@agent-cards/sdk 0.23.21 → 0.23.22

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7544ef9813a4b2b55031179301878be4c74d1f1363eacca7552d7ba0f5bb4843
+// artifact-sha256: 360d9805357acc5244c3beafbb16a6da782e933b506db49c2d63df06ac23f7b4
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -615,12 +615,12 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // navigation with the hosted_form notice. Only the entry path is matched, exactly (processors/eximbay.js
         // isEximbayEntryUrl: a query would reach Eximbay's servlet as fields beside the signed body). The window's
         // card lookup (checkCardBin.do) and its card post (checkApprv.jsp) carry a card and are never paused, and
-        // the agent's browser never loads the window while the entry waits. No SDK gate refuses those two posts
-        // in the agent's browser yet (checkout/src/pre-claim.ts holds Redsys's and NMI's, none for Eximbay), and
-        // until one does the SDK does not declare this capability. Eximbay's test host serves the same window
-        // for test merchants, so a live row reaches the live host only and a test row the test host only. Dark:
-        // served only to a client that declares the capability, and gated off for every org the operator has not
-        // allowlisted.
+        // the agent's browser never loads the window while the entry waits. The SDK's Eximbay gate refuses those
+        // two posts in the agent's browser, with every other post to these hosts but the entry
+        // (checkout/src/pre-claim.ts eximbayPreClaim), so no dummy card reaches Eximbay. Eximbay's test host serves
+        // the same window for test merchants, so a live row reaches the live host only and a test row the test host
+        // only. Dark: served only to a client that declares the capability, and gated off for every org the operator
+        // has not allowlisted.
         capability: "eximbay_hosted_payment_page",
         match: "secureapi\\.(?:test\\.)?eximbay\\.com/Gateway/BasicProcessor\\.krp",
         hosts: ["^secureapi\\.eximbay\\.com$", "^secureapi\\.test\\.eximbay\\.com$"],
@@ -2120,13 +2120,14 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // approves. paygent.js holds the rule the pause decision and the device read: the exact URL, the
         // script's content type, and createToken's seven keys in its order and spelling with the token key
         // held to the host's environment; createCvcToken (a stored card's code) is refused. The script
-        // abandons the XHR after 35 s; the preparation that moves the approval before the press comes with
-        // the API's Paygent change, which sets `preparationRequired` with it.
+        // abandons the XHR after 35 s, too soon for an approval after the press that sends it, so the
+        // lane is prepared only (`preparationRequired`): the cardholder approves before the press, and the
+        // press's request binds that approval (paygent.js isPreparedPaygentRequest). On the live host it
+        // binds only the merchant_id a reviewed pin lists for the approved origin and merchant
+        // (PAYGENT_MERCHANT_PINS), and one approval binds one request, so a second card request is sent nowhere.
         // Paygent's hosted payment page (link.paygent.co.jp) carries the card on other paths and is not paused.
         // Paygent answers a refused card inside HTTP 200, so its own judge reads every answer by its body
-        // (paygent.js paygentAnswerOutcome), never the shared status rule. No operator lists an org before the
-        // API's Paygent change lands: the amount the request does not name, the merchant pin per checkout
-        // origin, the refusal of a second card request on one checkout, and the preparation for the 35 s window.
+        // (paygent.js paygentAnswerOutcome), never the shared status rule.
         // Ships dark: served only to a client that declares `paygent_token`, gated off for every org until an
         // operator lists one (`paygent:<org>`), and autopilot never sends this request (autopilot.js
         // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.paygent.co.jp only on
@@ -2136,6 +2137,7 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^token\\.paygent\\.co\\.jp$", "^sandbox\\.paygent\\.co\\.jp$"],
         sandboxHosts: ["^sandbox\\.paygent\\.co\\.jp$"],
         hostEnvironmentPinned: true,
+        preparationRequired: true,
         // The body's shape is a form's (key=value pairs); its wire type stays the script's text/plain
         // (request-policy.js contentTypeFor). No header but the content type rides.
