@agent-cards/sdk 0.23.21 → 0.23.23

package/CHANGELOG.md

@@ -1,7 +1,43 @@
 # Changelog
 
+An unreleased change waits as a file of its own in `changes/` (`changes/README.md`), never under Unreleased here; the version cut moves it under the version a release publishes.
+
 ## Unreleased
 
+## 0.23.23
+
+- Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.
+
+- `redactUrl` masks a host written with its port and no scheme, such as `checkout.payulatam.com:443/...`, the way it masks a bare host, for every processor. A URL parser reads that host as the scheme, so the string came back unmasked.
+
+- Keep a PayU Latam checkout's session key out of your events and error messages. PayU Latam's WebCheckout page sends the card to `/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>` on its own host (`checkout.payulatam.com`, `sandbox.checkout.payulatam.com`), and the key is the only credential the page's routes read: anyone who holds it can read the checkout's order, payer and merchant. `redactUrl`, every event and every error message now show it as `{key}` on every host under `payulatam.com`, on every route of the page and with any of its characters percent-escaped, as in `https://checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/co/credit_card/{key}`. The SDK does not pause a PayU Latam payment yet. No API or Vault release is needed.
+
+- Pay a Midtrans Snap checkout, for Agentcard's own company only for now (dark launch). Midtrans' Snap popup posts the card as one JSON request to `https://api.midtrans.com/v2/token` (`https://api.sandbox.midtrans.com/v2/token` in test) under the business's publishable client key. This build declares `midtrans_card_token` on every sync, and the API serves the Midtrans entry only to a company Agentcard turned Midtrans on for, so every other company's Midtrans payments go through untouched. The token names no amount: the merchant's own server charges it afterwards, card free, and runs 3-D Secure there, so `authorize()` refuses a Midtrans token without `amount` above zero and `currency` (`AmountRequiredError`). The API refuses a saved-card reuse and any body that is not the card form's own token (`invalid_midtrans_request`), and holds the lane to Agentcard's own company until a reviewed change binds the client key to the merchant. The cardholder's device sends the card itself, with no relay. A Midtrans payment also needs the matching API and Vault releases.
+
+- Pay an SB Payment Service checkout, a Japanese store's card step that loads SBPS's one-time token script (`com_sbps_system_token.js`), for a company Agentcard turned SB Payment Service on for (dark launch). The script encrypts the card in the page and sends it as one JSONP `<script>` GET to `https://token.sps-system.com/token/generateToken` (`stbtoken.sps-system.com` in SBPS's test environment). The sync now also asks for `capabilities=sbps_token_jsonp`, and the API serves SBPS's recognizer only to an enabled company. There both adapters pause that GET, `authorize()` creates the authorization with its URL alone, the cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the paused script receives SBPS's one-time token in its own callback. Any other request on that path is aborted with an `unsupported_checkout` event, so the placeholder never reaches SBPS; the 3-D Secure info request and the scripts continue untouched. The request names no amount, so pass `amount` and `currency` above zero and the order total the page shows as `pageAmount`: `authorize()` refuses a request without them with `AmountRequiredError` or `PageAmountRequiredError`. A live payment needs a merchant Agentcard reviewed at its own checkout page, or the create answers `unsupported_checkout`. Every other company keeps today's path, where the request continues to SBPS untouched. No live payment has gone through this route yet. A payment also needs the matching API, relay and Vault releases.
+
+- Pause Paytrail's card method (the Visa and Mastercard method on the payment wall most Finnish webshops send the buyer to) for the cardholder's device. The sync now also asks for `capabilities=paytrail_hosted_payment_page`, and the API serves Paytrail's recognizer only for a company Agentcard turned Paytrail on for. The SDK pauses the merchant's signed entry to `https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect`, which carries no card and no amount, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Pass `amount` and `currency` (`eur`): the entry names no amount, so `authorize()` throws `AmountRequiredError` without them. Every other post of the card method your browser makes leads to or carries the card your agent typed: Paytrail's loading page's post, which opens Payment Highway's card page, and on `v1.api.paymenthighway.io` the card post, the Click to Pay posts and the 3-D Secure step, and so does the card page's lookup of the typed card's first digits. The SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required. Paytrail stays off for every company Agentcard has not turned it on for.
+
+- Keep a FastSpring checkout's session id out of your events and error messages however the URL spells the slashes around `/session/`. 0.23.22 showed the id after a slash escaped twice or more, as in `/session%252F<id>`, or doubled, as in `/session//<id>`. `redactUrl`, every event and every error message now show `{session}` in each of these spellings, as in `https://daisydisk.onfastspring.com/session%252F{session}/payment`. No API or Vault release is needed.
+
+- Pause the card token request Xendit's hosted invoice checkout sends, for the cardholder's device. Xendit's payment and donation links land on `https://checkout.xendit.co/web/<invoice id>`, where Pay Now has Xendit.js post the card as JSON to `https://api.xendit.co/v2/credit_card_tokens` under the business's publishable key. The sync now also asks for `capabilities=xendit_card_token`, and the API serves Xendit's recognizer only for a company Agentcard turned Xendit on for. The SDK pauses only the card form's single-use token request at that exact URL; a token that would keep the card on file, Xendit.js's code-only `storeCVN` post and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Xendit itself with the real card, and the page gets Xendit's token, then runs 3-D Secure and charges the token without the card. The token names the invoice's amount and currency, so `amount` and `currency` are optional: the API reads the token's and refuses a pair that disagrees with it. Matching API and Vault releases are required. Xendit stays off for every company Agentcard has not turned it on for.
+
+- Pause the card token request every Omise card form sends, for the cardholder's device. Omise.js's card frame (`https://cdn.omise.co/pay.html`), a merchant's own page calling Omise.js, and a checkout that bundles Omise's Node library all send the card as JSON to `https://vault.omise.co/tokens` under the merchant's public key. The sync now also asks for `capabilities=omise_card_token`, and the API serves Omise's recognizer only for a company Agentcard turned Omise on for. The SDK pauses only a card form's token request at that exact URL, a body the page posts as a `Blob` included; a wallet's tokenization and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Omise itself with the real card, and the page gets Omise's token. Omise's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a merchant Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Omise stays off for every company Agentcard has not turned it on for.
+
+## 0.23.22
+
+- Keep a FastSpring checkout's session id out of your events and error messages. FastSpring's checkout, on every store's own host under `onfastspring.com`, sends the card to `/session/<id>/payment` (after `/popup-<name>` in a popup), and anyone who holds that session id can read the session's own page, its order and the token its requests carry. `redactUrl`, every event and every error message now show it as `{session}` on every FastSpring store host, as in `https://daisydisk.onfastspring.com/session/{session}/payment`. The SDK does not pause a FastSpring payment yet. No API or Vault release is needed.
