@agent-cards/sdk 0.23.19 → 0.23.20

package/dist/quickpay.d.ts

@@ -0,0 +1,44 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export declare const QUICKPAY_PSP = "quickpay";
+export declare const QUICKPAY_HOSTS: readonly string[];
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export declare function isQuickpayHost(url: string): boolean;
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export declare function isQuickpayEntry(url: string, method: string): boolean;
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export declare function isQuickpayCardLookup(url: string, method: string): boolean;
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export declare function quickpayEntryUrl(url: string): string | null;
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export declare function isArmedQuickpayUrl(vault: {
+    isCardRequest(url: string, method?: string): boolean;
+}, url: string): boolean;

package/dist/quickpay.js

@@ -0,0 +1,65 @@
+/**
+ * QuickPay's hosted payment window (where most Danish and Nordic webshops send the buyer), as this SDK reads it.
+ *
+ * The merchant's page posts a signed entry form, top-level, to https://payment.quickpay.net/ (QuickPay's Form
+ * API v10), and QuickPay answers with a redirect to its own window under a session of its own (/<32 hex>). That
+ * entry carries no card, and it is the one request this SDK pauses: the cardholder's device repeats it over the
+ * end-to-end TLS relay and fills the card into the window QuickPay returns to it (payment-core
+ * processors/quickpay.js). Everything else the agent's browser posts to QuickPay carries a card the agent typed
+ * or follows one: the window's card post (/process_card), its fee lookup (/calculate_fee, which carries the card
+ * number), its wallet token post (/process_payment_token) and its 3-D Secure step (/<session>/3ds_auth). The
+ * window also looks up the card's first eight digits with a GET (/payment-methods?bin=...). This SDK aborts every
+ * one of them, so a placeholder card never reaches QuickPay.
+ *
+ * The host is payment-core's QUICKPAY_HOSTS; quickpay.test.mjs pins the two lists together. QuickPay has no test
+ * host: a test payment runs on the same host with QuickPay's own test cards.
+ */
+export const QUICKPAY_PSP = 'quickpay';
+export const QUICKPAY_HOSTS = Object.freeze(['payment.quickpay.net']);
+const QUICKPAY_ENTRY_URL = 'https://payment.quickpay.net/';
+/** Whether this URL is on QuickPay's window host (https, no credentials, any port, a trailing dot or not). */
+export function isQuickpayHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && QUICKPAY_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/**
+ * The only request on QuickPay's host that is the merchant's entry: a POST to the host's root, written exactly as
+ * a form action writes it, with no port, query or fragment (payment-core isQuickpayEntryUrl, which takes that one
+ * string only). The entry the SDK pauses; every other POST there is aborted.
+ */
+export function isQuickpayEntry(url, method) {
+    return String(method).toUpperCase() === 'POST' && url === QUICKPAY_ENTRY_URL;
+}
+/**
+ * The window's card lookup: a GET on QuickPay's host to /payment-methods, which names the first eight digits of
+ * the card typed so far in its `bin` query. Any other GET there (the window itself, its scripts and images) is
+ * not a card request.
+ */
+export function isQuickpayCardLookup(url, method) {
+    if (String(method).toUpperCase() !== 'GET' || !isQuickpayHost(url))
+        return false;
+    const parsed = new URL(url);
+    return /(?:^|\/)payment-methods\/?$/i.test(parsed.pathname) || parsed.searchParams.has('bin');
+}
+/** The entry URL the registry recognizes when this build is armed for QuickPay, for any URL on QuickPay's host. */
+export function quickpayEntryUrl(url) {
+    return isQuickpayHost(url) ? QUICKPAY_ENTRY_URL : null;
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on QuickPay's host and this build's
+ * registry serves QuickPay's entry. The window's card post and the other card requests are not the entry, so the
+ * registry's card-request test does not name them; the CDP adapter still pauses them through the recognizer's
+ * host pattern, and attachToPlaywright's route predicate asks this, so both adapters show the gates every
+ * request to QuickPay's host once QuickPay is armed.
+ */
+export function isArmedQuickpayUrl(vault, url) {
+    const entry = quickpayEntryUrl(url);
+    return entry !== null && vault.isCardRequest(entry, 'POST');
+}

