@agent-cards/sdk 0.23.22 → 0.23.23

package/dist/sbps.js

@@ -0,0 +1,90 @@
+// SB Payment Service (SBPS): the adapters' side of its one-time token request.
+//
+// SBPS's token script (com_sbps_system_token.js) encrypts the card in the merchant's page and sends it
+// as ONE JSONP <script> GET to /token/generateToken on token.sps-system.com (stbtoken.sps-system.com
+// for SBPS's test environment); the answer is JavaScript that calls the request's own callback with
+// {"tokenRes": {...}}. The rules that judge that request (the exact URL the browser writes for the
+// script's <script>, the merchant pins, the answer judge) live in payment-core and reach this SDK as
+// sbps.generated.ts. This module holds only what an attachment decides from them:
+//   - which request on SBPS's token hosts is the card token request to pause for the vault;
+//   - which is a variant of it this SDK does not complete (aborted, so the placeholder's ciphertext
+//     never reaches SBPS);
+//   - the script answer the paused request gets once the cardholder's device sent the real card: the
+//     token Agentcard stored, wrapped in the callback the paused URL named.
+// The 3-D Secure info request on the same host (/token/generateTds2Token: the buyer's name, phone and
+// email, no card) and the scripts continue untouched.
+import { SBPS_ANSWER_CONTENT_TYPE, SBPS_TOKEN_HOSTS, SBPS_TOKEN_PATH, isSbpsRequest, isSbpsTokenRequest, sbpsJsonp, sbpsOutcome, sbpsRequestFacts } from './sbps.generated.js';
+/** The processor id, as the registry and the API name it. */
+export const SBPS_PSP = 'sb_payment_service';
+/** The dark-launch capability the API serves the SBPS recognizer behind (payment-core definitions.js). */
+export const SBPS_CAPABILITY = 'sbps_token_jsonp';
+/** What the paused <script> is answered with. */
+export { SBPS_ANSWER_CONTENT_TYPE };
+const SBPS_HOSTNAMES = [SBPS_TOKEN_HOSTS.production, SBPS_TOKEN_HOSTS.sandbox];
+/** Which SBPS request this is, or null for a URL that is not on one of SBPS's token hosts. */
+export function classifySbpsRequest(url, method) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password
+        || !SBPS_HOSTNAMES.includes(parsed.hostname.toLowerCase().replace(/\.$/, '')))
+        return null;
+    // Every spelling of the token path belongs to the token request family: the exact request carries the
+    // card, and any neighbour of it is nothing this SDK completes. generateTds2Token is not a neighbour.
+    if (parsed.pathname.toLowerCase().startsWith(SBPS_TOKEN_PATH.toLowerCase())) {
+        return typeof method === 'string' && isSbpsTokenRequest(url, method.toUpperCase()) ? { kind: 'token_request' } : { kind: 'unsupported' };
+    }
+    return { kind: 'sibling' };
+}
+/** The token request GET exactly as payment-core admits it: its URL alone, with no body. */
+export function isSbpsTokenGet(request) {
+    return (request.method ?? 'POST').toUpperCase() === 'GET' && isSbpsRequest({ url: request.url, method: 'GET', body: request.body ?? '' });
+}
+/**
+ * The answer a paused token request gets, or null when the stored answer is not one to hand the page:
+ * SBPS's own shape, `<callback>(<tokenRes>)` under a script type, with the callback the paused URL
+ * named. The answer must be one payment-core's judge accepts for that exact URL (result OK and the
+ * five token fields), byte for byte what the API stored after running the same judge.
+ */
+export function sbpsScriptAnswer(templateUrl, response) {
+    const facts = sbpsRequestFacts(templateUrl);
+    if (!facts || response.status !== 200 || typeof response.body !== 'string')
+        return null;
+    let body;
+    try {
+        body = sbpsJsonp(facts.callback, response.body);
+    }
+    catch {
+        return null;
+    }
+    const verdict = sbpsOutcome(200, body, templateUrl, undefined);
+    if (verdict.outcome !== 'token' || verdict.sanitizedJson !== response.body)
+        return null;
+    return { status: 200, headers: { 'content-type': SBPS_ANSWER_CONTENT_TYPE }, body };
+}
+/**
+ * One attachment's view of SBPS's token hosts. Inert (classify returns null) until the registry serves
+ * SBPS, which a client reaches only by syncing with the capability for an org the API enabled, so a
+ * build, an org or an API that never served it leaves every SBPS request exactly as before.
