@agent-cards/sdk 0.23.21 → 0.23.23

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 7544ef9813a4b2b55031179301878be4c74d1f1363eacca7552d7ba0f5bb4843
+// artifact-sha256: 7d433d016a6cb47bb9d1cf22ab63bf41d3d67091d68a23e2d3c8885dbfa98b43
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -10,6 +10,158 @@ function deepFreeze(value) {
     }
     return value;
 }
+// src/registration.js
+var PARTS = { psp: "id", definitions: "list", refusedOperations: "list", settlementReadback: "any", exactUrl: "rule", bodyGate: "rule", amount: "rule" };
+var PSP_ID = /^[a-z][a-z0-9_]*$/;
+var registrationProblems = (spec) => problemsOf(spec, PARTS);
+function problemsOf(spec, parts) {
+    if (!spec || typeof spec !== "object")
+        return ["a registration is an object"];
+    const psp = spec.psp;
+    if (typeof psp !== "string" || !PSP_ID.test(psp))
+        return [`${JSON.stringify(psp)} is not a processor id`];
+    const problems2 = Object.keys(spec).filter((key) => !(key in parts)).map((key) => `${psp}: ${key} is no registration part`);
+    for (const [key, kind] of Object.entries(parts)) {
+        const value = spec[key];
+        if (value === void 0)
+            continue;
+        if (kind === "rule" && typeof value !== "function")
+            problems2.push(`${psp}: ${key} is not a function`);
+        if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
+            problems2.push(`${psp}: ${key} is not a list of card numbers`);
+        }
+    }
+    if ("definitions" in parts) {
+        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
+            problems2.push(`${psp}: names no definition`);
+        else if (spec.definitions.some((definition) => definition?.psp !== psp))
+            problems2.push(`${psp}: a definition names another processor`);
+        for (const id of spec.refusedOperations ?? []) {
+            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
+                problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
+        }
+    }
+    return problems2;
+}
+function registered(spec, parts) {
+    const problems2 = problemsOf(spec, parts);
+    if (problems2.length)
+        throw new Error(`payment-core registration refused: ${problems2.join("; ")}`);
+    return deepFreeze({ ...spec });
+}
+function registerProcessor(spec) {
+    return registered(spec, PARTS);
+}
+// src/processors/midtrans.js
+var MIDTRANS_PSP = "midtrans";
+var MIDTRANS_OPERATION = "midtrans.card_request";
+var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
+var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
+var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
+var BODY_LIMIT = 4096;
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var YEAR = /^20[0-9]{2}$/;
+var TERM = /^[0-9]{1,3}$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isMidtransTokenUrl(url) {
+    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function midtransBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null || !inOrder(value, MIDTRANS_TOKEN_KEYS)) {
+        if (record(value) && (own(value, "token_id") || own(value, "two_click")) && !own(value, "card_number"))
+            return refuse("midtrans_saved_card");
+        return refuse("midtrans_body_unsupported");
+    }
+    if (!own(value, "card_cvv") || !own(value, "card_number") || !own(value, "card_exp_month") || !own(value, "card_exp_year")) {
+        return refuse("midtrans_body_unsupported");
+    }
+    if (typeof value.card_cvv !== "string" || !SECURITY_CODE.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR.test(value.card_exp_year))
+        return refuse("midtrans_body_unsupported");
+    if (own(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
+        return refuse("midtrans_body_unsupported");
+    return CARD;
+}
+var midtrans_default = /* @__PURE__ */ registerProcessor({
+    psp: MIDTRANS_PSP,
+    definitions: [
+        {
+            psp: "midtrans",
+            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
+            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
+            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
+            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
+            capability: "midtrans_card_token",
+            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
+            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
+            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
+            // cookies never ride.
+            passthroughHeaders: ["^authorization$", "^x-service$"],
+            jsonCardFields: [["card_number"]]
+        }
+    ],
+    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
+    refusedOperations: [MIDTRANS_OPERATION],
+    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    settlementReadback: "not_surveyed",
+    exactUrl: isMidtransTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+});
+// src/processors/index.generated.js
+var REGISTERED_MODULES = Object.freeze({
+    midtrans: midtrans_default
+});
+// src/registry.js
+var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
+var ids = REGISTERED_PROCESSORS.map((processor) => processor.psp);
+var problems = REGISTERED_PROCESSORS.flatMap(registrationProblems);
+for (const [name, processor] of Object.entries(REGISTERED_MODULES)) {
+    if (processor.psp !== name)
+        problems.push(`processors/${name}.js registers ${JSON.stringify(processor.psp)}`);
+}
+if (ids.some((id, i) => i > 0 && ids[i - 1] >= id))
+    problems.push(`registered processors out of id order: ${ids.join(", ")}`);
+if (problems.length)
+    throw new Error(`payment-core registry refused: ${problems.join("; ")}`);
+var BY_PSP = new Map(REGISTERED_PROCESSORS.map((processor) => [processor.psp, processor]));
+var REGISTERED_IDS = Object.freeze(ids);
+var REGISTERED_DEFINITIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.definitions));
+var REGISTERED_REFUSED_OPERATIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.refusedOperations ?? []));
+var REGISTERED_SETTLEMENT_READBACK = Object.freeze(REGISTERED_PROCESSORS.filter((processor) => processor.settlementReadback !== void 0).map((processor) => [processor.psp, processor.settlementReadback]));
 // src/definitions.js
 var PROCESSOR_DEFINITIONS = deepFreeze([
     {
@@ -563,8 +715,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // posts the card there in that same session, and the runtime resolves the paused navigation with the
         // hosted_form notice. Only the entry path is matched, exactly (processors/paytrail.js isPaytrailEntryUrl:
         // a query would reach Paytrail's server beside the signed body). The card page and its card, wallet and
-        // card-number lookups live on Payment Highway's host, which no recognizer takes; the SDK's pause, a later
-        // change, refuses them in the agent's browser, so no dummy card reaches Payment Highway. The entry names no amount: Paytrail
+        // card-number lookups live on Payment Highway's host, which no recognizer takes: it is an abort host, armed in
+        // the SDK's adapters so the SDK's Paytrail gate refuses every card request the agent's browser sends there,
+        // and no dummy card reaches Payment Highway. The entry names no amount: Paytrail
         // holds it, so the cardholder approves the agent's amount and the device holds it to the amount the card
         // page names. Paytrail's public test merchant shares this host, so the host marks no environment. Dark:
         // served only to a client that declares the capability, and gated off for every org the operator has not
@@ -572,6 +725,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         capability: "paytrail_hosted_payment_page",
         match: "services\\.paytrail\\.com/payments/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/click-to-pay/loading-and-redirect",
         hosts: ["^services\\.paytrail\\.com$"],
+        // Payment Highway's live host (processors/paytrail.js PAYMENT_HIGHWAY_HOSTS), which no recognizer takes: an SDK that
+        // declares the capability arms it so its gate can refuse the card posts the agent's browser sends there.