+
+- Recognize Toast's card request behind a dark launch. `syncRegistry()` now declares the `toast_pinned_key` capability (`SUPPORTED_CAPABILITIES`), and the API serves the recognizer only to an org Agentcard has enabled, so no other org's Toast checkout changes. For an enabled org, the frame's post to `https://payments.toasttab.com/v1/payment-methods` pauses when it is the guest card request under the key Agentcard pins; Apple Pay and Google Pay requests on the same URL continue untouched, and any other card request there fails with `request_without_card`. `authorize()` needs `amount` and `currency` above zero (`AmountRequiredError`), since Toast's request names no price. The cardholder's device seals the real card under Toast's key, and the SDK writes that sealed card over the agent's placeholder in `card.cardData` and changes no other byte before it continues the request; an approval whose served set is anything else fails as `PaymentOutcomeUnknownError` with reason `cse_substitutions_malformed`, and one read after its window as `cse_substitutions_expired`.
+
+- Pay a Payrexx payment through the checkout relay, for a company Agentcard turns Payrexx on for (dark launch). A Payrexx merchant's page, `https://<merchant>.payrexx.com`, takes the card in Payrexx Pay's own card frame, which posts it to its own URL, `https://checkout.payrexx.com/?pspId=44&lang=<language>`. This build declares `payrexx_card_frame` on every sync, and the API serves the Payrexx entry only to a company Agentcard turned Payrexx on for, so every other company's Payrexx payments go through untouched, as for an unsupported processor. For an enabled company the SDK pauses only the frame's own one-time card request, and the API takes it only on a Payrexx page Agentcard reviewed, WWF Ost's (`wwfost.payrexx.com`) for now. It refuses any other page with `unsupported_checkout`, reason `payrexx_instance_unreviewed`, because a donation page may offer a monthly choice that it sends only in its own order request, which no card request shows, and the cardholder there would approve a one-time payment the page repeats. That request names the frame's total, but it only mints a token, and the merchant's page charges its own total later. So `authorize()` refuses one without `amount` above zero and `currency` (`AmountRequiredError`): send the total the page shows, and the API holds it to the frame's figure exactly. The cardholder's device sends the card through the checkout relay, and the frame gets Payrexx's answer: the token, or the start of 3-D Secure. When 3-D Secure starts, the frame posts the card again for the authentication and, after the bank's challenge, for the post-authentication. The approval's read then names until when it covers those two posts (`TokenReplay.followUpsUntil`), and while the Vault page stays open the cardholder's device sends each one with the real card, with no second prompt, and the frame gets Payrexx's answer. A challenge opens on the merchant's page in the agent's browser and needs a person at that browser. Any other post of the card to the frame fails in the browser, so Payrexx never receives the dummy card, and the checkout reads `unsupported` with reason `unsupported_payrexx_card_resend` and holds, keeping the approval's state. While a send is out, a new card request fails in the browser with a `blocked` event, `a follow-up send is in flight`, which an EBANX send also raises now. A send that fails holds the checkout, even one the frame sends while the card request's answer is still landing, so the SDK refuses the frame's next card request, an EBANX one too. A Payrexx payment also needs the matching API, Vault and checkout relay releases.
+
+- Pay a Paygent checkout, for a company Agentcard turned Paygent on for (dark launch). The merchant's page hands its card fields to Paygent's own `PaygentToken.js`, which sends them to `https://token.paygent.co.jp/n/token/request` (`https://sandbox.paygent.co.jp/n/token/request` in test) and gives up 35 seconds later, too soon for an approval after the press that sends it. So the SDK sends the card only through `prepare({ psp: 'paygent', environment: 'production' })` (`'sandbox'` for Paygent's test host), before the press; without one, the SDK refuses the request before it asks the API, and sends nothing. The sync now also asks for `capabilities=paygent_token`. Once the cardholder approves, the press's request pauses, the cardholder's device sends the card to Paygent itself, and the page receives Paygent's single-use token and nothing else. One approval sends one card request: the SDK refuses a second press, and a request for a stored card's security code too. Paygent's request names no amount, so the cardholder approves the `amount` and `currency` you pass, and the API refuses a zero `amount` with `amount_required`, which `prepare()` names too. On Paygent's live host, Agentcard pays only a merchant it has reviewed, at its reviewed page, under its reviewed name, merchant id and token key, and in its currency (Tokyo Chinese School at `https://fundexapp.jp`, in yen, today). The API refuses any other with `unsupported_checkout`, or `unsupported_currency` for another currency, and `prepare()` fails with that code before anyone is asked. The API holds the reviewed merchants, so a merchant Agentcard reviews later needs no new SDK. The merchant's server runs 3-D Secure after the token, in your agent's browser. No live payment has gone through this route yet. A payment also needs the matching API and Vault releases.
+
+- Pause Eximbay's payment window (where Korean merchants send a buyer who pays with a foreign card) for the cardholder's device. The sync now also asks for `capabilities=eximbay_hosted_payment_page`, and the API serves Eximbay's recognizer only for a company Agentcard turned Eximbay on for. The SDK pauses the merchant's signed entry form to `https://secureapi.eximbay.com/Gateway/BasicProcessor.krp` (or `secureapi.test.eximbay.com` for a test merchant), which carries no card, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The merchant's page posts that form in the page or into a window it opens. `attachToCdp` pauses the post in the page, and the post into a window the page opened once it has armed that window. Eximbay's popup integration opens the window and posts the entry into it at once, so that entry can leave before the window is armed, as the entry on windows the merchant's page opens says: the SDK then fails the window's next post, the step, and the checkout reads `unsupported`, with no card sent. `attachToPlaywright` pauses only the post in the page, because Playwright does not route a window the page opens, so attach to an Eximbay checkout with `attachToCdp`. Every other post a page the SDK watches makes to Eximbay, the step that opens its window, the window's amount query, its lookup of the card's first eight digits and its card post, carries the card your agent typed or follows it: the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required. Eximbay stays off for every company Agentcard has not turned it on for.
+
+- Pause the card token request Clover's card form sends, for the cardholder's device. Clover's iframe, on a merchant's own page or in the Clover Payments plugin for WooCommerce, sends the card to `https://token.clover.com/v1/tokens` (`token-sandbox.dev.clover.com` in Clover's sandbox) with the number encrypted under Clover's key. The sync now also asks for `capabilities=clover_card_token`, and the API serves Clover's recognizer only for a company Agentcard turned Clover on for. The SDK pauses only the card frame's own request at that exact URL. The cardholder's device builds the request again with the real card and sends it to Clover itself, and the frame gets Clover's token. Clover's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. Matching API and Vault releases are required. Clover stays off for every company Agentcard has not turned it on for.
+
 ## 0.23.21
 
