@agent-cards/sdk 0.23.28 → 0.24.0

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: e87510bfa2a9dbf91e4d234b93c0500d2ac2cc3c1bcdf0e21461346f24f5d25e
+// artifact-sha256: af4808cd3a159d4e1fe63628b365f7f48968b9b8e7bdd1f8c89f648fa0ce1e92
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -11,7 +11,17 @@ function deepFreeze(value) {
     return value;
 }
 // src/registration.js
-var PARTS = { psp: "id", definitions: "list", refusedOperations: "list", settlementReadback: "any", exactUrl: "rule", bodyGate: "rule", amount: "rule" };
+var PARTS = {
+    psp: "id",
+    definitions: "list",
+    refusedOperations: "list",
+    settlementReadback: "any",
+    exactUrl: "rule",
+    bodyGate: "rule",
+    amount: "rule",
+    hostedEntry: "rule",
+    limitations: "sentences"
+};
 var PSP_ID = /^[a-z][a-z0-9_]*$/;
 var registrationProblems = (spec) => problemsOf(spec, PARTS);
 function problemsOf(spec, parts) {
@@ -27,46 +37,1141 @@ function problemsOf(spec, parts) {
             continue;
         if (kind === "rule" && typeof value !== "function")
             problems2.push(`${psp}: ${key} is not a function`);
+        if (kind === "flag" && value !== true)
+            problems2.push(`${psp}: ${key} is not true`);
         if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
             problems2.push(`${psp}: ${key} is not a list of card numbers`);
         }
+        if (kind === "sentences" && !(Array.isArray(value) && value.length > 0 && value.every((s) => typeof s === "string" && s.trim() !== ""))) {
+            problems2.push(`${psp}: ${key} is not a list of sentences`);
+        }
+    }
+    if ("definitions" in parts) {
+        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
+            problems2.push(`${psp}: names no definition`);
+        else if (spec.definitions.some((definition) => definition?.psp !== psp))
+            problems2.push(`${psp}: a definition names another processor`);
+        for (const id of spec.refusedOperations ?? []) {
+            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
+                problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
+        }
+        const pages = Array.isArray(spec.definitions) ? spec.definitions.filter((d) => d?.hostedForm?.cardIn === "processor_page") : [];
+        if (spec.hostedEntry !== void 0 && (pages.length === 0 || pages.some((d) => d.hostedForm.policy !== void 0))) {
+            problems2.push(`${psp}: hostedEntry needs a definition whose hosted form takes the card on the processor's page and names no policy`);
+        }
+    }
+    return problems2;
+}
+function registered(spec, parts) {
+    const problems2 = problemsOf(spec, parts);
+    if (problems2.length)
+        throw new Error(`payment-core registration refused: ${problems2.join("; ")}`);
+    return deepFreeze({ ...spec });
+}
+function registerProcessor(spec) {
+    return registered(spec, PARTS);
+}
+// src/processors/bluesnap.js
+var BLUESNAP_PSP = "bluesnap";
+var BLUESNAP_OPERATION = "bluesnap.card_request";
+var BLUESNAP_HOSTS = /* @__PURE__ */ Object.freeze({ 1: "ws1.bluesnap.com", 2: "ws2.bluesnap.com", _: "sandpay.bluesnap.com" });
+var BLUESNAP_SANDBOX_HOST = "sandpay.bluesnap.com";
+var BLUESNAP_CARD_KEYS = /* @__PURE__ */ Object.freeze(["cvv", "ccNumber", "expDate"]);
+var BLUESNAP_LEG_KEYS = /* @__PURE__ */ Object.freeze(["cvv", "expDate"]);
+var BODY_LIMIT = 1024;
+var TOKEN_URL = /^https:\/\/(ws1|ws2|sandpay)\.bluesnap\.com\/services\/2\/payment-fields-tokens\/([0-9a-f]{64}_[12]?)$/;
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var EXPIRY = /^(?:0[1-9]|1[0-2])\/20[0-9]{2}$/;