+        abortHosts: ["^v1\\.api\\.paymenthighway\\.io$"],
         encoding: "form",
         passthroughHeaders: [],
         mode: "hosted_form",
@@ -615,12 +771,12 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // navigation with the hosted_form notice. Only the entry path is matched, exactly (processors/eximbay.js
         // isEximbayEntryUrl: a query would reach Eximbay's servlet as fields beside the signed body). The window's
         // card lookup (checkCardBin.do) and its card post (checkApprv.jsp) carry a card and are never paused, and
-        // the agent's browser never loads the window while the entry waits. No SDK gate refuses those two posts
-        // in the agent's browser yet (checkout/src/pre-claim.ts holds Redsys's and NMI's, none for Eximbay), and
-        // until one does the SDK does not declare this capability. Eximbay's test host serves the same window
-        // for test merchants, so a live row reaches the live host only and a test row the test host only. Dark:
-        // served only to a client that declares the capability, and gated off for every org the operator has not
-        // allowlisted.
+        // the agent's browser never loads the window while the entry waits. The SDK's Eximbay gate refuses those
+        // two posts in the agent's browser, with every other post to these hosts but the entry
+        // (checkout/src/pre-claim.ts eximbayPreClaim), so no dummy card reaches Eximbay. Eximbay's test host serves
+        // the same window for test merchants, so a live row reaches the live host only and a test row the test host
+        // only. Dark: served only to a client that declares the capability, and gated off for every org the operator
+        // has not allowlisted.
         capability: "eximbay_hosted_payment_page",
         match: "secureapi\\.(?:test\\.)?eximbay\\.com/Gateway/BasicProcessor\\.krp",
         hosts: ["^secureapi\\.eximbay\\.com$", "^secureapi\\.test\\.eximbay\\.com$"],
@@ -2120,13 +2276,14 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // approves. paygent.js holds the rule the pause decision and the device read: the exact URL, the
         // script's content type, and createToken's seven keys in its order and spelling with the token key
         // held to the host's environment; createCvcToken (a stored card's code) is refused. The script
-        // abandons the XHR after 35 s; the preparation that moves the approval before the press comes with
-        // the API's Paygent change, which sets `preparationRequired` with it.
+        // abandons the XHR after 35 s, too soon for an approval after the press that sends it, so the
+        // lane is prepared only (`preparationRequired`): the cardholder approves before the press, and the
+        // press's request binds that approval (paygent.js isPreparedPaygentRequest). On the live host it
+        // binds only the merchant_id a reviewed pin lists for the approved origin and merchant
+        // (PAYGENT_MERCHANT_PINS), and one approval binds one request, so a second card request is sent nowhere.
         // Paygent's hosted payment page (link.paygent.co.jp) carries the card on other paths and is not paused.
         // Paygent answers a refused card inside HTTP 200, so its own judge reads every answer by its body
-        // (paygent.js paygentAnswerOutcome), never the shared status rule. No operator lists an org before the
-        // API's Paygent change lands: the amount the request does not name, the merchant pin per checkout
-        // origin, the refusal of a second card request on one checkout, and the preparation for the 35 s window.
+        // (paygent.js paygentAnswerOutcome), never the shared status rule.
         // Ships dark: served only to a client that declares `paygent_token`, gated off for every org until an
         // operator lists one (`paygent:<org>`), and autopilot never sends this request (autopilot.js
         // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.paygent.co.jp only on
@@ -2136,6 +2293,7 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         hosts: ["^token\\.paygent\\.co\\.jp$", "^sandbox\\.paygent\\.co\\.jp$"],
         sandboxHosts: ["^sandbox\\.paygent\\.co\\.jp$"],
         hostEnvironmentPinned: true,
+        preparationRequired: true,
         // The body's shape is a form's (key=value pairs); its wire type stays the script's text/plain
         // (request-policy.js contentTypeFor). No header but the content type rides.
         encoding: "form",
@@ -2544,7 +2702,333 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             "^recaptcha-token$",
             "^recaptcha-type$"
         ]
-    }
+    },
+    {
+        psp: "cardcom",
+        // Cardcom (Israel), whose own payment page (https://secure.cardcom.solutions/EA/EA5/<page id>, Cardcom's Vue app)
+        // posts the whole page state on Process, as same-origin JSON, to https://secure.cardcom.solutions/api/EA5/SubmitPayment:
+        // the bot check's token, the page's seven stores and a 3-D Secure block. The card sits in clear text twice,
+        // Store.PaymentStore.{CardNumberField, MonthsField, YearsField, CvvField, CardOwnerNameField}.Value and
+        // _3DSecureReq.{CardNumber, CardExpireMonth, CardExpireYear, CVV, CardholderFullName}; the page id, the terminal and
+        // the amount ride beside it. cardcom.js holds the request rule the pause decision, the API's create and the device
+        // all read: exactly that URL, the page's one JSON Content-Type, and the page's own body for a one-time charge of one
+        // product, its two copies of the card the same; a standing order, installments, a kept card, 3-D Secure, an
+        // Israeli ID and a Turnstile or reCAPTCHA v2 page are refused by name. The endpoint answers any browser origin, so
+        // the device sends it by a direct fetch, with no cookie, and the bot check's token rides inside the paused body as
+        // the person's press minted it. Cardcom's test terminal shares the live host, so no sandbox host is marked and the
+        // lane takes live rows alone, each under a reviewed page pin (cardcom.js cardcomMerchantRefusal). Cardcom answers
+        // inside HTTP 200 whether it charged or not, so its own judge reads every answer (cardcom.js cardcomAnswerOutcome).