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 75a1d6551b8b0f5af53c9ce72e709e523f6911e0f96a1705fca0855b180d8532
+// artifact-sha256: abafbcce1536643bd38817e2332c0e107e93b04bc347051096c6e031cda00722
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -2133,6 +2133,100 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: ["^x-sumup-correlation-id$", "^x-sumup-widget-session-id$"],
         jsonCardFields: [["card", "number"]],
         request: { method: "PUT", cardIn: "body", response: "json" }
+    },
+    {
+        psp: "twoc2p",
+        // 2C2P's hosted payment page (pgw-ui.2c2p.com, builds 4.1 to 4.5), where most 2C2P merchants in Thailand,
+        // Malaysia and Singapore send a buyer, top level or in a frame. On Pay the page encrypts the card with
+        // 2C2P's own library under one static RSA-1024 key and posts one JSON request to
+        // pgwv4.2c2p.com/payment/<build>/Payment (sandbox-pgwv4 for a sandbox token), the card only as
+        // payment.data.securePayToken. twoc2p.js holds the rule the pause decision, the API's create, the approve
+        // and the SDK read: the exact Payment URL of a reviewed build, the page's own body, and a request that keeps,
+        // reuses or exposes a card, pays in instalments, converts the currency or redeems points refused. cse mode,
+        // as Paddle TokenEx and Shiji STS ship: the cardholder's device writes a new securePayToken from the real
+        // card under the key payment-core pins (twoc2p-keys.js), the runtime swaps it over the placeholder's, and the
+        // agent's page continues the request (substituteTwoC2p). A Payment request with no card field (a QR code, a
+        // bank transfer) carries none of the cardholder's cards and continues untouched (passWithoutCard). The
+        // request names no amount and no merchant: the payment token binds both, which the API reads from 2C2P's
+        // own session answer (twoc2p-answers.js), and a live payment is taken only for a merchant a reviewed pin
+        // names. Ships dark: served only to a client that declares `twoc2p_secure_pay`, gated off for every org
+        // until an operator lists one (`twoc2p:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox-pgwv4 only on test rows and
+        // only with documented test cards. `(?![\w/.-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "twoc2p_secure_pay",
+        match: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment(?![\\w/.-])",
+        hosts: ["^pgwv4\\.2c2p\\.com$", "^sandbox-pgwv4\\.2c2p\\.com$"],
+        sandboxHosts: ["^sandbox-pgwv4\\.2c2p\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The page continues its own request with its own headers; none is stored.
+        passthroughHeaders: [],
+        jsonCardFields: [["payment", "data", "securePayToken"]],
+        passWithoutCard: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "twoc2p-secure-pay", at: "payment.data", fields: ["securePayToken"] },
+        // The device's one field carries the whole card (number, expiry and code), so the client table names it once.
+        encryptedCardFields: { card: "securePayToken" }
+    },
+    {
+        psp: "hipay",
+        // HiPay Enterprise (France, Portugal, Italy, Spain): HiPay's JavaScript SDK (libs.hipay.com/js/sdkjs.js)
+        // takes the card in hosted fields, and their hidden controller frame on libs.hipay.com (or a direct post
