@agent-cards/sdk 0.23.18 → 0.23.20

package/dist/quickpay.d.ts

@@ -0,0 +1,44 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export declare const QUICKPAY_PSP = "quickpay";
+export declare const QUICKPAY_HOSTS: readonly string[];
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export declare function isQuickpayHost(url: string): boolean;
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isQuickpayEntry(url: string, method: string): boolean;
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export declare function isQuickpayCardLookup(url: string, method: string): boolean;
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export declare function quickpayEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export declare function isArmedQuickpayUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/quickpay.js

@@ -0,0 +1,65 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export const QUICKPAY_PSP = 'quickpay';
+export const QUICKPAY_HOSTS = Object.freeze(['payment.quickpay.net']);
+const QUICKPAY_ENTRY_URL = 'https://payment.quickpay.net/';
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export function isQuickpayHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && QUICKPAY_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isQuickpayEntry(url, method) {
+    return String(method).toUpperCase() === 'POST' && url === QUICKPAY_ENTRY_URL;
+}
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export function isQuickpayCardLookup(url, method) {
+    if (String(method).toUpperCase() !== 'GET' || !isQuickpayHost(url))
+        return false;
+    const parsed = new URL(url);
+    return /(?:^|\/)payment-methods\/?$/i.test(parsed.pathname) || parsed.searchParams.has('bin');
+}
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export function quickpayEntryUrl(url) {
+    return isQuickpayHost(url) ? QUICKPAY_ENTRY_URL : null;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export function isArmedQuickpayUrl(vault, url) {
+    const entry = quickpayEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7140b6eee18986c07c3393c1a950467cd13a86c32f47813ab57af11c7cd3fa02
+// artifact-sha256: abafbcce1536643bd38817e2332c0e107e93b04bc347051096c6e031cda00722
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -502,6 +502,104 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["(token)"]
         }
     },
+    {
+        psp: "comgate",
+        // ComGate's payment gateway, where most Czech and Slovak e-shops send the buyer (ComGate's own WooCommerce,
+        // Shoptet, PrestaShop and Magento modules). The merchant's server creates the payment at ComGate, which keeps
+        // the amount, the currency and the merchant on its side, and sends the buyer's browser to the gateway URL
+        // ComGate answered with, https://payN.comgate.cz/init?id=<transaction id> (processors/comgate.js). The
+        // gateway is an app that takes the card in ComGate's own card frames (sec.comgate.cz), encrypts it there
+        // under the payment's own RSA key and posts the ciphertext to ComGate's API (payments.comgate.cz, or
+        // payments-gcp.comgate.cz behind pay3 and pay4). The paused request is therefore the entry, a GET Document
+        // navigation that carries no card and no body: the cardholder's device makes the gateway's own API calls
+        // for that payment over the end-to-end TLS relay, holds the payment ComGate returns to what the person
+        // approved, encrypts the card under the payment's key as the card frame does and posts it, and the runtime
+        // resolves the paused navigation with the hosted_form notice. Only the entry is matched, exactly
+        // (processors/comgate.js isComgateEntryUrl: the one `id` parameter, nothing else). The card post
+        // (/client/instructions/card-process), the BIN lookup (/bin-checker, /client/instructions/check-card) and
+        // the Web Checkout SDK's /checkout/provider calls carry a card or part of one, already encrypted in ComGate's
+        // frame, so no body rule can see it: this lane's SDK change aborts every call to those paths in the agent's
+        // browser, as it pauses the entry, and no dummy card ever reaches ComGate. ComGate has no test host for merchants: a test
+        // payment runs on these hosts and says so in the payment the API returns, so the hosts mark no environment.
+        // Dark: served only to a client that declares the capability, and gated off for every org the operator has
+        // not allowlisted. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "comgate_hosted_payment_page",
+        match: "pay[1-4]\\.comgate\\.cz/init(?![\\w/.%-])",
+        hosts: ["^pay1\\.comgate\\.cz$", "^pay2\\.comgate\\.cz$", "^pay3\\.comgate\\.cz$", "^pay4\\.comgate\\.cz$"],
+        // The entry has no body; `encoding` names none, and the card rides the JSON the device builds.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The paused request is the navigation itself, a GET with the payment's id in its one query parameter.