         encoding: "form",
@@ -2544,6 +2546,212 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             "^recaptcha-token$",
             "^recaptcha-type$"
         ]
+    },
+    {
+        psp: "cardcom",
+        // Cardcom (Israel), whose own payment page (https://secure.cardcom.solutions/EA/EA5/<page id>, Cardcom's Vue app)
+        // posts the whole page state on Process, as same-origin JSON, to https://secure.cardcom.solutions/api/EA5/SubmitPayment:
+        // the bot check's token, the page's seven stores and a 3-D Secure block. The card sits in clear text twice,
+        // Store.PaymentStore.{CardNumberField, MonthsField, YearsField, CvvField, CardOwnerNameField}.Value and
+        // _3DSecureReq.{CardNumber, CardExpireMonth, CardExpireYear, CVV, CardholderFullName}; the page id, the terminal and
+        // the amount ride beside it. cardcom.js holds the request rule the pause decision, the API's create and the device
+        // all read: exactly that URL, the page's one JSON Content-Type, and the page's own body for a one-time charge of one
+        // product, its two copies of the card the same; a standing order, installments, a kept card, 3-D Secure, an
+        // Israeli ID and a Turnstile or reCAPTCHA v2 page are refused by name. The endpoint answers any browser origin, so
+        // the device sends it by a direct fetch, with no cookie, and the bot check's token rides inside the paused body as
+        // the person's press minted it. Cardcom's test terminal shares the live host, so no sandbox host is marked and the
+        // lane takes live rows alone, each under a reviewed page pin (cardcom.js cardcomMerchantRefusal). Cardcom answers
+        // inside HTTP 200 whether it charged or not, so its own judge reads every answer (cardcom.js cardcomAnswerOutcome).
+        // The LowProfile pages' /api/LPC6/SubmitPayment, the wallets' posts and the legacy EA4 pages are not this lane's.
+        // Ships dark: served only to a client that declares `cardcom_payment_page`, gated off for every org until an
+        // operator lists one (`cardcom:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "cardcom_payment_page",
+        match: "secure\\.cardcom\\.solutions/api/EA5/SubmitPayment(?![\\w/.%-])",
+        hosts: ["^secure\\.cardcom\\.solutions$"],
+        encoding: "json",
+        // The device writes the JSON Content-Type itself; Origin, Referer and the page's cookies never ride.
+        passthroughHeaders: [],
+        jsonCardFields: [["Store", "PaymentStore", "CardNumberField", "Value"], ["_3DSecureReq", "CardNumber"]]
+    },
+    {
+        psp: "nexi_checkout",
+        // Nexi Checkout (formerly Nets Easy; Denmark, Norway, Sweden, Finland), which takes the card in its own card frame,
+        // https://checkout.dibspayment.eu/v1/, embedded in the merchant's page by checkout.js or mounted by Nexi's hosted
+        // payment page. On Pay the frame posts the card in clear JSON to its own origin, https://checkout.dibspayment.eu/
+        // api/v1/pay, with the merchant's checkout key and the payment's id as headers: paymentType.card.cardNumber,
+        // expiryMonth (MM), expiryYear (YY), cardVerificationCode and cardholderName, beside the payment's amount in minor
+        // units, the card fee and the "save my card" and "remember me" flags. nexi-checkout.js holds the request rule the
+        // pause decision, the API's create and the device all read: exactly the pay endpoint URL, the JSON type, the frame's
+        // session headers and the card form's body byte for byte, with "save my card", "remember me" or a card fee refused
+        // by name. The endpoint answers no browser origin, so the card leaves the cardholder's device only through the
+        // checkout relay, and only the frame's four session headers ride beside the card. test.checkout.dibspayment.eu is
+        // Nexi's test environment: pinned (S7) to test rows, which send only Nexi's published test cards.
