@agent-cards/sdk 0.23.22 → 0.23.23

package/CHANGELOG.md

@@ -1,7 +1,29 @@
 # Changelog
 
+An unreleased change waits as a file of its own in `changes/` (`changes/README.md`), never under Unreleased here; the version cut moves it under the version a release publishes.
+
 ## Unreleased
 
+## 0.23.23
+
+- Pass ACI's ReD Shield device fingerprint through up to 8,192 characters. IKEA US's live payment step posts a fingerprint of 5,953 characters, longer than the 4,096 ACI's API reference names, and ACI takes it. Earlier releases refused any fingerprint over 4,096 characters as `aci_unsupported_request`, so an IKEA purchase still paid, but ACI's fraud screening scored every Agentcard order there without the shopper's device fingerprint. The fingerprint now continues untouched up to 8,192 characters, and a longer one is still refused without failing the checkout. No API or Vault release is needed.
+
+- `redactUrl` masks a host written with its port and no scheme, such as `checkout.payulatam.com:443/...`, the way it masks a bare host, for every processor. A URL parser reads that host as the scheme, so the string came back unmasked.
+
+- Keep a PayU Latam checkout's session key out of your events and error messages. PayU Latam's WebCheckout page sends the card to `/ppp-web-gateway-payu/checkout/submit/<country>/credit_card/<key>` on its own host (`checkout.payulatam.com`, `sandbox.checkout.payulatam.com`), and the key is the only credential the page's routes read: anyone who holds it can read the checkout's order, payer and merchant. `redactUrl`, every event and every error message now show it as `{key}` on every host under `payulatam.com`, on every route of the page and with any of its characters percent-escaped, as in `https://checkout.payulatam.com/ppp-web-gateway-payu/checkout/submit/co/credit_card/{key}`. The SDK does not pause a PayU Latam payment yet. No API or Vault release is needed.
+
+- Pay a Midtrans Snap checkout, for Agentcard's own company only for now (dark launch). Midtrans' Snap popup posts the card as one JSON request to `https://api.midtrans.com/v2/token` (`https://api.sandbox.midtrans.com/v2/token` in test) under the business's publishable client key. This build declares `midtrans_card_token` on every sync, and the API serves the Midtrans entry only to a company Agentcard turned Midtrans on for, so every other company's Midtrans payments go through untouched. The token names no amount: the merchant's own server charges it afterwards, card free, and runs 3-D Secure there, so `authorize()` refuses a Midtrans token without `amount` above zero and `currency` (`AmountRequiredError`). The API refuses a saved-card reuse and any body that is not the card form's own token (`invalid_midtrans_request`), and holds the lane to Agentcard's own company until a reviewed change binds the client key to the merchant. The cardholder's device sends the card itself, with no relay. A Midtrans payment also needs the matching API and Vault releases.
+
+- Pay an SB Payment Service checkout, a Japanese store's card step that loads SBPS's one-time token script (`com_sbps_system_token.js`), for a company Agentcard turned SB Payment Service on for (dark launch). The script encrypts the card in the page and sends it as one JSONP `<script>` GET to `https://token.sps-system.com/token/generateToken` (`stbtoken.sps-system.com` in SBPS's test environment). The sync now also asks for `capabilities=sbps_token_jsonp`, and the API serves SBPS's recognizer only to an enabled company. There both adapters pause that GET, `authorize()` creates the authorization with its URL alone, the cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the paused script receives SBPS's one-time token in its own callback. Any other request on that path is aborted with an `unsupported_checkout` event, so the placeholder never reaches SBPS; the 3-D Secure info request and the scripts continue untouched. The request names no amount, so pass `amount` and `currency` above zero and the order total the page shows as `pageAmount`: `authorize()` refuses a request without them with `AmountRequiredError` or `PageAmountRequiredError`. A live payment needs a merchant Agentcard reviewed at its own checkout page, or the create answers `unsupported_checkout`. Every other company keeps today's path, where the request continues to SBPS untouched. No live payment has gone through this route yet. A payment also needs the matching API, relay and Vault releases.
+
+- Pause Paytrail's card method (the Visa and Mastercard method on the payment wall most Finnish webshops send the buyer to) for the cardholder's device. The sync now also asks for `capabilities=paytrail_hosted_payment_page`, and the API serves Paytrail's recognizer only for a company Agentcard turned Paytrail on for. The SDK pauses the merchant's signed entry to `https://services.paytrail.com/payments/<transaction>/click-to-pay/loading-and-redirect`, which carries no card and no amount, as a `hosted_form` authorization, and answers the paused navigation with the `submitted_on_device` page once the cardholder's device has paid it. Pass `amount` and `currency` (`eur`): the entry names no amount, so `authorize()` throws `AmountRequiredError` without them. Every other post of the card method your browser makes leads to or carries the card your agent typed: Paytrail's loading page's post, which opens Payment Highway's card page, and on `v1.api.paymenthighway.io` the card post, the Click to Pay posts and the 3-D Secure step, and so does the card page's lookup of the typed card's first digits. The SDK fails each one and reads `unsupported` with reason `processor_card_page`. Matching API and Vault releases are required. Paytrail stays off for every company Agentcard has not turned it on for.
+
+- Keep a FastSpring checkout's session id out of your events and error messages however the URL spells the slashes around `/session/`. 0.23.22 showed the id after a slash escaped twice or more, as in `/session%252F<id>`, or doubled, as in `/session//<id>`. `redactUrl`, every event and every error message now show `{session}` in each of these spellings, as in `https://daisydisk.onfastspring.com/session%252F{session}/payment`. No API or Vault release is needed.
+
+- Pause the card token request Xendit's hosted invoice checkout sends, for the cardholder's device. Xendit's payment and donation links land on `https://checkout.xendit.co/web/<invoice id>`, where Pay Now has Xendit.js post the card as JSON to `https://api.xendit.co/v2/credit_card_tokens` under the business's publishable key. The sync now also asks for `capabilities=xendit_card_token`, and the API serves Xendit's recognizer only for a company Agentcard turned Xendit on for. The SDK pauses only the card form's single-use token request at that exact URL; a token that would keep the card on file, Xendit.js's code-only `storeCVN` post and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Xendit itself with the real card, and the page gets Xendit's token, then runs 3-D Secure and charges the token without the card. The token names the invoice's amount and currency, so `amount` and `currency` are optional: the API reads the token's and refuses a pair that disagrees with it. Matching API and Vault releases are required. Xendit stays off for every company Agentcard has not turned it on for.
+
+- Pause the card token request every Omise card form sends, for the cardholder's device. Omise.js's card frame (`https://cdn.omise.co/pay.html`), a merchant's own page calling Omise.js, and a checkout that bundles Omise's Node library all send the card as JSON to `https://vault.omise.co/tokens` under the merchant's public key. The sync now also asks for `capabilities=omise_card_token`, and the API serves Omise's recognizer only for a company Agentcard turned Omise on for. The SDK pauses only a card form's token request at that exact URL, a body the page posts as a `Blob` included; a wallet's tokenization and any other body there fail in your browser before anything is created. The cardholder's device sends the request to Omise itself with the real card, and the page gets Omise's token. Omise's request names no price, so pass `amount` and `currency`, above zero: without them `authorize()` throws `AmountRequiredError` before anything is created. The API pays only a merchant Agentcard reviewed for the checkout page the request comes from. Matching API and Vault releases are required. Omise stays off for every company Agentcard has not turned it on for.
+
 ## 0.23.22
 
