@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: abafbcce1536643bd38817e2332c0e107e93b04bc347051096c6e031cda00722
+// artifact-sha256: 360d9805357acc5244c3beafbb16a6da782e933b506db49c2d63df06ac23f7b4
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -600,6 +600,102 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             dedupe: ["checkout-account", "checkout-transaction-id"]
         }
     },
+    {
+        psp: "eximbay",
+        // Eximbay's payment window, the Korean gateway that takes foreign cards for Korean merchants selling
+        // abroad. The merchant's page posts a
+        // signed ENTRY form, top-level or into a popup, to https://secureapi.eximbay.com/Gateway/BasicProcessor.krp
+        // (Eximbay's integration v230, which its JavaScript SDK submits too): the amount, the merchant's mid, its
+        // order reference, its return and status URLs and an fgkey, a SHA-256 over every field under the
+        // merchant's secret key, and no card. Eximbay answers with a page that posts itself, with a paramkey, into
+        // its window under a JSESSIONID cookie, so a card form rebuilt away from that session has no payment to pay
+        // (processors/eximbay.js). The paused request is therefore the entry, a Document navigation that carries no
+        // card: the cardholder's device repeats it over the end-to-end TLS relay, fills the card into the window
+        // Eximbay returns to it and posts it back in that same session, and the runtime resolves the paused
+        // navigation with the hosted_form notice. Only the entry path is matched, exactly (processors/eximbay.js
+        // isEximbayEntryUrl: a query would reach Eximbay's servlet as fields beside the signed body). The window's
+        // card lookup (checkCardBin.do) and its card post (checkApprv.jsp) carry a card and are never paused, and
+        // the agent's browser never loads the window while the entry waits. The SDK's Eximbay gate refuses those
+        // two posts in the agent's browser, with every other post to these hosts but the entry
+        // (checkout/src/pre-claim.ts eximbayPreClaim), so no dummy card reaches Eximbay. Eximbay's test host serves
+        // the same window for test merchants, so a live row reaches the live host only and a test row the test host
+        // only. Dark: served only to a client that declares the capability, and gated off for every org the operator
+        // has not allowlisted.
+        capability: "eximbay_hosted_payment_page",
+        match: "secureapi\\.(?:test\\.)?eximbay\\.com/Gateway/BasicProcessor\\.krp",
+        hosts: ["^secureapi\\.eximbay\\.com$", "^secureapi\\.test\\.eximbay\\.com$"],
+        sandboxHosts: ["^secureapi\\.test\\.eximbay\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "form",
+        passthroughHeaders: [],
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the window Eximbay returns to the device, not into the paused entry, which must
+            // carry none (processors/eximbay.js checkEximbayEntry). The device never posts a form of its own: the
+            // Vault's form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/eximbay.js checkEximbayEntry), the reviewed merchants among them: the
+            // create runs them, and naming them here makes the cardholder's device run them again on the entry it is
+            // about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "eximbay",
+            required: ["ver", "mid", "txntype", "ref", "cur", "amt", "buyer", "email", "lang", "returnurl", "statusurl", "fgkey"],
+            // The window's own card fields, which the device fills in the window (never in the entry). The window's
+            // script also splits the number into cardno1 to cardno4 beside cardNum.
+            card: { number: "cardNum", month: "month", year: "year", cvc: "cvc" },
+            // The merchant, its order reference and the amount name one payment.
+            dedupe: ["mid", "ref", "amt", "cur"]
+        }
+    },
+    {
+        psp: "barion",
+        // Barion's Smart Gateway (Barion Payment Zrt.), where Hungarian, Czech and Slovak shops send a buyer who pays
+        // by card as a guest. The merchant's SERVER starts the payment (POST api.barion.com/v2/Payment/Start under its
+        // POSKey: the amount, the shop, its RedirectUrl) and sends the buyer's browser to
+        // secure.barion.com/Pay?Id={PaymentId}, a GET. That ENTRY is the payment's id alone: no card, no amount and no
+        // merchant, all of which Barion bound to the id on its own server. Barion answers with the gateway under a
+        // session of its own (an ASP.NET session and an anti-forgery token), whose script posts the card to
+        // /Pay/PrepareCardPaymentForGuest and /Pay/CompletePaymentAsGuestWithCard on the same host in that session, so a
+        // card post made away from that session has no payment to pay (processors/barion.js). The paused request is
+        // therefore the entry, a Document navigation that carries no card: the cardholder's device repeats it over the
+        // end-to-end TLS relay and makes the gateway's posts itself in that same session, and the runtime resolves the
+        // paused navigation with the hosted_form notice. Only the entry is matched, exactly (processors/barion.js
+        // isBarionEntryUrl: the path /Pay and one Id or id parameter, since the gateway acts on others): the card posts,
+        // the email check and the 3-D Secure steps share the host, and none of them is the entry. secure.test.barion.com
+        // runs the same gateway for Barion's test shops: a live row reaches only the live host and a test row only the
+        // test host, which takes only Barion's test cards. Dark: served only to a client that declares the capability,
+        // and gated off for every org the operator has not allowlisted.
+        capability: "barion_hosted_payment_page",
+        match: "secure(?:\\.test)?\\.barion\\.com/Pay",
+        hosts: ["^secure\\.barion\\.com$", "^secure\\.test\\.barion\\.com$"],
+        sandboxHosts: ["^secure\\.test\\.barion\\.com$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the gateway's own posts, which the device makes as the gateway's script does, since the
+        // entry has no body. No captured header is ever replayed.
+        encoding: "form",
+        passthroughHeaders: [],
+        // The entry is the GET the merchant's redirect makes, and it carries no card: the card goes into the gateway's
+        // own posts on the device. A client that pauses a GET only for a processor whose request it checks (the
+        // checkout SDK's isRecognizerRequest) never pauses this one until it learns the entry.
+        request: { method: "GET", cardIn: "none", response: "html_page" },
+        mode: "hosted_form",
+        hostedForm: {
+            // The card goes into the gateway's posts the device makes, never into the paused entry, which carries no
+            // body at all (processors/barion.js checkBarionEntry). The device never posts a form of its own: the Vault's
+            // form-action policy leaves these hosts out.
+            cardIn: "processor_page",
+            // The entry's own rules (processors/barion.js checkBarionEntry): the create runs them, and naming them here
+            // makes the cardholder's device run them again on the entry it is about to repeat (forms.js
+            // hostedFormTemplateRefusal).
+            policy: "barion",
+            // The entry is a bodiless GET, so no form field is required of it.
+            required: [],
+            // The fields of the gateway's charge post, which the device fills there (never in the entry).
+            card: { number: "CardNumber", expiry: "CardExpiration", cvc: "CardCVC" },
+            // The payment id in the entry's URL names one payment Barion started; the policy reads it there
+            // (checkBarionEntry's dedupe), since no form field holds it.
+            dedupe: ["(paymentId)"]
+        }
+    },
     // ── Verified tokenizers (plaintext PAN in the body) ───────────────────────
     // Each entry below was checked against the PSP's own shipped browser SDK or a
     // live probe, then run through resolveRecognizerForUrl with positive, sibling
@@ -2024,13 +2120,14 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // approves. paygent.js holds the rule the pause decision and the device read: the exact URL, the
         // script's content type, and createToken's seven keys in its order and spelling with the token key
         // held to the host's environment; createCvcToken (a stored card's code) is refused. The script
-        // abandons the XHR after 35 s; the preparation that moves the approval before the press comes with
-        // the API's Paygent change, which sets `preparationRequired` with it.
+        // abandons the XHR after 35 s, too soon for an approval after the press that sends it, so the
+        // lane is prepared only (`preparationRequired`): the cardholder approves before the press, and the
+        // press's request binds that approval (paygent.js isPreparedPaygentRequest). On the live host it
+        // binds only the merchant_id a reviewed pin lists for the approved origin and merchant
+        // (PAYGENT_MERCHANT_PINS), and one approval binds one request, so a second card request is sent nowhere.
         // Paygent's hosted payment page (link.paygent.co.jp) carries the card on other paths and is not paused.