+var SAVED_CARD_KEYS = ["last4Digits", "lastFourDigits", "ccType"];
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var LEG = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function bluesnapTokenUrl(url) {
+    const match = typeof url === "string" ? TOKEN_URL.exec(url) : null;
+    if (!match || BLUESNAP_HOSTS[match[2].slice(-1)] !== `${match[1]}.bluesnap.com`)
+        return null;
+    const host = `${match[1]}.bluesnap.com`;
+    return Object.freeze({ host, token: match[2], environment: host === BLUESNAP_SANDBOX_HOST ? "sandbox" : "production" });
+}
+function isBluesnapTokenUrl(url) {
+    return bluesnapTokenUrl(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function bluesnapBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse("bluesnap_body_unsupported");
+    const keys = Object.keys(value);
+    if (keys.some((key) => SAVED_CARD_KEYS.includes(key)))
+        return refuse(own(value, "ccNumber") ? "bluesnap_body_unsupported" : "bluesnap_saved_card");
+    if (keys.length === 0 || keys.some((key, i) => !BLUESNAP_CARD_KEYS.includes(key) || i > 0 && BLUESNAP_CARD_KEYS.indexOf(keys[i - 1]) >= BLUESNAP_CARD_KEYS.indexOf(key))) {
+        return refuse("bluesnap_body_unsupported");
+    }
+    if (own(value, "ccNumber") && !(typeof value.ccNumber === "string" && CARD_NUMBER.test(value.ccNumber)) || own(value, "cvv") && !(typeof value.cvv === "string" && SECURITY_CODE.test(value.cvv)) || own(value, "expDate") && !(typeof value.expDate === "string" && EXPIRY.test(value.expDate)))
+        return refuse("bluesnap_body_unsupported");
+    return own(value, "ccNumber") ? CARD : LEG;
+}
+var bluesnap_default = /* @__PURE__ */ registerProcessor({
+    psp: BLUESNAP_PSP,
+    definitions: [
+        {
+            psp: "bluesnap",
+            // The card fields' PUTs, as the header above reads them. The sandbox has its own server, so the device sends a
+            // test-mode request only documented test cards (hostEnvironmentPinned, device-replay.js S7). `(?![\w/.%-])`
+            // ends the token for a consumer that tests `match` unanchored; the exact-URL rule pins each server to its suffix.
+            // Ships dark: served only to a client that declares `bluesnap_hosted_payment_fields`, and the backend's gate turns
+            // it on for Agentcard's own company alone, in code.
+            capability: "bluesnap_hosted_payment_fields",
+            match: "(?:ws1|ws2|sandpay)\\.bluesnap\\.com/services/2/payment-fields-tokens/[0-9a-f]{64}_[12]?(?![\\w/.%-])",
+            hosts: ["^ws1\\.bluesnap\\.com$", "^ws2\\.bluesnap\\.com$", "^sandpay\\.bluesnap\\.com$"],
+            sandboxHosts: ["^sandpay\\.bluesnap\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The frames' own headers, each held to its shape by bluesnapRequestRefusal. Origin, Referer and cookies never
+            // ride (the frames send no cookie).
+            passthroughHeaders: ["^authorization$", "^bluesnap_version_header$", "^bluesnap_origin_version_header$", "^bluesnap_origin_header$"],
+            jsonCardFields: [["ccNumber"]],
+            // The expiry and code frames' PUTs: held by the checkout SDK and answered with the card request's answer.
+            splitCard: { absorb: [...BLUESNAP_LEG_KEYS], pass: [], siblingKeys: [] },
+            request: { method: "PUT", cardIn: "body", response: "json" }
+        }
+    ],
+    // Only the cardholder's device sends the card, after a person approves; no reviewed list names bluesnap.
+    refusedOperations: [BLUESNAP_OPERATION],
+    // Not surveyed: the PUT moves no money, and the merchant's own charge is a server call Agentcard never sees.