+        request: { method: "GET", cardIn: "processor_page", response: "document" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into ComGate's API from the device, not into the paused entry, which carries none. The
+            // device never posts a form of its own: the Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/comgate.js checkComgateEntry), the reviewed merchants among them: the
+            // create runs them, and naming them here makes the cardholder's device run them again on the entry it is
+            // about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "comgate",
+            required: [],
+            // The members of ComGate's card-process body the device writes, each the card frame's own ciphertext:
+            // the number, the expiry and the security code (`secret` in ComGate's names).
+            card: { number: "number", expiry: "expiry", cvc: "secret" },
+            // The payment's id names one payment (checkComgateEntry's dedupe): the entry's only parameter.
+            dedupe: ["id"]
+        }
+    },
+    {
+        psp: "paytrail",
+        // Paytrail's card method, the one Visa and Mastercard form on the payment wall most Finnish webshops send
+        // the buyer to (WooCommerce, MyCashflow, Vilkas and the merchants' own pages render the same forms). The
+        // merchant's page, or Paytrail's own wall, posts a card-free ENTRY top-level to
+        // https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect: seven checkout-
+        // fields Paytrail signed for the merchant (its account, the transaction, a timestamp, a nonce and an HMAC).
+        // Paytrail answers with a loading page that re-posts them to .../initialize-payment, which sends the
+        // browser to Payment Highway's card page (v1.api.paymenthighway.io, Paytrail's card platform) under a
+        // session of its own, so a card post made away from that session has no payment to pay
+        // (processors/paytrail.js). The paused request is therefore the entry, a Document navigation that carries
+        // no card: the cardholder's device repeats it over the end-to-end TLS relay, follows it to the card page,
+        // posts the card there in that same session, and the runtime resolves the paused navigation with the
+        // hosted_form notice. Only the entry path is matched, exactly (processors/paytrail.js isPaytrailEntryUrl:
+        // a query would reach Paytrail's server beside the signed body). The card page and its card, wallet and
+        // card-number lookups live on Payment Highway's host, which no recognizer takes; the SDK's pause, a later
+        // change, refuses them in the agent's browser, so no dummy card reaches Payment Highway. The entry names no amount: Paytrail
+        // holds it, so the cardholder approves the agent's amount and the device holds it to the amount the card
+        // page names. Paytrail's public test merchant shares this host, so the host marks no environment. Dark:
+        // served only to a client that declares the capability, and gated off for every org the operator has not
+        // allowlisted.
+        capability: "paytrail_hosted_payment_page",
+        match: "services\\.paytrail\\.com/payments/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/click-to-pay/loading-and-redirect",
+        hosts: ["^services\\.paytrail\\.com$"],
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into Payment Highway's card page, which the device reaches from the entry, never into the
+            // paused entry, which must carry none (processors/paytrail.js checkPaytrailEntry). The device never posts
+            // a form of its own: the Vault's form-action policy leaves this host out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/paytrail.js checkPaytrailEntry), the reviewed merchants among them:
+            // the create runs them, and naming them here makes the cardholder's device run them again on the entry
+            // it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "paytrail",
+            required: [
+                "checkout-transaction-id",
+                "checkout-account",
+                "checkout-method",
+                "checkout-algorithm",
+                "checkout-timestamp",
+                "checkout-nonce",
+                "signature"
+            ],
+            // The card page's own card members, which the device writes into the page's JSON card post (never into
+            // the entry).
+            card: { number: "pan", month: "expiry_month", year: "expiry_year", cvc: "cvc" },
+            // The merchant's account and the transaction name one payment.
+            dedupe: ["checkout-account", "checkout-transaction-id"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -1970,6 +2068,165 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^payment\\.pay\\.nl$"],
         encoding: "multipart",
         passthroughHeaders: []
+    },
+    {
+        psp: "revolut",
+        // Revolut Business's online checkout (Revolut Merchant, UK and EEA): the card field and card popup
+        // RevolutCheckout.js mounts as frames from merchant.revolut.com, for an order the merchant's server made,
+        // on the merchant's own page (the WooCommerce plugin among them) or Revolut's hosted checkout page. The
+        // frame's pay posts the card as one JSON body to its own origin's /api/public/orders/<order token>/payments,
+        // the token a lowercase uuid. PAN@ payment_method.number, the expiry as numbers @ .expiry_month and
+        // .expiry_year (four digits), the code @ .cvv, beside the order's amount in minor units. Unencrypted.