+        // from the merchant's own origin) posts it as one JSON body to HiPay's Secure Vault under the merchant's
+        // public Basic credential: card_number, card_expiry_month (MM), card_expiry_year (YYYY), cvc, card_holder
+        // when the page has the field, and multi_use. hipay.js holds the request rule the pause decision, the API's
+        // create, the prepared bind and the device all read: exactly a token URL, a JSON Content-Type, a public
+        // username of the vault's own environment, and a complete create byte for byte. The hosted fields also post
+        // the number alone while it is typed; that body is refused (hipay_number_only) and the SDK fails it in the
+        // browser, so the frame keeps the number and Pay sends one complete create. The merchant's page gives the
+        // frame 20 seconds after Pay, so the lane is prepared only (preparationRequired). HiPay's vault answers any
+        // browser origin, so the card leaves the cardholder's device by a direct fetch. The body names no amount and
+        // no merchant: a live request is taken only for a checkout origin and a public username one reviewed pin
+        // names together. stage-secure2-vault.hipay-tpp.com is HiPay's stage vault: pinned (S7) to test rows, which
+        // send only test cards. Ships dark: served only to a client that declares `hipay_vault_token`, gated off
+        // for every org until an operator lists one (`hipay:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path for a consumer that tests
+        // `match` unanchored, so /rest/v2/token/update is never this entry.
+        capability: "hipay_vault_token",
+        match: "(?:stage-)?secure2-vault\\.hipay-tpp\\.com/rest/v2/token(?![\\w/.-])",
+        hosts: ["^secure2-vault\\.hipay-tpp\\.com$", "^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        sandboxHosts: ["^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // The merchant's public credential and the frame's JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"]
+    },
+    {
+        psp: "amazon_payment_services",
+        // Amazon Payment Services (formerly PayFort; the UAE, Saudi Arabia, Egypt), its custom merchant page: the
+        // merchant's own card form posts top-level, as a document navigation, to /FortAPI/paymentPage on
+        // checkout.payfort.com, form encoded, with service_command=TOKENIZATION and the merchant's signed fields
+        // beside card_number, expiry_date (YYMM) and card_security_code. amazon-payment-services.js holds the rule
+        // the pause decision reads: exactly that URL, and the form field by field, with another service command, a
+        // saved card (token_name) and a recurring agreement (merchant_extra) refused by name. The same URL takes
+        // APS's redirection and iframe entries, which carry no card and continue untouched (passWithoutCard); APS's
+        // own page then takes the card, and no Vault mode pays it. The request names no amount: the merchant
+        // charges the token APS answers with later, from its own server, so the agent's amount is the figure the
+        // cardholder approves. APS answers no browser origin, so the card leaves the cardholder's device only
+        // through the checkout relay, with the page's own Origin and Referer. sbcheckout.payfort.com is APS's
