@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 75a1d6551b8b0f5af53c9ce72e709e523f6911e0f96a1705fca0855b180d8532
+// artifact-sha256: 7544ef9813a4b2b55031179301878be4c74d1f1363eacca7552d7ba0f5bb4843
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -600,6 +600,102 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["checkout-account", "checkout-transaction-id"]
         }
     },
+    {
+        psp: "eximbay",
+        // Eximbay's payment window, the Korean gateway that takes foreign cards for Korean merchants selling
+        // abroad. The merchant's page posts a
+        // signed ENTRY form, top-level or into a popup, to https://secureapi.eximbay.com/Gateway/BasicProcessor.krp
+        // (Eximbay's integration v230, which its JavaScript SDK submits too): the amount, the merchant's mid, its
+        // order reference, its return and status URLs and an fgkey, a SHA-256 over every field under the
+        // merchant's secret key, and no card. Eximbay answers with a page that posts itself, with a paramkey, into
+        // its window under a JSESSIONID cookie, so a card form rebuilt away from that session has no payment to pay
+        // (processors/eximbay.js). The paused request is therefore the entry, a Document navigation that carries no
+        // card: the cardholder's device repeats it over the end-to-end TLS relay, fills the card into the window
+        // Eximbay returns to it and posts it back in that same session, and the runtime resolves the paused
+        // navigation with the hosted_form notice. Only the entry path is matched, exactly (processors/eximbay.js
+        // isEximbayEntryUrl: a query would reach Eximbay's servlet as fields beside the signed body). The window's
+        // card lookup (checkCardBin.do) and its card post (checkApprv.jsp) carry a card and are never paused, and
+        // the agent's browser never loads the window while the entry waits. No SDK gate refuses those two posts
+        // in the agent's browser yet (checkout/src/pre-claim.ts holds Redsys's and NMI's, none for Eximbay), and
+        // until one does the SDK does not declare this capability. Eximbay's test host serves the same window
+        // for test merchants, so a live row reaches the live host only and a test row the test host only. Dark:
+        // served only to a client that declares the capability, and gated off for every org the operator has not
+        // allowlisted.
+        capability: "eximbay_hosted_payment_page",
+        match: "secureapi\\.(?:test\\.)?eximbay\\.com/Gateway/BasicProcessor\\.krp",
+        hosts: ["^secureapi\\.eximbay\\.com$", "^secureapi\\.test\\.eximbay\\.com$"],
+        sandboxHosts: ["^secureapi\\.test\\.eximbay\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the window Eximbay returns to the device, not into the paused entry, which must
+            // carry none (processors/eximbay.js checkEximbayEntry). The device never posts a form of its own: the
+            // Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/eximbay.js checkEximbayEntry), the reviewed merchants among them: the
+            // create runs them, and naming them here makes the cardholder's device run them again on the entry it is
+            // about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "eximbay",
+            required: ["ver", "mid", "txntype", "ref", "cur", "amt", "buyer", "email", "lang", "returnurl", "statusurl", "fgkey"],
+            // The window's own card fields, which the device fills in the window (never in the entry). The window's
+            // script also splits the number into cardno1 to cardno4 beside cardNum.
+            card: { number: "cardNum", month: "month", year: "year", cvc: "cvc" },
+            // The merchant, its order reference and the amount name one payment.
+            dedupe: ["mid", "ref", "amt", "cur"]
+        }
+    },
+    {
+        psp: "barion",
+        // Barion's Smart Gateway (Barion Payment Zrt.), where Hungarian, Czech and Slovak shops send a buyer who pays
+        // by card as a guest. The merchant's SERVER starts the payment (POST api.barion.com/v2/Payment/Start under its
+        // POSKey: the amount, the shop, its RedirectUrl) and sends the buyer's browser to
+        // secure.barion.com/Pay?Id={PaymentId}, a GET. That ENTRY is the payment's id alone: no card, no amount and no
+        // merchant, all of which Barion bound to the id on its own server. Barion answers with the gateway under a
+        // session of its own (an ASP.NET session and an anti-forgery token), whose script posts the card to
+        // /Pay/PrepareCardPaymentForGuest and /Pay/CompletePaymentAsGuestWithCard on the same host in that session, so a
+        // card post made away from that session has no payment to pay (processors/barion.js). The paused request is
+        // therefore the entry, a Document navigation that carries no card: the cardholder's device repeats it over the
+        // end-to-end TLS relay and makes the gateway's posts itself in that same session, and the runtime resolves the
+        // paused navigation with the hosted_form notice. Only the entry is matched, exactly (processors/barion.js
+        // isBarionEntryUrl: the path /Pay and one Id or id parameter, since the gateway acts on others): the card posts,
+        // the email check and the 3-D Secure steps share the host, and none of them is the entry. secure.test.barion.com
+        // runs the same gateway for Barion's test shops: a live row reaches only the live host and a test row only the
+        // test host, which takes only Barion's test cards. Dark: served only to a client that declares the capability,
+        // and gated off for every org the operator has not allowlisted.
+        capability: "barion_hosted_payment_page",
+        match: "secure(?:\\.test)?\\.barion\\.com/Pay",
+        hosts: ["^secure\\.barion\\.com$", "^secure\\.test\\.barion\\.com$"],
+        sandboxHosts: ["^secure\\.test\\.barion\\.com$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the gateway's own posts, which the device makes as the gateway's script does, since the
+        // entry has no body. No captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into the gateway's
+        // own posts on the device. A client that pauses a GET only for a processor whose request it checks (the
+        // checkout SDK's isRecognizerRequest) never pauses this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the gateway's posts the device makes, never into the paused entry, which carries no
+            // body at all (processors/barion.js checkBarionEntry). The device never posts a form of its own: the Vault's
+            // form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/barion.js checkBarionEntry): the create runs them, and naming them here
+            // makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "barion",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // The fields of the gateway's charge post, which the device fills there (never in the entry).
+            card: { number: "CardNumber", expiry: "CardExpiration", cvc: "CardCVC" },
+            // The payment id in the entry's URL names one payment Barion started; the policy reads it there
+            // (checkBarionEntry's dedupe), since no form field holds it.