 - Keep a FastSpring checkout's session id out of your events and error messages. FastSpring's checkout, on every store's own host under `onfastspring.com`, sends the card to `/session/<id>/payment` (after `/popup-<name>` in a popup), and anyone who holds that session id can read the session's own page, its order and the token its requests carry. `redactUrl`, every event and every error message now show it as `{session}` on every FastSpring store host, as in `https://daisydisk.onfastspring.com/session/{session}/payment`. The SDK does not pause a FastSpring payment yet. No API or Vault release is needed.

package/README.md

@@ -286,6 +286,7 @@ Coverage is specific to the processor request format, merchant setup, browser tr
 | Elavon Converge (Hosted Payment Page) | dark: paused only for an org Agentcard enables for Converge, always with the cardholder's approval, never autopilot. One credit card sale in US dollars per payment page on `api.convergepay.com` or `www.convergepay.com` (`api.demo.convergepay.com` in Converge's demo environment); no amount needed. See [Pay an Elavon Converge payment page](#pay-an-elavon-converge-payment-page) |
 | Moneris Hosted Tokenization (Moneris's card frame; Raisin donation pages) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/HPPtoken/request.php` on `www3.moneris.com` or `gateway.moneris.com` (`esqa.moneris.com` for a test row) when it carries the card number, expiry and CVD, always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the profile id the frame names must be one pinned for the checkout page's origin (Jack.org's Raisin page today), or the create answers `unsupported_checkout`. A frame that leaves the expiry or CVD to the merchant's page, or a post to any other `request.php` URL, fails in the browser with a `blocked` event, `request_without_card`. The cardholder's device sends the card through the checkout relay, and the page gets Moneris's temporary token, which the merchant charges from its own server: pass `amount` and `currency`, the total the cardholder approves. Moneris Checkout (`/chkt/`, `/chktv2/`) is not supported |
 | GoDaddy Payments (Poynt's card frame on a GoDaddy Online Store checkout) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the frame's post to `/v1/commerce/stores/<store id>/payment-tokens/generate-nonce` on `services.poynt.net`, always with the cardholder's approval. A live payment needs a store Agentcard reviewed: the store id must be one pinned for the checkout page's origin, or the create answers `unsupported_checkout`; a test key is refused, since Poynt has no test host. A form that asks Poynt to keep the card fails in the browser with a `blocked` event. The cardholder's device sends the card through the checkout relay, and the page gets Poynt's nonce, which the store's server charges: pass `amount` and `currency`, the total the cardholder approves. The store's pay button runs an invisible reCAPTCHA, so a person presses it |
+| SB Payment Service (SBPS's one-time token script; BOSS E・ZO FUKUOKA's ticket site) | dark launch: after `vault.syncRegistry()`, and only for an org Agentcard has enabled, the SDK pauses the token script's JSONP GET to `/token/generateToken` on `token.sps-system.com` (`stbtoken.sps-system.com` for a test row), always with the cardholder's approval. A live payment needs a merchant Agentcard reviewed: the merchant and service ids the request names must be ones pinned for the checkout page's origin, or the create answers `unsupported_checkout`. Any other request on that path fails in the browser with an `unsupported_checkout` event. The cardholder's device rebuilds the card's ciphertext under SBPS's key and sends it through the checkout relay, and the page's script gets SBPS's one-time token in its own callback, which the store charges from its own server: pass `amount` and `currency` above zero, and the order total the page shows as `pageAmount` |
 | WSPay Components (WSPay's build of Monri Components) | dark launch: the card frame's confirm of a new card, after `vault.syncRegistry()`, with `amount` and `currency`, and only for an org Agentcard has enabled; for any other org the SDK leaves WSPay's requests alone. The cardholder's device sends the card to WSPay and the frame receives WSPay's answer. A confirm that asks WSPay to keep the card on file, as Valamar's does on every booking, is paid only as a hotel's EUR 1.00 card guarantee with a card the cardholder stored. Validated in local Chromium against a model of the card frame; no WSPay sandbox run or live merchant purchase yet. See [Pay a WSPay Components checkout](#pay-a-wspay-components-checkout) |