         // Paygent answers a refused card inside HTTP 200, so its own judge reads every answer by its body
-        // (paygent.js paygentAnswerOutcome), never the shared status rule. No operator lists an org before the
-        // API's Paygent change lands: the amount the request does not name, the merchant pin per checkout
-        // origin, the refusal of a second card request on one checkout, and the preparation for the 35 s window.
+        // (paygent.js paygentAnswerOutcome), never the shared status rule.
         // Ships dark: served only to a client that declares `paygent_token`, gated off for every org until an
         // operator lists one (`paygent:<org>`), and autopilot never sends this request (autopilot.js
         // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.paygent.co.jp only on
@@ -2040,6 +2137,7 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^token\\.paygent\\.co\\.jp$", "^sandbox\\.paygent\\.co\\.jp$"],
         sandboxHosts: ["^sandbox\\.paygent\\.co\\.jp$"],
         hostEnvironmentPinned: true,
+        preparationRequired: true,
         // The body's shape is a form's (key=value pairs); its wire type stays the script's text/plain
         // (request-policy.js contentTypeFor). No header but the content type rides.
         encoding: "form",
@@ -2106,16 +2204,17 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         psp: "sumup",
         // SumUp's online payments (UK, EEA, US, Latin America): the Payment Widget
         // (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) that SumUp's WooCommerce plugin, its Payment Links, Online
-        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page serves every
-        // merchant from one origin). Each card field is a frame on gateway.sumup.com, and a
+        // Store and invoices all mount (its hosted checkout page too, which this lane refuses: that page sends a body
+        // nobody has reviewed). Each card field is a frame on gateway.sumup.com, and a
         // hidden form frame there sends the card in one PUT to https://api.sumup.com/v0.2/checkouts/<checkout id>:
         // JSON {"payment_type":"card","device_information":..,"card":{"name","number","expiry_month":"MM",
         // "expiry_year":"YY" or "YYYY","cvv"},"installments":1,..}, unencrypted, with X-Sumup-Correlation-Id naming
         // the same checkout. sumup.js holds the request rule the pause decision, the API's create and the device all
         // read: exactly that URL, a JSON Content-Type, the correlation id, and the widget's body byte for byte, with
         // a body that carries a recurring mandate, which keeps the card at SumUp, refused. The body names no
-        // amount and no merchant: the checkout the merchant's server created holds both, so a live request is taken
-        // only for a checkout origin a reviewed pin lists. The request carries no cookie and no Authorization
+        // amount and no merchant: the checkout the merchant's server created holds both, so the API reads the checkout
+        // from SumUp by its id and takes a live request only for a merchant code a reviewed pin lists (sumup.js
+        // SUMUP_MERCHANT_PINS). The request carries no cookie and no Authorization
         // header (the checkout id is its credential), and the API answers any browser origin's preflight with
         // credentials omitted. The answer is the checkout: PAID, FAILED, or PENDING with a 3-D Secure step the
         // widget then runs in the page. SumUp's sandbox merchants share the live host, so no sandbox host is
@@ -2227,6 +2326,432 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: ["^origin$", "^referer$"],
         cardFields: ["card_number"],
         passWithoutCard: "(?:sb)?checkout\\.payfort\\.com/FortAPI/paymentPage"
+    },
+    {
+        psp: "paypal",
+        // PayPal Card Fields (Advanced Credit and Debit Card Payments) on Orders v2: one JSON POST from a
+        // PayPal-owned frame to confirm-payment-source for the order the merchant's server created. Card
+        // Fields v5 (www.paypal.com/smart/card-field) sends it to its own origin, v6 to api-m.paypal.com.
+        // PAN@ payment_source.card.number, expiry YYYY-MM @ .expiry, CVC @ .security_code; a Bearer token
+        // PayPal minted into the frame; no amount, no encryption. paypal.js holds the rule the pause
+        // decision, the API's create and the device all read: exactly the confirm URL with an upper-case
+        // order id, and the frames' own new-card body. The same URL confirms a PayPal wallet, a saved card
+        // or a token with no number, which continues untouched (jsonCardFields, passWithoutCard). Not here: legacy Hosted
+        // Fields on cors.api.paypal.com and PayPal's guest card form, which the checkout SDK refuses for
+        // every company, the order's other calls, subscriptions and /v2/payments/find-bin-details.
+        // PayPal-Auth-Assertion is a server-side header and never rides.
+        // Ships dark: served only to a client that declares `paypal_card_fields`, gated off for every org
+        // until an operator lists one (`paypal:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): the sandbox
+        // hosts only on test rows and only with documented test cards, the live hosts only on live rows.
+        capability: "paypal_card_fields",
+        match: "(?:www|api-m)(?:\\.sandbox)?\\.paypal\\.com/v2/checkout/orders/[A-Z0-9]{1,36}/confirm-payment-source(?![\\w/-])",
+        hosts: ["^www\\.paypal\\.com$", "^www\\.sandbox\\.paypal\\.com$", "^api-m\\.paypal\\.com$", "^api-m\\.sandbox\\.paypal\\.com$"],
+        sandboxHosts: ["^www\\.sandbox\\.paypal\\.com$", "^api-m\\.sandbox\\.paypal\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [
+            "^authorization$",
+            "^prefer$",
+            "^paypal-client-metadata-id$",
+            "^paypal-partner-attribution-id$",
+            "^paypal-integration-artifact$",
+            "^fn_sync_data$"
+        ],
+        jsonCardFields: [["payment_source", "card", "number"]],
+        passWithoutCard: "(?:www|api-m)(?:\\.sandbox)?\\.paypal\\.com/v2/checkout/orders/[A-Z0-9]{1,36}/confirm-payment-source"
+    },
+    {
+        psp: "clover",
+        // Clover (a Fiserv company), North America. Clover's card frame (the INTERMEDIATE frame of
+        // checkout.clover.com/widget.html, which checkout.clover.com/sdk.js mounts on Clover's payment links, Hosted
+        // Checkout and Online Ordering and on every merchant site that embeds Clover's iframe) sends the card to Clover's
+        // token API, which answers with a single-use clv_ token the merchant's server charges afterwards. One JSON POST
+        // to exactly https://token.clover.com/v1/tokens (token-sandbox.dev.clover.com on Clover's sandbox), under the
+        // merchant's public Ecommerce key in the apikey header and X-Clover-Client-Type HOSTED_IFRAME, with the card in
+        // `card`: the number as encrypted_pan, RSA-OAEP under Clover's published TransArmor key, and the code, expiry,
+        // first six, last four and brand in plain text. clover.js holds the request rule the pause decision and the
+        // device read, and the API's create once its Clover branch lands: exactly that URL, the frame's three headers,
+        // and the frame's single-use card body with nothing the frame does not write. The body names no amount, so a
+        // live request is taken only for a store and key a reviewed pin names together. As for GMO, the paused body
+        // holds the agent's placeholder ciphertext and nothing can be written into it: injectCard and
+        // prepareDeviceReplay refuse this psp, and the cardholder's device builds the request with the real card under
+        // the key payment-core pins and sends it itself (the token API answers the Vault's origin), with no relay. A
+        // multi-pay token, the frame's reCAPTCHA variant, a number sent in the clear and every gift card, ACH or wallet
+        // token request to the same URL are refused. token-sandbox.dev.clover.com is Clover's sandbox: pinned (S7) to
+        // test rows, which send only Clover's test cards.
+        // Ships dark: served only to a client that declares `clover_card_token`, gated off for every org until an
+        // operator lists one (`clover:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` keeps /v1/tokens/<id> and /v1/tokens.json out of `match`;
+        // every consumer anchors it, and recognition.js takes only the exact URL (isCloverTokenUrl).
+        capability: "clover_card_token",
+        match: "token(?:-sandbox\\.dev)?\\.clover\\.com/v1/tokens(?![\\w/.%-])",
+        hosts: ["^token\\.clover\\.com$", "^token-sandbox\\.dev\\.clover\\.com$"],
+        sandboxHosts: ["^token-sandbox\\.dev\\.clover\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The merchant's key and the frame's client type are what the token API reads beside the body, and the Accept
+        // rides as the frame sent it; origin, referer and cookies never do.