 - Pause ComGate's payment gateway, where most Czech and Slovak e-shops send the buyer, for the cardholder's device. The sync now also asks for `capabilities=comgate_hosted_payment_page`, and the API serves ComGate's recognizer only for a company Agentcard turned ComGate on for. The merchant's server creates the payment at ComGate and sends the buyer to `https://payN.comgate.cz/init?id=<transaction id>`. The SDK pauses that link, in the page, in a frame of it or in a window it opened, as a `hosted_form` authorization that carries the link alone, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. The link names no amount, so `authorize()` refuses one without `amount` and `currency`, above zero, with `AmountRequiredError`. Every request but a GET that your browser makes to ComGate's API (`payments.comgate.cz`, `payments-gcp.comgate.cz`) or its card frame hosts (`sec.comgate.cz`, `sec-gcp.comgate.cz`) carries the card your agent typed, part of it or its ciphertext, and the SDK fails each one and reads `unsupported` with reason `processor_card_page`. Your events and error messages name the link without its id. Matching API and Vault releases are required. ComGate stays off for every company Agentcard has not turned it on for.

package/PREFLIGHT.md

@@ -211,8 +211,12 @@ HiPay (`hipay`) has no discovery rule in this table. HiPay's JavaScript SDK (`li
 
 Gravy Secure Fields (`gravy`) is identified from the loader its merchants load, `/secure-fields/latest/secure-fields.js` on `cdn.<merchant>.gr4vy.app` (or `cdn.sandbox.<merchant>.gr4vy.app`), but it is not in this table. It launches dark: the direct SDK pauses Gravy's card request, a `PUT` from Gravy's controller frame, only after `syncRegistry()` and only for an org Agentcard has enabled, so the bundled catalog leaves it out and a Gravy checkout stays `unknown`.
 
+Toast (`toast`) has no discovery rule in this table while it launches dark: the direct SDK pauses Toast's card request only after `syncRegistry()` and only for an org Agentcard has enabled, so a Toast checkout stays `unknown` until a rule for Toast's payments frame ships with the release that serves it to every company.
+
 Paddle (`paddle_vgs`) has no discovery rule in this table. Paddle's checkout frame on `buy.paddle.com` names the tokenizer it sends the card through only after the buyer's first step, and Paddle can name another one for each checkout, so nothing on the page before that step says which one a checkout uses, and a Paddle checkout stays `unknown`. The direct SDK pauses the card request a VGS checkout sends to `vault.paddle.com/cards` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Paddle row of the [README](./README.md) processor table for what the SDK covers.
 