+        // revolut.js holds the rule the pause decision, the API's create and the device all read: exactly this
+        // URL, the frame's own headers, and its card payment body byte for byte, with a payment that keeps the
+        // card on file (save_for CUSTOMER or MERCHANT) refused by its own code. A payment with another method
+        // (Apple Pay, Google Pay, Revolut Pay, open banking) carries no card on the same URL and continues
+        // untouched (passWithoutCard). merchant.revolut.com answers the Vault's origin, so the cardholder's device
+        // sends the request itself. 3-D Secure follows the answer in the agent's page, card free. The environment
+        // is pinned (S7): sandbox-merchant.revolut.com only on test rows and only with test cards (revolut.js
+        // REVOLUT_TEST_CARDS), merchant.revolut.com only on live rows.
+        // Ships dark: served only to a client that declares `revolut_card_field`, gated off for every org until an
+        // operator lists one (`revolut:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // order the payment names is bound to what the cardholder approves (backend config.ts REVOLUT_ORDER_BOUND_TO_APPROVAL).
+        // Autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "revolut_card_field",
+        match: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments",
+        hosts: ["^merchant\\.revolut\\.com$", "^sandbox-merchant\\.revolut\\.com$"],
+        sandboxHosts: ["^sandbox-merchant\\.revolut\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's own headers: the API version Revolut reads the body by, its device id and the widget's
+        // version (the four the preflight allows, with the content type), and the JSON Accept. Origin, Referer
+        // and cookies never ride (the frame's own fetch carries Revolut's cookies only because it is same origin).
+        passthroughHeaders: ["^revolut-api-version$", "^revolut-device-id$", "^revolut-client-version$", "^accept$"],
+        jsonCardFields: [["payment_method", "number"]],
+        passWithoutCard: "(?:sandbox-)?merchant\\.revolut\\.com/api/public/orders/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payments"
+    },
+    {
+        psp: "sumup",
+        // SumUp's online payments (UK, EEA, US, Latin America): the Payment Widget
+        // (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) that SumUp's WooCommerce plugin, its Payment Links, Online
+        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page serves every
+        // merchant from one origin). Each card field is a frame on gateway.sumup.com, and a
+        // hidden form frame there sends the card in one PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>:
+        // JSON {"payment_type":"card","device_information":..,"card":{"name","number","expiry_month":"MM",
+        // "expiry_year":"YY" or "YYYY","cvv"},"installments":1,..}, unencrypted, with X-Sumup-Correlation-Id naming
+        // the same checkout. sumup.js holds the request rule the pause decision, the API's create and the device all
+        // read: exactly that URL, a JSON Content-Type, the correlation id, and the widget's body byte for byte, with
+        // a body that carries a recurring mandate, which keeps the card at SumUp, refused. The body names no
+        // amount and no merchant: the checkout the merchant's server created holds both, so a live request is taken
+        // only for a checkout origin a reviewed pin lists. The request carries no cookie and no Authorization
+        // header (the checkout id is its credential), and the API answers any browser origin's preflight with
+        // credentials omitted. The answer is the checkout: PAID, FAILED, or PENDING with a 3-D Secure step the
+        // widget then runs in the page. SumUp's sandbox merchants share the live host, so no sandbox host is
+        // marked and the lane takes production rows only.
+        // Ships dark: served only to a client that declares `sumup_checkout_process`, gated off for every org until
+        // an operator lists one (`sumup:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match`
+        // unanchored, so the checkout's apple-pay-session sibling is never matched.
+        capability: "sumup_checkout_process",
+        match: "api\\.sumup\\.com/v0\\.2/checkouts/[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}(?![\\w/.%-])",
+        hosts: ["^api\\.sumup\\.com$"],
+        encoding: "json",
+        // The widget's correlation and session ids ride as it sent them, each held to its own shape (sumup.js);
+        // origin, referer and cookies never do (the widget sends no cookie).