+        passthroughHeaders: ["^apikey$", "^x-clover-client-type$", "^accept$"],
+        jsonCardFields: [["card", "encrypted_pan"]]
+    },
+    {
+        psp: "tap_payments",
+        // Tap Payments' Card SDK v2 frame (sdk.tap.company/v2/card/index.html), the card form of Tap's hosted
+        // checkout (checkout.tap.company) and of every merchant embedding the Card SDK, in Kuwait, Saudi
+        // Arabia, the UAE, Bahrain, Qatar and Oman. The frame encrypts the card itself: JSEncrypt
+        // (RSAES-PKCS1-v1_5, base64) of JSON.stringify({cvc, exp_month, exp_year, name, number}) under the
+        // merchant's own RSA key, sent as encryptedData in one JSON POST to /v2/card/token with the merchant's
+        // publishable key as Authorization. Tap answers a token (tok_...); 3-D Secure and the charge follow,
+        // card free. tap-payments.js holds the request rule the pause decision, the API, the device and the
+        // swap read: the exact URL, the frame's body, a one-time purpose, and a publishable key a reviewed pin
+        // lists with the merchant's key (TAP_PAYMENTS_MERCHANT_PINS). cse mode, as GMO, Shiji STS and Paddle
+        // TokenEx ship: the cardholder's device encrypts the real card under the pinned key, the runtime swaps
+        // encryptedData (substituteTapPayments), and the agent's frame sends the request (the token endpoint
+        // answers no preflight from the Vault's origin). A save purpose, a consent to keep the card and a
+        // payment agreement are refused. Test and live keys share the host, and a key's own prefix names its
+        // environment, so no sandbox host is marked.
+        // Ships dark: served only to a client that declares `tap_card_sdk_token`, gated off for every org
+        // until an operator lists one (`tap_payments:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "tap_card_sdk_token",
+        match: "sdk\\.tap\\.company/v2/card/token(?![\\w/.-])",
+        hosts: ["^sdk\\.tap\\.company$"],
+        encoding: "json",
+        // The publishable key names the merchant the card is encrypted for; the frame's other headers (mdn,
+        // application) ride on the page's own request and are never recorded.
+        passthroughHeaders: ["^authorization$"],
+        // The one ciphertext, by the role the client table names, so it carries the same encrypted-field set
+        // the approve leg accepts (vault-allowlist-drift). The generic Adyen substitution refuses it (RSA
+        // base64, not a JWE): only substituteTapPayments writes this body, dispatched by psp.
+        encryptedCardFields: { number: "encryptedData" },
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-pkcs1v15", at: "", fields: ["encryptedData"] }
+    },
+    {
+        psp: "conekta",
+        // Conekta (Mexico) through Conekta.js, the tokenizer a merchant's own page loads from cdn.conekta.io or hosts
+        // itself: on Pay it posts the card with one XHR, in clear JSON, to https://api.conekta.io/tokens under the
+        // merchant's public key (Basic authorization) and Accept application/vnd.conekta-v0.3.0+json, as
+        // {"card":{<the page's members>,"device_fingerprint"}}: card.number, card.cvc, card.exp_month, card.exp_year and
+        // card.name, in the page's order. The answer is a single-use token the merchant's server charges later; the request
+        // names no amount, so the agent's amount is the price the cardholder approves. conekta.js holds the rules the pause
+        // decision, the API's create and the device read: the exact URL, the tokenizer's headers, and the page's card body
+        // member by member, with the tokenizer's fingerprint last. Conekta's Component (pay.conekta.com/api/tokens, the
+        // frame behind the WooCommerce plugin 5.x and 6.x, the Shopify app, hosted checkout and payment links) seals its
+        // token form in the page, so its two token URLs are named here only to be refused: its POST by name
+        // (conekta_component_unsupported) at the pause, the API's create and the device; its PUT, not this recognizer's
+        // method, continues untouched with the agent's placeholder, and the create refuses it as a method no Conekta card
+        // request uses. Conekta's API answers any browser origin, so the card leaves the cardholder's
+        // device by a direct fetch. Test and live share api.conekta.io and Conekta's keys name no mode, so no sandbox host
+        // is marked and the lane takes live rows alone: a live request pays only an origin and a key one reviewed pin lists
+        // together (conekta.js conektaMerchantRefusal), and none is listed yet. Conekta can answer a refusal inside a 2xx,
+        // so its own judge reads every answer (conekta.js conektaAnswerOutcome), never the shared status rule.
+        // Ships dark: served only to a client that declares `conekta_tokenizer`, gated off for every org until an
+        // operator lists `conekta:<org>`, and autopilot never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        // `(?![\w/.-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "conekta_tokenizer",
+        match: "(?:api\\.conekta\\.io/tokens|pay\\.conekta\\.com/api/tokens/?)(?![\\w/.-])",
+        hosts: ["^api\\.conekta\\.io$", "^pay\\.conekta\\.com$"],
+        encoding: "json",
+        // Conekta.js's public key, its API version and the four headers beside them. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$", "^accept-language$", "^conekta-client-user-agent$", "^raisehtmlerror$", "^x-tokenization-source$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "makecommerce",
+        // MakeCommerce (Maksekeskus AS; Estonia, Latvia, Lithuania, Finland), which takes the card in its own card frame
+        // (https://cc.maksekeskus.ee/card) over the shop's order page. On Pay the frame posts the card in clear JSON to its
+        // own origin, https://cc.maksekeskus.ee/card-payment, under the shop's publishable key (Basic authorization):
+        // card.number, card.exp_month (MM), card.exp_year (YY), card.cvc and card.name, beside the transaction's id, the
+        // shop's id and host, and the "Remember my card" and subscription boxes. makecommerce.js holds the request rule
+        // the pause decision, the API's create and the device all read: exactly the card endpoint URL, the JSON type,
+        // the body's own key under Basic, and the frame's body byte for byte, with either box ticked refused (it keeps
+        // the card on file). The body names no amount: MakeCommerce's transaction holds it, in EUR. The endpoint answers
+        // no browser origin, so the card leaves the cardholder's device only through the checkout relay, and only the
+        // publishable key rides beside the card. cc-test.maksekeskus.ee is MakeCommerce's TEST environment: pinned (S7)
+        // to test rows, which send only its published test cards.
+        // Ships dark: served only to a client that declares `makecommerce_card_frame`, gated off for every org until an
+        // operator lists one (`makecommerce:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "makecommerce_card_frame",
+        match: "cc(?:-test)?\\.maksekeskus\\.ee/card-payment(?![\\w/.%-])",
+        hosts: ["^cc\\.maksekeskus\\.ee$", "^cc-test\\.maksekeskus\\.ee$"],
+        sandboxHosts: ["^cc-test\\.maksekeskus\\.ee$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's publishable key. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "tokenex_iframe",
+        // TokenEx hosted iframe v3 (v3.min.js?version=latest, read 2026-10-18) in PCI mode
+        // with its CVV frame: JetBlue's booking checkout (TokenExID 9014311640612780, Origin
+        // https://www.jetblue.com). PAN@ Data, CVV@ CvvValue (json). TokenEx's own card-number iframe document
+        // on htp.tokenex.com reads the CVV from its same-origin CVV frame and posts the whole card as one XHR
+        // to its own document URL, query included: application/json, with TokenExID, Origin, the
+        // AuthenticationKey the merchant's server minted, Timestamp and TokenScheme (each echoed in the
+        // query), the frame's flags, and no amount, cookie or merchant session. The cardholder name and the
+        // expiry stay on the merchant's page. tokenex-iframe.js judges the whole request (the exact URL and
+        // its query, the body's keys in order and their types, the query and body agreeing), refuses a
+        // cvvOnly or PCI-only frame, a placeholder of another brand than the card, and an account it has not
+        // reviewed, and writes only Data and CvvValue. BinLookup and Forter post to their own paths under
+        // /iframe/v3 and never match (the right-edge boundary and the exact-URL rule in
+        // resolveRecognizerForUrl); a post with an empty Data carries no card and continues untouched
+        // (passWithoutCard). Hosts are the two literal labels (never *.tokenex.com: api. and test-api. are
+        // TokenEx's server API, which carries merchant credentials); the test host is pinned (S7): it takes
+        // only documented test cards, and a live row never points at it.