+        // sandbox: pinned (S7) to test rows, which send only test cards.
+        // Ships dark: served only to a client that declares `aps_custom_merchant_page`, gated off for every org
+        // until an operator lists one (`amazon_payment_services:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests
+        // `match` unanchored.
+        capability: "aps_custom_merchant_page",
+        match: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage(?![\\w/.%-])",
+        hosts: ["^checkout\\.payfort\\.com$", "^sbcheckout\\.payfort\\.com$"],
+        sandboxHosts: ["^sbcheckout\\.payfort\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        // The form's own Origin and Referer: a browser sends both on the page's POST, and the request rule holds
+        // them to the checkout page. Cookies and every other header never ride.
+        passthroughHeaders: ["^origin$", "^referer$"],
+        cardFields: ["card_number"],
+        passWithoutCard: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage"
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2313,6 +2407,10 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/payrexx.js
+var PAYREXX_FOLLOW_UP_WINDOW_MS = 15 * 60 * 1e3;
+var PAYREXX_FOLLOW_UP_IDLE_MS = 60 * 1e3;
+var PAYREXX_FOLLOW_UP_CHALLENGE_MS = 11 * 60 * 1e3;
 // src/paygent.js
 var PAYGENT_PSP = "paygent";
 var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
@@ -2335,6 +2433,22 @@ var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
+// src/twoc2p-keys.js
+var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/1ljsxI+r6qQraTFrHfWNrV41vxumBF+4ILAG3WsN6HEBQU2wSUv/IyQmZkiys1ilOb+OOuQTH8OXMnqQg9E4epyePW3L7IeOieSbIIDeSX6UpTWmT/Fs7moWZkN8RpuCV0u87n3AY2tQbtcSqwEKi2sxzWLFwscoGn6N5yVIpQIDAQAB",
+        sha256: "bb8f27929ce140c6ef0ec9c4a20d7ca0b83376bc35a501985dc40d16669384fe",
+        script: Object.freeze({ url: "https://t.2c2p.com/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "4a745a37765a2e28e299d64f6ea5811aab27b176da61db6f840fa85d6a47e763" })
+    }),
+    sandbox: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKakJC+2MSZikKoPzlNqXvJCuWNLhejg3gMRePSetYNNgnhyqFwwAR7t7i/B2QFZoixSYc2/23cJz0jA5O+q+Cu3fycqKlf1L9966+X3B9nyHe2eKQZr8KrcS/8+sEKcd0pLATY4AleW1iktuN+2oghrDKuv+aDNztWcOy+PTofwIDAQAB",
+        sha256: "7f80c07f1d72db28ede10dae942940657c72dfa789836c9fdf283cba6feff2e6",
+        script: Object.freeze({ url: "https://demo2.2c2p.com/2C2PFrontEnd/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "435723d92bfefb00607a56851967e0b745d52b8d49443de5f0000f0583fde5cc" })
+    })
+});
+// src/amazon-payment-services.js
+var BODY_LIMIT = 32 * 1024;
+var ANSWER_LIMIT = 64 * 1024;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2561,7 +2675,15 @@ var METHOD_PAGE = /* @__PURE__ */ new Set(["resultadoMethod", ...BROWSER_FIELDS,
 var REDSYS_REFUSALS = Object.freeze(["redsys_card_page", "redsys_3ds_challenge", "redsys_declined"]);
 // src/processors/quickpay.js
 var QUICKPAY_HOSTS = Object.freeze(["payment.quickpay.net"]);
-var QUICKPAY_MERCHANTS = Object.freeze([]);
+var QUICKPAY_MERCHANTS = Object.freeze([
+    Object.freeze({
+        merchantId: "107268",
+        agreementId: null,
+        merchant: "Skandinavisk Dyrepark",
+        host: "shop.skandinaviskdyrepark.dk",
+        callbackHost: "shop.skandinaviskdyrepark.dk"
+    })
+]);
 var MAX_ENTRY3 = 16 * 1024;
 var REQUIRED3 = Object.freeze([
     "version",