+            dedupe: ["(paymentId)"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -2106,16 +2202,17 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         psp: "sumup",
         // SumUp's online payments (UK, EEA, US, Latin America): the Payment Widget
         // (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) that SumUp's WooCommerce plugin, its Payment Links, Online
-        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page serves every
-        // merchant from one origin). Each card field is a frame on gateway.sumup.com, and a
+        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page sends a body
+        // nobody has reviewed). Each card field is a frame on gateway.sumup.com, and a
         // hidden form frame there sends the card in one PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>:
         // JSON {"payment_type":"card","device_information":..,"card":{"name","number","expiry_month":"MM",
         // "expiry_year":"YY" or "YYYY","cvv"},"installments":1,..}, unencrypted, with X-Sumup-Correlation-Id naming
         // the same checkout. sumup.js holds the request rule the pause decision, the API's create and the device all
         // read: exactly that URL, a JSON Content-Type, the correlation id, and the widget's body byte for byte, with
         // a body that carries a recurring mandate, which keeps the card at SumUp, refused. The body names no
-        // amount and no merchant: the checkout the merchant's server created holds both, so a live request is taken
-        // only for a checkout origin a reviewed pin lists. The request carries no cookie and no Authorization
+        // amount and no merchant: the checkout the merchant's server created holds both, so the API reads the checkout
+        // from SumUp by its id and takes a live request only for a merchant code a reviewed pin lists (sumup.js
+        // SUMUP_MERCHANT_PINS). The request carries no cookie and no Authorization
         // header (the checkout id is its credential), and the API answers any browser origin's preflight with
         // credentials omitted. The answer is the checkout: PAID, FAILED, or PENDING with a 3-D Secure step the
         // widget then runs in the page. SumUp's sandbox merchants share the live host, so no sandbox host is
@@ -2133,6 +2230,320 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: ["^x-sumup-correlation-id$", "^x-sumup-widget-session-id$"],
         jsonCardFields: [["card", "number"]],
         request: { method: "PUT", cardIn: "body", response: "json" }
+    },
+    {
+        psp: "twoc2p",
+        // 2C2P's hosted payment page (pgw-ui.2c2p.com, builds 4.1 to 4.5), where most 2C2P merchants in Thailand,
+        // Malaysia and Singapore send a buyer, top level or in a frame. On Pay the page encrypts the card with
+        // 2C2P's own library under one static RSA-1024 key and posts one JSON request to
+        // pgwv4.2c2p.com/payment/<build>/Payment (sandbox-pgwv4 for a sandbox token), the card only as
+        // payment.data.securePayToken. twoc2p.js holds the rule the pause decision, the API's create, the approve
+        // and the SDK read: the exact Payment URL of a reviewed build, the page's own body, and a request that keeps,
+        // reuses or exposes a card, pays in instalments, converts the currency or redeems points refused. cse mode,
+        // as Paddle TokenEx and Shiji STS ship: the cardholder's device writes a new securePayToken from the real
+        // card under the key payment-core pins (twoc2p-keys.js), the runtime swaps it over the placeholder's, and the
+        // agent's page continues the request (substituteTwoC2p). A Payment request with no card field (a QR code, a
+        // bank transfer) carries none of the cardholder's cards and continues untouched (passWithoutCard). The
+        // request names no amount and no merchant: the payment token binds both, which the API reads from 2C2P's
+        // own session answer (twoc2p-answers.js), and a live payment is taken only for a merchant a reviewed pin
+        // names. Ships dark: served only to a client that declares `twoc2p_secure_pay`, gated off for every org
+        // until an operator lists one (`twoc2p:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox-pgwv4 only on test rows and
+        // only with documented test cards. `(?![\w/.-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "twoc2p_secure_pay",
+        match: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment(?![\\w/.-])",
+        hosts: ["^pgwv4\\.2c2p\\.com$", "^sandbox-pgwv4\\.2c2p\\.com$"],
+        sandboxHosts: ["^sandbox-pgwv4\\.2c2p\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The page continues its own request with its own headers; none is stored.
+        passthroughHeaders: [],
+        jsonCardFields: [["payment", "data", "securePayToken"]],
+        passWithoutCard: "(?:sandbox-)?pgwv4\\.2c2p\\.com/payment/4\\.[0-9]{1,2}/Payment",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "twoc2p-secure-pay", at: "payment.data", fields: ["securePayToken"] },
+        // The device's one field carries the whole card (number, expiry and code), so the client table names it once.
+        encryptedCardFields: { card: "securePayToken" }
+    },
+    {
+        psp: "hipay",
+        // HiPay Enterprise (France, Portugal, Italy, Spain): HiPay's JavaScript SDK (libs.hipay.com/js/sdkjs.js)
+        // takes the card in hosted fields, and their hidden controller frame on libs.hipay.com (or a direct post
+        // from the merchant's own origin) posts it as one JSON body to HiPay's Secure Vault under the merchant's
+        // public Basic credential: card_number, card_expiry_month (MM), card_expiry_year (YYYY), cvc, card_holder
+        // when the page has the field, and multi_use. hipay.js holds the request rule the pause decision, the API's
+        // create, the prepared bind and the device all read: exactly a token URL, a JSON Content-Type, a public
+        // username of the vault's own environment, and a complete create byte for byte. The hosted fields also post
+        // the number alone while it is typed; that body is refused (hipay_number_only) and the SDK fails it in the
+        // browser, so the frame keeps the number and Pay sends one complete create. The merchant's page gives the
+        // frame 20 seconds after Pay, so the lane is prepared only (preparationRequired). HiPay's vault answers any
+        // browser origin, so the card leaves the cardholder's device by a direct fetch. The body names no amount and
+        // no merchant: a live request is taken only for a checkout origin and a public username one reviewed pin
+        // names together. stage-secure2-vault.hipay-tpp.com is HiPay's stage vault: pinned (S7) to test rows, which
+        // send only test cards. Ships dark: served only to a client that declares `hipay_vault_token`, gated off
+        // for every org until an operator lists one (`hipay:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path for a consumer that tests
+        // `match` unanchored, so /rest/v2/token/update is never this entry.
+        capability: "hipay_vault_token",
+        match: "(?:stage-)?secure2-vault\\.hipay-tpp\\.com/rest/v2/token(?![\\w/.-])",
+        hosts: ["^secure2-vault\\.hipay-tpp\\.com$", "^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        sandboxHosts: ["^stage-secure2-vault\\.hipay-tpp\\.com$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // The merchant's public credential and the frame's JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"]
+    },
+    {
+        psp: "amazon_payment_services",
+        // Amazon Payment Services (formerly PayFort; the UAE, Saudi Arabia, Egypt), its custom merchant page: the
+        // merchant's own card form posts top-level, as a document navigation, to /FortAPI/paymentPage on
+        // checkout.payfort.com, form encoded, with service_command=TOKENIZATION and the merchant's signed fields
+        // beside card_number, expiry_date (YYMM) and card_security_code. amazon-payment-services.js holds the rule
+        // the pause decision reads: exactly that URL, and the form field by field, with another service command, a
+        // saved card (token_name) and a recurring agreement (merchant_extra) refused by name. The same URL takes
+        // APS's redirection and iframe entries, which carry no card and continue untouched (passWithoutCard); APS's
+        // own page then takes the card, and no Vault mode pays it. The request names no amount: the merchant
+        // charges the token APS answers with later, from its own server, so the agent's amount is the figure the
+        // cardholder approves. APS answers no browser origin, so the card leaves the cardholder's device only
+        // through the checkout relay, with the page's own Origin and Referer. sbcheckout.payfort.com is APS's
+        // sandbox: pinned (S7) to test rows, which send only test cards.