+        // Ships dark: served only to a client that declares `tokenex_iframe_tokenize`, gated off for every
+        // org until an operator allowlists one, and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). Not paddle_tokenex: that lane is Paddle's own frame, which
+        // encrypts the card for TokenEx inside Paddle's /pay.
+        capability: "tokenex_iframe_tokenize",
+        match: "(?:test-)?htp\\.tokenex\\.com/iframe/v3(?:[?#]|$)",
+        hosts: ["^htp\\.tokenex\\.com$", "^test-htp\\.tokenex\\.com$"],
+        sandboxHosts: ["^test-htp\\.tokenex\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        passthroughHeaders: [],
+        // only the content type rides: no cookie, origin or referer
+        jsonCardFields: [["Data"]],
+        passWithoutCard: "(?:test-)?htp\\.tokenex\\.com/iframe/v3"
+    },
+    {
+        psp: "poynt",
+        // GoDaddy Payments' card frame, Poynt Collect (cdn.poynt.net/collect/payment-form), on a GoDaddy
+        // Online Store checkout: one JSON POST to generate-nonce for the store the URL names. PAN@
+        // card.number, with expirationMonth ("MM"), expirationYear ("20YY") and the network the frame read
+        // (type) beside it, and the security code outside the card, at verificationData.cvData. poynt.js
+        // holds the request rule the pause decision, the API's create and the device all read: exactly the
+        // URL, the frame's headers and the frame's body byte for byte. Poynt answers with a nonce that
+        // GoDaddy's server charges. services.poynt.net refuses every browser origin but the frame's, so the
+        // card leaves the cardholder's device only through the checkout relay. The frame's open-tokenize
+        // path, for a page that names no store, is not matched, so it continues untouched. No sandbox host.
+        // Ships dark: served only to a client that declares `poynt_collect_nonce`, gated off for every org
+        // until an operator lists one (`poynt:<org>`), held to the stores poynt.js pins per checkout
+        // origin, and autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "poynt_collect_nonce",
+        match: "services\\.poynt\\.net/v1/commerce/stores/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/payment-tokens/generate-nonce",
+        hosts: ["^services\\.poynt\\.net$"],
+        encoding: "json",
+        // The frame's own session, request and version ids, Sardine's session and the reCAPTCHA Enterprise
+        // token Poynt checks; never the page's Authorization, which GoDaddy's checkout does not pass.
+        passthroughHeaders: [
+            "^poynt-session-id$",
+            "^poynt-request-id$",
+            "^poynt-collect-version$",
+            "^poynt-sardine-session-id$",
+            "^recaptcha-token$",
+            "^recaptcha-type$"
+        ]
+    },
+    {
+        psp: "cardcom",
+        // Cardcom (Israel), whose own payment page (https://secure.cardcom.solutions/EA/EA5/<page id>, Cardcom's Vue app)
+        // posts the whole page state on Process, as same-origin JSON, to https://secure.cardcom.solutions/api/EA5/SubmitPayment:
+        // the bot check's token, the page's seven stores and a 3-D Secure block. The card sits in clear text twice,
+        // Store.PaymentStore.{CardNumberField, MonthsField, YearsField, CvvField, CardOwnerNameField}.Value and
+        // _3DSecureReq.{CardNumber, CardExpireMonth, CardExpireYear, CVV, CardholderFullName}; the page id, the terminal and
+        // the amount ride beside it. cardcom.js holds the request rule the pause decision, the API's create and the device
+        // all read: exactly that URL, the page's one JSON Content-Type, and the page's own body for a one-time charge of one
+        // product, its two copies of the card the same; a standing order, installments, a kept card, 3-D Secure, an
+        // Israeli ID and a Turnstile or reCAPTCHA v2 page are refused by name. The endpoint answers any browser origin, so
+        // the device sends it by a direct fetch, with no cookie, and the bot check's token rides inside the paused body as
+        // the person's press minted it. Cardcom's test terminal shares the live host, so no sandbox host is marked and the
+        // lane takes live rows alone, each under a reviewed page pin (cardcom.js cardcomMerchantRefusal). Cardcom answers
+        // inside HTTP 200 whether it charged or not, so its own judge reads every answer (cardcom.js cardcomAnswerOutcome).
+        // The LowProfile pages' /api/LPC6/SubmitPayment, the wallets' posts and the legacy EA4 pages are not this lane's.
+        // Ships dark: served only to a client that declares `cardcom_payment_page`, gated off for every org until an
+        // operator lists one (`cardcom:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "cardcom_payment_page",
+        match: "secure\\.cardcom\\.solutions/api/EA5/SubmitPayment(?![\\w/.%-])",
+        hosts: ["^secure\\.cardcom\\.solutions$"],
+        encoding: "json",
+        // The device writes the JSON Content-Type itself; Origin, Referer and the page's cookies never ride.
+        passthroughHeaders: [],
+        jsonCardFields: [["Store", "PaymentStore", "CardNumberField", "Value"], ["_3DSecureReq", "CardNumber"]]
+    },
+    {
+        psp: "nexi_checkout",
+        // Nexi Checkout (formerly Nets Easy; Denmark, Norway, Sweden, Finland), which takes the card in its own card frame,
+        // https://checkout.dibspayment.eu/v1/, embedded in the merchant's page by checkout.js or mounted by Nexi's hosted
+        // payment page. On Pay the frame posts the card in clear JSON to its own origin, https://checkout.dibspayment.eu/
+        // api/v1/pay, with the merchant's checkout key and the payment's id as headers: paymentType.card.cardNumber,
+        // expiryMonth (MM), expiryYear (YY), cardVerificationCode and cardholderName, beside the payment's amount in minor
+        // units, the card fee and the "save my card" and "remember me" flags. nexi-checkout.js holds the request rule the
+        // pause decision, the API's create and the device all read: exactly the pay endpoint URL, the JSON type, the frame's
+        // session headers and the card form's body byte for byte, with "save my card", "remember me" or a card fee refused
+        // by name. The endpoint answers no browser origin, so the card leaves the cardholder's device only through the
+        // checkout relay, and only the frame's four session headers ride beside the card. test.checkout.dibspayment.eu is
+        // Nexi's test environment: pinned (S7) to test rows, which send only Nexi's published test cards.
+        // Ships dark: served only to a client that declares `nexi_checkout_pay`, gated off for every org until an operator
+        // lists one (`nexi_checkout:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "nexi_checkout_pay",
+        match: "(?:test\\.)?checkout\\.dibspayment\\.eu/api/v1/pay(?![\\w/.%-])",
+        hosts: ["^checkout\\.dibspayment\\.eu$", "^test\\.checkout\\.dibspayment\\.eu$"],
+        sandboxHosts: ["^test\\.checkout\\.dibspayment\\.eu$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's checkout key, payment id, partner merchant number and API version. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^checkoutkey$", "^paymentid$", "^partnermerchantnumber$", "^api-version$"],
+        jsonCardFields: [["paymentType", "card", "cardNumber"]]
+    },
+    {
+        psp: "openpay_bbva",
+        // Openpay (BBVA México's online acquiring platform; Openpay Colombia and Openpay Perú) through openpay.js, the
+        // tokenizer a merchant's own page loads: on Pay it posts the card with one XHR, in clear JSON, to
+        // https://api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe) under the merchant's public key
+        // (Basic authorization), as {card_number, holder_name, cvv2, expiration_month, expiration_year[, address]} in the
+        // caller's own order and types. The answer is a single-use token the merchant's server charges later; the request
+        // names no amount, so the agent's amount is the price the cardholder approves. openpay.js holds the rules the pause
+        // decision, the API's create, the prepared bind and the device read: the exact token URL, openpay.js's three
+        // headers and the caller's body member by member. openpay.js abandons the request 40 s after Pay, so the lane is
+        // prepared only (preparationRequired). Openpay's API answers any browser origin, so the card leaves the
+        // cardholder's device by a direct fetch. A production request pays only an origin whose reviewed pin names its
+        // host, merchant id and key (openpay.js openpayMerchantRefusal). sandbox-api.openpay.<tld> is Openpay's sandbox:
+        // pinned (S7) to test rows, which send only Openpay's documented test cards. Openpay can answer a refusal inside a
+        // 2xx, so its own judge reads every answer (openpay.js openpayAnswerOutcome), never the shared status rule.