+        // Ships dark: served only to a client that declares `nexi_checkout_pay`, gated off for every org until an operator
+        // lists one (`nexi_checkout:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "nexi_checkout_pay",
+        match: "(?:test\\.)?checkout\\.dibspayment\\.eu/api/v1/pay(?![\\w/.%-])",
+        hosts: ["^checkout\\.dibspayment\\.eu$", "^test\\.checkout\\.dibspayment\\.eu$"],
+        sandboxHosts: ["^test\\.checkout\\.dibspayment\\.eu$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's checkout key, payment id, partner merchant number and API version. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^checkoutkey$", "^paymentid$", "^partnermerchantnumber$", "^api-version$"],
+        jsonCardFields: [["paymentType", "card", "cardNumber"]]
+    },
+    {
+        psp: "openpay_bbva",
+        // Openpay (BBVA México's online acquiring platform; Openpay Colombia and Openpay Perú) through openpay.js, the
+        // tokenizer a merchant's own page loads: on Pay it posts the card with one XHR, in clear JSON, to
+        // https://api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe) under the merchant's public key
+        // (Basic authorization), as {card_number, holder_name, cvv2, expiration_month, expiration_year[, address]} in the
+        // caller's own order and types. The answer is a single-use token the merchant's server charges later; the request
+        // names no amount, so the agent's amount is the price the cardholder approves. openpay.js holds the rules the pause
+        // decision, the API's create, the prepared bind and the device read: the exact token URL, openpay.js's three
+        // headers and the caller's body member by member. openpay.js abandons the request 40 s after Pay, so the lane is
+        // prepared only (preparationRequired). Openpay's API answers any browser origin, so the card leaves the
+        // cardholder's device by a direct fetch. A production request pays only an origin whose reviewed pin names its
+        // host, merchant id and key (openpay.js openpayMerchantRefusal). sandbox-api.openpay.<tld> is Openpay's sandbox:
+        // pinned (S7) to test rows, which send only Openpay's documented test cards. Openpay can answer a refusal inside a
+        // 2xx, so its own judge reads every answer (openpay.js openpayAnswerOutcome), never the shared status rule.
+        // Ships dark: served only to a client that declares `openpay_tokenizer`, gated off for every org until an operator
+        // lists `openpay_bbva:<org>`, and autopilot never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        // `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "openpay_tokenizer",
+        match: "(?:sandbox-)?api\\.openpay\\.(?:mx|co|pe)/v1/[a-z0-9]{10,40}/tokens(?![\\w/.%-])",
+        hosts: [
+            "^api\\.openpay\\.mx$",
+            "^api\\.openpay\\.co$",
+            "^api\\.openpay\\.pe$",
+            "^sandbox-api\\.openpay\\.mx$",
+            "^sandbox-api\\.openpay\\.co$",
+            "^sandbox-api\\.openpay\\.pe$"
+        ],
+        sandboxHosts: ["^sandbox-api\\.openpay\\.mx$", "^sandbox-api\\.openpay\\.co$", "^sandbox-api\\.openpay\\.pe$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // openpay.js's public key and its JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"],
+        jsonCardFields: [["card_number"]]
+    },
+    {
+        psp: "toast",
+        // Toast's payments frame (payments.toasttab.com), the card leg of every Toast online-ordering and
+        // e-gift checkout: one POST to /v1/payment-methods with the card sealed in card.cardData, RSA-OAEP
+        // with SHA-1 over a JSON object under a 2048-bit key the frame hardcodes. toast.js holds the one
+        // request rule the pause decision, the API's create, the approve leg and the device read: exactly
+        // that URL and the frame's guest card body byte for byte, under the key id toast.js pins. The device
+        // seals the real card under that pinned key (never one from a row, a request or a page), and the
+        // agent's browser continues its own request with only cardData rewritten, so the frame's bearer,
+        // its restaurant and intent headers and the session secret stay the page's and none is stored. Apple
+        // Pay and Google Pay payment methods share the URL, carry no card the Vault holds, and continue
+        // untouched (passWithoutCard); `jsonCardFields` names where the card sits, and toast.js's own gate
+        // answers before it (card-fields.js). Toast's sandbox needs a partner account, so only the live host is
+        // named and a test row is refused at create. Ships dark: served only to a client that declares
+        // `toast_pinned_key`, off for every org until an operator lists `toast:<org>`, and autopilot never
+        // sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path, so a
+        // consumer that tests `match` unanchored never takes /v1/payment-methods/x for a card request.