+        // Ships dark: served only to a client that declares `aps_custom_merchant_page`, gated off for every org
+        // until an operator lists one (`amazon_payment_services:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests
+        // `match` unanchored.
+        capability: "aps_custom_merchant_page",
+        match: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage(?![\\w/.%-])",
+        hosts: ["^checkout\\.payfort\\.com$", "^sbcheckout\\.payfort\\.com$"],
+        sandboxHosts: ["^sbcheckout\\.payfort\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        // The form's own Origin and Referer: a browser sends both on the page's POST, and the request rule holds
+        // them to the checkout page. Cookies and every other header never ride.
+        passthroughHeaders: ["^origin$", "^referer$"],
+        cardFields: ["card_number"],
+        passWithoutCard: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage"
+    },
+    {
+        psp: "paypal",
+        // PayPal Card Fields (Advanced Credit and Debit Card Payments) on Orders v2: one JSON POST from a
+        // PayPal-owned frame to confirm-payment-source for the order the merchant's server created. Card
+        // Fields v5 (www.paypal.com/smart/card-field) sends it to its own origin, v6 to api-m.paypal.com.
+        // PAN@ payment_source.card.number, expiry YYYY-MM @ .expiry, CVC @ .security_code; a Bearer token
+        // PayPal minted into the frame; no amount, no encryption. paypal.js holds the rule the pause
+        // decision, the API's create and the device all read: exactly the confirm URL with an upper-case
+        // order id, and the frames' own new-card body. The same URL confirms a PayPal wallet, a saved card
+        // or a token with no number, which continues untouched (jsonCardFields, passWithoutCard). Not here: legacy Hosted
+        // Fields on cors.api.paypal.com and PayPal's guest card form, which the checkout SDK refuses for
+        // every company, the order's other calls, subscriptions and /v2/payments/find-bin-details.
+        // PayPal-Auth-Assertion is a server-side header and never rides.
+        // Ships dark: served only to a client that declares `paypal_card_fields`, gated off for every org
+        // until an operator lists one (`paypal:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): the sandbox
+        // hosts only on test rows and only with documented test cards, the live hosts only on live rows.
+        capability: "paypal_card_fields",
+        match: "(?:www|api-m)(?:\\.sandbox)?\\.paypal\\.com/v2/checkout/orders/[A-Z0-9]{1,36}/confirm-payment-source(?![\\w/-])",
+        hosts: ["^www\\.paypal\\.com$", "^www\\.sandbox\\.paypal\\.com$", "^api-m\\.paypal\\.com$", "^api-m\\.sandbox\\.paypal\\.com$"],
+        sandboxHosts: ["^www\\.sandbox\\.paypal\\.com$", "^api-m\\.sandbox\\.paypal\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [
+            "^authorization$",
+            "^prefer$",
+            "^paypal-client-metadata-id$",
+            "^paypal-partner-attribution-id$",
+            "^paypal-integration-artifact$",
+            "^fn_sync_data$"
+        ],
+        jsonCardFields: [["payment_source", "card", "number"]],
+        passWithoutCard: "(?:www|api-m)(?:\\.sandbox)?\\.paypal\\.com/v2/checkout/orders/[A-Z0-9]{1,36}/confirm-payment-source"
+    },
+    {
+        psp: "clover",
+        // Clover (a Fiserv company), North America. Clover's card frame (the INTERMEDIATE frame of
+        // checkout.clover.com/widget.html, which checkout.clover.com/sdk.js mounts on Clover's payment links, Hosted
+        // Checkout and Online Ordering and on every merchant site that embeds Clover's iframe) sends the card to Clover's
+        // token API, which answers with a single-use clv_ token the merchant's server charges afterwards. One JSON POST
+        // to exactly https://token.clover.com/v1/tokens (token-sandbox.dev.clover.com on Clover's sandbox), under the
+        // merchant's public Ecommerce key in the apikey header and X-Clover-Client-Type HOSTED_IFRAME, with the card in
+        // `card`: the number as encrypted_pan, RSA-OAEP under Clover's published TransArmor key, and the code, expiry,
+        // first six, last four and brand in plain text. clover.js holds the request rule the pause decision and the
+        // device read, and the API's create once its Clover branch lands: exactly that URL, the frame's three headers,
+        // and the frame's single-use card body with nothing the frame does not write. The body names no amount, so a
+        // live request is taken only for a store and key a reviewed pin names together. As for GMO, the paused body
+        // holds the agent's placeholder ciphertext and nothing can be written into it: injectCard and
+        // prepareDeviceReplay refuse this psp, and the cardholder's device builds the request with the real card under
+        // the key payment-core pins and sends it itself (the token API answers the Vault's origin), with no relay. A
+        // multi-pay token, the frame's reCAPTCHA variant, a number sent in the clear and every gift card, ACH or wallet
+        // token request to the same URL are refused. token-sandbox.dev.clover.com is Clover's sandbox: pinned (S7) to
+        // test rows, which send only Clover's test cards.
+        // Ships dark: served only to a client that declares `clover_card_token`, gated off for every org until an
+        // operator lists one (`clover:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` keeps /v1/tokens/<id> and /v1/tokens.json out of `match`;
+        // every consumer anchors it, and recognition.js takes only the exact URL (isCloverTokenUrl).
+        capability: "clover_card_token",
+        match: "token(?:-sandbox\\.dev)?\\.clover\\.com/v1/tokens(?![\\w/.%-])",
+        hosts: ["^token\\.clover\\.com$", "^token-sandbox\\.dev\\.clover\\.com$"],
+        sandboxHosts: ["^token-sandbox\\.dev\\.clover\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The merchant's key and the frame's client type are what the token API reads beside the body, and the Accept
+        // rides as the frame sent it; origin, referer and cookies never do.