+        // The LowProfile pages' /api/LPC6/SubmitPayment, the wallets' posts and the legacy EA4 pages are not this lane's.
+        // Ships dark: served only to a client that declares `cardcom_payment_page`, gated off for every org until an
+        // operator lists one (`cardcom:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "cardcom_payment_page",
+        match: "secure\\.cardcom\\.solutions/api/EA5/SubmitPayment(?![\\w/.%-])",
+        hosts: ["^secure\\.cardcom\\.solutions$"],
+        encoding: "json",
+        // The device writes the JSON Content-Type itself; Origin, Referer and the page's cookies never ride.
+        passthroughHeaders: [],
+        jsonCardFields: [["Store", "PaymentStore", "CardNumberField", "Value"], ["_3DSecureReq", "CardNumber"]]
+    },
+    {
+        psp: "nexi_checkout",
+        // Nexi Checkout (formerly Nets Easy; Denmark, Norway, Sweden, Finland), which takes the card in its own card frame,
+        // https://checkout.dibspayment.eu/v1/, embedded in the merchant's page by checkout.js or mounted by Nexi's hosted
+        // payment page. On Pay the frame posts the card in clear JSON to its own origin, https://checkout.dibspayment.eu/
+        // api/v1/pay, with the merchant's checkout key and the payment's id as headers: paymentType.card.cardNumber,
+        // expiryMonth (MM), expiryYear (YY), cardVerificationCode and cardholderName, beside the payment's amount in minor
+        // units, the card fee and the "save my card" and "remember me" flags. nexi-checkout.js holds the request rule the
+        // pause decision, the API's create and the device all read: exactly the pay endpoint URL, the JSON type, the frame's
+        // session headers and the card form's body byte for byte, with "save my card", "remember me" or a card fee refused
+        // by name. The endpoint answers no browser origin, so the card leaves the cardholder's device only through the
+        // checkout relay, and only the frame's four session headers ride beside the card. test.checkout.dibspayment.eu is
+        // Nexi's test environment: pinned (S7) to test rows, which send only Nexi's published test cards.
+        // Ships dark: served only to a client that declares `nexi_checkout_pay`, gated off for every org until an operator
+        // lists one (`nexi_checkout:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "nexi_checkout_pay",
+        match: "(?:test\\.)?checkout\\.dibspayment\\.eu/api/v1/pay(?![\\w/.%-])",
+        hosts: ["^checkout\\.dibspayment\\.eu$", "^test\\.checkout\\.dibspayment\\.eu$"],
+        sandboxHosts: ["^test\\.checkout\\.dibspayment\\.eu$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The frame's checkout key, payment id, partner merchant number and API version. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^checkoutkey$", "^paymentid$", "^partnermerchantnumber$", "^api-version$"],
+        jsonCardFields: [["paymentType", "card", "cardNumber"]]
+    },
+    {
+        psp: "openpay_bbva",
+        // Openpay (BBVA México's online acquiring platform; Openpay Colombia and Openpay Perú) through openpay.js, the
+        // tokenizer a merchant's own page loads: on Pay it posts the card with one XHR, in clear JSON, to
+        // https://api.openpay.mx/v1/<merchant id>/tokens (api.openpay.co, api.openpay.pe) under the merchant's public key
+        // (Basic authorization), as {card_number, holder_name, cvv2, expiration_month, expiration_year[, address]} in the
+        // caller's own order and types. The answer is a single-use token the merchant's server charges later; the request
+        // names no amount, so the agent's amount is the price the cardholder approves. openpay.js holds the rules the pause
+        // decision, the API's create, the prepared bind and the device read: the exact token URL, openpay.js's three
+        // headers and the caller's body member by member. openpay.js abandons the request 40 s after Pay, so the lane is
+        // prepared only (preparationRequired). Openpay's API answers any browser origin, so the card leaves the
+        // cardholder's device by a direct fetch. A production request pays only an origin whose reviewed pin names its
+        // host, merchant id and key (openpay.js openpayMerchantRefusal). sandbox-api.openpay.<tld> is Openpay's sandbox:
+        // pinned (S7) to test rows, which send only Openpay's documented test cards. Openpay can answer a refusal inside a
+        // 2xx, so its own judge reads every answer (openpay.js openpayAnswerOutcome), never the shared status rule.
+        // Ships dark: served only to a client that declares `openpay_tokenizer`, gated off for every org until an operator
+        // lists `openpay_bbva:<org>`, and autopilot never sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        // `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+        capability: "openpay_tokenizer",
+        match: "(?:sandbox-)?api\\.openpay\\.(?:mx|co|pe)/v1/[a-z0-9]{10,40}/tokens(?![\\w/.%-])",
+        hosts: [
+            "^api\\.openpay\\.mx$",
+            "^api\\.openpay\\.co$",
+            "^api\\.openpay\\.pe$",
+            "^sandbox-api\\.openpay\\.mx$",
+            "^sandbox-api\\.openpay\\.co$",
+            "^sandbox-api\\.openpay\\.pe$"
+        ],
+        sandboxHosts: ["^sandbox-api\\.openpay\\.mx$", "^sandbox-api\\.openpay\\.co$", "^sandbox-api\\.openpay\\.pe$"],
+        hostEnvironmentPinned: true,
+        preparationRequired: true,
+        encoding: "json",
+        // openpay.js's public key and its JSON Accept. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^accept$"],
+        jsonCardFields: [["card_number"]]
+    },
+    {
+        psp: "toast",
+        // Toast's payments frame (payments.toasttab.com), the card leg of every Toast online-ordering and
+        // e-gift checkout: one POST to /v1/payment-methods with the card sealed in card.cardData, RSA-OAEP
+        // with SHA-1 over a JSON object under a 2048-bit key the frame hardcodes. toast.js holds the one
+        // request rule the pause decision, the API's create, the approve leg and the device read: exactly
+        // that URL and the frame's guest card body byte for byte, under the key id toast.js pins. The device
+        // seals the real card under that pinned key (never one from a row, a request or a page), and the
+        // agent's browser continues its own request with only cardData rewritten, so the frame's bearer,
+        // its restaurant and intent headers and the session secret stay the page's and none is stored. Apple
+        // Pay and Google Pay payment methods share the URL, carry no card the Vault holds, and continue
+        // untouched (passWithoutCard); `jsonCardFields` names where the card sits, and toast.js's own gate
+        // answers before it (card-fields.js). Toast's sandbox needs a partner account, so only the live host is
+        // named and a test row is refused at create. Ships dark: served only to a client that declares
+        // `toast_pinned_key`, off for every org until an operator lists `toast:<org>`, and autopilot never
+        // sends it (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). `(?![\w/.-])` ends the path, so a
+        // consumer that tests `match` unanchored never takes /v1/payment-methods/x for a card request.