+ */
+export class SbpsGate {
+    vault;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    /** What this request is, when the registry serves SBPS and the URL is on its token hosts; null leaves it to the other gates. */
+    classify(url, method) {
+        if (typeof this.vault?.recognizesProcessor !== 'function' || !this.vault.recognizesProcessor(SBPS_PSP))
+            return null;
+        return classifySbpsRequest(url, method);
+    }
+    /** Playwright's route predicate sees only the URL: route the token request family, never the scripts or the 3-D Secure info request. */
+    matches(url) {
+        const request = this.classify(url, 'GET');
+        return request !== null && request.kind !== 'sibling';
+    }
+}

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 360d9805357acc5244c3beafbb16a6da782e933b506db49c2d63df06ac23f7b4
+// artifact-sha256: 7d433d016a6cb47bb9d1cf22ab63bf41d3d67091d68a23e2d3c8885dbfa98b43
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -10,6 +10,158 @@ function deepFreeze(value) {
     }
     return value;
 }
+// src/registration.js
+var PARTS = { psp: "id", definitions: "list", refusedOperations: "list", settlementReadback: "any", exactUrl: "rule", bodyGate: "rule", amount: "rule" };
+var PSP_ID = /^[a-z][a-z0-9_]*$/;
+var registrationProblems = (spec) => problemsOf(spec, PARTS);
+function problemsOf(spec, parts) {
+    if (!spec || typeof spec !== "object")
+        return ["a registration is an object"];
+    const psp = spec.psp;
+    if (typeof psp !== "string" || !PSP_ID.test(psp))
+        return [`${JSON.stringify(psp)} is not a processor id`];
+    const problems2 = Object.keys(spec).filter((key) => !(key in parts)).map((key) => `${psp}: ${key} is no registration part`);
+    for (const [key, kind] of Object.entries(parts)) {
+        const value = spec[key];
+        if (value === void 0)
+            continue;
+        if (kind === "rule" && typeof value !== "function")
+            problems2.push(`${psp}: ${key} is not a function`);
+        if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
+            problems2.push(`${psp}: ${key} is not a list of card numbers`);
+        }
+    }
+    if ("definitions" in parts) {
+        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
+            problems2.push(`${psp}: names no definition`);
+        else if (spec.definitions.some((definition) => definition?.psp !== psp))
+            problems2.push(`${psp}: a definition names another processor`);
+        for (const id of spec.refusedOperations ?? []) {
+            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
+                problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
+        }
+    }
+    return problems2;
+}
+function registered(spec, parts) {
+    const problems2 = problemsOf(spec, parts);
+    if (problems2.length)
+        throw new Error(`payment-core registration refused: ${problems2.join("; ")}`);
+    return deepFreeze({ ...spec });
+}
+function registerProcessor(spec) {
+    return registered(spec, PARTS);
+}
+// src/processors/midtrans.js
+var MIDTRANS_PSP = "midtrans";
+var MIDTRANS_OPERATION = "midtrans.card_request";
+var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
+var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
+var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
+var BODY_LIMIT = 4096;
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var YEAR = /^20[0-9]{2}$/;
+var TERM = /^[0-9]{1,3}$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isMidtransTokenUrl(url) {
+    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function midtransBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null || !inOrder(value, MIDTRANS_TOKEN_KEYS)) {
+        if (record(value) && (own(value, "token_id") || own(value, "two_click")) && !own(value, "card_number"))
+            return refuse("midtrans_saved_card");
+        return refuse("midtrans_body_unsupported");
+    }
+    if (!own(value, "card_cvv") || !own(value, "card_number") || !own(value, "card_exp_month") || !own(value, "card_exp_year")) {
+        return refuse("midtrans_body_unsupported");
+    }
+    if (typeof value.card_cvv !== "string" || !SECURITY_CODE.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR.test(value.card_exp_year))
+        return refuse("midtrans_body_unsupported");
+    if (own(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
+        return refuse("midtrans_body_unsupported");
+    return CARD;
+}
+var midtrans_default = /* @__PURE__ */ registerProcessor({
+    psp: MIDTRANS_PSP,
+    definitions: [
+        {
+            psp: "midtrans",
+            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
+            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
+            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
+            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
+            capability: "midtrans_card_token",
+            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
+            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
+            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
+            // cookies never ride.