+        passthroughHeaders: ["^apikey$", "^x-clover-client-type$", "^accept$"],
+        jsonCardFields: [["card", "encrypted_pan"]]
+    },
+    {
+        psp: "tap_payments",
+        // Tap Payments' Card SDK v2 frame (sdk.tap.company/v2/card/index.html), the card form of Tap's hosted
+        // checkout (checkout.tap.company) and of every merchant embedding the Card SDK, in Kuwait, Saudi
+        // Arabia, the UAE, Bahrain, Qatar and Oman. The frame encrypts the card itself: JSEncrypt
+        // (RSAES-PKCS1-v1_5, base64) of JSON.stringify({cvc, exp_month, exp_year, name, number}) under the
+        // merchant's own RSA key, sent as encryptedData in one JSON POST to /v2/card/token with the merchant's
+        // publishable key as Authorization. Tap answers a token (tok_...); 3-D Secure and the charge follow,
+        // card free. tap-payments.js holds the request rule the pause decision, the API, the device and the
+        // swap read: the exact URL, the frame's body, a one-time purpose, and a publishable key a reviewed pin
+        // lists with the merchant's key (TAP_PAYMENTS_MERCHANT_PINS). cse mode, as GMO, Shiji STS and Paddle
+        // TokenEx ship: the cardholder's device encrypts the real card under the pinned key, the runtime swaps
+        // encryptedData (substituteTapPayments), and the agent's frame sends the request (the token endpoint
+        // answers no preflight from the Vault's origin). A save purpose, a consent to keep the card and a
+        // payment agreement are refused. Test and live keys share the host, and a key's own prefix names its
+        // environment, so no sandbox host is marked.
+        // Ships dark: served only to a client that declares `tap_card_sdk_token`, gated off for every org
+        // until an operator lists one (`tap_payments:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "tap_card_sdk_token",
+        match: "sdk\\.tap\\.company/v2/card/token(?![\\w/.-])",
+        hosts: ["^sdk\\.tap\\.company$"],
+        encoding: "json",
+        // The publishable key names the merchant the card is encrypted for; the frame's other headers (mdn,
+        // application) ride on the page's own request and are never recorded.
+        passthroughHeaders: ["^authorization$"],
+        // The one ciphertext, by the role the client table names, so it carries the same encrypted-field set
+        // the approve leg accepts (vault-allowlist-drift). The generic Adyen substitution refuses it (RSA
+        // base64, not a JWE): only substituteTapPayments writes this body, dispatched by psp.
+        encryptedCardFields: { number: "encryptedData" },
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-pkcs1v15", at: "", fields: ["encryptedData"] }
+    },
+    {
+        psp: "conekta",
+        // Conekta (Mexico) through Conekta.js, the tokenizer a merchant's own page loads from cdn.conekta.io or hosts
+        // itself: on Pay it posts the card with one XHR, in clear JSON, to https://api.conekta.io/tokens under the
+        // merchant's public key (Basic authorization) and Accept application/vnd.conekta-v0.3.0+json, as
+        // {"card":{<the page's members>,"device_fingerprint"}}: card.number, card.cvc, card.exp_month, card.exp_year and
+        // card.name, in the page's order. The answer is a single-use token the merchant's server charges later; the request
+        // names no amount, so the agent's amount is the price the cardholder approves. conekta.js holds the rules the pause
+        // decision, the API's create and the device read: the exact URL, the tokenizer's headers, and the page's card body
+        // member by member, with the tokenizer's fingerprint last. Conekta's Component (pay.conekta.com/api/tokens, the
+        // frame behind the WooCommerce plugin 5.x and 6.x, the Shopify app, hosted checkout and payment links) seals its
+        // token form in the page, so its two token URLs are named here only to be refused: its POST by name
+        // (conekta_component_unsupported) at the pause, the API's create and the device; its PUT, not this recognizer's
+        // method, continues untouched with the agent's placeholder, and the create refuses it as a method no Conekta card
+        // request uses. Conekta's API answers any browser origin, so the card leaves the cardholder's
+        // device by a direct fetch. Test and live share api.conekta.io and Conekta's keys name no mode, so no sandbox host
+        // is marked and the lane takes live rows alone: a live request pays only an origin and a key one reviewed pin lists
+        // together (conekta.js conektaMerchantRefusal), and none is listed yet. Conekta can answer a refusal inside a 2xx,
+        // so its own judge reads every answer (conekta.js conektaAnswerOutcome), never the shared status rule.
+        // Ships dark: served only to a client that declares `conekta_tokenizer`, gated off for every org until an
+        // operator lists `conekta:<org>`, and autopilot never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        // `(?![\w/.-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "conekta_tokenizer",
+        match: "(?:api\\.conekta\\.io/tokens|pay\\.conekta\\.com/api/tokens/?)(?![\\w/.-])",
+        hosts: ["^api\\.conekta\\.io$", "^pay\\.conekta\\.com$"],
+        encoding: "json",
+        // Conekta.js's public key, its API version and the four headers beside them. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$", "^accept-language$", "^conekta-client-user-agent$", "^raisehtmlerror$", "^x-tokenization-source$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "makecommerce",
+        // MakeCommerce (Maksekeskus AS; Estonia, Latvia, Lithuania, Finland), which takes the card in its own card frame
+        // (https://cc.maksekeskus.ee/card) over the shop's order page. On Pay the frame posts the card in clear JSON to its
+        // own origin, https://cc.maksekeskus.ee/card-payment, under the shop's publishable key (Basic authorization):
+        // card.number, card.exp_month (MM), card.exp_year (YY), card.cvc and card.name, beside the transaction's id, the
+        // shop's id and host, and the "Remember my card" and subscription boxes. makecommerce.js holds the request rule
+        // the pause decision, the API's create and the device all read: exactly the card endpoint URL, the JSON type,
+        // the body's own key under Basic, and the frame's body byte for byte, with either box ticked refused (it keeps
+        // the card on file). The body names no amount: MakeCommerce's transaction holds it, in EUR. The endpoint answers
+        // no browser origin, so the card leaves the cardholder's device only through the checkout relay, and only the
+        // publishable key rides beside the card. cc-test.maksekeskus.ee is MakeCommerce's TEST environment: pinned (S7)
+        // to test rows, which send only its published test cards.