+        // Ships dark: served only to a client that declares `openpay_tokenizer`, gated off for every org until an operator
+        // lists `openpay_bbva:<org>`, and autopilot never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        // `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "openpay_tokenizer",
+        match: "(?:sandbox-)?api\\.openpay\\.(?:mx|co|pe)/v1/[a-z0-9]{10,40}/tokens(?![\\w/.%-])",
+        hosts: [
+            "^api\\.openpay\\.mx$",
+            "^api\\.openpay\\.co$",
+            "^api\\.openpay\\.pe$",
+            "^sandbox-api\\.openpay\\.mx$",
+            "^sandbox-api\\.openpay\\.co$",
+            "^sandbox-api\\.openpay\\.pe$"
+        ],
+        sandboxHosts: ["^sandbox-api\\.openpay\\.mx$", "^sandbox-api\\.openpay\\.co$", "^sandbox-api\\.openpay\\.pe$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // openpay.js's public key and its JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"],
+        jsonCardFields: [["card_number"]]
+    },
+    {
+        psp: "toast",
+        // Toast's payments frame (payments.toasttab.com), the card leg of every Toast online-ordering and
+        // e-gift checkout: one POST to /v1/payment-methods with the card sealed in card.cardData, RSA-OAEP
+        // with SHA-1 over a JSON object under a 2048-bit key the frame hardcodes. toast.js holds the one
+        // request rule the pause decision, the API's create, the approve leg and the device read: exactly
+        // that URL and the frame's guest card body byte for byte, under the key id toast.js pins. The device
+        // seals the real card under that pinned key (never one from a row, a request or a page), and the
+        // agent's browser continues its own request with only cardData rewritten, so the frame's bearer,
+        // its restaurant and intent headers and the session secret stay the page's and none is stored. Apple
+        // Pay and Google Pay payment methods share the URL, carry no card the Vault holds, and continue
+        // untouched (passWithoutCard); `jsonCardFields` names where the card sits, and toast.js's own gate
+        // answers before it (card-fields.js). Toast's sandbox needs a partner account, so only the live host is
+        // named and a test row is refused at create. Ships dark: served only to a client that declares
+        // `toast_pinned_key`, off for every org until an operator lists `toast:<org>`, and autopilot never
+        // sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path, so a
+        // consumer that tests `match` unanchored never takes /v1/payment-methods/x for a card request.
+        capability: "toast_pinned_key",
+        match: "payments\\.toasttab\\.com/v1/payment-methods(?![\\w/.-])",
+        hosts: ["^payments\\.toasttab\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["card", "cardData"]],
+        passWithoutCard: "payments\\.toasttab\\.com/v1/payment-methods",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-oaep-sha1-json", at: "card", fields: ["cardData"] }
+    },
+    {
+        psp: "fastspring",
+        // FastSpring's checkout, the merchant of record for every FastSpring store: the popup (Store Builder
+        // Library), embedded and web storefronts all run FastSpring's one checkout app, and its Pay posts the
+        // card as one JSON XHR to <store>.onfastspring.com[/popup-<name>|/embedded-<name>]/session/<id>/payment
+        // (<store>.test.onfastspring.com in a store's test mode) under the session's X-Session-Token. PAN@
+        // card.number, in FastSpring's groups of four or as digits, with card.month, card.year and
+        // card.security beside it. fastspring.js holds the request rule the pause decision, the API's create and
+        // the device all read: exactly a session's /payment URL, a JSON Content-Type, the token, and the card
+        // body (a card FastSpring saved, a renewal, a gift, a tax id's EBANX route and a CAPTCHA answer each
+        // refused by name). The request names no amount and no seller: the store in the host is the payee,
+        // so a live payment goes only to a store fastspring.js pins, and the session's own document names
+        // the total. PayPal, wallets and bank methods post the same URL with no card and continue untouched
+        // (passWithoutCard). The checkout answers no other origin's preflight, so the card leaves the
+        // cardholder's device only through the checkout relay. Ships dark: served only to a client that
+        // declares `fastspring_card_payment`, gated off for every org until an operator lists one
+        // (`fastspring:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): a test store's host only on test
+        // rows and only with documented test cards. `(?![\w/.%;-])` ends the path for a consumer that tests
+        // `match` unanchored. Not here: FastSpring Classic (sites.fastspring.com), a separate application
+        // whose card step is a session-bound form navigation.
+        capability: "fastspring_card_payment",
+        match: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment(?![\\w/.%;-])",
+        hosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.onfastspring\\.com$", "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        sandboxHosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The session's token, which FastSpring's interceptor writes on every call of the page. Origin,
+        // Referer and cookies never ride: the session id and the token are the whole binding.
+        passthroughHeaders: ["^x-session-token$"],
+        jsonCardFields: [["card", "number"]],
+        passWithoutCard: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment"
+    },
+    {
+        psp: "omise",
+        // Omise's card token (Opn Payments; Thailand, Japan, Singapore and Malaysia): every Omise card form, the card
+        // frame cdn.omise.co/pay.html that the official WooCommerce plugin, Omise's hosted checkout page and Payment
+        // Links+ load, and a merchant's own form calling Omise.js 2.16.0, posts the card in one JSON body to Omise's
+        // vault under the merchant's public key (Basic): PAN@ card.number, the expiry @ card.expiration_month and
+        // .expiration_year in the form's own spelling, the code @ card.security_code, beside the holder's name and
+        // address. Unencrypted, and it names no amount: the merchant's server charges the token for its own order
+        // afterwards. omise.js holds the rule the pause decision, the API's create and the device all read: exactly
+        // this URL, a public key and Omise.js's own headers, and the card form's token body as JSON.stringify writes
+        // it, with a wallet's tokenization on the same URL refused. vault.omise.co answers the Vault's origin
+        // (Access-Control-Allow-Origin *), so the cardholder's device sends it itself. Test mode shares the host
+        // under a pkey_test_ key, so no sandbox host is marked: the device sends a test key only Omise's documented
+        // test cards (omise.js OMISE_TEST_CARDS). 3-D Secure, where the merchant's account runs it, follows the
+        // merchant's charge on 3dsms.omise.co with no card.
+        // Ships dark: served only to a client that declares `omise_card_token`, gated off for every org until an
+        // operator lists one (`omise:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's public key is bound to the merchant (backend config.ts OMISE_KEY_BOUND_TO_MERCHANT). Autopilot never
+        // sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "omise_card_token",
+        match: "vault\\.omise\\.co/tokens",
+        hosts: ["^vault\\.omise\\.co$"],
+        encoding: "json",
+        // Omise.js's own headers: the public key and its client's name. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^x-user-agent$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "xendit",
+        // Xendit's hosted invoice checkout (checkout.xendit.co/web/<invoice id>), which every Xendit Invoice API
+        // merchant, dashboard payment link and donation link, Shopify's Xendit app and the older WooCommerce plugin
+        // open: its Pay Now hands the card to Xendit.js 2.6.1, which posts it as one JSON body to Xendit's own API
+        // under the business's publishable key (Basic). PAN@ card_data.account_number, the expiry as "MM" and
+        // "YYYY" @ card_data.exp_month and .exp_year, the code @ card_data.cvn and again @ card_cvn, beside the
+        // invoice's amount and currency. Unencrypted. xendit.js holds the rule the pause decision, the API's create
+        // and the device all read: exactly this URL, the publishable key and Xendit.js's own headers, and the card
+        // form's single-use token body byte for byte, with a multi-use token (the card kept on file, and the
+        // checkout's Safe Acceptance mode) refused by its own code, and a token that skips 3-D Secure or names a
+        // xenPlatform sub-account refused too. storeCVN posts a code alone to the same URL
+        // and is refused like any other body. api.xendit.co answers the Vault's origin (Access-Control-Allow-Origin
+        // *), so the cardholder's device sends it itself. Test mode shares the host under an xnd_public_development_
+        // key, so no sandbox host is marked: the device sends a test-mode key only Xendit's documented test cards
+        // (xendit.js XENDIT_TEST_CARDS). 3-D Secure follows the answer on redirect.xendit.co with no card.