+            passthroughHeaders: ["^authorization$", "^x-service$"],
+            jsonCardFields: [["card_number"]]
+        }
+    ],
+    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
+    refusedOperations: [MIDTRANS_OPERATION],
+    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    settlementReadback: "not_surveyed",
+    exactUrl: isMidtransTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+});
+// src/processors/index.generated.js
+var REGISTERED_MODULES = Object.freeze({
+    midtrans: midtrans_default
+});
+// src/registry.js
+var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
+var ids = REGISTERED_PROCESSORS.map((processor) => processor.psp);
+var problems = REGISTERED_PROCESSORS.flatMap(registrationProblems);
+for (const [name, processor] of Object.entries(REGISTERED_MODULES)) {
+    if (processor.psp !== name)
+        problems.push(`processors/${name}.js registers ${JSON.stringify(processor.psp)}`);
+}
+if (ids.some((id, i) => i > 0 && ids[i - 1] >= id))
+    problems.push(`registered processors out of id order: ${ids.join(", ")}`);
+if (problems.length)
+    throw new Error(`payment-core registry refused: ${problems.join("; ")}`);
+var BY_PSP = new Map(REGISTERED_PROCESSORS.map((processor) => [processor.psp, processor]));
+var REGISTERED_IDS = Object.freeze(ids);
+var REGISTERED_DEFINITIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.definitions));
+var REGISTERED_REFUSED_OPERATIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.refusedOperations ?? []));
+var REGISTERED_SETTLEMENT_READBACK = Object.freeze(REGISTERED_PROCESSORS.filter((processor) => processor.settlementReadback !== void 0).map((processor) => [processor.psp, processor.settlementReadback]));
 // src/definitions.js
 var PROCESSOR_DEFINITIONS = deepFreeze([
     {
@@ -563,8 +715,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // posts the card there in that same session, and the runtime resolves the paused navigation with the
         // hosted_form notice. Only the entry path is matched, exactly (processors/paytrail.js isPaytrailEntryUrl:
         // a query would reach Paytrail's server beside the signed body). The card page and its card, wallet and
-        // card-number lookups live on Payment Highway's host, which no recognizer takes; the SDK's pause, a later
-        // change, refuses them in the agent's browser, so no dummy card reaches Payment Highway. The entry names no amount: Paytrail
+        // card-number lookups live on Payment Highway's host, which no recognizer takes: it is an abort host, armed in
+        // the SDK's adapters so the SDK's Paytrail gate refuses every card request the agent's browser sends there,
+        // and no dummy card reaches Payment Highway. The entry names no amount: Paytrail
         // holds it, so the cardholder approves the agent's amount and the device holds it to the amount the card
         // page names. Paytrail's public test merchant shares this host, so the host marks no environment. Dark:
         // served only to a client that declares the capability, and gated off for every org the operator has not
@@ -572,6 +725,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         capability: "paytrail_hosted_payment_page",
         match: "services\\.paytrail\\.com/payments/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/click-to-pay/loading-and-redirect",
         hosts: ["^services\\.paytrail\\.com$"],
+        // Payment Highway's live host (processors/paytrail.js PAYMENT_HIGHWAY_HOSTS), which no recognizer takes: an SDK that
+        // declares the capability arms it so its gate can refuse the card posts the agent's browser sends there.