+        // Ships dark: served only to a client that declares `makecommerce_card_frame`, gated off for every org until an
+        // operator lists one (`makecommerce:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "makecommerce_card_frame",
+        match: "cc(?:-test)?\\.maksekeskus\\.ee/card-payment(?![\\w/.%-])",
+        hosts: ["^cc\\.maksekeskus\\.ee$", "^cc-test\\.maksekeskus\\.ee$"],
+        sandboxHosts: ["^cc-test\\.maksekeskus\\.ee$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's publishable key. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "tokenex_iframe",
+        // TokenEx hosted iframe v3 (v3.min.js?version=latest, read 2026-10-18) in PCI mode
+        // with its CVV frame: JetBlue's booking checkout (TokenExID 9014311640612780, Origin
+        // https://www.jetblue.com). PAN@ Data, CVV@ CvvValue (json). TokenEx's own card-number iframe document
+        // on htp.tokenex.com reads the CVV from its same-origin CVV frame and posts the whole card as one XHR
+        // to its own document URL, query included: application/json, with TokenExID, Origin, the
+        // AuthenticationKey the merchant's server minted, Timestamp and TokenScheme (each echoed in the
+        // query), the frame's flags, and no amount, cookie or merchant session. The cardholder name and the
+        // expiry stay on the merchant's page. tokenex-iframe.js judges the whole request (the exact URL and
+        // its query, the body's keys in order and their types, the query and body agreeing), refuses a
+        // cvvOnly or PCI-only frame, a placeholder of another brand than the card, and an account it has not
+        // reviewed, and writes only Data and CvvValue. BinLookup and Forter post to their own paths under
+        // /iframe/v3 and never match (the right-edge boundary and the exact-URL rule in
+        // resolveRecognizerForUrl); a post with an empty Data carries no card and continues untouched
+        // (passWithoutCard). Hosts are the two literal labels (never *.tokenex.com: api. and test-api. are
+        // TokenEx's server API, which carries merchant credentials); the test host is pinned (S7): it takes
+        // only documented test cards, and a live row never points at it.
+        // Ships dark: served only to a client that declares `tokenex_iframe_tokenize`, gated off for every
+        // org until an operator allowlists one, and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). Not paddle_tokenex: that lane is Paddle's own frame, which
+        // encrypts the card for TokenEx inside Paddle's /pay.
+        capability: "tokenex_iframe_tokenize",
+        match: "(?:test-)?htp\\.tokenex\\.com/iframe/v3(?:[?#]|$)",
+        hosts: ["^htp\\.tokenex\\.com$", "^test-htp\\.tokenex\\.com$"],
+        sandboxHosts: ["^test-htp\\.tokenex\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [],
+        // only the content type rides: no cookie, origin or referer
+        jsonCardFields: [["Data"]],
+        passWithoutCard: "(?:test-)?htp\\.tokenex\\.com/iframe/v3"
+    },
+    {
+        psp: "poynt",
+        // GoDaddy Payments' card frame, Poynt Collect (cdn.poynt.net/collect/payment-form), on a GoDaddy
+        // Online Store checkout: one JSON POST to generate-nonce for the store the URL names. PAN@
+        // card.number, with expirationMonth ("MM"), expirationYear ("20YY") and the network the frame read
+        // (type) beside it, and the security code outside the card, at verificationData.cvData. poynt.js
+        // holds the request rule the pause decision, the API's create and the device all read: exactly the
+        // URL, the frame's headers and the frame's body byte for byte. Poynt answers with a nonce that
+        // GoDaddy's server charges. services.poynt.net refuses every browser origin but the frame's, so the
+        // card leaves the cardholder's device only through the checkout relay. The frame's open-tokenize
+        // path, for a page that names no store, is not matched, so it continues untouched. No sandbox host.
+        // Ships dark: served only to a client that declares `poynt_collect_nonce`, gated off for every org
+        // until an operator lists one (`poynt:<org>`), held to the stores poynt.js pins per checkout
+        // origin, and autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "poynt_collect_nonce",
+        match: "services\\.poynt\\.net/v1/commerce/stores/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payment-tokens/generate-nonce",
+        hosts: ["^services\\.poynt\\.net$"],
+        encoding: "json",
+        // The frame's own session, request and version ids, Sardine's session and the reCAPTCHA Enterprise
+        // token Poynt checks; never the page's Authorization, which GoDaddy's checkout does not pass.
+        passthroughHeaders: [
+            "^poynt-session-id$",
+            "^poynt-request-id$",
+            "^poynt-collect-version$",
+            "^poynt-sardine-session-id$",
+            "^recaptcha-token$",
+            "^recaptcha-type$"
+        ]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2313,6 +2724,14 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/gopay.js
+var GOPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ id: "caramilla", merchant: "Caramilla.cz", origins: Object.freeze(["https://www.caramilla.cz"]) })
+]);
+// src/payrexx.js
+var PAYREXX_FOLLOW_UP_WINDOW_MS = 15 * 60 * 1e3;
+var PAYREXX_FOLLOW_UP_IDLE_MS = 60 * 1e3;
+var PAYREXX_FOLLOW_UP_CHALLENGE_MS = 11 * 60 * 1e3;
 // src/paygent.js
 var PAYGENT_PSP = "paygent";
 var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
@@ -2335,6 +2754,203 @@ var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
+// src/twoc2p-keys.js
+var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/1ljsxI+r6qQraTFrHfWNrV41vxumBF+4ILAG3WsN6HEBQU2wSUv/IyQmZkiys1ilOb+OOuQTH8OXMnqQg9E4epyePW3L7IeOieSbIIDeSX6UpTWmT/Fs7moWZkN8RpuCV0u87n3AY2tQbtcSqwEKi2sxzWLFwscoGn6N5yVIpQIDAQAB",
+        sha256: "bb8f27929ce140c6ef0ec9c4a20d7ca0b83376bc35a501985dc40d16669384fe",
+        script: Object.freeze({ url: "https://t.2c2p.com/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "4a745a37765a2e28e299d64f6ea5811aab27b176da61db6f840fa85d6a47e763" })
+    }),
+    sandbox: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKakJC+2MSZikKoPzlNqXvJCuWNLhejg3gMRePSetYNNgnhyqFwwAR7t7i/B2QFZoixSYc2/23cJz0jA5O+q+Cu3fycqKlf1L9966+X3B9nyHe2eKQZr8KrcS/8+sEKcd0pLATY4AleW1iktuN+2oghrDKuv+aDNztWcOy+PTofwIDAQAB",
+        sha256: "7f80c07f1d72db28ede10dae942940657c72dfa789836c9fdf283cba6feff2e6",
+        script: Object.freeze({ url: "https://demo2.2c2p.com/2C2PFrontEnd/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "435723d92bfefb00607a56851967e0b745d52b8d49443de5f0000f0583fde5cc" })
+    })
+});
+// src/hipay.js
+var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin5({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+]);
+// src/amazon-payment-services.js
+var BODY_LIMIT = 32 * 1024;
+var ANSWER_LIMIT = 64 * 1024;
+// src/clover.js
+var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
+var OPTIONAL_KEYS = /* @__PURE__ */ Object.freeze(["address_line1", "phone_numbers", "email_address", "name", "address_zip"]);
+var CARD_ORDER = /* @__PURE__ */ Object.freeze([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
+// src/tap-payments.js
+var pin6 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sessions: Object.freeze({ ...fields.sessions }),
+    key: Object.freeze({ ...fields.key })
+});
+var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin6({
+        id: "casefilegame",
+        merchant: "Casefilegame",
+        tapMerchantId: "67977048",
+        publishableKey: "pk_live_ydlRjrWcLXaVvpsSBQKOie86",
+        environment: "production",
+        origins: ["https://checkout.tap.company"],
+        // The WooCommerce plugin's redirect (Plugin-WooCommerce-All-in-one tap.php 567-586, read 2026-10-17)
+        // creates the src_all charge with save_card false and names no agreement, subscription or destinations.