+        passthroughHeaders: ["^x-sumup-correlation-id$", "^x-sumup-widget-session-id$"],
+        jsonCardFields: [["card", "number"]],
+        request: { method: "PUT", cardIn: "body", response: "json" }
+    },
+    {
+        psp: "twoc2p",
+        // 2C2P's hosted payment page (pgw-ui.2c2p.com, builds 4.1 to 4.5), where most 2C2P merchants in Thailand,
+        // Malaysia and Singapore send a buyer, top level or in a frame. On Pay the page encrypts the card with
+        // 2C2P's own library under one static RSA-1024 key and posts one JSON request to
+        // pgwv4.2c2p.com/payment/<build>/Payment (sandbox-pgwv4 for a sandbox token), the card only as
+        // payment.data.securePayToken. twoc2p.js holds the rule the pause decision, the API's create, the approve
+        // and the SDK read: the exact Payment URL of a reviewed build, the page's own body, and a request that keeps,
+        // reuses or exposes a card, pays in instalments, converts the currency or redeems points refused. cse mode,
+        // as Paddle TokenEx and Shiji STS ship: the cardholder's device writes a new securePayToken from the real
+        // card under the key payment-core pins (twoc2p-keys.js), the runtime swaps it over the placeholder's, and the
+        // agent's page continues the request (substituteTwoC2p). A Payment request with no card field (a QR code, a
+        // bank transfer) carries none of the cardholder's cards and continues untouched (passWithoutCard). The
+        // request names no amount and no merchant: the payment token binds both, which the API reads from 2C2P's
+        // own session answer (twoc2p-answers.js), and a live payment is taken only for a merchant a reviewed pin
+        // names. Ships dark: served only to a client that declares `twoc2p_secure_pay`, gated off for every org
+        // until an operator lists one (`twoc2p:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox-pgwv4 only on test rows and
+        // only with documented test cards. `(?![\w/.-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "twoc2p_secure_pay",
+        match: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment(?![\\w/.-])",
+        hosts: ["^pgwv4\\.2c2p\\.com$", "^sandbox-pgwv4\\.2c2p\\.com$"],
+        sandboxHosts: ["^sandbox-pgwv4\\.2c2p\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The page continues its own request with its own headers; none is stored.
+        passthroughHeaders: [],
+        jsonCardFields: [["payment", "data", "securePayToken"]],
+        passWithoutCard: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "twoc2p-secure-pay", at: "payment.data", fields: ["securePayToken"] },
+        // The device's one field carries the whole card (number, expiry and code), so the client table names it once.
+        encryptedCardFields: { card: "securePayToken" }
+    },
+    {
+        psp: "hipay",
+        // HiPay Enterprise (France, Portugal, Italy, Spain): HiPay's JavaScript SDK (libs.hipay.com/js/sdkjs.js)
+        // takes the card in hosted fields, and their hidden controller frame on libs.hipay.com (or a direct post
+        // from the merchant's own origin) posts it as one JSON body to HiPay's Secure Vault under the merchant's
+        // public Basic credential: card_number, card_expiry_month (MM), card_expiry_year (YYYY), cvc, card_holder
+        // when the page has the field, and multi_use. hipay.js holds the request rule the pause decision, the API's
+        // create, the prepared bind and the device all read: exactly a token URL, a JSON Content-Type, a public
+        // username of the vault's own environment, and a complete create byte for byte. The hosted fields also post
+        // the number alone while it is typed; that body is refused (hipay_number_only) and the SDK fails it in the
+        // browser, so the frame keeps the number and Pay sends one complete create. The merchant's page gives the
+        // frame 20 seconds after Pay, so the lane is prepared only (preparationRequired). HiPay's vault answers any
+        // browser origin, so the card leaves the cardholder's device by a direct fetch. The body names no amount and
+        // no merchant: a live request is taken only for a checkout origin and a public username one reviewed pin
+        // names together. stage-secure2-vault.hipay-tpp.com is HiPay's stage vault: pinned (S7) to test rows, which
+        // send only test cards. Ships dark: served only to a client that declares `hipay_vault_token`, gated off
+        // for every org until an operator lists one (`hipay:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path for a consumer that tests
+        // `match` unanchored, so /rest/v2/token/update is never this entry.