+    settlementReadback: "not_surveyed",
+    exactUrl: isBluesnapTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isBluesnapTokenUrl(url) ? { verdict: "refuse", code: "bluesnap_url_refused" } : bluesnapBodyVerdict(body)
+});
+// src/processors/iyzico.js
+var IYZICO_PSP = "iyzico";
+var IYZICO_OPERATION = "iyzico.card_request";
+var PATHS = ["/payment/iyzipos/checkoutform/auth/ecom", "/payment/iyzipos/checkoutform/initialize3ds/ecom"];
+var IYZICO_CARD_URLS = /* @__PURE__ */ Object.freeze(["https://api.iyzipay.com", "https://sandbox-api.iyzipay.com"].flatMap((origin) => PATHS.map((path) => `${origin}${path}`)));
+var IYZICO_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "installment",
+    "paidPrice",
+    "paymentChannel",
+    "paymentCard",
+    "buyerProtected",
+    "gsmNumber",
+    "dccPayment",
+    "dccQueryRrn",
+    "pwiMetadata"
+]);
+var IYZICO_CARD_KEYS = /* @__PURE__ */ Object.freeze([
+    "cardNumber",
+    "cardHolderName",
+    "expireYear",
+    "expireMonth",
+    "cvc",
+    "registerConsumerCard",
+    "registerCard"
+]);
+var BODY_LIMIT2 = 4096;
+var CARD_NUMBER2 = /^[0-9]{12,19}$/;
+var SECURITY_CODE2 = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0?[1-9]|1[0-2])$/;
+var YEAR = /^(?:[0-9]{2}|20[0-9]{2})$/;
+var PRICE = /^([1-9][0-9]{0,8}|0)(?:\.([0-9]{1,2}))?$/;
+var CHANNELS = /* @__PURE__ */ Object.freeze(["WEB", "MOBILE_WEB", "MOBILE_IOS", "MOBILE_ANDROID", "MOBILE_WINDOWS"]);
+var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["lightRedesign", "pwiGrowthActionDisabled"]);
+var FLAG = /^[A-Za-z_]{1,16}$/;
+var HOLDER = /^[^\x00-\x1f\x7f0-9]{3,100}$/u;
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own2 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse2 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD2 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isIyzicoCardUrl(url) {
+    return typeof url === "string" && IYZICO_CARD_URLS.includes(url);
+}
+function readBody2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT2)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record2(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hundredths(price) {
+    const match = typeof price === "number" && Number.isFinite(price) ? PRICE.exec(String(price)) : null;
+    const value = match ? Number(match[1]) * 100 + Number((match[2] ?? "").padEnd(2, "0")) : 0;
+    return value > 0 ? value : null;
+}
+var holderName = (name) => typeof name === "string" && HOLDER.test(name) && name.trim().split(/\s+/).filter((word) => word.length > 1).length > 1;
+var metadata = (value) => record2(value) && inOrder(value, METADATA_KEYS) && Object.values(value).every((flag) => Array.isArray(flag) && flag.length === 1 && typeof flag[0] === "string" && FLAG.test(flag[0]));
+function iyzicoBodyVerdict(body) {
+    const value = readBody2(body);
+    if (value === null)
+        return refuse2("iyzico_body_unsupported");
+    const card = value.paymentCard;
+    if (record2(card) && (own2(card, "cardToken") || own2(card, "ucsToken") || own2(card, "consumerToken")) && !own2(card, "cardNumber"))
+        return refuse2("iyzico_saved_card");
+    if (own2(value, "dccPayment") || own2(value, "dccQueryRrn"))
+        return refuse2("iyzico_dcc_refused");
+    if (own2(value, "gsmNumber") || own2(value, "buyerProtected") && value.buyerProtected !== false || record2(card) && (own2(card, "registerCard") && card.registerCard !== 0 || own2(card, "registerConsumerCard") && card.registerConsumerCard !== false)) {
+        return refuse2("iyzico_keeps_card");
+    }
+    if (Number.isSafeInteger(value.installment) && value.installment > 1)
+        return refuse2("iyzico_installments_refused");