+        abortHosts: ["^v1\\.api\\.paymenthighway\\.io$"],
         encoding: "form",
         passthroughHeaders: [],
         mode: "hosted_form",
@@ -2752,7 +2908,127 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // Referer and cookies never ride.
         passthroughHeaders: ["^authorization$", "^client-type$", "^client-version$", "^client-id$"],
         jsonCardFields: [["card_data", "account_number"]]
-    }
+    },
+    {
+        psp: "sb_payment_service",
+        // SB Payment Service (SBPS), SoftBank's card gateway: its one-time token script on the merchant's
+        // page (com_sbps_system_token.js) encrypts the card in the page and sends it as ONE JSONP <script>
+        // GET to /token/generateToken on token.sps-system.com (stbtoken.sps-system.com for SBPS's test
+        // environment), the card in the query: val is AES-256-CBC of "number:YYYYMM:code" under a PBKDF2 key
+        // over the merchant and service ids, and key is the salt and iv RSA-wrapped under SBPS's key in the
+        // script. sbps.js holds the request rule the pause decision, the API's create and the device all
+        // read: the exact URL the browser writes for the script's <script>, so the 3-D Secure info request
+        // on the same host (/token/generateTds2Token, the buyer's details and no card) is never recognized.
+        // Nothing can be written into the paused ciphertext: the cardholder's device rebuilds key and val
+        // with the real card under the key payment-core pins, and sends the GET through the checkout relay,
+        // since the host answers no browser origin and answers with JavaScript.
+        // Ships dark: served only to a client that declares `sbps_token_jsonp`, gated off for every org until
+        // an operator lists one (`sb_payment_service:<org>`), held to the merchants sbps.js pins per checkout
+        // origin, and autopilot never sends this request (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS). The
+        // environment is pinned (S7): stbtoken only on test rows and only with documented test cards.
+        capability: "sbps_token_jsonp",
+        // The path has a right-edge guard for the SDK's unanchored test.
+        match: "(?:stb)?token\\.sps-system\\.com/token/generateToken(?![\\w/.-])",
+        hosts: ["^token\\.sps-system\\.com$", "^stbtoken\\.sps-system\\.com$"],
+        sandboxHosts: ["^stbtoken\\.sps-system\\.com$"],
+        hostEnvironmentPinned: true,
+        // `encoding` describes the query, since the request has no body. No captured header is ever
+        // replayed, and the card rides in the query of one GET whose answer is JSONP.
+        encoding: "form",
+        passthroughHeaders: [],
+        request: { method: "GET", cardIn: "query", response: "jsonp" }
+    },
+    {
+        psp: "tappay",
+        // TapPay (Cherri Tech, Taiwan): TapPay Fields, the card iframes every TPDirect integration mounts from
+        // js.tappaysdk.com (confirmed live 2026-10-17). TPDirect.card.getPrime makes TapPay's own api iframe
+        // (js.tappaysdk.com/sdk/tpdirect/api/html/<version>) read the three field iframes and POST one request:
+        //   POST https://js.tappaysdk.com/payment/tpdirect/production/getprime
+        //   Content-Type: application/x-www-form-urlencoded, x-api-key: <the merchant's TapPay app key>
+        //   jsonString={"cardnumber":...,"cardduedate":"<YYYYMM>","appid":...,"appkey":...,"appname":...,
+        //     "url":...,"port":...,"protocol":...,"tappay_sdk_version":...,"cardholder_info":{...}[,"cardccv":...][,"device_id":...]}
+        // The one form field jsonString holds the whole card request as the SDK's JSON.stringify. tappay.js
+        // holds the request rule, the pause decision, the device fill and the answer judge; the card sits at
+        // cardnumber, cardduedate (TapPay's "20"+YY+MM, so YYYYMM) and the optional cardccv. The request names no
+        // amount and mints a prime (one-time token, 90-second TTL) the merchant's server charges with Pay by
+        // Prime, where 3-D Secure runs (three_domain_secure), never in this request. The api iframe posts same
+        // origin, so a replay from the Vault's origin is cross-origin and its x-api-key preflight is refused
+        // (OPTIONS to getprime drew 403 with no Access-Control-Allow-Origin, 2026-10-17), so the card leaves the
+        // cardholder's device only through the checkout relay, and tappayAnswerOutcome judges the answer, since
+        // TapPay reports a refusal inside HTTP 200 with a non-zero status. One host serves every merchant, so a
+        // live card is tokenized only for a checkout origin a reviewed pin lists (tappay.js tappayMerchantRefusal)
+        // and the approval names that merchant. TapPay's sandbox is the same host with the /sandbox/ path and so
+        // cannot be told from production by host (hostEnvironment is host based): this lane recognizes production
+        // only, as Wix Payments does, and a sandbox test run is a later change.