+Paygent (`paygent`) has no discovery rule in this table yet. Every Paygent card form loads Paygent's `PaygentToken.js`, so a rule would name every Paygent checkout while no Paygent payment has gone through, and a Paygent checkout stays `unknown`. The direct SDK pauses the token request to `token.paygent.co.jp/n/token/request` only after `syncRegistry()`, only through a prepared checkout, and only for an org Agentcard has enabled. Read the Paygent row of the [README](./README.md) processor table for what the SDK covers.
+
 The bundled direct SDK profile declares processor support for `one_time` purchases. The catalog carries each processor's request limitations and known exclusions. A detection rule does not cover every product or regional variant sold under the processor's name. For example, Moneris Hosted Tokenization and Moneris Checkout use different payment paths; the implemented adapter covers Hosted Tokenization.
 
 The catalog also carries reviewed hosted, regional, and versioned variants observed on live checkouts: Adyen secured fields on the regional live hosts and any release, the Square card element frame, dLocal Smart Fields releases, Mercado Pago secure fields and the guest Checkout Pro card form, and the Rapyd hosted checkout page. A variant the implemented adapter does not admit, such as the Tranzila terminal-root page, the Authorize.Net hosted payment form, or a Worldpay hosted payment page, identifies its processor and returns `unknown` with `processor_variant_unverified`. A new fingerprint never declares payment support by itself.