+        capability: "toast_pinned_key",
+        match: "payments\\.toasttab\\.com/v1/payment-methods(?![\\w/.-])",
+        hosts: ["^payments\\.toasttab\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["card", "cardData"]],
+        passWithoutCard: "payments\\.toasttab\\.com/v1/payment-methods",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-oaep-sha1-json", at: "card", fields: ["cardData"] }
+    },
+    {
+        psp: "fastspring",
+        // FastSpring's checkout, the merchant of record for every FastSpring store: the popup (Store Builder
+        // Library), embedded and web storefronts all run FastSpring's one checkout app, and its Pay posts the
+        // card as one JSON XHR to <store>.onfastspring.com[/popup-<name>|/embedded-<name>]/session/<id>/payment
+        // (<store>.test.onfastspring.com in a store's test mode) under the session's X-Session-Token. PAN@
+        // card.number, in FastSpring's groups of four or as digits, with card.month, card.year and
+        // card.security beside it. fastspring.js holds the request rule the pause decision, the API's create and
+        // the device all read: exactly a session's /payment URL, a JSON Content-Type, the token, and the card
+        // body (a card FastSpring saved, a renewal, a gift, a tax id's EBANX route and a CAPTCHA answer each
+        // refused by name). The request names no amount and no seller: the store in the host is the payee,
+        // so a live payment goes only to a store fastspring.js pins, and the session's own document names
+        // the total. PayPal, wallets and bank methods post the same URL with no card and continue untouched
+        // (passWithoutCard). The checkout answers no other origin's preflight, so the card leaves the
+        // cardholder's device only through the checkout relay. Ships dark: served only to a client that
+        // declares `fastspring_card_payment`, gated off for every org until an operator lists one
+        // (`fastspring:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): a test store's host only on test
+        // rows and only with documented test cards. `(?![\w/.%;-])` ends the path for a consumer that tests
+        // `match` unanchored. Not here: FastSpring Classic (sites.fastspring.com), a separate application
+        // whose card step is a session-bound form navigation.
+        capability: "fastspring_card_payment",
+        match: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment(?![\\w/.%;-])",
+        hosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.onfastspring\\.com$", "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        sandboxHosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The session's token, which FastSpring's interceptor writes on every call of the page. Origin,
+        // Referer and cookies never ride: the session id and the token are the whole binding.
+        passthroughHeaders: ["^x-session-token$"],
+        jsonCardFields: [["card", "number"]],
+        passWithoutCard: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment"
+    },
+    {
+        psp: "omise",
+        // Omise's card token (Opn Payments; Thailand, Japan, Singapore and Malaysia): every Omise card form, the card
+        // frame cdn.omise.co/pay.html that the official WooCommerce plugin, Omise's hosted checkout page and Payment
+        // Links+ load, and a merchant's own form calling Omise.js 2.16.0, posts the card in one JSON body to Omise's
+        // vault under the merchant's public key (Basic): PAN@ card.number, the expiry @ card.expiration_month and
+        // .expiration_year in the form's own spelling, the code @ card.security_code, beside the holder's name and
+        // address. Unencrypted, and it names no amount: the merchant's server charges the token for its own order
+        // afterwards. omise.js holds the rule the pause decision, the API's create and the device all read: exactly
+        // this URL, a public key and Omise.js's own headers, and the card form's token body as JSON.stringify writes
+        // it, with a wallet's tokenization on the same URL refused. vault.omise.co answers the Vault's origin
+        // (Access-Control-Allow-Origin *), so the cardholder's device sends it itself. Test mode shares the host
+        // under a pkey_test_ key, so no sandbox host is marked: the device sends a test key only Omise's documented
+        // test cards (omise.js OMISE_TEST_CARDS). 3-D Secure, where the merchant's account runs it, follows the
+        // merchant's charge on 3dsms.omise.co with no card.