+        // Ships dark: served only to a client that declares `tappay_prime`, gated off for every org until an
+        // operator lists one (`tappay:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "tappay_prime",
+        match: "js\\.tappaysdk\\.com/payment/tpdirect/production/getprime",
+        hosts: ["^js\\.tappaysdk\\.com$"],
+        encoding: "form",
+        passthroughHeaders: ["^x-api-key$"]
+    },
+    {
+        psp: "paymob",
+        // Paymob's own checkout (Egypt, the UAE, Saudi Arabia, Oman): Unified Checkout, the hosted page every
+        // Paymob payment link, PayMe handle, WooCommerce plugin and Shopify redirect app opens, and Pixel, the
+        // card frame a merchant's own page embeds. Pay sends the card in one JSON POST to the Paymob API of the
+        // merchant's country, /api/acceptance/payments/pay on accept., uae., ksa. or oman.paymob.com (and
+        // accept.paymobsolutions.com, Paymob Egypt's older name for the same API): {source: {identifier,
+        // sourceholder_name, subtype: "CARD", expiry_month, expiry_year, cvn, ...}, payment_token, ...}.
+        // Unencrypted. The request names no amount of its own: its payment key, Paymob's signed JWT for the
+        // merchant's intention, names the amount and currency Paymob charges. paymob.js holds the rule the
+        // pause decision reads: the exact URL, a JSON content type, and the card form's payment, key by key,
+        // with a saved Paymob card, a payment that keeps the card, pays in installments, splits, converts or
+        // names a Paymob account, and any other card shape refused. Every other method of the checkout
+        // (wallets, Apple Pay, Google Pay, KNET, valU, cash) carries no card on the same URL and continues
+        // untouched (passWithoutCard). The API answers any origin's preflight, so the cardholder's device
+        // sends the card itself; no header is needed beside the content type. 3-D Secure follows the answer,
+        // with no card. Test and live modes share the hosts (test keys and integrations separate them), so no
+        // sandbox host is marked.
+        // Ships dark: served only to a client that declares `paymob_checkout_pay`, gated off for every org
+        // until an operator lists one (`paymob:<org>`), and autopilot never sends this request
+        // (autopilot.js DEVICE_REPLAY_REFUSED_OPERATIONS).
+        capability: "paymob_checkout_pay",
+        match: "(?:accept|uae|ksa|oman)\\.paymob\\.com/api/acceptance/payments/pay|accept\\.paymobsolutions\\.com/api/acceptance/payments/pay",
+        hosts: ["^accept\\.paymob\\.com$", "^uae\\.paymob\\.com$", "^ksa\\.paymob\\.com$", "^oman\\.paymob\\.com$", "^accept\\.paymobsolutions\\.com$"],
+        encoding: "json",
+        passthroughHeaders: [],
+        jsonCardFields: [["source", "identifier"]],
+        passWithoutCard: "(?:accept|uae|ksa|oman)\\.paymob\\.com/api/acceptance/payments/pay|accept\\.paymobsolutions\\.com/api/acceptance/payments/pay"
+    },
+    {
+        psp: "payu_latam",
+        // PayU Latam's WebCheckout (Colombia, Mexico, Chile, Peru, Panama), the hosted page a PayU Latam
+        // merchant's payment form, button, link or cart plugin opens at checkout.payulatam.com. Its card form
+        // posts the whole checkout transaction as JSON to /ppp-web-gateway-payu/checkout/submit/<country>
+        // /credit_card/<session key> on the page's own host, the card in checkoutCreditCard: the number as the
+        // field's mask spells it, the code, and the month and two-digit year as numbers. The body copies the
+        // order PayU holds for the session, but PayU charges its own, so the amount is the agent's (no request
+        // amount in backend.js). payu-latam.js holds the rule the
+        // pause decision reads: the exact URL with a country this lane read, and the card form's own body, with
+        // the box that has PayU keep the card, a card PayU saved, a wallet, installments and a test order on
+        // the live host refused. The page's BIN lookup (checkout/card_info/) and its 3-D Secure redirect use
+        // other paths, which `match` leaves out; `(?![\w/;.%-])` ends the key for a consumer that tests `match`
+        // unanchored. The submit answers a CORS preflight from any origin, so the cardholder's device can send
+        // the card itself. Ships dark: served only to a client that declares
+        // `payu_latam_webcheckout_card`, gated off for every org until an operator lists one
+        // (`payu_latam:<org>`), and autopilot never sends this request (autopilot.js
+        // DEVICE_REPLAY_REFUSED_OPERATIONS). The environment is pinned (S7): sandbox.checkout.payulatam.com
+        // only on test rows and only with documented test cards.
