYPE;
     }
+    if (rec.psp === PAYGENT_PSP) {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        if (!captured || typeof captured[1] !== "string" || !/^text\/plain; ?charset=utf-8$/i.test(captured[1].trim())) {
+            throw new Error("Refusing to pay: Paygent's token script sends its card only as text/plain in UTF-8.");
+        }
+        return PAYGENT_CONTENT_TYPE;
+    }
+    if (rec.encoding === "multipart") {
+        const captured = Object.entries(headers || {}).find(([k]) => /^content-type$/i.test(k));
+        const value = captured && typeof captured[1] === "string" ? captured[1] : "";
+        if (multipartBoundary(value) === null)
+            throw new Error("Refusing to pay: this processor takes its card form only as multipart/form-data with its own boundary.");
+        return value;
+    }
     const encoding = rec && rec.encoding === "form" ? "form" : "json";
     const allowed = ALLOWED_MEDIA_TYPES[encoding];
     const fallback = allowed[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.17",
+  "version": "0.23.19",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",