+        sessions: { saveCard: false, agreement: false, subscription: false, destinations: false },
+        key: {
+            spki: "MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAzja2vB+Iyafj2Mm3pFg65z7Yvj9ZeoFLdMBgWFyyjF020r5HSPKVhuZ39uJkjs0U/kWgEpKDzHZAKdtGv36dS33NjMAzYpgFkD8j+9/YWqpvAGRj5nv1b/q7NaiZk3b1wm7aXHJOx5L6rPQf2qDQxhcSNHocU+Uy8wGmGxRRu6QRKN3khaz4o4jJDzqxns4h/ShzHjdZeWIVfpCAyVoED0IESBYrvGEhJeyKnga5XdHdBU2yP8P1huO4RbSKcZv00ZgxVHAQQ9CqArW3TE8SyLLnJPkSpSHHBnIPSQS1z3ld1mImy/zqTd4ltkV6XHpYqVvoPmys2EuZX3pMvCcPGwIBEQ==",
+            sha256: "6eb4e89a1e05a06a39d631f6fb450c052a9cad9935edc1921e84e80207470552",
+            // The shared parser takes exponent 17 only under a pin that names it (rsa-pkcs1v15.js).
+            exponent: 17
+        }
+    })
+]);
+// src/conekta.js
+var LETTERS = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
+var PAGE_NAME = new RegExp(`^[${LETTERS} .'-]{1,64}$`);
+var HAS_LETTER = new RegExp(`[${LETTERS}]`);
+var ADDRESS_VALUE = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
+var PAN_LIKE = new RegExp(`(?:[0-9][^0-9${LETTERS}]*){12,}`);
+var HOLDER = new RegExp(`^[${LETTERS}](?:[${LETTERS} .'-]{0,62}[${LETTERS}.])?$`);
+var ERROR_TYPE_STATUS = /* @__PURE__ */ Object.freeze({
+    malformed_request_error: 400,
+    authentication_error: 401,
+    processing_error: 402,
+    resource_not_found_error: 404,
+    conflict_error: 409,
+    precondition_required_error: 412,
+    parameter_validation_error: 422
+});
+var CONEKTA_ANSWER_ERROR_TYPES = /* @__PURE__ */ Object.freeze(Object.keys(ERROR_TYPE_STATUS));
+// src/tokenex-iframe.js
+var TOKENEX_IFRAME_HOSTS = Object.freeze(["htp.tokenex.com", "test-htp.tokenex.com"]);
+var TOKENEX_IFRAME_REFUSAL_REASONS = Object.freeze(["unsupported", "brand_mismatch", "unreviewed_account"]);
+var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
+    "TokenExID",
+    "Origin",
+    "AuthenticationKey",
+    "Timestamp",
+    "Data",
+    "CvvValue",
+    "TokenScheme",
+    "CvvOnly",
+    "PCI",
+    "ReturnHash",
+    "use3DS",
+    "ThreeDSMethodNotificationUrl",
+    "kountSessionId",
+    "fraudMerchantId",
+    "UseKount",
+    "kountMode",
+    "kountAnId",
+    "FraudServicesRiskRequestModel",
+    "EnforceLuhnCompliance",
+    "CustomDataLuhnCheck"
+]);
+var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
+var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
+    "htp.tokenex.com": Object.freeze({}),
+    "test-htp.tokenex.com": Object.freeze({})
+});
+var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
+    "htp.tokenex.com": Object.freeze({}),
+    "test-htp.tokenex.com": Object.freeze({})
+});
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var panLike = (value) => (value.match(/\p{Nd}/gu) ?? []).length >= 12;
+var plain = (value, max) => text(value, max) && !panLike(value);
+var TOKENEX_ID = /^[0-9]{16}$/;
+var AUTHENTICATION_KEY = /^[A-Za-z0-9+/]{43}=$/;
+var TIMESTAMP = /^20[0-9]{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])(?:[01][0-9]|2[0-3])[0-5][0-9][0-5][0-9]$/;
+function isOrigin(value) {
+    if (typeof value !== "string" || value.length > 255 || !value.startsWith("https://"))
+        return false;
+    try {
+        return new URL(value).origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+var BOUND = {
+    TokenExID: (value) => exact(TOKENEX_ID, value),
+    Origin: isOrigin,
+    AuthenticationKey: (value) => exact(AUTHENTICATION_KEY, value),
+    Timestamp: (value) => exact(TIMESTAMP, value),
+    TokenScheme: (value) => TOKENEX_IFRAME_TOKEN_SCHEMES.includes(value)
+};
+var BOUND_KEYS = Object.keys(BOUND);
+var BOOLEAN = /^(?:true|false)$/i;
+var QUERY_RULES = {
+    ...BOUND,
+    Mode: (value) => value === "Data",
+    PCI: (value) => exact(/^true$/i, value),
+    CVV: (value) => exact(/^true$/i, value),
+    Container: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    CvvContainer: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    EnforceLuhnCompliance: (value) => exact(BOOLEAN, value),
+    CustomDataLabel: (value) => plain(value, 64),
+    CustomCvvDataLabel: (value) => plain(value, 64),
+    ExpiresInSeconds: (value) => exact(/^[1-9][0-9]{0,3}$/, value),
+    ReturnAutoCompleteValues: (value) => exact(BOOLEAN, value)
+};
+var QUERY_REQUIRED = [...BOUND_KEYS, "Mode", "PCI", "CVV"];
+var PLACEHOLDER = /^[0-9]{1,19}(?: [0-9]{1,19}){0,5}$/;
+var placeholderDigits = (value) => exact(PLACEHOLDER, value) && value.length <= 23 ? value.replace(/ /g, "") : null;
+var RULES = {
+    ...BOUND,
+    Data: (value) => {
+        const pan = placeholderDigits(value);
+        return pan !== null && pan.length >= 13 && pan.length <= 19;
+    },
+    CvvValue: (value) => digits(value, 3, 4),
+    CvvOnly: (value) => value === "False",
+    PCI: (value) => value === "True",
+    ReturnHash: (value) => value === null,
+    use3DS: (value) => value === "False",
+    ThreeDSMethodNotificationUrl: (value) => value === "",
+    kountSessionId: (value) => value === "",
+    fraudMerchantId: (value) => value === "",
+    UseKount: (value) => value === "False",
+    kountMode: (value) => value === "",
+    kountAnId: (value) => value === "",