+        capability: "payu_latam_webcheckout_card",
+        match: "(?:sandbox\\.)?checkout\\.payulatam\\.com/ppp-web-gateway-payu/checkout/submit/(?:ar|br|cl|co|mx|pa|pe)/credit_card/[0-9a-f]{32}(?![\\w/;.%-])",
+        hosts: ["^checkout\\.payulatam\\.com$", "^sandbox\\.checkout\\.payulatam\\.com$"],
+        sandboxHosts: ["^sandbox\\.checkout\\.payulatam\\.com$"],
+        hostEnvironmentPinned: true,
+        encoding: "json",
+        // AngularJS's Accept, which the page sends on every $http call. Cookies, Origin and Referer never ride.
+        passthroughHeaders: ["^accept$"],
+        jsonCardFields: [["checkoutCreditCard", "number"]]
+    },
+    // Every processor registered since this list froze, in id order (registry.js).
+    ...REGISTERED_DEFINITIONS
 ]);
 var PSP_RECOGNIZERS = deepFreeze(PROCESSOR_DEFINITIONS.map(({ compose, encryptedCardFields, deviceSteps, deviceEncrypt, ...definition }) => definition));
 var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
@@ -2992,7 +3268,7 @@ var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
 ]);
 // src/amazon-payment-services.js
-var BODY_LIMIT = 32 * 1024;
+var BODY_LIMIT2 = 32 * 1024;
 var ANSWER_LIMIT = 64 * 1024;
 // src/clover.js
 var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
@@ -3215,6 +3491,159 @@ var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin10({ id: "socialgiver", merchant: "Socialgiver", origins: ["https://www.socialgiver.com"], keys: ["pkey_5d5o2iahksmyrkybemg"] }),
     pin10({ id: "thireq_pecko_links", merchant: "Thireq Pecko", origins: ["https://linksplus.omise.co"], keys: ["pkey_65w70xniwsinf0gm680"] })
 ]);
+// src/payu-latam.js
+var PAYU_LATAM_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["checkout.payulatam.com"]),
+    sandbox: Object.freeze(["sandbox.checkout.payulatam.com"])
+});
+var ADDRESS = ["street1", "street2", "street3", "city", "state", "country", "postalCode", "phone"];
+var PERSON = [
+    "fullName",
+    "emailAddress",
+    "contactPhone",
+    "phoneCountryCode",
+    "dniNumber",
+    "isDniNumberEncrypt",
+    "dniType",
+    "personType",
+    "businessName",
+    "cnpj",
+    "gender"
+];
+var MONEY = ["value", "symbol", "currency"];
+var RECORD_MEMBERS = /* @__PURE__ */ Object.freeze({
+    payer: [...PERSON, "merchantBuyerId", "billingAddress", "birthDate", "identificationNumber", "identificationType"],
+    "payer.billingAddress": ADDRESS,
+    order: [
+        "id",
+        "referenceCode",
+        "airlineCode",
+        "description",
+        "isTest",
+        "signature",
+        "language",
+        "buyer",
+        "shipment",
+        "state",
+        "status",
+        "paymentApprovalDate",
+        "creationDate",
+        "accountId",
+        "amount",
+        "tax",
+        "totalPurchase",
+        "currency",
+        "amountConvertedValue",