+        // Ships dark: served only to a client that declares `xendit_card_token`, gated off for every org until an
+        // operator lists one (`xendit:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's publishable key is bound to the merchant (backend config.ts XENDIT_KEY_BOUND_TO_MERCHANT). Autopilot
+        // never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "xendit_card_token",
+        match: "api\\.xendit\\.co/v2/credit_card_tokens",
+        hosts: ["^api\\.xendit\\.co$"],
+        encoding: "json",
+        // Xendit.js's own headers: the publishable key, and the client's type, version and id (the invoice). Origin,
+        // Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^client-type$", "^client-version$", "^client-id$"],
+        jsonCardFields: [["card_data", "account_number"]]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2407,6 +2932,10 @@ var WIX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 // src/paymongo.js
 var PAYMONGO_CHECKOUT_HOST = "checkout.paymongo.com";
 var ORIGIN = `https://${PAYMONGO_CHECKOUT_HOST}/`;
+// src/gopay.js
+var GOPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ id: "caramilla", merchant: "Caramilla.cz", origins: Object.freeze(["https://www.caramilla.cz"]) })
+]);
 // src/payrexx.js
 var PAYREXX_FOLLOW_UP_WINDOW_MS = 15 * 60 * 1e3;
 var PAYREXX_FOLLOW_UP_IDLE_MS = 60 * 1e3;
@@ -2418,6 +2947,17 @@ var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
     sandbox: Object.freeze(["sandbox.paygent.co.jp"])
 });
 var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var PAYGENT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({
+        id: "fundex_tcs_eng",
+        merchant: "Tokyo Chinese School",
+        merchantId: "60362",
+        keySha256: "6073dee112b1e4089025d1c1f3c4cfad818c314a81943ffa55b839cb2df51018",
+        origins: ["https://fundexapp.jp"],
+        currency: "jpy"
+    })
+]);
 // src/multipart-form.js
 var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
 var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
@@ -2427,9 +2967,9 @@ function multipartBoundary(contentType) {
     return match ? match[1] : null;
 }
 // src/pay-nl.js
-var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
 var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+    pin5({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
@@ -2446,9 +2986,235 @@ var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
         script: Object.freeze({ url: "https://demo2.2c2p.com/2C2PFrontEnd/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "435723d92bfefb00607a56851967e0b745d52b8d49443de5f0000f0583fde5cc" })
     })
 });
+// src/hipay.js
+var pin6 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+]);
 // src/amazon-payment-services.js
 var BODY_LIMIT = 32 * 1024;
 var ANSWER_LIMIT = 64 * 1024;
+// src/clover.js
+var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
+var OPTIONAL_KEYS = /* @__PURE__ */ Object.freeze(["address_line1", "phone_numbers", "email_address", "name", "address_zip"]);
+var CARD_ORDER = /* @__PURE__ */ Object.freeze([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
+// src/tap-payments.js
+var pin7 = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sessions: Object.freeze({ ...fields.sessions }),
+    key: Object.freeze({ ...fields.key })
+});
+var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin7({
+        id: "casefilegame",
+        merchant: "Casefilegame",
+        tapMerchantId: "67977048",
+        publishableKey: "pk_live_ydlRjrWcLXaVvpsSBQKOie86",
+        environment: "production",
+        origins: ["https://checkout.tap.company"],
+        // The WooCommerce plugin's redirect (Plugin-WooCommerce-All-in-one tap.php 567-586, read 2026-10-17)
+        // creates the src_all charge with save_card false and names no agreement, subscription or destinations.
+        sessions: { saveCard: false, agreement: false, subscription: false, destinations: false },
+        key: {
+            spki: "MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAzja2vB+Iyafj2Mm3pFg65z7Yvj9ZeoFLdMBgWFyyjF020r5HSPKVhuZ39uJkjs0U/kWgEpKDzHZAKdtGv36dS33NjMAzYpgFkD8j+9/YWqpvAGRj5nv1b/q7NaiZk3b1wm7aXHJOx5L6rPQf2qDQxhcSNHocU+Uy8wGmGxRRu6QRKN3khaz4o4jJDzqxns4h/ShzHjdZeWIVfpCAyVoED0IESBYrvGEhJeyKnga5XdHdBU2yP8P1huO4RbSKcZv00ZgxVHAQQ9CqArW3TE8SyLLnJPkSpSHHBnIPSQS1z3ld1mImy/zqTd4ltkV6XHpYqVvoPmys2EuZX3pMvCcPGwIBEQ==",
+            sha256: "6eb4e89a1e05a06a39d631f6fb450c052a9cad9935edc1921e84e80207470552",
+            // The shared parser takes exponent 17 only under a pin that names it (rsa-pkcs1v15.js).
+            exponent: 17
+        }
+    })
+]);
+// src/conekta.js
+var LETTERS = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
+var PAGE_NAME = new RegExp(`^[${LETTERS} .'-]{1,64}$`);
+var HAS_LETTER = new RegExp(`[${LETTERS}]`);
+var ADDRESS_VALUE = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
+var PAN_LIKE = new RegExp(`(?:[0-9][^0-9${LETTERS}]*){12,}`);
+var HOLDER = new RegExp(`^[${LETTERS}](?:[${LETTERS} .'-]{0,62}[${LETTERS}.])?$`);
+var ERROR_TYPE_STATUS = /* @__PURE__ */ Object.freeze({
+    malformed_request_error: 400,
+    authentication_error: 401,
+    processing_error: 402,
+    resource_not_found_error: 404,
+    conflict_error: 409,
+    precondition_required_error: 412,
+    parameter_validation_error: 422
+});
+var CONEKTA_ANSWER_ERROR_TYPES = /* @__PURE__ */ Object.freeze(Object.keys(ERROR_TYPE_STATUS));
+// src/tokenex-iframe.js
+var TOKENEX_IFRAME_HOSTS = Object.freeze(["htp.tokenex.com", "test-htp.tokenex.com"]);
+var TOKENEX_IFRAME_REFUSAL_REASONS = Object.freeze(["unsupported", "brand_mismatch", "unreviewed_account"]);
+var TOKENEX_IFRAME_BODY_KEYS = Object.freeze([
+    "TokenExID",
+    "Origin",
+    "AuthenticationKey",
+    "Timestamp",
+    "Data",
+    "CvvValue",
+    "TokenScheme",
+    "CvvOnly",
+    "PCI",
+    "ReturnHash",
+    "use3DS",
+    "ThreeDSMethodNotificationUrl",
+    "kountSessionId",
+    "fraudMerchantId",
+    "UseKount",
+    "kountMode",
+    "kountAnId",
+    "FraudServicesRiskRequestModel",
+    "EnforceLuhnCompliance",
+    "CustomDataLuhnCheck"
+]);
+var TOKENEX_IFRAME_TOKEN_SCHEMES = Object.freeze(["sixTOKENfour"]);
+var TOKENEX_IFRAME_REVIEWED_ACCOUNTS = Object.freeze({
+    "htp.tokenex.com": Object.freeze({}),
+    "test-htp.tokenex.com": Object.freeze({})
+});
+var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
+    "htp.tokenex.com": Object.freeze({}),
+    "test-htp.tokenex.com": Object.freeze({})
+});
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var panLike = (value) => (value.match(/\p{Nd}/gu) ?? []).length >= 12;
+var plain = (value, max) => text(value, max) && !panLike(value);
+var TOKENEX_ID = /^[0-9]{16}$/;
+var AUTHENTICATION_KEY = /^[A-Za-z0-9+/]{43}=$/;
+var TIMESTAMP = /^20[0-9]{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])(?:[01][0-9]|2[0-3])[0-5][0-9][0-5][0-9]$/;
+function isOrigin(value) {