+        capability: "hipay_vault_token",
+        match: "(?:stage-)?secure2-vault\\.hipay-tpp\\.com/rest/v2/token(?![\\w/.-])",
+        hosts: ["^secure2-vault\\.hipay-tpp\\.com$", "^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        sandboxHosts: ["^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // The merchant's public credential and the frame's JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"]
+    },
+    {
+        psp: "amazon_payment_services",
+        // Amazon Payment Services (formerly PayFort; the UAE, Saudi Arabia, Egypt), its custom merchant page: the
+        // merchant's own card form posts top-level, as a document navigation, to /FortAPI/paymentPage on
+        // checkout.payfort.com, form encoded, with service_command=TOKENIZATION and the merchant's signed fields
+        // beside card_number, expiry_date (YYMM) and card_security_code. amazon-payment-services.js holds the rule
+        // the pause decision reads: exactly that URL, and the form field by field, with another service command, a
+        // saved card (token_name) and a recurring agreement (merchant_extra) refused by name. The same URL takes
+        // APS's redirection and iframe entries, which carry no card and continue untouched (passWithoutCard); APS's
+        // own page then takes the card, and no Vault mode pays it. The request names no amount: the merchant
+        // charges the token APS answers with later, from its own server, so the agent's amount is the figure the
+        // cardholder approves. APS answers no browser origin, so the card leaves the cardholder's device only
+        // through the checkout relay, with the page's own Origin and Referer. sbcheckout.payfort.com is APS's
+        // sandbox: pinned (S7) to test rows, which send only test cards.
+        // Ships dark: served only to a client that declares `aps_custom_merchant_page`, gated off for every org
+        // until an operator lists one (`amazon_payment_services:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests
+        // `match` unanchored.
+        capability: "aps_custom_merchant_page",
+        match: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage(?![\\w/.%-])",
+        hosts: ["^checkout\\.payfort\\.com$", "^sbcheckout\\.payfort\\.com$"],
+        sandboxHosts: ["^sbcheckout\\.payfort\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        // The form's own Origin and Referer: a browser sends both on the page's POST, and the request rule holds
+        // them to the checkout page. Cookies and every other header never ride.
+        passthroughHeaders: ["^origin$", "^referer$"],
+        cardFields: ["card_number"],
+        passWithoutCard: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage"
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2150,6 +2407,10 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/payrexx.js
+var PAYREXX_FOLLOW_UP_WINDOW_MS = 15 * 60 * 1e3;
+var PAYREXX_FOLLOW_UP_IDLE_MS = 60 * 1e3;
+var PAYREXX_FOLLOW_UP_CHALLENGE_MS = 11 * 60 * 1e3;
 // src/paygent.js
 var PAYGENT_PSP = "paygent";
 var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
@@ -2172,6 +2433,22 @@ var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
+// src/twoc2p-keys.js
+var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/1ljsxI+r6qQraTFrHfWNrV41vxumBF+4ILAG3WsN6HEBQU2wSUv/IyQmZkiys1ilOb+OOuQTH8OXMnqQg9E4epyePW3L7IeOieSbIIDeSX6UpTWmT/Fs7moWZkN8RpuCV0u87n3AY2tQbtcSqwEKi2sxzWLFwscoGn6N5yVIpQIDAQAB",
+        sha256: "bb8f27929ce140c6ef0ec9c4a20d7ca0b83376bc35a501985dc40d16669384fe",
+        script: Object.freeze({ url: "https://t.2c2p.com/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "4a745a37765a2e28e299d64f6ea5811aab27b176da61db6f840fa85d6a47e763" })
+    }),
+    sandbox: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKakJC+2MSZikKoPzlNqXvJCuWNLhejg3gMRePSetYNNgnhyqFwwAR7t7i/B2QFZoixSYc2/23cJz0jA5O+q+Cu3fycqKlf1L9966+X3B9nyHe2eKQZr8KrcS/8+sEKcd0pLATY4AleW1iktuN+2oghrDKuv+aDNztWcOy+PTofwIDAQAB",
+        sha256: "7f80c07f1d72db28ede10dae942940657c72dfa789836c9fdf283cba6feff2e6",