+        capability: "toast_pinned_key",
+        match: "payments\\.toasttab\\.com/v1/payment-methods(?![\\w/.-])",
+        hosts: ["^payments\\.toasttab\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["card", "cardData"]],
+        passWithoutCard: "payments\\.toasttab\\.com/v1/payment-methods",
+        clientSideEncrypted: true,
+        mode: "cse",
+        cse: { scheme: "rsa-oaep-sha1-json", at: "card", fields: ["cardData"] }
+    },
+    {
+        psp: "fastspring",
+        // FastSpring's checkout, the merchant of record for every FastSpring store: the popup (Store Builder
+        // Library), embedded and web storefronts all run FastSpring's one checkout app, and its Pay posts the
+        // card as one JSON XHR to <store>.onfastspring.com[/popup-<name>|/embedded-<name>]/session/<id>/payment
+        // (<store>.test.onfastspring.com in a store's test mode) under the session's X-Session-Token. PAN@
+        // card.number, in FastSpring's groups of four or as digits, with card.month, card.year and
+        // card.security beside it. fastspring.js holds the request rule the pause decision, the API's create and
+        // the device all read: exactly a session's /payment URL, a JSON Content-Type, the token, and the card
+        // body (a card FastSpring saved, a renewal, a gift, a tax id's EBANX route and a CAPTCHA answer each
+        // refused by name). The request names no amount and no seller: the store in the host is the payee,
+        // so a live payment goes only to a store fastspring.js pins, and the session's own document names
+        // the total. PayPal, wallets and bank methods post the same URL with no card and continue untouched
+        // (passWithoutCard). The checkout answers no other origin's preflight, so the card leaves the
+        // cardholder's device only through the checkout relay. Ships dark: served only to a client that
+        // declares `fastspring_card_payment`, gated off for every org until an operator lists one
+        // (`fastspring:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): a test store's host only on test
+        // rows and only with documented test cards. `(?![\w/.%;-])` ends the path for a consumer that tests
+        // `match` unanchored. Not here: FastSpring Classic (sites.fastspring.com), a separate application
+        // whose card step is a session-bound form navigation.
+        capability: "fastspring_card_payment",
+        match: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment(?![\\w/.%;-])",
+        hosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.onfastspring\\.com$", "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        sandboxHosts: ["^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.test\\.onfastspring\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // The session's token, which FastSpring's interceptor writes on every call of the page. Origin,
+        // Referer and cookies never ride: the session id and the token are the whole binding.
+        passthroughHeaders: ["^x-session-token$"],
+        jsonCardFields: [["card", "number"]],
+        passWithoutCard: "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.test)?\\.onfastspring\\.com(?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?/session/[A-Za-z0-9_-]{16,64}/payment"
+    },
+    {
+        psp: "omise",
+        // Omise's card token (Opn Payments; Thailand, Japan, Singapore and Malaysia): every Omise card form, the card
+        // frame cdn.omise.co/pay.html that the official WooCommerce plugin, Omise's hosted checkout page and Payment
+        // Links+ load, and a merchant's own form calling Omise.js 2.16.0, posts the card in one JSON body to Omise's
+        // vault under the merchant's public key (Basic): PAN@ card.number, the expiry @ card.expiration_month and
+        // .expiration_year in the form's own spelling, the code @ card.security_code, beside the holder's name and
+        // address. Unencrypted, and it names no amount: the merchant's server charges the token for its own order
+        // afterwards. omise.js holds the rule the pause decision, the API's create and the device all read: exactly
+        // this URL, a public key and Omise.js's own headers, and the card form's token body as JSON.stringify writes
+        // it, with a wallet's tokenization on the same URL refused. vault.omise.co answers the Vault's origin
+        // (Access-Control-Allow-Origin *), so the cardholder's device sends it itself. Test mode shares the host
+        // under a pkey_test_ key, so no sandbox host is marked: the device sends a test key only Omise's documented
+        // test cards (omise.js OMISE_TEST_CARDS). 3-D Secure, where the merchant's account runs it, follows the
+        // merchant's charge on 3dsms.omise.co with no card.