 | Shiji STS (MyCheck Wallet V3; Wyndham's booking pages) | dark launch, mode `cse` under a pinned key, and only for an org Agentcard has enabled. The card token a hotel booking mints guarantees the stay, so the cardholder approves with a card they stored, under a line that says the hotel can keep it on file. See [Shiji STS](#shiji-sts-mycheck-wallet-v3) |
 | Wix checkout (Wix Cashier's card frame; Wix Payments and classic Stripe on Wix) | dark launch: only in Agentcard's own account for now, after `vault.syncRegistry()`, and only through `prepare({ psp: 'wix_payments', environment: 'production' })` at a store Agentcard reviewed, with `amount` and `currency`. The frame's post to `cashier-pci.wixapps.net/_api/payment-gateway-web/tokenize/v2/tokens` pauses, the cardholder's device sends the card through the checkout relay, and the frame receives Wix's token. Wix has no test environment. The SDK refuses the frame's second card request after a 401 or 403 in the browser, and fails a request still unsent 20 seconds after the pause, before the card leaves (`wix_payments_send_window_closed`) |
@@ -300,7 +301,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -331,7 +332,11 @@ same way: this build pauses the merchant's redirect to
 page or a frame of it, and with `attachToCdp` also in a window the page opened,
 for the cardholder's device, and fails every request but a GET your browser
 makes to Webpay, so the token is never spent in your browser and Webpay never
-sees the card your agent typed. `attachToPlaywright` covers the page it is
+sees the card your agent typed. Once the cardholder's phone has paid, the
+paused link goes to the shop's return page with Webpay's token, for a shop
+Agentcard has reviewed with its return page, so the shop records the order and
+shows its receipt in your browser; any other Webpay checkout gets the
+`submitted_on_device` page. `attachToPlaywright` covers the page it is
 attached to and that page's frames, and pauses the entry when one of them
 navigates to it directly or by script. Playwright's `page.route` never sees the
 hop of an HTTP redirect, so a merchant whose server answers its checkout with a
@@ -342,6 +347,11 @@ that opens Webpay in a popup needs that popup attached on its own, and a popup's
 first navigation needs the integration
 [Browser integration and merchant outcomes](#browser-integration-and-merchant-outcomes)
 describes.
+Paytrail's card method (`paytrail_hosted_payment_page`) is served the same
+way: this build pauses the merchant's signed Visa and Mastercard entry to
+`services.paytrail.com` for the cardholder's device, and fails the loading
+page's own post, every post your browser makes to Payment Highway's card page
+and the card page's lookup of the typed card's first digits.
 PayMongo's hosted checkout (`paymongo_checkout_pay`) is served on the same terms:
 this build pauses the checkout page's own card attach on `checkout.paymongo.com`,
 the cardholder's device sends it through the checkout relay, and the page gets
@@ -401,6 +411,19 @@ build pauses the card token request Clover's card frame sends to
 real card encrypted under Clover's key and sends it to Clover itself, and the
 frame gets Clover's token. Clover's request names no price, so pass `amount`
 and `currency`, above zero: that is the amount the cardholder approves.
+Xendit's hosted invoice checkout (`xendit_card_token`) is served on the same
+terms: this build pauses the card token request Xendit.js sends from
+`checkout.xendit.co` to `api.xendit.co/v2/credit_card_tokens`, the cardholder's
+device sends it to Xendit itself with the real card, and the page gets Xendit's
+token and runs 3-D Secure. The token names the invoice's amount, so `amount`
+and `currency` are optional; a pair you pass must match the token's.
+Omise's card token (`omise_card_token`) is served on the same terms: this
+build pauses the token request an Omise card form sends to
+`vault.omise.co/tokens`, from Omise.js's card frame or from a merchant's own
+page, the cardholder's device sends it to Omise itself with the real card, and
+the page gets Omise's token. The API pays only a merchant Agentcard reviewed
+for the page the request comes from. Omise's request names no price, so pass
+`amount` and `currency`, above zero: that is the amount the cardholder approves.
 CyberSource Secure Acceptance's token
 create (`cybersource_sa_token_create`) is served on the same terms too; every
 other company keeps the stop every build applies to a card posted to Secure
@@ -1363,8 +1386,8 @@ await controller.prepare({ psp: 'aci', environment: 'production' }); // 'sandbox
 Type a placeholder card of the approved card's network (a Mastercard-range placeholder for an Agentcard-issued card), then click Pay once. The cardholder's device refuses a placeholder of another network before any card leaves it, and the authorization ends `declined` with reason `aci_brand_mismatch`. The SDK:
 