+        script: Object.freeze({ url: "https://demo2.2c2p.com/2C2PFrontEnd/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "435723d92bfefb00607a56851967e0b745d52b8d49443de5f0000f0583fde5cc" })
+    })
+});
+// src/amazon-payment-services.js
+var BODY_LIMIT = 32 * 1024;
+var ANSWER_LIMIT = 64 * 1024;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2398,7 +2675,15 @@ var METHOD_PAGE = /* @__PURE__ */ new Set(["resultadoMethod", ...BROWSER_FIELDS,
 var REDSYS_REFUSALS = Object.freeze(["redsys_card_page", "redsys_3ds_challenge", "redsys_declined"]);
 // src/processors/quickpay.js
 var QUICKPAY_HOSTS = Object.freeze(["payment.quickpay.net"]);
-var QUICKPAY_MERCHANTS = Object.freeze([]);
+var QUICKPAY_MERCHANTS = Object.freeze([
+    Object.freeze({
+        merchantId: "107268",
+        agreementId: null,
+        merchant: "Skandinavisk Dyrepark",
+        host: "shop.skandinaviskdyrepark.dk",
+        callbackHost: "shop.skandinaviskdyrepark.dk"
+    })
+]);
 var MAX_ENTRY3 = 16 * 1024;
 var REQUIRED3 = Object.freeze([
     "version",
@@ -2447,6 +2732,18 @@ var AUTH_FIELDS = Object.freeze([
     "[auth]threeDSCompInd"
 ]);
 var QUICKPAY_REFUSALS = Object.freeze(["quickpay_card_page", "quickpay_3ds_challenge", "quickpay_cancelled"]);
+// src/processors/comgate.js
+var COMGATE_GATEWAY_HOSTS = Object.freeze({
+    "pay1.comgate.cz": "payments.comgate.cz",
+    "pay2.comgate.cz": "payments.comgate.cz",
+    "pay3.comgate.cz": "payments-gcp.comgate.cz",
+    "pay4.comgate.cz": "payments-gcp.comgate.cz"
+});
+var COMGATE_MERCHANTS = Object.freeze([]);
+var MAX_LOAD = 1024 * 1024;
+var MAX_ANSWER = 64 * 1024;
+var HEADER_NAMES = Object.freeze(["content-type", "x-cg-origin", "origin"]);
+var COMGATE_REFUSALS = Object.freeze(["comgate_3ds_challenge", "comgate_declined"]);
 // src/processors/przelewy24.js
 var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
 var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
@@ -2478,6 +2775,27 @@ var MAX_PAGE5 = 64 * 1024;
 var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
 var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
 var TRANSBANK_REFUSALS = Object.freeze(["transbank_3ds_challenge", "transbank_aborted", "transbank_error"]);
+// src/processors/paytrail.js
+var PAYTRAIL_HOSTS = Object.freeze(["services.paytrail.com"]);
+var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
+    "checkout-transaction-id",
+    "checkout-account",
+    "checkout-method",
+    "checkout-algorithm",
+    "checkout-timestamp",
+    "checkout-nonce",
+    "signature"
+]);
+var PAYTRAIL_MERCHANTS = Object.freeze([]);
+var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var UUID = new RegExp(`^${UUID_SOURCE}$`);
+var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
+var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
+var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
+var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`);
+var MAX_PAGE6 = 256 * 1024;
+var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
+var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"

package/dist/twoc2p.d.ts

@@ -0,0 +1,54 @@
+/** The PSP id the API and the recognizer name this lane, re-exported so the client dispatches by it. */
+export { TWOC2P_PSP } from './twoc2p.generated.js';
+/** The dark-launch capability a build declares when it fills a 2C2P Payment with the device's card field. */
+export declare const TWOC2P_CAPABILITY = "twoc2p_secure_pay";
+/** A cse substitution as the API serves it (substitute.ts Substitutions): here the one card field. */
+interface TwoC2pServedSubstitution {
+    encoding: string;
+    at: string;
+    fields: Record<string, string>;
+    remove?: string[];
+}
+/**
+ * Whether an approved 2C2P authorization's served substitution is one this SDK can continue: JSON at payment.data,
+ * no sibling to remove, and exactly the one card field, a non-empty string. substituteTwoC2p checks the field
+ * against the pinned key for the Payment's environment; this is the shape gate the continuation runs first.