+        // Ships dark: served only to a client that declares `omise_card_token`, gated off for every org until an
+        // operator lists one (`omise:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's public key is bound to the merchant (backend config.ts OMISE_KEY_BOUND_TO_MERCHANT). Autopilot never
+        // sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "omise_card_token",
+        match: "vault\\.omise\\.co/tokens",
+        hosts: ["^vault\\.omise\\.co$"],
+        encoding: "json",
+        // Omise.js's own headers: the public key and its client's name. Origin, Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^x-user-agent$"],
+        jsonCardFields: [["card", "number"]]
+    },
+    {
+        psp: "xendit",
+        // Xendit's hosted invoice checkout (checkout.xendit.co/web/<invoice id>), which every Xendit Invoice API
+        // merchant, dashboard payment link and donation link, Shopify's Xendit app and the older WooCommerce plugin
+        // open: its Pay Now hands the card to Xendit.js 2.6.1, which posts it as one JSON body to Xendit's own API
+        // under the business's publishable key (Basic). PAN@ card_data.account_number, the expiry as "MM" and
+        // "YYYY" @ card_data.exp_month and .exp_year, the code @ card_data.cvn and again @ card_cvn, beside the
+        // invoice's amount and currency. Unencrypted. xendit.js holds the rule the pause decision, the API's create
+        // and the device all read: exactly this URL, the publishable key and Xendit.js's own headers, and the card
+        // form's single-use token body byte for byte, with a multi-use token (the card kept on file, and the
+        // checkout's Safe Acceptance mode) refused by its own code, and a token that skips 3-D Secure or names a
+        // xenPlatform sub-account refused too. storeCVN posts a code alone to the same URL
+        // and is refused like any other body. api.xendit.co answers the Vault's origin (Access-Control-Allow-Origin
+        // *), so the cardholder's device sends it itself. Test mode shares the host under an xnd_public_development_
+        // key, so no sandbox host is marked: the device sends a test-mode key only Xendit's documented test cards
+        // (xendit.js XENDIT_TEST_CARDS). 3-D Secure follows the answer on redirect.xendit.co with no card.
+        // Ships dark: served only to a client that declares `xendit_card_token`, gated off for every org until an
+        // operator lists one (`xendit:<org>`), and the backend's gate serves only Agentcard's own company until the
+        // token's publishable key is bound to the merchant (backend config.ts XENDIT_KEY_BOUND_TO_MERCHANT). Autopilot
+        // never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "xendit_card_token",
+        match: "api\\.xendit\\.co/v2/credit_card_tokens",
+        hosts: ["^api\\.xendit\\.co$"],
+        encoding: "json",
+        // Xendit.js's own headers: the publishable key, and the client's type, version and id (the invoice). Origin,
+        // Referer and cookies never ride.
+        passthroughHeaders: ["^authorization$", "^client-type$", "^client-version$", "^client-id$"],
+        jsonCardFields: [["card_data", "account_number"]]
+    },
+    {
+        psp: "sb_payment_service",
+        // SB Payment Service (SBPS), SoftBank's card gateway: its one-time token script on the merchant's
+        // page (com_sbps_system_token.js) encrypts the card in the page and sends it as ONE JSONP <script>
+        // GET to /token/generateToken on token.sps-system.com (stbtoken.sps-system.com for SBPS's test
+        // environment), the card in the query: val is AES-256-CBC of "number:YYYYMM:code" under a PBKDF2 key
+        // over the merchant and service ids, and key is the salt and iv RSA-wrapped under SBPS's key in the
+        // script. sbps.js holds the request rule the pause decision, the API's create and the device all
+        // read: the exact URL the browser writes for the script's <script>, so the 3-D Secure info request
+        // on the same host (/token/generateTds2Token, the buyer's details and no card) is never recognized.
+        // Nothing can be written into the paused ciphertext: the cardholder's device rebuilds key and val
+        // with the real card under the key payment-core pins, and sends the GET through the checkout relay,
+        // since the host answers no browser origin and answers with JavaScript.
+        // Ships dark: served only to a client that declares `sbps_token_jsonp`, gated off for every org until
+        // an operator lists one (`sb_payment_service:<org>`), held to the merchants sbps.js pins per checkout
+        // origin, and autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The
+        // environment is pinned (S7): stbtoken only on test rows and only with documented test cards.
+        capability: "sbps_token_jsonp",
+        // The path has a right-edge guard for the SDK's unanchored test.
+        match: "(?:stb)?token\\.sps-system\\.com/token/generateToken(?![\\w/.-])",
+        hosts: ["^token\\.sps-system\\.com$", "^stbtoken\\.sps-system\\.com$"],
+        sandboxHosts: ["^stbtoken\\.sps-system\\.com$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the query, since the request has no body. No captured header is ever
+        // replayed, and the card rides in the query of one GET whose answer is JSONP.
+        encoding: "form",
+        passthroughHeaders: [],
+        request: { method: "GET", cardIn: "query", response: "jsonp" }
+    },
+    {
+        psp: "tappay",
+        // TapPay (Cherri Tech, Taiwan): TapPay Fields, the card iframes every TPDirect integration mounts from
+        // js.tappaysdk.com (confirmed live 2026-10-17). TPDirect.card.getPrime makes TapPay's own api iframe
+        // (js.tappaysdk.com/sdk/tpdirect/api/html/<version>) read the three field iframes and POST one request:
+        //   POST https://js.tappaysdk.com/payment/tpdirect/production/getprime
+        //   Content-Type: application/x-www-form-urlencoded, x-api-key: <the merchant's TapPay app key>
+        //   jsonString={"cardnumber":...,"cardduedate":"<YYYYMM>","appid":...,"appkey":...,"appname":...,
+        //     "url":...,"port":...,"protocol":...,"tappay_sdk_version":...,"cardholder_info":{...}[,"cardccv":...][,"device_id":...]}
+        // The one form field jsonString holds the whole card request as the SDK's JSON.stringify. tappay.js
+        // holds the request rule, the pause decision, the device fill and the answer judge; the card sits at
+        // cardnumber, cardduedate (TapPay's "20"+YY+MM, so YYYYMM) and the optional cardccv. The request names no
+        // amount and mints a prime (one-time token, 90-second TTL) the merchant's server charges with Pay by
+        // Prime, where 3-D Secure runs (three_domain_secure), never in this request. The api iframe posts same
+        // origin, so a replay from the Vault's origin is cross-origin and its x-api-key preflight is refused
+        // (OPTIONS to getprime drew 403 with no Access-Control-Allow-Origin, 2026-10-17), so the card leaves the
+        // cardholder's device only through the checkout relay, and tappayAnswerOutcome judges the answer, since
+        // TapPay reports a refusal inside HTTP 200 with a non-zero status. One host serves every merchant, so a
+        // live card is tokenized only for a checkout origin a reviewed pin lists (tappay.js tappayMerchantRefusal)
+        // and the approval names that merchant. TapPay's sandbox is the same host with the /sandbox/ path and so
+        // cannot be told from production by host (hostEnvironment is host based): this lane recognizes production
+        // only, as Wix Payments does, and a sandbox test run is a later change.