+        // Ships dark: served only to a client that declares `omise_card_token`, gated off for every org until an
+        // operator lists one (`omise:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's public key is bound to the merchant (backend config.ts OMISE_KEY_BOUND_TO_MERCHANT). Autopilot never
+        // sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "omise_card_token",
+        match: "vault\\.omise\\.co/tokens",
+        hosts: ["^vault\\.omise\\.co$"],
+        encoding: "json",
+        // Omise.js's own headers: the public key and its client's name. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^x-user-agent$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "xendit",
+        // Xendit's hosted invoice checkout (checkout.xendit.co/web/<invoice id>), which every Xendit Invoice API
+        // merchant, dashboard payment link and donation link, Shopify's Xendit app and the older WooCommerce plugin
+        // open: its Pay Now hands the card to Xendit.js 2.6.1, which posts it as one JSON body to Xendit's own API
+        // under the business's publishable key (Basic). PAN@ card_data.account_number, the expiry as "MM" and
+        // "YYYY" @ card_data.exp_month and .exp_year, the code @ card_data.cvn and again @ card_cvn, beside the
+        // invoice's amount and currency. Unencrypted. xendit.js holds the rule the pause decision, the API's create
+        // and the device all read: exactly this URL, the publishable key and Xendit.js's own headers, and the card
+        // form's single-use token body byte for byte, with a multi-use token (the card kept on file, and the
+        // checkout's Safe Acceptance mode) refused by its own code, and a token that skips 3-D Secure or names a
+        // xenPlatform sub-account refused too. storeCVN posts a code alone to the same URL
+        // and is refused like any other body. api.xendit.co answers the Vault's origin (Access-Control-Allow-Origin
+        // *), so the cardholder's device sends it itself. Test mode shares the host under an xnd_public_development_
+        // key, so no sandbox host is marked: the device sends a test-mode key only Xendit's documented test cards
+        // (xendit.js XENDIT_TEST_CARDS). 3-D Secure follows the answer on redirect.xendit.co with no card.
+        // Ships dark: served only to a client that declares `xendit_card_token`, gated off for every org until an
+        // operator lists one (`xendit:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's publishable key is bound to the merchant (backend config.ts XENDIT_KEY_BOUND_TO_MERCHANT). Autopilot
+        // never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "xendit_card_token",
+        match: "api\\.xendit\\.co/v2/credit_card_tokens",
+        hosts: ["^api\\.xendit\\.co$"],
+        encoding: "json",
+        // Xendit.js's own headers: the publishable key, and the client's type, version and id (the invoice). Origin,
+        // Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^client-type$", "^client-version$", "^client-id$"],
+        jsonCardFields: [["card_data", "account_number"]]
     }
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
@@ -2739,6 +2947,17 @@ var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
     sandbox: Object.freeze(["sandbox.paygent.co.jp"])
 });
 var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var PAYGENT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({
+        id: "fundex_tcs_eng",
+        merchant: "Tokyo Chinese School",
+        merchantId: "60362",
+        keySha256: "6073dee112b1e4089025d1c1f3c4cfad818c314a81943ffa55b839cb2df51018",
+        origins: ["https://fundexapp.jp"],
+        currency: "jpy"
+    })
+]);
 // src/multipart-form.js
 var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
 var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
@@ -2748,9 +2967,9 @@ function multipartBoundary(contentType) {
     return match ? match[1] : null;
 }
 // src/pay-nl.js
-var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
 var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+    pin5({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
@@ -2768,9 +2987,9 @@ var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
     })
 });
 // src/hipay.js
-var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var pin6 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
 var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin5({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+    pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
 ]);
 // src/amazon-payment-services.js
 var BODY_LIMIT = 32 * 1024;
@@ -2780,14 +2999,14 @@ var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month",
 var OPTIONAL_KEYS = /* @__PURE__ */ Object.freeze(["address_line1", "phone_numbers", "email_address", "name", "address_zip"]);
 var CARD_ORDER = /* @__PURE__ */ Object.freeze([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
 // src/tap-payments.js