+    FraudServicesRiskRequestModel: (value) => value === "",
+    EnforceLuhnCompliance: (value) => value === "true" || value === "false",
+    CustomDataLuhnCheck: (value) => value === true
+};
+var TOKENEX_IFRAME_GATE_CODES = Object.freeze(["tokenex_iframe_url_refused", "tokenex_iframe_body_unsupported", "tokenex_iframe_query_mismatch"]);
+var SUCCESS_RULES = {
+    token: (value) => digits(value, 13, 19),
+    firstSix: (value) => digits(value, 6, 6),
+    lastFour: (value) => digits(value, 4, 4),
+    referenceNumber: (value) => exact(/^[A-Za-z0-9-]{1,64}$/, value),
+    tokenHMAC: (value) => exact(/^[A-Za-z0-9+/]{1,128}={0,2}$/, value),
+    cvvIncluded: (value) => typeof value === "boolean"
+};
+var SUCCESS_KEYS = Object.keys(SUCCESS_RULES);
+// src/poynt.js
+var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var NONCE_URL = new RegExp(`^https://services\\.poynt\\.net/v1/commerce/stores/(${UUID})/payment-tokens/generate-nonce$`);
+var STORE_ID = new RegExp(`^${UUID}$`);
+var APPLICATION_ID = new RegExp(`^urn:aid:${UUID}$`);
+var pin7 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
+var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin7({
+        id: "yearning_for_learning",
+        merchant: "Yearning for Learning Publishing & Coaching",
+        origins: ["https://ff305485-ba6c-423a-87b0-cebe3f83ffe9.mysimplestore.com"],
+        storeIds: ["71ac12ed-e61f-4318-95db-db0e7c649d6f"]
+    }),
+    pin7({
+        id: "timber_ridge_bookkeeping",
+        merchant: "Timber Ridge Bookkeeping",
+        origins: ["https://d7d64ac3-0352-4e53-af9a-f6d8e7b5fb71.mysimplestore.com"],
+        storeIds: ["27be984a-0a03-4a54-8675-e64bbbe1c43e"]
+    })
+]);
+var MAX_ANSWER_CHARS = 16 * 1024;
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2561,7 +3177,15 @@ var METHOD_PAGE = /* @__PURE__ */ new Set(["resultadoMethod", ...BROWSER_FIELDS,
 var REDSYS_REFUSALS = Object.freeze(["redsys_card_page", "redsys_3ds_challenge", "redsys_declined"]);
 // src/processors/quickpay.js
 var QUICKPAY_HOSTS = Object.freeze(["payment.quickpay.net"]);
-var QUICKPAY_MERCHANTS = Object.freeze([]);
+var QUICKPAY_MERCHANTS = Object.freeze([
+    Object.freeze({
+        merchantId: "107268",
+        agreementId: null,
+        merchant: "Skandinavisk Dyrepark",
+        host: "shop.skandinaviskdyrepark.dk",
+        callbackHost: "shop.skandinaviskdyrepark.dk"
+    })
+]);
 var MAX_ENTRY3 = 16 * 1024;
 var REQUIRED3 = Object.freeze([
     "version",
@@ -2617,7 +3241,9 @@ var COMGATE_GATEWAY_HOSTS = Object.freeze({
     "pay3.comgate.cz": "payments-gcp.comgate.cz",
     "pay4.comgate.cz": "payments-gcp.comgate.cz"
 });
-var COMGATE_MERCHANTS = Object.freeze([]);
+var COMGATE_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "Dárek pro Beskydy", origins: Object.freeze(["https://darekprobeskydy.info"]), merchantIds: Object.freeze([]) })
+]);
 var MAX_LOAD = 1024 * 1024;
 var MAX_ANSWER = 64 * 1024;
 var HEADER_NAMES = Object.freeze(["content-type", "x-cg-origin", "origin"]);
@@ -2625,7 +3251,9 @@ var COMGATE_REFUSALS = Object.freeze(["comgate_3ds_challenge", "comgate_declined
 // src/processors/przelewy24.js
 var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
 var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
-var PRZELEWY24_MERCHANTS = Object.freeze([]);
+var PRZELEWY24_MERCHANTS = Object.freeze([
+    Object.freeze({ id: "kupbilet", merchant: "KupBilet.pl", merchantId: null, origins: Object.freeze(["https://www.kupbilet.pl"]) })
+]);
 var MAX_PAGE4 = 256 * 1024;
 var CURRENCIES3 = Object.freeze(["PLN", "EUR", "GBP", "USD", "CZK", "CHF", "DKK", "NOK", "SEK", "RON", "BGN", "HUF"]);
 var PRZELEWY24_AJAX_HEADERS = Object.freeze({ Accept: "*/*", "X-Requested-With": "XMLHttpRequest" });
@@ -2648,7 +3276,15 @@ var TRANSBANK_HOSTS = Object.freeze(["webpay3g.transbank.cl", "webpay3gint.trans
 var TRANSBANK_SANDBOX_HOSTS = Object.freeze(["webpay3gint.transbank.cl"]);
 var TOKEN = "[0-9a-f]{64}";
 var ENTRY_QUERY = new RegExp(`^\\?token_ws=(${TOKEN})$`);
-var TRANSBANK_MERCHANTS = Object.freeze([]);
+var TRANSBANK_MERCHANTS = Object.freeze([
+    Object.freeze({
+        commerceCode: null,
+        fantasyName: null,
+        merchant: "Teleférico Santiago",
+        hosts: Object.freeze(["telefericosantiago.cl"]),
+        returnHost: "telefericosantiago.cl"
+    })
+]);
 var MAX_PAGE5 = 64 * 1024;
 var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
 var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
@@ -2666,7 +3302,7 @@ var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
 ]);
 var PAYTRAIL_MERCHANTS = Object.freeze([]);
 var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
-var UUID = new RegExp(`^${UUID_SOURCE}$`);
+var UUID2 = new RegExp(`^${UUID_SOURCE}$`);
 var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
 var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
 var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
@@ -2674,6 +3310,101 @@ var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`
 var MAX_PAGE6 = 256 * 1024;
 var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
 var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