+        "taxConvertedValue",
+        "taxReturnBase",
+        "taxReturnBaseConvertedValue",
+        "additionalValue",
+        "administrativeFee",
+        "taxAdministrativeFee",
+        "taxAdministrativeFeeReturnBase",
+        "enabledPaymentMethods",
+        "enabledInstallments",
+        "enabledPaymentMethodTypes",
+        "enabledIin",
+        "enabledPseBanks",
+        "enabledKhipuBanks",
+        "paymentMethodsDescription",
+        "urlEncodedId",
+        "shippingValue",
+        "paymentRequestLinkId",
+        "airlineDescription",
+        "displayShipping",
+        "displayBuyerComments",
+        "buyerCommentsLabel",
+        "extraParameters",
+        "dispersion"
+    ],
+    "order.buyer": [...PERSON, "merchantBuyerId", "buyerAddress", "comments"],
+    "order.buyer.buyerAddress": ADDRESS,
+    "order.shipment": [...PERSON, "merchantShipmentId", "shippingAddress", "comments"],
+    "order.shipment.shippingAddress": ADDRESS,
+    "order.amount": MONEY,
+    "order.tax": MONEY,
+    "order.totalPurchase": MONEY,
+    "order.amountConvertedValue": MONEY,
+    "order.taxConvertedValue": MONEY,
+    "order.taxReturnBase": MONEY,
+    "order.taxReturnBaseConvertedValue": MONEY,
+    shippingInfo: [
+        "userLogin",
+        "id",
+        "reference",
+        "description",
+        "currency",
+        "deliveryCity",
+        "deliveryCityName",
+        "deliveryAddress1",
+        "deliveryAddress2",
+        "deliveryAddress3",
+        "postalCode",
+        "fullName",
+        "documentType",
+        "document",
+        "phoneNumber",
+        "observationsReceivingShipment",
+        "destinationState",
+        "destinationStateName",
+        "destinationCountry",
+        "destinationEmail",
+        "originFullName",
+        "originIdentificationType",
+        "originIdentification",
+        "originCity",
+        "originState",
+        "originCountry",
+        "originAddress",
+        "originZipCode",
+        "originPhone",
+        "originEmail",
+        "kilogramWeight",
+        "volumetricWeight",
+        "totalValue",
+        "declaredValue",
+        "shippingValue",
+        "guideNumber",
+        "enlistmentApplies",
+        "deliveryDate",
+        "deliveryDays",
+        "minDeliveryDays",
+        "packageHeight",
+        "packageWidth",
+        "packageLength",
+        "shippingProvider",
+        "shippingState",
+        "creationDate",
+        "lastUpdateDate",
+        "expirationDate",
+        "signature",
+        "strCreationDate",
+        "comment",
+        "warehouseId",
+        "additionalDeliveryDays",
+        "shippingMerchantValue"
+    ],
+    // PayU's own ten, as transaction/create names them, and the merchant's extra1 to extra4 (the payment form's
+    // optional fields), each text or nothing.