+        // Ships dark: served only to a client that declares `tappay_prime`, gated off for every org until an
+        // operator lists one (`tappay:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "tappay_prime",
+        match: "js\\.tappaysdk\\.com/payment/tpdirect/production/getprime",
+        hosts: ["^js\\.tappaysdk\\.com$"],
+        encoding: "form",
+        passthroughHeaders: ["^x-api-key$"]
+    },
+    {
+        psp: "paymob",
+        // Paymob's own checkout (Egypt, the UAE, Saudi Arabia, Oman): Unified Checkout, the hosted page every
+        // Paymob payment link, PayMe handle, WooCommerce plugin and Shopify redirect app opens, and Pixel, the
+        // card frame a merchant's own page embeds. Pay sends the card in one JSON POST to the Paymob API of the
+        // merchant's country, /api/acceptance/payments/pay on accept., uae., ksa. or oman.paymob.com (and
+        // accept.paymobsolutions.com, Paymob Egypt's older name for the same API): {source: {identifier,
+        // sourceholder_name, subtype: "CARD", expiry_month, expiry_year, cvn, ...}, payment_token, ...}.
+        // Unencrypted. The request names no amount of its own: its payment key, Paymob's signed JWT for the
+        // merchant's intention, names the amount and currency Paymob charges. paymob.js holds the rule the
+        // pause decision reads: the exact URL, a JSON content type, and the card form's payment, key by key,
+        // with a saved Paymob card, a payment that keeps the card, pays in installments, splits, converts or
+        // names a Paymob account, and any other card shape refused. Every other method of the checkout
+        // (wallets, Apple Pay, Google Pay, KNET, valU, cash) carries no card on the same URL and continues
+        // untouched (passWithoutCard). The API answers any origin's preflight, so the cardholder's device
+        // sends the card itself; no header is needed beside the content type. 3-D Secure follows the answer,
+        // with no card. Test and live modes share the hosts (test keys and integrations separate them), so no
+        // sandbox host is marked.
+        // Ships dark: served only to a client that declares `paymob_checkout_pay`, gated off for every org
+        // until an operator lists one (`paymob:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "paymob_checkout_pay",
+        match: "(?:accept|uae|ksa|oman)\\.paymob\\.com/api/acceptance/payments/pay|accept\\.paymobsolutions\\.com/api/acceptance/payments/pay",
+        hosts: ["^accept\\.paymob\\.com$", "^uae\\.paymob\\.com$", "^ksa\\.paymob\\.com$", "^oman\\.paymob\\.com$", "^accept\\.paymobsolutions\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["source", "identifier"]],
+        passWithoutCard: "(?:accept|uae|ksa|oman)\\.paymob\\.com/api/acceptance/payments/pay|accept\\.paymobsolutions\\.com/api/acceptance/payments/pay"
+    },
+    {
+        psp: "payu_latam",
+        // PayU Latam's WebCheckout (Colombia, Mexico, Chile, Peru, Panama), the hosted page a PayU Latam
+        // merchant's payment form, button, link or cart plugin opens at checkout.payulatam.com. Its card form
+        // posts the whole checkout transaction as JSON to /ppp-web-gateway-payu/checkout/submit/<country>
+        // /credit_card/<session key> on the page's own host, the card in checkoutCreditCard: the number as the
+        // field's mask spells it, the code, and the month and two-digit year as numbers. The body copies the
+        // order PayU holds for the session, but PayU charges its own, so the amount is the agent's (no request
+        // amount in backend.js). payu-latam.js holds the rule the
+        // pause decision reads: the exact URL with a country this lane read, and the card form's own body, with
+        // the box that has PayU keep the card, a card PayU saved, a wallet, installments and a test order on
+        // the live host refused. The page's BIN lookup (checkout/card_info/) and its 3-D Secure redirect use
+        // other paths, which `match` leaves out; `(?![\w/;.%-])` ends the key for a consumer that tests `match`
+        // unanchored. The submit answers a CORS preflight from any origin, so the cardholder's device can send
+        // the card itself. Ships dark: served only to a client that declares
+        // `payu_latam_webcheckout_card`, gated off for every org until an operator lists one
+        // (`payu_latam:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.checkout.payulatam.com
+        // only on test rows and only with documented test cards.
+        capability: "payu_latam_webcheckout_card",
+        match: "(?:sandbox\\.)?checkout\\.payulatam\\.com/ppp-web-gateway-payu/checkout/submit/(?:ar|br|cl|co|mx|pa|pe)/credit_card/[0-9a-f]{32}(?![\\w/;.%-])",
+        hosts: ["^checkout\\.payulatam\\.com$", "^sandbox\\.checkout\\.payulatam\\.com$"],
+        sandboxHosts: ["^sandbox\\.checkout\\.payulatam\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // AngularJS's Accept, which the page sends on every $http call. Cookies, Origin and Referer never ride.
+        passthroughHeaders: ["^accept$"],
+        jsonCardFields: [["checkoutCreditCard", "number"]]
+    },
+    // Every processor registered since this list froze, in id order (registry.js).