 - pauses the card-number request and binds it to the preparation. The cardholder's device sends it to ACI with the real number, CVC and expiry, and the page receives ACI's answer.
-- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than ACI takes, leaves them waiting for the card-number request.
-- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to the 4,096 characters ACI takes) through untouched.
+- holds the page's own CVC and expiry requests and answers them with that answer, so the placeholder values never reach ACI (`aci_leg_absorbed`). They fail when the card-number request fails, or when none begins within 5 seconds, which is what a one-click stored-card form that sends a CVC request alone gets. A refused request that carries no card number, such as a device fingerprint longer than 8,192 characters, leaves them waiting for the card-number request.
+- lets the holder request and the ReD Shield device fingerprint the widget posts on load (`customer.browserFingerprint.value` alone, up to 8,192 characters) through untouched. IKEA US's page posts one of 5,953 characters, past the 4,096 ACI's API reference names, and ACI takes it.
 - lets the page's `/payment` submission continue once, only as the widget's own form post into its hidden iframe (a frame navigation) and only after its checkout's card-number request was answered (`aci_payment_continued`). In classic mode the placeholder expiry the page put there is removed (`stripped: true`). `paymentBrand` must be the brand of the placeholder you typed, `shopperResultUrl` must be on the prepared merchant origin, and `shopperResultTarget`, when the page sets one, must be `_top`, ACI's own default.
 