package/README.md

@@ -281,16 +281,19 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Pelecard (Iframe/Redirect 2.0) | dark: paused only for an org Agentcard enables for Pelecard, in test mode and live. One-time card payments on `gateway21` and `gateway20.pelecard.biz`; pass `amount`, `currency` and the page's total as `pageAmount`. A live checkout pays only with a card the cardholder stored. See [Pay a Pelecard checkout](#pay-a-pelecard-checkout) |
 | CreditGuard (Hyp PPS hosted payment page) | dark launch, prepared checkout only (see "Pay a CreditGuard checkout"): served to this build (`capabilities=creditguard_pps_process`) only for a company Agentcard enabled for it, and prepared or paid only for that company. The cardholder's device sends the card and the page reads CreditGuard's answer. 3-D Secure, OTP, installments, save-my-card and currency conversion are refused. No UAT or live capture yet |
 | Primer (Web SDK v2 hosted fields; Printful, GetYourGuide) | dark launch (mode `token`): only for an org Agentcard has enabled; see [Pay a Primer checkout](#pay-a-primer-checkout) |
+| Toast (Toast's payments frame; Toast online ordering) | dark launch, mode `cse` under a pinned key: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the frame's post to `payments.toasttab.com/v1/payment-methods` pauses when it is the guest card request, always with the cardholder's approval, never autopilot. Pass `amount` and `currency`, above zero: the request names no price, so that is the total the cardholder approves. A card the page asks Toast to keep for later payments, or one sealed under another key, is refused. Apple Pay and Google Pay requests on the same URL continue untouched. No live payment has gone through this route yet |
 | Payrails web SDK (Blacklane, FlixBus) | dark launch (mode `device_encrypt`): only for an org Agentcard has enabled, and only the card form's single-use save and its single-use payment until card-on-file consent exists; see [Pay a Payrails checkout](#pay-a-payrails-checkout) |
 | Elavon Converge (Hosted Payment Page) | dark: paused only for an org Agentcard enables for Converge, always with the cardholder's approval, never autopilot. One credit card sale in US dollars per payment page on `api.convergepay.com` or `www.convergepay.com` (`api.demo.convergepay.com` in Converge's demo environment); no amount needed. See [Pay an Elavon Converge payment page](#pay-an-elavon-converge-payment-page) |
 | Moneris Hosted Tokenization (Moneris's card frame; Raisin donation pages) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/HPPtoken/request.php` on `www3.moneris.com` or `gateway.moneris.com` (`esqa.moneris.com` for a test row) when it carries the card number, expiry and CVD, always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the profile id the frame names must be one pinned for the checkout page's origin (Jack.org's Raisin page today), or the create answers `unsupported_checkout`. A frame that leaves the expiry or CVD to the merchant's page, or a post to any other `request.php` URL, fails in the browser with a `blocked` event, `request_without_card`. The cardholder's device sends the card through the checkout relay, and the page gets Moneris's temporary token, which the merchant charges from its own server: pass `amount` and `currency`, the total the cardholder approves. Moneris Checkout (`/chkt/`, `/chktv2/`) is not supported |
 | GoDaddy Payments (Poynt's card frame on a GoDaddy Online Store checkout) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/v1/commerce/stores/<store id>/payment-tokens/generate-nonce` on `services.poynt.net`, always with the cardholder's approval. A live payment needs a store Agentcard reviewed: the store id must be one pinned for the checkout page's origin, or the create answers `unsupported_checkout`; a test key is refused, since Poynt has no test host. A form that asks Poynt to keep the card fails in the browser with a `blocked` event. The cardholder's device sends the card through the checkout relay, and the page gets Poynt's nonce, which the store's server charges: pass `amount` and `currency`, the total the cardholder approves. The store's pay button runs an invisible reCAPTCHA, so a person presses it |
+| SB Payment Service (SBPS's one-time token script; BOSS E・ZO FUKUOKA's ticket site) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the token script's JSONP GET to `/token/generateToken` on `token.sps-system.com` (`stbtoken.sps-system.com` for a test row), always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the merchant and service ids the request names must be ones pinned for the checkout page's origin, or the create answers `unsupported_checkout`. Any other request on that path fails in the browser with an `unsupported_checkout` event. The cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the page's script gets SBPS's one-time token in its own callback, which the store charges from its own server: pass `amount` and `currency` above zero, and the order total the page shows as `pageAmount` |
 | WSPay Components (WSPay's build of Monri Components) | dark launch: the card frame's confirm of a new card, after `vault.syncRegistry()`, with `amount` and `currency`, and only for an org Agentcard has enabled; for any other org the SDK leaves WSPay's requests alone. The cardholder's device sends the card to WSPay and the frame receives WSPay's answer. A confirm that asks WSPay to keep the card on file, as Valamar's does on every booking, is paid only as a hotel's EUR 1.00 card guarantee with a card the cardholder stored. Validated in local Chromium against a model of the card frame; no WSPay sandbox run or live merchant purchase yet. See [Pay a WSPay Components checkout](#pay-a-wspay-components-checkout) |
 | Shiji STS (MyCheck Wallet V3; Wyndham's booking pages) | dark launch, mode `cse` under a pinned key, and only for an org Agentcard has enabled. The card token a hotel booking mints guarantees the stay, so the cardholder approves with a card they stored, under a line that says the hotel can keep it on file. See [Shiji STS](#shiji-sts-mycheck-wallet-v3) |
 | Wix checkout (Wix Cashier's card frame; Wix Payments and classic Stripe on Wix) | dark launch: only in Agentcard's own account for now, after `vault.syncRegistry()`, and only through `prepare({ psp: 'wix_payments', environment: 'production' })` at a store Agentcard reviewed, with `amount` and `currency`. The frame's post to `cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens` pauses, the cardholder's device sends the card through the checkout relay, and the frame receives Wix's token. Wix has no test environment. The SDK refuses the frame's second card request after a 401 or 403 in the browser, and fails a request still unsent 20 seconds after the pause, before the card leaves (`wix_payments_send_window_closed`) |
 | HiPay Enterprise (HiPay's hosted fields; France, Portugal, Italy, Spain) | dark launch: after `vault.syncRegistry()`, only for an org Agentcard has enabled, and only through `prepare({ psp: 'hipay', environment: 'production' })` (`'sandbox'` for HiPay's stage vault) at a merchant Agentcard reviewed, with `amount` and `currency` above zero. The hosted fields' post to `secure2-vault.hipay-tpp.com/rest/v2/token` pauses, the cardholder's device sends the card to HiPay directly, and the frame receives HiPay's token. The frame's number-only post and its `/update` fail in the browser (`hipay_number_only`, `hipay_update_refused`), and a request still unsent 12 seconds after the pause fails before the card leaves (`hipay_send_window_closed`). Agentcard has reviewed one merchant so far, HappyBulle: a live checkout prepares only at `https://www.happybulle.com`, with `merchant: 'HappyBulle'`; `prepare()` at any other page fails with `unsupported_checkout`, and so does the create for a card request under any public username but HappyBulle's own |
 | Amadeus Checkout (Air France, KLM) | dark: only for an org Agentcard enabled, and only through `prepare({ psp: 'amadeus_checkout', cardId })`. The Checkout Web SDK's card add pauses; every other action on its URL continues. Air France and KLM keep the expiry in their own form, so the agent types the stored card's real expiry there and the checkout pays only with that card. Every Data Collection Page store is refused as `amadeus_dcp_field_config_unreviewed`. No live purchase yet. See "Prepare an Amadeus Checkout card step" |
 | Paddle checkout (Paddle's card vault or TokenEx; any Paddle seller) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled. On a Paddle checkout whose card method names VGS, pay only through `prepare({ psp: 'paddle_vgs', environment: 'production' })` (`'sandbox'` for Paddle's sandbox) on an attachment whose `cardId` names the paying card; without one, `prepare()` fails with `card_required`. The frame's post to `vault.paddle.com/cards` pauses, the cardholder's device sends the card itself, and the frame receives the stored card's id; its second request after its 10-second timeout gets the same answer. Type `placeholderCard()`'s facts for that card into Paddle's form, and pass `amount` and `currency`, the total the cardholder approves. Only Visa, Mastercard and American Express cards are paid (`paddle_vgs_card_unsupported` otherwise), and a typed expiry or placeholder that is not the card's fails the create with `paddle_vgs_card_mismatch`. On the live vault, Agentcard pays a checkout at any Paddle seller's own https page; from any other page, such as `http://localhost:4000`, `prepare()` fails with `unsupported_checkout`. Paddle's vault keeps the card, so Paddle can charge it again without another approval, at a subscription's renewal for example. Paddle's `/pay` that follows names the approved card's first six and last four digits, expiry and brand: the SDK writes them over the ones Paddle's form read from the placeholder, and aborts a `/pay` that names another stored card or comes more than a minute later. On a Paddle checkout whose card method names TokenEx, call no `prepare()`: the SDK pauses Paddle's `/pay`, and once the cardholder approves it, writes the card the cardholder's device encrypted over the placeholder's. With a `paddle_vgs` preparation on the attachment, the SDK refuses that `/pay` with `checkout_changed`. A Paddle checkout that sends the card through Spreedly is not supported |
+| Paygent (`PaygentToken.js`; Fundex donation forms) | dark launch: only for an org Agentcard enabled, after `vault.syncRegistry()`, and only through `prepare({ psp: 'paygent', environment: 'production' })` (`'sandbox'` for Paygent's test host) before the press that sends the card: the script gives up on its token request 35 seconds after sending it. The request to `token.paygent.co.jp/n/token/request` pauses, the cardholder's device sends the card itself, and the page receives Paygent's single-use token. One approval sends one card request, so the SDK refuses a second press, and a request for a stored card's security code too. Pass `amount` and `currency`, the total the cardholder approves. On the live host the API accepts only a reviewed merchant at its reviewed page, under its reviewed name, merchant id and token key, and in its currency (Tokyo Chinese School at `https://fundexapp.jp`, in yen), and refuses any other before anyone is asked. The merchant runs 3-D Secure after the token in the agent's browser. No live payment has gone through this route yet |
 