+    ...REGISTERED_DEFINITIONS
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
 var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
@@ -2739,6 +3223,17 @@ var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
     sandbox: Object.freeze(["sandbox.paygent.co.jp"])
 });
 var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var PAYGENT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin4({
+        id: "fundex_tcs_eng",
+        merchant: "Tokyo Chinese School",
+        merchantId: "60362",
+        keySha256: "6073dee112b1e4089025d1c1f3c4cfad818c314a81943ffa55b839cb2df51018",
+        origins: ["https://fundexapp.jp"],
+        currency: "jpy"
+    })
+]);
 // src/multipart-form.js
 var BOUNDARY_CHARACTERS = "[A-Za-z0-9'+_.-]{1,70}";
 var BOUNDARY = new RegExp(`^${BOUNDARY_CHARACTERS}$`);
@@ -2748,9 +3243,9 @@ function multipartBoundary(contentType) {
     return match ? match[1] : null;
 }
 // src/pay-nl.js
-var pin4 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
+var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), serviceIds: Object.freeze([...fields.serviceIds]) });
 var PAY_NL_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin4({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
+    pin5({ id: "weeztix", merchant: "Weeztix", origins: ["https://shop.weeztix.com"], serviceIds: ["SL-6399-2740"] })
 ]);
 var ERROR_KEYS = /* @__PURE__ */ Object.freeze(["errorId", "errorTag", "errorMessage", "errorFieldName"]);
 var REQUEST_KEYS = /* @__PURE__ */ Object.freeze(["result", ...ERROR_KEYS]);
@@ -2768,26 +3263,26 @@ var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
     })
 });
 // src/hipay.js
-var pin5 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var pin6 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
 var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin5({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+    pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
 ]);
 // src/amazon-payment-services.js
-var BODY_LIMIT = 32 * 1024;
+var BODY_LIMIT2 = 32 * 1024;
 var ANSWER_LIMIT = 64 * 1024;
 // src/clover.js
 var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
 var OPTIONAL_KEYS = /* @__PURE__ */ Object.freeze(["address_line1", "phone_numbers", "email_address", "name", "address_zip"]);
 var CARD_ORDER = /* @__PURE__ */ Object.freeze([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
 // src/tap-payments.js
-var pin6 = (fields) => Object.freeze({
+var pin7 = (fields) => Object.freeze({
     ...fields,
     origins: Object.freeze([...fields.origins]),
     sessions: Object.freeze({ ...fields.sessions }),
     key: Object.freeze({ ...fields.key })
 });
 var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin6({
+    pin7({
         id: "casefilegame",
         merchant: "Casefilegame",
         tapMerchantId: "67977048",
@@ -2930,20 +3425,37 @@ var SUCCESS_RULES = {
     cvvIncluded: (value) => typeof value === "boolean"
 };
 var SUCCESS_KEYS = Object.keys(SUCCESS_RULES);
+// src/openpay.js
+var LETTERS2 = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
+var PAGE_NAME2 = new RegExp(`^[${LETTERS2} .'-]{1,64}$`);
+var HAS_LETTER2 = new RegExp(`[${LETTERS2}]`);
+var ADDRESS_VALUE2 = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
+var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
+var pin8 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
+var OPENPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin8({
+        id: "diario_de_yucatan",
+        merchant: "Diario de Yucatán",
+        origins: ["https://www.yucatan.com.mx"],
+        host: "api.openpay.mx",
+        merchantId: "mqyloyrm8tsvtsgcrj0d",
+        publicKeys: ["pk_260aa43616a445bb98472e6ca51da968"]
+    })
+]);
 // src/poynt.js
 var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var NONCE_URL = new RegExp(`^https://services\\.poynt\\.net/v1/commerce/stores/(${UUID})/payment-tokens/generate-nonce$`);
 var STORE_ID = new RegExp(`^${UUID}$`);
 var APPLICATION_ID = new RegExp(`^urn:aid:${UUID}$`);
-var pin7 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
+var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), storeIds: Object.freeze([...fields.storeIds]) });
 var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
-    pin7({
+    pin9({
         id: "yearning_for_learning",
         merchant: "Yearning for Learning Publishing & Coaching",
         origins: ["https://ff305485-ba6c-423a-87b0-cebe3f83ffe9.mysimplestore.com"],
         storeIds: ["71ac12ed-e61f-4318-95db-db0e7c649d6f"]
     }),
-    pin7({
+    pin9({
         id: "timber_ridge_bookkeeping",
         merchant: "Timber Ridge Bookkeeping",
         origins: ["https://d7d64ac3-0352-4e53-af9a-f6d8e7b5fb71.mysimplestore.com"],
@@ -2951,6 +3463,187 @@ var POYNT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     })
 ]);
 var MAX_ANSWER_CHARS = 16 * 1024;
+// src/cardcom.js
+var CARDCOM_ORIGIN = "https://secure.cardcom.solutions";
+var CARDCOM_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({
+        id: "machon_alte_usd",
+        merchant: "Machon Alte",
+        origins: Object.freeze([CARDCOM_ORIGIN]),
+        page: "kzR5pTyr0kC3oqjpGbCMiQ",
+        terminal: 162226,
+        products: Object.freeze([Object.freeze({ uid: "JoQrlcuGCUWYM4I66eX7pw", currency: "usd", price: null })]),
+        settings: "e38d7c7abce83a3a994a707e345595cf6ec2a15d77794a8eea70c0d5ce4773ab"
+    })
+]);
+// src/toast.js
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+// src/fastspring.js
+var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
+]);
+var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
+// src/omise.js
+var pin10 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
+var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin10({ id: "taejai", merchant: "Taejai", origins: ["https://taejai.com"], keys: ["pkey_53q6mm66esjr563ob0h"] }),
+    pin10({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
+    pin10({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
+]);
+// src/payu-latam.js
+var PAYU_LATAM_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["checkout.payulatam.com"]),
+    sandbox: Object.freeze(["sandbox.checkout.payulatam.com"])
+});
+var ADDRESS = ["street1", "street2", "street3", "city", "state", "country", "postalCode", "phone"];
+var PERSON = [
+    "fullName",
+    "emailAddress",
+    "contactPhone",
+    "phoneCountryCode",