+    if (typeof value !== "string" || value.length > 255 || !value.startsWith("https://"))
+        return false;
+    try {
+        return new URL(value).origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+var BOUND = {
+    TokenExID: (value) => exact(TOKENEX_ID, value),
+    Origin: isOrigin,
+    AuthenticationKey: (value) => exact(AUTHENTICATION_KEY, value),
+    Timestamp: (value) => exact(TIMESTAMP, value),
+    TokenScheme: (value) => TOKENEX_IFRAME_TOKEN_SCHEMES.includes(value)
+};
+var BOUND_KEYS = Object.keys(BOUND);
+var BOOLEAN = /^(?:true|false)$/i;
+var QUERY_RULES = {
+    ...BOUND,
+    Mode: (value) => value === "Data",
+    PCI: (value) => exact(/^true$/i, value),
+    CVV: (value) => exact(/^true$/i, value),
+    Container: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    CvvContainer: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    EnforceLuhnCompliance: (value) => exact(BOOLEAN, value),
+    CustomDataLabel: (value) => plain(value, 64),
+    CustomCvvDataLabel: (value) => plain(value, 64),
+    ExpiresInSeconds: (value) => exact(/^[1-9][0-9]{0,3}$/, value),
+    ReturnAutoCompleteValues: (value) => exact(BOOLEAN, value)
+};
+var QUERY_REQUIRED = [...BOUND_KEYS, "Mode", "PCI", "CVV"];
+var PLACEHOLDER = /^[0-9]{1,19}(?: [0-9]{1,19}){0,5}$/;
+var placeholderDigits = (value) => exact(PLACEHOLDER, value) && value.length <= 23 ? value.replace(/ /g, "") : null;
+var RULES = {
+    ...BOUND,
+    Data: (value) => {
+        const pan = placeholderDigits(value);
+        return pan !== null && pan.length >= 13 && pan.length <= 19;
+    },
+    CvvValue: (value) => digits(value, 3, 4),
+    CvvOnly: (value) => value === "False",
+    PCI: (value) => value === "True",
+    ReturnHash: (value) => value === null,
+    use3DS: (value) => value === "False",
+    ThreeDSMethodNotificationUrl: (value) => value === "",
+    kountSessionId: (value) => value === "",
+    fraudMerchantId: (value) => value === "",
+    UseKount: (value) => value === "False",
+    kountMode: (value) => value === "",
+    kountAnId: (value) => value === "",
+    FraudServicesRiskRequestModel: (value) => value === "",
+    EnforceLuhnCompliance: (value) => value === "true" || value === "false",
+    CustomDataLuhnCheck: (value) => value === true
+};
+var TOKENEX_IFRAME_GATE_CODES = Object.freeze(["tokenex_iframe_url_refused", "tokenex_iframe_body_unsupported", "tokenex_iframe_query_mismatch"]);
+var SUCCESS_RULES = {
+    token: (value) => digits(value, 13, 19),
+    firstSix: (value) => digits(value, 6, 6),
+    lastFour: (value) => digits(value, 4, 4),
+    referenceNumber: (value) => exact(/^[A-Za-z0-9-]{1,64}$/, value),
+    tokenHMAC: (value) => exact(/^[A-Za-z0-9+/]{1,128}={0,2}$/, value),
+    cvvIncluded: (value) => typeof value === "boolean"
+};
+var SUCCESS_KEYS = Object.keys(SUCCESS_RULES);
+// src/openpay.js
+var LETTERS2 = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
+var PAGE_NAME2 = new RegExp(`^[${LETTERS2} .'-]{1,64}$`);
+var HAS_LETTER2 = new RegExp(`[${LETTERS2}]`);
+var ADDRESS_VALUE2 = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
+var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
+var pin8 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
+var OPENPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin8({
+        id: "diario_de_yucatan",
+        merchant: "Diario de Yucatán",
+        origins: ["https://www.yucatan.com.mx"],
+        host: "api.openpay.mx",
+        merchantId: "mqyloyrm8tsvtsgcrj0d",
+        publicKeys: ["pk_260aa43616a445bb98472e6ca51da968"]
+    })
+]);
+// src/poynt.js
+var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var NONCE_URL = new RegExp(`^https://services\\.poynt\\.net/v1/commerce/stores/(${UUID})/payment-tokens/generate-nonce$`);
+var STORE_ID = new RegExp(`^${UUID}$`);
+var APPLICATION_ID = new RegExp(`^urn:aid:${UUID}$`);
+var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
+var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin9({
+        id: "yearning_for_learning",
+        merchant: "Yearning for Learning Publishing & Coaching",
+        origins: ["https://ff305485-ba6c-423a-87b0-cebe3f83ffe9.mysimplestore.com"],
+        storeIds: ["71ac12ed-e61f-4318-95db-db0e7c649d6f"]
+    }),
+    pin9({
+        id: "timber_ridge_bookkeeping",
+        merchant: "Timber Ridge Bookkeeping",
+        origins: ["https://d7d64ac3-0352-4e53-af9a-f6d8e7b5fb71.mysimplestore.com"],
+        storeIds: ["27be984a-0a03-4a54-8675-e64bbbe1c43e"]
+    })
+]);
+var MAX_ANSWER_CHARS = 16 * 1024;
+// src/cardcom.js
+var CARDCOM_ORIGIN = "https://secure.cardcom.solutions";
+var CARDCOM_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({
+        id: "machon_alte_usd",
+        merchant: "Machon Alte",
+        origins: Object.freeze([CARDCOM_ORIGIN]),
+        page: "kzR5pTyr0kC3oqjpGbCMiQ",
+        terminal: 162226,
+        products: Object.freeze([Object.freeze({ uid: "JoQrlcuGCUWYM4I66eX7pw", currency: "usd", price: null })]),
+        settings: "e38d7c7abce83a3a994a707e345595cf6ec2a15d77794a8eea70c0d5ce4773ab"
+    })
+]);
+// src/toast.js
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+// src/fastspring.js
+var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+]);
+var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
+// src/omise.js
+var pin10 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
+var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin10({ id: "taejai", merchant: "Taejai", origins: ["https://taejai.com"], keys: ["pkey_53q6mm66esjr563ob0h"] }),
+    pin10({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
+    pin10({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2469,6 +3235,10 @@ var AMADEUS_CARD_URLS = Object.freeze({
         dcp: Object.freeze([])
     })
 });
+var AMADEUS_RELAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["paypages.payment.amadeus.com"]),
+    sandbox: Object.freeze(["paypages.test.payment.amadeus.com"])
+});
 var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
 var AMADEUS_REFUSAL_REASONS = Object.freeze([
     "unsupported",
@@ -2739,7 +3509,9 @@ var COMGATE_GATEWAY_HOSTS = Object.freeze({
     "pay3.comgate.cz": "payments-gcp.comgate.cz",
     "pay4.comgate.cz": "payments-gcp.comgate.cz"
 });
-var COMGATE_MERCHANTS = Object.freeze([]);
+var COMGATE_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "Dárek pro Beskydy", origins: Object.freeze(["https://darekprobeskydy.info"]), merchantIds: Object.freeze([]) })
+]);
 var MAX_LOAD = 1024 * 1024;
 var MAX_ANSWER = 64 * 1024;
 var HEADER_NAMES = Object.freeze(["content-type", "x-cg-origin", "origin"]);
@@ -2747,7 +3519,9 @@ var COMGATE_REFUSALS = Object.freeze(["comgate_3ds_challenge", "comgate_declined
 // src/processors/przelewy24.js
 var PRZELEWY24_HOSTS = Object.freeze(["secure.przelewy24.pl", "sandbox.przelewy24.pl"]);
 var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
-var PRZELEWY24_MERCHANTS = Object.freeze([]);
+var PRZELEWY24_MERCHANTS = Object.freeze([