 The SDK removes that expiry only on a browser that sends the body it replaced on a navigation, which the SDK's tests show on Chromium. `attachToCdp` drives Chromium. `attachToPlaywright` reads the page's browser engine, or, for a persistent context, checks whether a CDP session opens, which only Chromium allows. On Firefox or WebKit it refuses a classic-mode `/payment` as `aci_expiry_unstrippable` rather than send the placeholder expiry. A SAQ-A-mode `/payment` has nothing to remove and continues on any engine.

package/dist/aci.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 624ca03645e28d72156188c850b3650fd0f5162b0366475e6a124657120f7f11
+// artifact-sha256: 82e5241b99296bfb616a3c740a6a1c6a29f563405ed4a6ded681e21fb24168ab
 // src/aci.js
 var ACI_HOSTS = Object.freeze(["eu-prod.oppwa.com", "oppwa.com", "eu-test.oppwa.com", "test.oppwa.com"]);
 var ACI_TEST_HOSTS = Object.freeze(["eu-test.oppwa.com", "test.oppwa.com"]);
@@ -23,8 +23,8 @@ var ACI_PASSED_FIELDS = Object.freeze(["card.holder"]);
 var ACI_SIBLING_KEYS = Object.freeze(["customParameters[SHOPPER_EndToEndIdentity]"]);
 var ACI_REMOVED_ON_CONTINUATION = Object.freeze(["card.expiryMonth", "card.expiryYear"]);
 var ACI_FINGERPRINT_FIELD = "customer.browserFingerprint.value";
-var FINGERPRINT_LENGTH = 4096;
-var LEG_BODY_LIMIT = 16384;
+var FINGERPRINT_LENGTH = 8192;
+var LEG_BODY_LIMIT = 32768;
 var END_TO_END = ACI_SIBLING_KEYS[0];
 var CHECKOUT_ID = /^[0-9A-F]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}$/i;
 var ENDPOINT_PATH = /^\/v1\/checkouts\/([^/]+?)(\/payment|\/registration)?$/;

package/dist/agent-amount.generated.d.ts

@@ -0,0 +1,7 @@
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export declare const AGENT_AMOUNT: {
+    processors: readonly string[];
+    aboveZero: readonly string[];
+    pageAmount: readonly string[];
+    names: Readonly<Record<string, string>>;
+};

package/dist/agent-amount.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
+/** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
+export const AGENT_AMOUNT = { "processors": ["clover", "comgate", "cybersource_secure_acceptance", "gmo_pg", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymongo", "paypal", "payrexx", "paytrail", "pelecard", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "wix_payments", "wspay"], "aboveZero": ["clover", "comgate", "gopay", "hipay", "makecommerce", "midtrans", "moneris", "omise", "pay_nl", "payfast", "paymongo", "paypal", "payrexx", "poynt", "przelewy24", "revolut", "sb_payment_service", "sumup", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "omise": "Omise", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymongo": "PayMongo", "paypal": "PayPal", "payrexx": "Payrexx", "paytrail": "Paytrail", "pelecard": "Pelecard", "poynt": "GoDaddy Payments", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/capabilities.generated.d.ts

@@ -0,0 +1,2 @@
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export declare const DECLARED_CAPABILITIES: readonly string[];

package/dist/capabilities.generated.js

@@ -0,0 +1,3 @@
+// Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
+/** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "authorize_net_dpm_form", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "omise_card_token", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymongo_checkout_pay", "paypal_card_fields", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "pelecard_transaction", "poynt_collect_nonce", "primer_payment_instruments", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "verifone_card_capture", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];