+    if (!inOrder(value, IYZICO_BODY_KEYS) || !["installment", "paidPrice", "paymentChannel", "paymentCard"].every((key) => own2(value, key)) || value.installment !== 1 || hundredths(value.paidPrice) === null || !CHANNELS.includes(value.paymentChannel) || own2(value, "pwiMetadata") && !metadata(value.pwiMetadata))
+        return refuse2("iyzico_body_unsupported");
+    if (!record2(card) || Object.keys(card).join() !== IYZICO_CARD_KEYS.join() || typeof card.cardNumber !== "string" || !CARD_NUMBER2.test(card.cardNumber) || !holderName(card.cardHolderName) || typeof card.expireYear !== "string" || !YEAR.test(card.expireYear) || typeof card.expireMonth !== "string" || !MONTH.test(card.expireMonth) || typeof card.cvc !== "string" || !SECURITY_CODE2.test(card.cvc))
+        return refuse2("iyzico_body_unsupported");
+    return CARD2;
+}
+var iyzico_default = /* @__PURE__ */ registerProcessor({
+    psp: IYZICO_PSP,
+    definitions: [
+        {
+            psp: "iyzico",
+            // The Checkout Form's card payment, as the header above reads it. Sandbox has its own host, so the device sends
+            // a test-mode payment only iyzico's documented test cards (hostEnvironmentPinned, device-replay.js S7). Ships dark:
+            // served only to a client that declares `iyzico_checkout_form`, for a company the backend's gate turns iyzico on
+            // for, and autopilot never sends it.
+            capability: "iyzico_checkout_form",
+            match: "(?:sandbox-)?api\\.iyzipay\\.com/payment/iyzipos/checkoutform/(?:auth|initialize3ds)/ecom",
+            hosts: ["^api\\.iyzipay\\.com$", "^sandbox-api\\.iyzipay\\.com$"],
+            sandboxHosts: ["^sandbox-api\\.iyzipay\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The form's session token and its Accept. Origin, Referer and cookies never ride, and neither does IYZI_LC,
+            // which iyzico's preflight does not allow.
+            passthroughHeaders: ["^x-iyzi-token$", "^accept$"],
+            jsonCardFields: [["paymentCard", "cardNumber"]]
+        }
+    ],
+    // Only the cardholder's device sends it, after a person approves; 3-D Secure needs that person at the browser.
+    refusedOperations: [IYZICO_OPERATION],
+    // iyzico answers the form's result (CF retrieve) only to the merchant's API key and secret.
+    settlementReadback: {
+        answer: "none",
+        reason: "merchant_credential_required",
+        note: "The processor answers a payment result only to the server credentials of the shop; the intercepted request carries a checkout reference and no credential.",
+        source: "https://docs.iyzico.com/en/payment-methods/checkoutform/cf-implementation/cf-retrieve"
+    },
+    exactUrl: isIyzicoCardUrl,
+    bodyGate: (url, body) => url !== void 0 && !isIyzicoCardUrl(url) ? refuse2("iyzico_url_refused") : iyzicoBodyVerdict(body)
+});
+// src/processors/midtrans.js
+var MIDTRANS_PSP = "midtrans";
+var MIDTRANS_OPERATION = "midtrans.card_request";
+var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
+var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
+var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
+var BODY_LIMIT3 = 4096;
+var CARD_NUMBER3 = /^[0-9]{12,19}$/;
+var SECURITY_CODE3 = /^[0-9]{3,4}$/;
+var MONTH2 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR2 = /^20[0-9]{2}$/;
+var TERM = /^[0-9]{1,3}$/;
+var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own3 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder2 = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse3 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD3 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isMidtransTokenUrl(url) {
+    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+}
+function readBody3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT3)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record3(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function midtransBodyVerdict(body) {