+    "order.extraParameters": [
+        "CURRENCY",
+        "LANGUAGE",
+        "ACCOUNT_ID",
+        "ALGORITHM_SIGNATURE",
+        "CHECKOUT_VERSION",
+        "RESPONSE_URL",
+        "IS_TEST",
+        "SIGNATURE",
+        "NOTIFY_URL",
+        "IP_COUNTRY",
+        "EXTRA1",
+        "EXTRA2",
+        "EXTRA3",
+        "EXTRA4"
+    ]
+});
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;
@@ -3550,7 +3979,8 @@ var TRANSBANK_MERCHANTS = Object.freeze([
         fantasyName: null,
         merchant: "Teleférico Santiago",
         hosts: Object.freeze(["telefericosantiago.cl"]),
-        returnHost: "telefericosantiago.cl"
+        returnHost: "telefericosantiago.cl",
+        returnUrl: null
     })
 ]);
 var MAX_PAGE5 = 64 * 1024;
@@ -3568,7 +3998,9 @@ var PAYTRAIL_ENTRY_FIELDS = Object.freeze([
     "checkout-nonce",
     "signature"
 ]);
-var PAYTRAIL_MERCHANTS = Object.freeze([]);
+var PAYTRAIL_MERCHANTS = Object.freeze([
+    Object.freeze({ account: "1076015", merchant: "DofE Finland", paytrailName: "Avartti-säätiö", returnHost: "dofe.fi" })
+]);
 var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var UUID2 = new RegExp(`^${UUID_SOURCE}$`);
 var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
@@ -3673,6 +4105,23 @@ var DECLINE_CODES = Object.freeze([
     "AccountSuspended"
 ]);
 var FRICTIONLESS_STATUSES = Object.freeze([0, 5, 7]);
+// src/sbps.js
+var pin11 = (fields) => /* @__PURE__ */ Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    accounts: Object.freeze(fields.accounts.map((account) => Object.freeze({ ...account })))
+});
+var SBPS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    /* @__PURE__ */ pin11({
+        id: "boss_ezo_fukuoka",
+        merchant: `BOSS E${ /* @__PURE__ */String.fromCharCode(12539)}ZO FUKUOKA`,
+        origins: ["https://ticket.e-zofukuoka.com"],
+        accounts: [{ merchantId: "75082", serviceId: "001" }]
+    })
+]);
+var ERROR_TYPES = /* @__PURE__ */ Object.freeze(["03", "04", "05", "07", "99"]);
+var ERROR_FIELDS = /* @__PURE__ */ Object.freeze(["001", "002", "003", "004", "005", "999"]);
+var SBPS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(ERROR_TYPES.flatMap((type) => ERROR_FIELDS.map((field) => `${type}${field}`)));
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"

package/dist/transbank.d.ts

@@ -43,3 +43,36 @@ export declare function servesTransbank(vault: {
 export declare function isArmedTransbankUrl(vault: {
     isCardRequest(url: string, method?: string): boolean;
 } | undefined, url: string): boolean;
+/**
+ * A reviewed Webpay shop, as this build reads it to send the browser back: the hosts of its checkout pages, the host of
+ * its return page, and the return page itself, exactly as its transactions name it (null while nobody has read it).
+ */
+export interface TransbankReturnPage {
+    readonly hosts: readonly string[];
+    readonly returnHost: string;
+    readonly returnUrl: string | null;
+}
+/**
+ * payment-core's TRANSBANK_MERCHANTS, every row that names its commerce code, with these three fields. A row without a
+ * code names no shop there, so it is not listed here. transbank.test.mjs pins this list to payment-core's, so a reviewed
+ * change that codes a shop there fails this package's tests until the shop is listed here too. Teleférico Santiago's
+ * row names no code yet, so no paused entry is sent back anywhere.
+ */
+export declare const TRANSBANK_RETURN_PAGES: readonly TransbankReturnPage[];
+/**
+ * Where the paused Webpay entry `entryUrl` goes once the cardholder's phone has paid it: the return page of the one
+ * reviewed shop whose checkout pages include `pageOrigin` (the origin the create named, written exactly as an origin),
+ * with the entry's token as `token_ws`. The same navigation payment-core's transbankMerchantReturn builds, and the one
+ * Webpay itself sends the phone's session to. Null for a link that is not Webpay's entry, a page no reviewed shop
+ * lists, a page two list, or a shop whose return page no token can follow. `pages` is for tests.
+ */
+export declare function transbankMerchantReturn(entryUrl: unknown, pageOrigin: unknown, pages?: readonly TransbankReturnPage[]): string | null;
+/**
+ * The answer the paused entry gets: a 303 to the shop's return page, which the browser follows with a GET, and which no
+ * cache keeps (the URL carries Webpay's token).
+ */
+export declare function transbankMerchantReturnAnswer(returnUrl: string): {
+    status: 303;
+    headers: Record<string, string>;
+    body: string;
+};