 The recognizer list, and the status of each reviewed Adyen merchant profile on
 your client, are fetched from the API at runtime (`agentcard.checkout.syncRegistry()`),
@@ -298,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -329,7 +332,11 @@ same way: this build pauses the merchant's redirect to
 page or a frame of it, and with `attachToCdp` also in a window the page opened,
 for the cardholder's device, and fails every request but a GET your browser
 makes to Webpay, so the token is never spent in your browser and Webpay never
-sees the card your agent typed. `attachToPlaywright` covers the page it is
+sees the card your agent typed. Once the cardholder's phone has paid, the
+paused link goes to the shop's return page with Webpay's token, for a shop
+Agentcard has reviewed with its return page, so the shop records the order and
+shows its receipt in your browser; any other Webpay checkout gets the
+`submitted_on_device` page. `attachToPlaywright` covers the page it is
 attached to and that page's frames, and pauses the entry when one of them
 navigates to it directly or by script. Playwright's `page.route` never sees the
 hop of an HTTP redirect, so a merchant whose server answers its checkout with a
@@ -340,6 +347,11 @@ that opens Webpay in a popup needs that popup attached on its own, and a popup's
 first navigation needs the integration
 [Browser integration and merchant outcomes](#browser-integration-and-merchant-outcomes)
 describes.
+Paytrail's card method (`paytrail_hosted_payment_page`) is served the same
+way: this build pauses the merchant's signed Visa and Mastercard entry to
+`services.paytrail.com` for the cardholder's device, and fails the loading
+page's own post, every post your browser makes to Payment Highway's card page
+and the card page's lookup of the typed card's first digits.
 PayMongo's hosted checkout (`paymongo_checkout_pay`) is served on the same terms:
 this build pauses the checkout page's own card attach on `checkout.paymongo.com`,
 the cardholder's device sends it through the checkout relay, and the page gets
@@ -355,6 +367,14 @@ same way: this build pauses the merchant's signed entry form to
 `payment.quickpay.net` for the cardholder's device and fails every other post
 your browser makes to QuickPay, and the window's lookup of the typed card's
 first digits.
+Eximbay's payment window (`eximbay_hosted_payment_page`) is served the same
+way: this build pauses the merchant's signed entry form to
+`secureapi.eximbay.com/Gateway/BasicProcessor.krp` for the cardholder's device
+and fails every other post your browser makes to Eximbay. A merchant that opens
+Eximbay's window in a new window gets the pause only under `attachToCdp`, and
+only once the SDK has armed that window: an entry posted into a window the page
+opens in the same moment can leave first, and the SDK then fails the window's
+next post, so the checkout reads `unsupported` with no card sent.
 Revolut Business's card field (`revolut_card_field`) is served on the same
 terms: this build pauses the frame's card payment on `merchant.revolut.com`,
 the cardholder's device sends it to Revolut itself, and the frame gets
@@ -364,6 +384,16 @@ for now (dark launch), until a reviewed change binds GoPay's payee and amount
 to the approval: this build pauses the card frame's own post on
 `secure.gopay.com`, at a shop Agentcard reviewed, the cardholder's device sends
 it through the checkout relay, and the frame gets GoPay's answer.
+Payrexx Pay's card frame (`payrexx_card_frame`) is served only to a build that
+lists it, for a company Agentcard turned Payrexx on for: this build pauses the
+frame's own one-time card request on `checkout.payrexx.com`, the cardholder's
+device sends it through the checkout relay, and the frame gets Payrexx's
+answer. The API takes it only on a Payrexx page Agentcard reviewed, WWF Ost's
+for now, and refuses any other with `unsupported_checkout`
+(`payrexx_instance_unreviewed`): a donation page may offer a monthly choice
+that no card request shows. When that answer starts 3-D Secure, the device also sends the frame's
+two 3-D Secure posts under the same approval, and every other post of the card
+to the frame fails in your browser.
 ComGate's payment gateway (`comgate_hosted_payment_page`) is served only to a
 build that lists it, for a company Agentcard turned ComGate on for: this build
 pauses the gateway link the merchant sends the buyer to,
@@ -375,6 +405,25 @@ this build pauses the widget's card `PUT` to `api.sumup.com/v0.2/checkouts/<id>`
 the API takes it only for a reviewed SumUp merchant and at the `amount` the
 payment page shows, the cardholder's device sends it to SumUp, and the widget
 gets SumUp's answer.
+Clover's card form (`clover_card_token`) is served on the same terms: this
+build pauses the card token request Clover's card frame sends to
+`token.clover.com/v1/tokens`, the cardholder's device builds it again with the
+real card encrypted under Clover's key and sends it to Clover itself, and the
+frame gets Clover's token. Clover's request names no price, so pass `amount`
+and `currency`, above zero: that is the amount the cardholder approves.
+Xendit's hosted invoice checkout (`xendit_card_token`) is served on the same
+terms: this build pauses the card token request Xendit.js sends from
+`checkout.xendit.co` to `api.xendit.co/v2/credit_card_tokens`, the cardholder's
+device sends it to Xendit itself with the real card, and the page gets Xendit's
+token and runs 3-D Secure. The token names the invoice's amount, so `amount`
+and `currency` are optional; a pair you pass must match the token's.
+Omise's card token (`omise_card_token`) is served on the same terms: this
+build pauses the token request an Omise card form sends to
+`vault.omise.co/tokens`, from Omise.js's card frame or from a merchant's own
+page, the cardholder's device sends it to Omise itself with the real card, and
+the page gets Omise's token. The API pays only a merchant Agentcard reviewed
+for the page the request comes from. Omise's request names no price, so pass
+`amount` and `currency`, above zero: that is the amount the cardholder approves.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure
@@ -1337,8 +1386,8 @@ await controller.prepare({ psp: 'aci', environment: 'production' }); // 'sandbox
 Type a placeholder card of the approved card's network (a Mastercard-range placeholder for an Agentcard-issued card), then click Pay once. The cardholder's device refuses a placeholder of another network before any card leaves it, and the authorization ends `declined` with reason `aci_brand_mismatch`. The SDK:
 