+ */
+export declare function isTwoC2pServedSubstitution(sub: unknown): sub is TwoC2pServedSubstitution;
+/** The part of the client a refused continuation retires its approval through. */
+interface TwoC2pRetiringClient {
+    cancelAuthorization?: (authorizationId: string, reason: 'merchant_never_retried') => Promise<unknown>;
+}
+/**
+ * The retirement a refused 2C2P continuation runs (twoC2pContinuation's `retire`), or undefined for a client that
+ * cannot cancel: the approval is cancelled as merchant_never_retried, since its field went to no request, and the
+ * API stops serving the field. The paused request fails at once, so the cancel is not awaited; when the API does not
+ * confirm it, `onEvent` hears approval_retire_unconfirmed with the authorization's id. The API's sweep drops the field
+ * once its readable window passes either way.
+ */
+export declare function twoC2pRetire(client: TwoC2pRetiringClient | undefined, authorizationId: string, onEvent?: (event: {
+    type: string;
+    detail?: unknown;
+}) => void): (() => void) | undefined;
+/** The paused request an approval was created from: the URL and body the API reviewed at create. */
+export interface TwoC2pApprovedRequest {
+    url: string;
+    body: string;
+}
+/**
+ * The continuation of an approved 2C2P Payment: the paused body with the device's card field written over the
+ * placeholder's (payment-core substituteTwoC2p, which refuses a field that is not one under the pinned key for the
+ * Payment's environment, or one already in the paused body).
+ *
+ * Only into `approved`, the paused Payment the approval was created from: `url` and `body` must equal it byte for
+ * byte. 2C2P's key is the same for every merchant, so the field would pay any later Payment of the same shape;
+ * binding it to the one request keeps this lane from ever writing one payment's field into another.
+ *
+ * Null when neither URL is a 2C2P Payment, so every other processor keeps its own swap. Throws for any other body or
+ * URL, and for a substitution the shape gate or the swap refuses, in each case before anything continues. A refusal
+ * means the device's field went to no request, so `retire` runs first: the caller retires the approval as
+ * merchant_never_retried, and the API stops serving the field (cdp.ts cseContinuation).
+ */
+export declare function twoC2pContinuation(url: string, body: string, sub: unknown, approved: TwoC2pApprovedRequest, retire?: () => void): {
+    body: string;
+} | null;

package/dist/twoc2p.generated.d.ts

@@ -0,0 +1,33 @@
+declare var TWOC2P_PSP: string;
+declare var TWOC2P_CAPABILITY: string;
+declare var TWOC2P_OPERATION: string;
+declare var TWOC2P_SCHEME: string;
+declare var TWOC2P_FIELD_AT: string;
+declare var TWOC2P_FIELD: string;
+declare var TWOC2P_REVIEWED_BUILDS: readonly string[];
+declare var TWOC2P_REFUSAL_CODES: readonly string[];
+declare function twoC2pPaymentTarget(url: any): Readonly<{
+    environment: "production" | "sandbox";
+    version: string;
+    reviewed: boolean;
+}> | null;
+declare function twoC2pPaymentCarriesCard(body: any): boolean;
+declare function twoC2pBodyVerdict(body: any, keyBytes?: number, environment?: undefined): Readonly<{
+    verdict: "continue";
+}> | Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function twoC2pRequestRefusal(request: any, environment: any): any;
+declare function twoC2pRefusalMessage(code: any): any;
+declare function encryptTwoC2pCard(card: any, environment: any, facilities?: {}): Promise<string>;
+declare function twoC2pSubstitutionOf(value: any, environment: any): any;
+declare function substituteTwoC2p(url: any, body: any, field: any): string;
+declare function twoC2pSubstitutionsRefusal(template: any, substitution: any): {
+    code: string;
+    message: any;
+} | null;
+declare function twoC2pKeyUsable(authorization: any): boolean;
+export { TWOC2P_CAPABILITY, TWOC2P_FIELD, TWOC2P_FIELD_AT, TWOC2P_OPERATION, TWOC2P_PSP, TWOC2P_REFUSAL_CODES, TWOC2P_REVIEWED_BUILDS, TWOC2P_SCHEME, encryptTwoC2pCard, substituteTwoC2p, twoC2pBodyVerdict, twoC2pKeyUsable, twoC2pPaymentCarriesCard, twoC2pPaymentTarget, twoC2pRefusalMessage, twoC2pRequestRefusal, twoC2pSubstitutionOf, twoC2pSubstitutionsRefusal };