+// src/processors/eximbay.js
+var EXIMBAY_HOSTS = Object.freeze(["secureapi.eximbay.com", "secureapi.test.eximbay.com"]);
+var EXIMBAY_MERCHANTS = Object.freeze([]);
+var MAX_ENTRY4 = 16 * 1024;
+var REQUIRED4 = Object.freeze(["ver", "mid", "txntype", "ref", "cur", "amt", "buyer", "email", "lang", "returnurl", "statusurl", "fgkey"]);
+var CURRENCIES4 = Object.freeze({ USD: 2, KRW: 0, JPY: 0, EUR: 2, GBP: 2, SGD: 2, HKD: 2, CAD: 2, AUD: 2, THB: 2 });
+var MAX_PAGE7 = 512 * 1024;
+var ATTRS = `(?:[^>"']|"[^"]{0,1024}"|'[^']{0,1024}'){0,512}`;
+var startTag = (name) => new RegExp(`<${name}(?=[\\t\\n\\f\\r />])${ATTRS}>`, "gi");
+var FORM_START = startTag("form");
+var INPUT_START = startTag("input");
+var SELECT_TAG = startTag("select");
+var OPTION_TAG = startTag("option");
+var BUTTON_TAG = startTag("button");
+var FIELDSET_TAG = startTag("fieldset");
+var XHR_HEADERS = Object.freeze({ "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest" });
+var FORM_HEADERS2 = Object.freeze({ "Content-Type": "application/x-www-form-urlencoded" });
+var SKIPPED = Object.freeze([
+    ["<!--", "-->", /<!--[\s\S]*?-->/g],
+    ["<script", "</script", /<script\b[\s\S]*?<\/script\s*>/gi],
+    ["<style", "</style", /<style\b[\s\S]*?<\/style\s*>/gi]
+]);
+var CARD_KEYS_WINDOW = Object.freeze(["cardno1", "cardno2", "cardno3", "cardno4", "cardNum", "month", "year", "cvc"]);
+var WINDOW_FIELDS = /* @__PURE__ */ new Set([
+    "paramkey",
+    "cardcode",
+    "channelCode",
+    "issuerCountry",
+    ...CARD_KEYS_WINDOW,
+    "tel",
+    "unioncardno",
+    "unionoffcardno",
+    "month_unionpay",
+    "year_unionpay",
+    "firstname",
+    "lastname",
+    "cvc_unionpay",
+    "firstname_unionpay",
+    "lastname_unionpay",
+    "email",
+    "shipTo_country",
+    "shipTo_postalCode",
+    "shipTo_city",
+    "shipTo_street1"
+]);
+var WRITTEN = /* @__PURE__ */ new Set(["cardcode", "issuerCountry", ...CARD_KEYS_WINDOW, "firstname", "lastname"]);
+var OTHER_CARD = Object.freeze(["unioncardno", "unionoffcardno", "month_unionpay", "year_unionpay", "cvc_unionpay"]);
+var BRANDS = Object.freeze({
+    C000: /^4\d{15}$/,
+    C001: /^(?:5[1-5]\d{14}|2(?:22[1-9]|2[3-9]\d|[3-6]\d{2}|7[01]\d|720)\d{12})$/,
+    C002: /^3[47]\d{13}$/,
+    C003: /^35(?:2[89]|[3-8]\d)\d{12}$/
+});
+var EXIMBAY_REFUSALS = Object.freeze(["eximbay_card_refused", "eximbay_3ds_challenge", "eximbay_declined"]);
+var RESULT_BINDS = Object.freeze(["mid", "txntype", "ref", "cur", "amt"]);
+// src/processors/barion.js
+var BARION_HOSTS = Object.freeze(["secure.barion.com", "secure.test.barion.com"]);
+var BARION_SANDBOX_HOSTS = Object.freeze(["secure.test.barion.com"]);
+var BARION_SHOPS = Object.freeze([]);
+var MAX_PAGE8 = 512 * 1024;
+var CURRENCIES5 = Object.freeze(["HUF", "EUR", "USD", "CZK", "RON", "PLN"]);
+var CARD_INPUTS = Object.freeze({ number: "cc-number", expiry: "cc-exp-date", cvc: "CardCVC", holder: "CardHolderName" });
+var CHECKBOXES = Object.freeze(["RegisterUser", "AcceptedTerms", "HasEmailConsent"]);
+var OTHER_INPUTS = Object.freeze({ FirstPassword: ["password"], RecaptchaToken: ["hidden"], __RequestVerificationToken: ["hidden"], Identifier: ["hidden"] });
+var BARION_AJAX_HEADERS = Object.freeze({
+    Accept: "*/*",
+    "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
+    "X-Requested-With": "XMLHttpRequest"
+});
+var CARD_TYPES2 = Object.freeze([{ prefix: /^4/, type: 20 }, { prefix: /^5[1-5]|^2[2-7]/, type: 10 }, { prefix: /^3[47]/, type: 30 }]);
+var COLOR_DEPTHS = Object.freeze([1, 4, 8, 15, 16, 24, 32, 48]);
+var BARION_REFUSALS = Object.freeze(["barion_declined", "barion_3ds_challenge", "barion_sca_soft_decline"]);
+var MAX_ANSWER2 = 64 * 1024;
+var DECLINE_CODES = Object.freeze([
+    "CardError",
+    "CardExpired",
+    "MaximumCardPaymentAmountExceeded",
+    "MinimumCardPaymentAmountNotReached",
+    "PaymentExpired",
+    "PaymentCancelled",
+    "PaymentFailed",
+    "ThreeDsNotEnabled",
+    "ThreeDsAuthenticationFailed",
+    "NoSuitableProviderFound",
+    "EmailBelongsToValidUser",
+    "InvalidEmailAddress",
+    "CvcRequired",
+    "CardHolderNameRequired",
+    "CardRegistrationExpired",
+    "StartPaymentError",
+    "TheSourceAndDestinationAccountsAreMatched",
+    "UserIsSuspended",
+    "AccountSuspended"
+]);
+var FRICTIONLESS_STATUSES = Object.freeze([0, 5, 7]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -2864,18 +3595,18 @@ function parseStripeCheckoutContext(request) {
     if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
         reject("context_invalid");
     const encoded = entries[0][1];
-    let text = "", bits = 0, count = 0;
+    let text2 = "", bits = 0, count = 0;
     for (const char of encoded) {
         bits = bits << 6 | alphabet.indexOf(char);
         count += 6;
         if (count >= 8) {
             count -= 8;
-            text += String.fromCharCode(bits >>> count & 255);
+            text2 += String.fromCharCode(bits >>> count & 255);
         }
     }
     let value;
     try {
-        value = context(JSON.parse(text));
+        value = context(JSON.parse(text2));
     }
     catch {
         reject("context_invalid");