+    const value = readBody3(body);
+    if (value === null || !inOrder2(value, MIDTRANS_TOKEN_KEYS)) {
+        if (record3(value) && (own3(value, "token_id") || own3(value, "two_click")) && !own3(value, "card_number"))
+            return refuse3("midtrans_saved_card");
+        return refuse3("midtrans_body_unsupported");
+    }
+    if (!own3(value, "card_cvv") || !own3(value, "card_number") || !own3(value, "card_exp_month") || !own3(value, "card_exp_year")) {
+        return refuse3("midtrans_body_unsupported");
+    }
+    if (typeof value.card_cvv !== "string" || !SECURITY_CODE3.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER3.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH2.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR2.test(value.card_exp_year))
+        return refuse3("midtrans_body_unsupported");
+    if (own3(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
+        return refuse3("midtrans_body_unsupported");
+    return CARD3;
+}
+var midtrans_default = /* @__PURE__ */ registerProcessor({
+    psp: MIDTRANS_PSP,
+    definitions: [
+        {
+            psp: "midtrans",
+            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
+            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
+            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
+            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
+            capability: "midtrans_card_token",
+            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
+            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
+            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
+            // cookies never ride.
+            passthroughHeaders: ["^authorization$", "^x-service$"],
+            jsonCardFields: [["card_number"]]
+        }
+    ],
+    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
+    refusedOperations: [MIDTRANS_OPERATION],
+    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    settlementReadback: "not_surveyed",
+    exactUrl: isMidtransTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+});
+// src/processors/oceanpayment.js
+var OCEANPAYMENT_PSP = "oceanpayment";
+var OCEANPAYMENT_OPERATION = "oceanpayment.card_request";
+var OCEANPAYMENT_HOSTS = /* @__PURE__ */ Object.freeze({ "secure.oceanpayment.com": "production", "test-secure.oceanpayment.com": "sandbox" });
+var OCEANPAYMENT_FORM_FIELDS = /* @__PURE__ */ Object.freeze([
+    "card_number_three",
+    "card_number_two",
+    "card_number_temp",
+    "card_number",
+    "card_date",
+    "card_year",
+    "card_month",
+    "card_secureCode",
+    "copyCard",
+    "closePage",
+    "starttime",
+    "endtime",
+    "comloadpage",
+    "timezone",
+    "OSLang",
+    "os",
+    "brower",
+    "BrowerLang",
+    "resolution",
+    "methods",
+    "reference_id",
+    "methods",
+    "reference"
+]);
+var URL_LIMIT = 2048;
+var BODY_LIMIT4 = 8192;
+var SEND_PAY = /^\/gateway\/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}$/;
+var own4 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact = (pattern, value) => typeof value === "string" && pattern.test(value);
+var CARD_RUN = /[0-9]{12}/;
+var printable = (max) => (value) => typeof value === "string" && value.length <= max && /^[\x20-\x7e]*$/.test(value) && !CARD_RUN.test(value);
+var STAMP = /^(?:|20[0-9]{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01]) (?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3})$/;
+var LANGUAGE = /^(?:|[A-Za-z]{2,8}(?:[-_][A-Za-z0-9]{1,8}){0,3})$/;
+var SHAPES = /* @__PURE__ */ new Map([
+    ["customerCardType", (v) => v === ""],
+    // The page's paste and typing markers: "0" until typed, the number's length when its key handler read it, or "N"
+    // after a paste.