-var pin6 = (fields) => Object.freeze({
+var pin7 = (fields) => Object.freeze({
     ...fields,
     origins: Object.freeze([...fields.origins]),
     sessions: Object.freeze({ ...fields.sessions }),
     key: Object.freeze({ ...fields.key })
 });
 var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin6({
+    pin7({
         id: "casefilegame",
         merchant: "Casefilegame",
         tapMerchantId: "67977048",
@@ -2930,20 +3149,37 @@ var SUCCESS_RULES = {
     cvvIncluded: (value) => typeof value === "boolean"
 };
 var SUCCESS_KEYS = Object.keys(SUCCESS_RULES);
+// src/openpay.js
+var LETTERS2 = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
+var PAGE_NAME2 = new RegExp(`^[${LETTERS2} .'-]{1,64}$`);
+var HAS_LETTER2 = new RegExp(`[${LETTERS2}]`);
+var ADDRESS_VALUE2 = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
+var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
+var pin8 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
+var OPENPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin8({
+        id: "diario_de_yucatan",
+        merchant: "Diario de Yucatán",
+        origins: ["https://www.yucatan.com.mx"],
+        host: "api.openpay.mx",
+        merchantId: "mqyloyrm8tsvtsgcrj0d",
+        publicKeys: ["pk_260aa43616a445bb98472e6ca51da968"]
+    })
+]);
 // src/poynt.js
 var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var NONCE_URL = new RegExp(`^https://services\\.poynt\\.net/v1/commerce/stores/(${UUID})/payment-tokens/generate-nonce$`);
 var STORE_ID = new RegExp(`^${UUID}$`);
 var APPLICATION_ID = new RegExp(`^urn:aid:${UUID}$`);
-var pin7 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
+var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
 var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin7({
+    pin9({
         id: "yearning_for_learning",
         merchant: "Yearning for Learning Publishing & Coaching",
         origins: ["https://ff305485-ba6c-423a-87b0-cebe3f83ffe9.mysimplestore.com"],
         storeIds: ["71ac12ed-e61f-4318-95db-db0e7c649d6f"]
     }),
-    pin7({
+    pin9({
         id: "timber_ridge_bookkeeping",
         merchant: "Timber Ridge Bookkeeping",
         origins: ["https://d7d64ac3-0352-4e53-af9a-f6d8e7b5fb71.mysimplestore.com"],
@@ -2951,6 +3187,34 @@ var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     })
 ]);
 var MAX_ANSWER_CHARS = 16 * 1024;
+// src/cardcom.js
+var CARDCOM_ORIGIN = "https://secure.cardcom.solutions";
+var CARDCOM_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({
+        id: "machon_alte_usd",
+        merchant: "Machon Alte",
+        origins: Object.freeze([CARDCOM_ORIGIN]),
+        page: "kzR5pTyr0kC3oqjpGbCMiQ",
+        terminal: 162226,
+        products: Object.freeze([Object.freeze({ uid: "JoQrlcuGCUWYM4I66eX7pw", currency: "usd", price: null })]),
+        settings: "e38d7c7abce83a3a994a707e345595cf6ec2a15d77794a8eea70c0d5ce4773ab"
+    })
+]);
+// src/toast.js
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+// src/fastspring.js
+var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+]);
+var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
+// src/omise.js
+var pin10 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
+var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin10({ id: "taejai", merchant: "Taejai", origins: ["https://taejai.com"], keys: ["pkey_53q6mm66esjr563ob0h"] }),
+    pin10({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
+    pin10({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2971,6 +3235,10 @@ var AMADEUS_CARD_URLS = Object.freeze({
         dcp: Object.freeze([])
     })
 });
+var AMADEUS_RELAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["paypages.payment.amadeus.com"]),
+    sandbox: Object.freeze(["paypages.test.payment.amadeus.com"])
+});
 var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
 var AMADEUS_REFUSAL_REASONS = Object.freeze([
     "unsupported",

package/dist/toast-seal.generated.d.ts

@@ -0,0 +1,37 @@
+declare var TOAST_SCHEME: string;
+declare var ToastError: {
+    new (reason: any): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+    };
+};
+declare function toastCardPlaintext(card: any, postalCode: any): string;
+declare function encryptToastCard(card: any, request: any, facilities?: {}): Promise<{
+    cardData: string;
+}>;
+declare function isToastCiphertextUnderKey(value: any): boolean;
+declare function toastKeyUsable(authorization: any): boolean;
+declare function toastSubstitutionsRefusal(template: any, substitutions: any): {
+    code: string;
+    message: any;
+} | null;
+declare function substituteToastCardData(url: any, body: any, fields: any): string;
+declare function toastAnswerOutcome(status: any, text: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { TOAST_SCHEME, ToastError, encryptToastCard, isToastCiphertextUnderKey, substituteToastCardData, toastAnswerOutcome, toastCardPlaintext, toastKeyUsable, toastSubstitutionsRefusal };