 - pauses the card-number request and binds it to the preparation. The cardholder's device sends it to ACI with the real number, CVC and expiry, and the page receives ACI's answer.
-- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than ACI takes, leaves them waiting for the card-number request.
-- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to the 4,096 characters ACI takes) through untouched.
+- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than 8,192 characters, leaves them waiting for the card-number request.
+- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to 8,192 characters) through untouched. IKEA US's page posts one of 5,953 characters, past the 4,096 ACI's API reference names, and ACI takes it.
 - lets the page's `/payment` submission continue once, only as the widget's own form post into its hidden iframe (a frame navigation) and only after its checkout's card-number request was answered (`aci_payment_continued`). In classic mode the placeholder expiry the page put there is removed (`stripped: true`). `paymentBrand` must be the brand of the placeholder you typed, `shopperResultUrl` must be on the prepared merchant origin, and `shopperResultTarget`, when the page sets one, must be `_top`, ACI's own default.
 
 The SDK removes that expiry only on a browser that sends the body it replaced on a navigation, which the SDK's tests show on Chromium. `attachToCdp` drives Chromium. `attachToPlaywright` reads the page's browser engine, or, for a persistent context, checks whether a CDP session opens, which only Chromium allows. On Firefox or WebKit it refuses a classic-mode `/payment` as `aci_expiry_unstrippable` rather than send the placeholder expiry. A SAQ-A-mode `/payment` has nothing to remove and continues on any engine.

package/dist/aci.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 624ca03645e28d72156188c850b3650fd0f5162b0366475e6a124657120f7f11
+// artifact-sha256: 82e5241b99296bfb616a3c740a6a1c6a29f563405ed4a6ded681e21fb24168ab
 // src/aci.js
 var ACI_HOSTS = Object.freeze(["eu-prod.oppwa.com", "oppwa.com", "eu-test.oppwa.com", "test.oppwa.com"]);
 var ACI_TEST_HOSTS = Object.freeze(["eu-test.oppwa.com", "test.oppwa.com"]);
@@ -23,8 +23,8 @@ var ACI_PASSED_FIELDS = Object.freeze(["card.holder"]);
 var ACI_SIBLING_KEYS = Object.freeze(["customParameters[SHOPPER_EndToEndIdentity]"]);
 var ACI_REMOVED_ON_CONTINUATION = Object.freeze(["card.expiryMonth", "card.expiryYear"]);
 var ACI_FINGERPRINT_FIELD = "customer.browserFingerprint.value";
-var FINGERPRINT_LENGTH = 4096;
-var LEG_BODY_LIMIT = 16384;
+var FINGERPRINT_LENGTH = 8192;
+var LEG_BODY_LIMIT = 32768;
 var END_TO_END = ACI_SIBLING_KEYS[0];
 var CHECKOUT_ID = /^[0-9A-F]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}$/i;
 var ENDPOINT_PATH = /^\/v1\/checkouts\/([^/]+?)(\/payment|\/registration)?$/;

package/dist/agent-amount.generated.d.ts

@@ -0,0 +1,7 @@
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export declare const AGENT_AMOUNT: {
+    processors: readonly string[];
+    aboveZero: readonly string[];
+    pageAmount: readonly string[];
+    names: Readonly<Record<string, string>>;
+};

package/dist/agent-amount.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export const AGENT_AMOUNT = { "processors": ["clover", "comgate", "cybersource_secure_acceptance", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["clover", "comgate", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/amadeus-checkout.generated.d.ts