+    ["card_number_three", (v) => exact(/^(?:0|N|[1-9]|1[0-9])$/, v)],
+    ["card_number_two", (v) => exact(/^(?:0|[1-9]|1[0-9])$/, v)],
+    ["card_number_temp", (v) => exact(/^[0-9]{4}(?: ?[0-9]{4}){3}$/, v)],
+    ["card_number", (v) => exact(/^[0-9]{16}$/, v)],
+    ["card_date", (v) => exact(/^(?:0[1-9]|1[0-2])\/[0-9]{2}$/, v)],
+    ["card_year", (v) => exact(/^20[0-9]{2}$/, v)],
+    ["card_month", (v) => exact(/^(?:0[1-9]|1[0-2])$/, v)],
+    ["card_secureCode", (v) => exact(/^[0-9]{3,4}$/, v)],
+    ["copyCard", (v) => v === "" || v === "0" || v === "1"],
+    // PAY NOW's handler sets it to 1 before the page submits.
+    ["closePage", (v) => v === "1"],
+    ["starttime", (v) => exact(STAMP, v)],
+    ["endtime", (v) => exact(STAMP, v)],
+    ["comloadpage", (v) => v === "0" || v === "1"],
+    // getTimezoneOffset()/60*-1: whole or fractional hours.
+    ["timezone", (v) => exact(/^(?:|-?(?:[0-9]|1[0-4])(?:\.[0-9]{1,2})?)$/, v)],
+    ["OSLang", (v) => exact(LANGUAGE, v)],
+    ["os", printable(64)],
+    ["brower", printable(128)],
+    ["BrowerLang", (v) => exact(LANGUAGE, v)],
+    ["resolution", printable(32)],
+    ["methods", (v) => v === "1"],
+    ["reference_id", (v) => v === ""],
+    // The page's own trade number.
+    ["reference", (v) => exact(/^[0-9]{1,40}$/, v)],
+    ["button", (v) => v === ""]
+]);
+function oceanpaymentSendPayUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own4(OCEANPAYMENT_HOSTS, parsed.hostname) || !SEND_PAY.test(parsed.pathname))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: OCEANPAYMENT_HOSTS[parsed.hostname] });
+}
+var isOceanpaymentSendPayUrl = (url) => oceanpaymentSendPayUrl(url) !== null;
+function formEncode(value) {
+    let encoded;
+    try {
+        encoded = encodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+    return encoded.replace(/[!'()~]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%20/g, "+");
+}
+function formDecode(raw) {
+    if (!/^(?:[A-Za-z0-9*._+-]|%[0-9A-F]{2})*$/.test(raw))
+        return null;
+    let value;
+    try {
+        value = decodeURIComponent(raw.replace(/\+/g, "%20"));
+    }
+    catch {
+        return null;
+    }
+    return formEncode(value) === raw ? value : null;
+}
+function readPairs(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT4)
+        return null;
+    const pairs = [];
+    for (const chunk of body.split("&")) {
+        const separator = chunk.indexOf("=");
+        if (separator < 1)
+            return null;
+        const rawName = chunk.slice(0, separator), raw = chunk.slice(separator + 1);
+        const name = formDecode(rawName), value = formDecode(raw);
+        if (name === null || value === null)
+            return null;
+        pairs.push({ name, rawName, raw, value });
+    }
+    return pairs;
+}
+function formPairs(body) {
+    const pairs = readPairs(body);
+    if (!pairs)
+        return null;
+    const start = pairs[0].name === "customerCardType" ? 1 : 0;
+    const end = pairs[pairs.length - 1].name === "button" ? pairs.length - 1 : pairs.length;
+    if (end - start !== OCEANPAYMENT_FORM_FIELDS.length || OCEANPAYMENT_FORM_FIELDS.some((name, i) => pairs[start + i].name !== name))
+        return null;
+    return pairs;
+}
+var valueOf = (pairs, name) => pairs.find((pair) => pair.name === name)?.value;
+function bodyRefusal(body) {
+    const pairs = formPairs(body);
+    if (!pairs)
+        return "oceanpayment_body_unsupported";
+    if (pairs[0].name === "customerCardType" && pairs[0].value !== "")
+        return "oceanpayment_card_brand_refused";
+    if (valueOf(pairs, "reference_id") !== "")
+        return "oceanpayment_device_data_refused";