package/dist/twoc2p.d.ts

@@ -0,0 +1,54 @@
+/** The PSP id the API and the recognizer name this lane, re-exported so the client dispatches by it. */
+export { TWOC2P_PSP } from './twoc2p.generated.js';
+/** The dark-launch capability a build declares when it fills a 2C2P Payment with the device's card field. */
+export declare const TWOC2P_CAPABILITY = "twoc2p_secure_pay";
+/** A cse substitution as the API serves it (substitute.ts Substitutions): here the one card field. */
+interface TwoC2pServedSubstitution {
+    encoding: string;
+    at: string;
+    fields: Record<string, string>;
+    remove?: string[];
+}
+/**
+ * Whether an approved 2C2P authorization's served substitution is one this SDK can continue: JSON at payment.data,
+ * no sibling to remove, and exactly the one card field, a non-empty string. substituteTwoC2p checks the field
+ * against the pinned key for the Payment's environment; this is the shape gate the continuation runs first.
+ */
+export declare function isTwoC2pServedSubstitution(sub: unknown): sub is TwoC2pServedSubstitution;
+/** The part of the client a refused continuation retires its approval through. */
+interface TwoC2pRetiringClient {
+    cancelAuthorization?: (authorizationId: string, reason: 'merchant_never_retried') => Promise<unknown>;
+}
+/**
+ * The retirement a refused 2C2P continuation runs (twoC2pContinuation's `retire`), or undefined for a client that
+ * cannot cancel: the approval is cancelled as merchant_never_retried, since its field went to no request, and the
+ * API stops serving the field. The paused request fails at once, so the cancel is not awaited; when the API does not
+ * confirm it, `onEvent` hears approval_retire_unconfirmed with the authorization's id. The API's sweep drops the field
+ * once its readable window passes either way.
+ */
+export declare function twoC2pRetire(client: TwoC2pRetiringClient | undefined, authorizationId: string, onEvent?: (event: {
+    type: string;
+    detail?: unknown;
+}) => void): (() => void) | undefined;
+/** The paused request an approval was created from: the URL and body the API reviewed at create. */
+export interface TwoC2pApprovedRequest {
+    url: string;
+    body: string;
+}
+/**
+ * The continuation of an approved 2C2P Payment: the paused body with the device's card field written over the
+ * placeholder's (payment-core substituteTwoC2p, which refuses a field that is not one under the pinned key for the
+ * Payment's environment, or one already in the paused body).
+ *
+ * Only into `approved`, the paused Payment the approval was created from: `url` and `body` must equal it byte for
+ * byte. 2C2P's key is the same for every merchant, so the field would pay any later Payment of the same shape;
+ * binding it to the one request keeps this lane from ever writing one payment's field into another.
+ *
+ * Null when neither URL is a 2C2P Payment, so every other processor keeps its own swap. Throws for any other body or
+ * URL, and for a substitution the shape gate or the swap refuses, in each case before anything continues. A refusal
+ * means the device's field went to no request, so `retire` runs first: the caller retires the approval as
+ * merchant_never_retried, and the API stops serving the field (cdp.ts cseContinuation).
+ */
+export declare function twoC2pContinuation(url: string, body: string, sub: unknown, approved: TwoC2pApprovedRequest, retire?: () => void): {
+    body: string;
+} | null;

package/dist/twoc2p.generated.d.ts

@@ -0,0 +1,33 @@
+declare var TWOC2P_PSP: string;
+declare var TWOC2P_CAPABILITY: string;
+declare var TWOC2P_OPERATION: string;
+declare var TWOC2P_SCHEME: string;
+declare var TWOC2P_FIELD_AT: string;
+declare var TWOC2P_FIELD: string;
+declare var TWOC2P_REVIEWED_BUILDS: readonly string[];
+declare var TWOC2P_REFUSAL_CODES: readonly string[];
+declare function twoC2pPaymentTarget(url: any): Readonly<{
+    environment: "production" | "sandbox";
+    version: string;
+    reviewed: boolean;
+}> | null;
+declare function twoC2pPaymentCarriesCard(body: any): boolean;
+declare function twoC2pBodyVerdict(body: any, keyBytes?: number, environment?: undefined): Readonly<{
+    verdict: "continue";
+}> | Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function twoC2pRequestRefusal(request: any, environment: any): any;
+declare function twoC2pRefusalMessage(code: any): any;
+declare function encryptTwoC2pCard(card: any, environment: any, facilities?: {}): Promise<string>;
+declare function twoC2pSubstitutionOf(value: any, environment: any): any;
+declare function substituteTwoC2p(url: any, body: any, field: any): string;
+declare function twoC2pSubstitutionsRefusal(template: any, substitution: any): {
+    code: string;
+    message: any;
+} | null;
+declare function twoC2pKeyUsable(authorization: any): boolean;
+export { TWOC2P_CAPABILITY, TWOC2P_FIELD, TWOC2P_FIELD_AT, TWOC2P_OPERATION, TWOC2P_PSP, TWOC2P_REFUSAL_CODES, TWOC2P_REVIEWED_BUILDS, TWOC2P_SCHEME, encryptTwoC2pCard, substituteTwoC2p, twoC2pBodyVerdict, twoC2pKeyUsable, twoC2pPaymentCarriesCard, twoC2pPaymentTarget, twoC2pRefusalMessage, twoC2pRequestRefusal, twoC2pSubstitutionOf, twoC2pSubstitutionsRefusal };