@@ -12,6 +12,10 @@ declare var AMADEUS_CARD_URLS: Readonly<{
         dcp: readonly never[];
     }>;
 }>;
+declare var AMADEUS_RELAY_HOSTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
 declare var AMADEUS_MERCHANT_EXPIRY_POLICIES: readonly string[];
 declare var AMADEUS_MERCHANT_EXPIRY_POLICY: string;
 declare var AMADEUS_REFUSAL_REASONS: readonly string[];
@@ -34,6 +38,7 @@ declare function injectAmadeusCard(body: any, card: any, options?: {}): {
     body: string;
     where: any[];
 };
+declare function isAmadeusDeviceRequest(templateBody: any, deviceBody: any, environment: any): boolean;
 declare function amadeusResponseOutcome(status: any, body: any, { url, card }?: {}): {
     outcome: string;
     reason: string;
@@ -54,4 +59,4 @@ declare function sanitizeAmadeusResponse(body: any, url: any, card: any): string
 declare function amadeusFacts(body: any): {
     refusalCode: any;
 };
-export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };
+export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, AMADEUS_RELAY_HOSTS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isAmadeusDeviceRequest, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };

package/dist/amadeus-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: d537d04a5cd64f34af196a0f6cec7a7f5319bb396d94824131857a04632aab0a
+// artifact-sha256: 2f7fee05c7e7675b8929a13a4c2870f4d795c6d0b59cc616fb952c4a4d1cfe08
 // src/amadeus-body.js
 var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -43,6 +43,10 @@ var AMADEUS_CARD_URLS = Object.freeze({
         dcp: Object.freeze([])
     })
 });
+var AMADEUS_RELAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["paypages.payment.amadeus.com"]),
+    sandbox: Object.freeze(["paypages.test.payment.amadeus.com"])
+});
 var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
 var AMADEUS_MERCHANT_EXPIRY_POLICY = "fill";
 var AMADEUS_REFUSAL_REASONS = Object.freeze([
@@ -356,6 +360,26 @@ function injectAmadeusCard(body, card, options = {}) {
         write(holder, sound.name);
     return { body: JSON.stringify(value), where };
 }
+function isAmadeusDeviceRequest(templateBody, deviceBody, environment) {
+    const page = readAmadeusBody(templateBody);
+    const device = readAmadeusBody(deviceBody);
+    if (!page || !device || !owns2(page, "PPID") || !owns2(device, "PPID") || sdkShapeRefusal(page) || sdkShapeRefusal(device))
+        return false;
+    const before = page.data.mopdata;
+    const after = device.data.mopdata;
+    const written = ["pan", "CVV", "expmonth", "expyear", ...owns2(before, "holdername") ? ["holdername"] : []];
+    if (!written.every((key) => owns2(after, key)))
+        return false;
+    const restored = readAmadeusBody(deviceBody);
+    for (const key of written)
+        restored.data.mopdata[key] = before[key];
+    if (JSON.stringify(restored) !== templateBody)
+        return false;
+    const cvcLength = after.vendor === "amex" ? 4 : 3;
+    if (amadeusVendorFor(after.pan) !== after.vendor || !digits(after.CVV, cvcLength, cvcLength) || !exact(MONTH, after.expmonth) || !exact(TWO_DIGITS, after.expyear) || owns2(after, "holdername") && after.holdername.trim() === "")
+        return false;
+    return environment === "sandbox" || after.pan !== before.pan;
+}
 var RESPONSE_LIMIT = 32768;
 var DECLINE_LABELS = Object.freeze(["label_error_payment", "label_error_bin", "label_error_bin_vendor", "label_error_bin_type"]);
 var EXPIRED_LABELS = Object.freeze(["session_timeout", "ppid_expired"]);
@@ -546,4 +570,4 @@ function amadeusFacts(body) {
     const label = value ? sdkFailureLabel(value) : null;
     return { refusalCode: DECLINE_LABELS.includes(label) ? label : null };
 }
-export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };
+export { AMADEUS_CARD_MOPID, AMADEUS_CARD_URLS, AMADEUS_CHECKOUT_CAPABILITY, AMADEUS_CHECKOUT_PSP, AMADEUS_DCP_REVIEWED_KEYS, AMADEUS_MERCHANT_EXPIRY_POLICIES, AMADEUS_MERCHANT_EXPIRY_POLICY, AMADEUS_REFUSAL_REASONS, AMADEUS_RELAY_HOSTS, amadeusBodyKind, amadeusCardUrl, amadeusEnvironment, amadeusFacts, amadeusPreparationUrls, amadeusRefusalMessage, amadeusRequestRefusal, amadeusResponseOutcome, amadeusSdkHostRefusal, amadeusVendorFor, injectAmadeusCard, isAmadeusCardUrl, isAmadeusDcpConfig, isAmadeusDeviceRequest, isPreparedAmadeusRequest, readAmadeusBody, sanitizeAmadeusResponse };

package/dist/capabilities.generated.d.ts

@@ -0,0 +1,2 @@
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export declare const DECLARED_CAPABILITIES: readonly string[];

package/dist/capabilities.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];