+    "dniNumber",
+    "isDniNumberEncrypt",
+    "dniType",
+    "personType",
+    "businessName",
+    "cnpj",
+    "gender"
+];
+var MONEY = ["value", "symbol", "currency"];
+var RECORD_MEMBERS = /* @__PURE__ */ Object.freeze({
+    payer: [...PERSON, "merchantBuyerId", "billingAddress", "birthDate", "identificationNumber", "identificationType"],
+    "payer.billingAddress": ADDRESS,
+    order: [
+        "id",
+        "referenceCode",
+        "airlineCode",
+        "description",
+        "isTest",
+        "signature",
+        "language",
+        "buyer",
+        "shipment",
+        "state",
+        "status",
+        "paymentApprovalDate",
+        "creationDate",
+        "accountId",
+        "amount",
+        "tax",
+        "totalPurchase",
+        "currency",
+        "amountConvertedValue",
+        "taxConvertedValue",
+        "taxReturnBase",
+        "taxReturnBaseConvertedValue",
+        "additionalValue",
+        "administrativeFee",
+        "taxAdministrativeFee",
+        "taxAdministrativeFeeReturnBase",
+        "enabledPaymentMethods",
+        "enabledInstallments",
+        "enabledPaymentMethodTypes",
+        "enabledIin",
+        "enabledPseBanks",
+        "enabledKhipuBanks",
+        "paymentMethodsDescription",
+        "urlEncodedId",
+        "shippingValue",
+        "paymentRequestLinkId",
+        "airlineDescription",
+        "displayShipping",
+        "displayBuyerComments",
+        "buyerCommentsLabel",
+        "extraParameters",
+        "dispersion"
+    ],
+    "order.buyer": [...PERSON, "merchantBuyerId", "buyerAddress", "comments"],
+    "order.buyer.buyerAddress": ADDRESS,
+    "order.shipment": [...PERSON, "merchantShipmentId", "shippingAddress", "comments"],
+    "order.shipment.shippingAddress": ADDRESS,
+    "order.amount": MONEY,
+    "order.tax": MONEY,
+    "order.totalPurchase": MONEY,
+    "order.amountConvertedValue": MONEY,
+    "order.taxConvertedValue": MONEY,
+    "order.taxReturnBase": MONEY,
+    "order.taxReturnBaseConvertedValue": MONEY,
+    shippingInfo: [
+        "userLogin",
+        "id",
+        "reference",
+        "description",
+        "currency",
+        "deliveryCity",
+        "deliveryCityName",
+        "deliveryAddress1",
+        "deliveryAddress2",
+        "deliveryAddress3",
+        "postalCode",
+        "fullName",
+        "documentType",
+        "document",
+        "phoneNumber",
+        "observationsReceivingShipment",
+        "destinationState",
+        "destinationStateName",
+        "destinationCountry",
+        "destinationEmail",
+        "originFullName",
+        "originIdentificationType",
+        "originIdentification",
+        "originCity",
+        "originState",
+        "originCountry",
+        "originAddress",
+        "originZipCode",
+        "originPhone",
+        "originEmail",
+        "kilogramWeight",
+        "volumetricWeight",
+        "totalValue",
+        "declaredValue",
+        "shippingValue",
+        "guideNumber",
+        "enlistmentApplies",
+        "deliveryDate",
+        "deliveryDays",
+        "minDeliveryDays",
+        "packageHeight",
+        "packageWidth",
+        "packageLength",
+        "shippingProvider",
+        "shippingState",
+        "creationDate",
+        "lastUpdateDate",
+        "expirationDate",
+        "signature",
+        "strCreationDate",
+        "comment",
+        "warehouseId",
+        "additionalDeliveryDays",
+        "shippingMerchantValue"
+    ],
+    // PayU's own ten, as transaction/create names them, and the merchant's extra1 to extra4 (the payment form's
+    // optional fields), each text or nothing.
+    "order.extraParameters": [
+        "CURRENCY",
+        "LANGUAGE",
+        "ACCOUNT_ID",
+        "ALGORITHM_SIGNATURE",
+        "CHECKOUT_VERSION",
+        "RESPONSE_URL",
+        "IS_TEST",
+        "SIGNATURE",
+        "NOTIFY_URL",
+        "IP_COUNTRY",
+        "EXTRA1",
+        "EXTRA2",
+        "EXTRA3",
+        "EXTRA4"
+    ]
+});
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -2971,6 +3664,10 @@ var AMADEUS_CARD_URLS = Object.freeze({
         dcp: Object.freeze([])
     })
 });
+var AMADEUS_RELAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["paypages.payment.amadeus.com"]),
+    sandbox: Object.freeze(["paypages.test.payment.amadeus.com"])
+});
 var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
 var AMADEUS_REFUSAL_REASONS = Object.freeze([
     "unsupported",
@@ -3282,7 +3979,8 @@ var TRANSBANK_MERCHANTS = Object.freeze([
         fantasyName: null,
         merchant: "Teleférico Santiago",
         hosts: Object.freeze(["telefericosantiago.cl"]),
-        returnHost: "telefericosantiago.cl"
+        returnHost: "telefericosantiago.cl",
+        returnUrl: null
     })
 ]);
 var MAX_PAGE5 = 64 * 1024;
@@ -3300,7 +3998,9 @@ var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
     "checkout-nonce",
     "signature"
 ]);
-var PAYTRAIL_MERCHANTS = Object.freeze([]);
+var PAYTRAIL_MERCHANTS = Object.freeze([
+    Object.freeze({ account: "1076015", merchant: "DofE Finland", paytrailName: "Avartti-säätiö", returnHost: "dofe.fi" })
+]);
 var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var UUID2 = new RegExp(`^${UUID_SOURCE}$`);
 var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
@@ -3405,6 +4105,23 @@ var DECLINE_CODES = Object.freeze([
     "AccountSuspended"
 ]);
 var FRICTIONLESS_STATUSES = Object.freeze([0, 5, 7]);
+// src/sbps.js
+var pin11 = (fields) => /* @__PURE__ */ Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    accounts: Object.freeze(fields.accounts.map((account) => Object.freeze({ ...account })))
+});
+var SBPS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    /* @__PURE__ */ pin11({
+        id: "boss_ezo_fukuoka",
+        merchant: `BOSS E${ /* @__PURE__ */String.fromCharCode(12539)}ZO FUKUOKA`,
+        origins: ["https://ticket.e-zofukuoka.com"],
+        accounts: [{ merchantId: "75082", serviceId: "001" }]
+    })
+]);
+var ERROR_TYPES = /* @__PURE__ */ Object.freeze(["03", "04", "05", "07", "99"]);
+var ERROR_FIELDS = /* @__PURE__ */ Object.freeze(["001", "002", "003", "004", "005", "999"]);
+var SBPS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(ERROR_TYPES.flatMap((type) => ERROR_FIELDS.map((field) => `${type}${field}`)));
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"