+    Object.freeze({ id: "kupbilet", merchant: "KupBilet.pl", merchantId: null, origins: Object.freeze(["https://www.kupbilet.pl"]) })
+]);
 var MAX_PAGE4 = 256 * 1024;
 var CURRENCIES3 = Object.freeze(["PLN", "EUR", "GBP", "USD", "CZK", "CHF", "DKK", "NOK", "SEK", "RON", "BGN", "HUF"]);
 var PRZELEWY24_AJAX_HEADERS = Object.freeze({ Accept: "*/*", "X-Requested-With": "XMLHttpRequest" });
@@ -2770,7 +3544,15 @@ var TRANSBANK_HOSTS = Object.freeze(["webpay3g.transbank.cl", "webpay3gint.trans
 var TRANSBANK_SANDBOX_HOSTS = Object.freeze(["webpay3gint.transbank.cl"]);
 var TOKEN = "[0-9a-f]{64}";
 var ENTRY_QUERY = new RegExp(`^\\?token_ws=(${TOKEN})$`);
-var TRANSBANK_MERCHANTS = Object.freeze([]);
+var TRANSBANK_MERCHANTS = Object.freeze([
+    Object.freeze({
+        commerceCode: null,
+        fantasyName: null,
+        merchant: "Teleférico Santiago",
+        hosts: Object.freeze(["telefericosantiago.cl"]),
+        returnHost: "telefericosantiago.cl"
+    })
+]);
 var MAX_PAGE5 = 64 * 1024;
 var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
 var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
@@ -2788,7 +3570,7 @@ var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
 ]);
 var PAYTRAIL_MERCHANTS = Object.freeze([]);
 var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
-var UUID = new RegExp(`^${UUID_SOURCE}$`);
+var UUID2 = new RegExp(`^${UUID_SOURCE}$`);
 var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
 var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
 var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
@@ -2796,6 +3578,101 @@ var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`
 var MAX_PAGE6 = 256 * 1024;
 var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
 var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
+// src/processors/eximbay.js
+var EXIMBAY_HOSTS = Object.freeze(["secureapi.eximbay.com", "secureapi.test.eximbay.com"]);
+var EXIMBAY_MERCHANTS = Object.freeze([]);
+var MAX_ENTRY4 = 16 * 1024;
+var REQUIRED4 = Object.freeze(["ver", "mid", "txntype", "ref", "cur", "amt", "buyer", "email", "lang", "returnurl", "statusurl", "fgkey"]);
+var CURRENCIES4 = Object.freeze({ USD: 2, KRW: 0, JPY: 0, EUR: 2, GBP: 2, SGD: 2, HKD: 2, CAD: 2, AUD: 2, THB: 2 });
+var MAX_PAGE7 = 512 * 1024;
+var ATTRS = `(?:[^>"']|"[^"]{0,1024}"|'[^']{0,1024}'){0,512}`;
+var startTag = (name) => new RegExp(`<${name}(?=[\\t\\n\\f\\r />])${ATTRS}>`, "gi");
+var FORM_START = startTag("form");
+var INPUT_START = startTag("input");
+var SELECT_TAG = startTag("select");
+var OPTION_TAG = startTag("option");
+var BUTTON_TAG = startTag("button");
+var FIELDSET_TAG = startTag("fieldset");
+var XHR_HEADERS = Object.freeze({ "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest" });
+var FORM_HEADERS2 = Object.freeze({ "Content-Type": "application/x-www-form-urlencoded" });
+var SKIPPED = Object.freeze([
+    ["<!--", "-->", /<!--[\s\S]*?-->/g],
+    ["<script", "</script", /<script\b[\s\S]*?<\/script\s*>/gi],
+    ["<style", "</style", /<style\b[\s\S]*?<\/style\s*>/gi]
+]);
+var CARD_KEYS_WINDOW = Object.freeze(["cardno1", "cardno2", "cardno3", "cardno4", "cardNum", "month", "year", "cvc"]);
+var WINDOW_FIELDS = /* @__PURE__ */ new Set([
+    "paramkey",
+    "cardcode",
+    "channelCode",
+    "issuerCountry",
+    ...CARD_KEYS_WINDOW,
+    "tel",
+    "unioncardno",
+    "unionoffcardno",
+    "month_unionpay",
+    "year_unionpay",
+    "firstname",
+    "lastname",
+    "cvc_unionpay",
+    "firstname_unionpay",
+    "lastname_unionpay",
+    "email",
+    "shipTo_country",
+    "shipTo_postalCode",
+    "shipTo_city",
+    "shipTo_street1"
+]);
+var WRITTEN = /* @__PURE__ */ new Set(["cardcode", "issuerCountry", ...CARD_KEYS_WINDOW, "firstname", "lastname"]);
+var OTHER_CARD = Object.freeze(["unioncardno", "unionoffcardno", "month_unionpay", "year_unionpay", "cvc_unionpay"]);
+var BRANDS = Object.freeze({
+    C000: /^4\d{15}$/,
+    C001: /^(?:5[1-5]\d{14}|2(?:22[1-9]|2[3-9]\d|[3-6]\d{2}|7[01]\d|720)\d{12})$/,
+    C002: /^3[47]\d{13}$/,
+    C003: /^35(?:2[89]|[3-8]\d)\d{12}$/
+});
+var EXIMBAY_REFUSALS = Object.freeze(["eximbay_card_refused", "eximbay_3ds_challenge", "eximbay_declined"]);
+var RESULT_BINDS = Object.freeze(["mid", "txntype", "ref", "cur", "amt"]);
+// src/processors/barion.js
+var BARION_HOSTS = Object.freeze(["secure.barion.com", "secure.test.barion.com"]);
+var BARION_SANDBOX_HOSTS = Object.freeze(["secure.test.barion.com"]);
+var BARION_SHOPS = Object.freeze([]);
+var MAX_PAGE8 = 512 * 1024;
+var CURRENCIES5 = Object.freeze(["HUF", "EUR", "USD", "CZK", "RON", "PLN"]);
+var CARD_INPUTS = Object.freeze({ number: "cc-number", expiry: "cc-exp-date", cvc: "CardCVC", holder: "CardHolderName" });
+var CHECKBOXES = Object.freeze(["RegisterUser", "AcceptedTerms", "HasEmailConsent"]);
+var OTHER_INPUTS = Object.freeze({ FirstPassword: ["password"], RecaptchaToken: ["hidden"], __RequestVerificationToken: ["hidden"], Identifier: ["hidden"] });
+var BARION_AJAX_HEADERS = Object.freeze({
+    Accept: "*/*",
+    "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
+    "X-Requested-With": "XMLHttpRequest"
+});
+var CARD_TYPES2 = Object.freeze([{ prefix: /^4/, type: 20 }, { prefix: /^5[1-5]|^2[2-7]/, type: 10 }, { prefix: /^3[47]/, type: 30 }]);
+var COLOR_DEPTHS = Object.freeze([1, 4, 8, 15, 16, 24, 32, 48]);
+var BARION_REFUSALS = Object.freeze(["barion_declined", "barion_3ds_challenge", "barion_sca_soft_decline"]);
+var MAX_ANSWER2 = 64 * 1024;
+var DECLINE_CODES = Object.freeze([
+    "CardError",
+    "CardExpired",
+    "MaximumCardPaymentAmountExceeded",
+    "MinimumCardPaymentAmountNotReached",
+    "PaymentExpired",
+    "PaymentCancelled",
+    "PaymentFailed",
+    "ThreeDsNotEnabled",
+    "ThreeDsAuthenticationFailed",
+    "NoSuitableProviderFound",
+    "EmailBelongsToValidUser",
+    "InvalidEmailAddress",
+    "CvcRequired",
+    "CardHolderNameRequired",
+    "CardRegistrationExpired",
+    "StartPaymentError",
+    "TheSourceAndDestinationAccountsAreMatched",
+    "UserIsSuspended",
+    "AccountSuspended"
+]);
+var FRICTIONLESS_STATUSES = Object.freeze([0, 5, 7]);
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -2986,18 +3863,18 @@ function parseStripeCheckoutContext(request) {
     if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
         reject("context_invalid");
     const encoded = entries[0][1];
-    let text = "", bits = 0, count = 0;
+    let text2 = "", bits = 0, count = 0;
     for (const char of encoded) {
         bits = bits << 6 | alphabet.indexOf(char);
         count += 6;
         if (count >= 8) {
             count -= 8;
-            text += String.fromCharCode(bits >>> count & 255);
+            text2 += String.fromCharCode(bits >>> count & 255);
         }
     }
     let value;
     try {
-        value = context(JSON.parse(text));
+        value = context(JSON.parse(text2));
     }
     catch {
         reject("context_invalid");