+    if (pairs.some(({ name, value }) => !SHAPES.get(name)(value)))
+        return "oceanpayment_body_unsupported";
+    const number = valueOf(pairs, "card_number");
+    const temp = valueOf(pairs, "card_number_temp");
+    const [month, year] = valueOf(pairs, "card_date").split("/");
+    if (temp.replace(/ /g, "") !== number || temp !== number && temp !== spaced(number))
+        return "oceanpayment_body_unsupported";
+    if (valueOf(pairs, "card_month") !== month || valueOf(pairs, "card_year") !== `20${year}`)
+        return "oceanpayment_body_unsupported";
+    return null;
+}
+var spaced = (number) => number.replace(/([0-9]{4})(?=[0-9])/g, "$1 ");
+function oceanpaymentBodyVerdict(body) {
+    const code = bodyRefusal(body);
+    return code ? Object.freeze({ verdict: "refuse", code }) : Object.freeze({ verdict: "card" });
+}
+var oceanpayment_default = /* @__PURE__ */ registerProcessor({
+    psp: OCEANPAYMENT_PSP,
+    definitions: [
+        {
+            psp: "oceanpayment",
+            // The hosted page's card post, as the header above reads it. The sandbox has its own host, so a test row's device
+            // sends only Oceanpayment's documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `oceanpayment_hosted_payment_page`, and only for a company the
+            // backend's processor gate turns Oceanpayment on for. `(?![\w/.%;=!-])` ends the path for a consumer that tests
+            // `match` unanchored.
+            capability: "oceanpayment_hosted_payment_page",
+            match: "(?:test-)?secure\\.oceanpayment\\.com/gateway/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}(?![\\w/.%;=!-])",
+            hosts: ["^secure\\.oceanpayment\\.com$", "^test-secure\\.oceanpayment\\.com$"],
+            sandboxHosts: ["^test-secure\\.oceanpayment\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "form",
+            // A form navigation: nothing but its type is replayed. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            cardFields: ["card_number"]
+        }
+    ],
+    // Only the cardholder's device sends this card, after a person approves; no reviewed list names oceanpayment.
+    refusedOperations: [OCEANPAYMENT_OPERATION],
+    // Not surveyed: Oceanpayment tells the merchant's server the result (its noticeUrl), and reading a payment back takes the
+    // merchant's own secure code, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isOceanpaymentSendPayUrl,
+    bodyGate: (url, body) => url !== void 0 && !isOceanpaymentSendPayUrl(url) ? Object.freeze({ verdict: "refuse", code: "oceanpayment_url_refused" }) : oceanpaymentBodyVerdict(body)
+    // No amount reader: the post names none, so the agent's pair is the figure the cardholder approves.
+});
+// src/processors/paymentwall.js
+var PAYMENTWALL_PSP = "paymentwall";
+var PAYMENTWALL_OPERATION = "paymentwall.card_request";
+var PAYMENTWALL_TOKEN_URL = "https://pwgateway.com/api/token";
+var PAYMENTWALL_SANDBOX_TOKEN_URL = "https://api.paymentwall.com/api/brick/token";
+var BODY_LIMIT5 = 2048;
+var KEY = "public_key";
+var PUBLIC_KEY = /^(?:t_)?[A-Za-z0-9]{16,64}$/;
+var SHAPES2 = /* @__PURE__ */ Object.freeze({
+    [KEY]: PUBLIC_KEY,
+    "card[number]": /^[0-9]{12,19}$/,
+    "card[exp_month]": /^(?:0?[1-9]|1[0-2])$/,
+    "card[exp_year]": /^(?:[0-9]{2}|20[0-9]{2})$/,
+    "card[cvv]": /^[0-9]{3,4}$/
+});
+var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn(digits2) {
+    let sum = 0;
+    for (let at = 0; at < digits2.length; at += 1) {
+        let digit = Number(digits2[digits2.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function paymentwallUrlEnvironment(url) {
+    if (url === PAYMENTWALL_TOKEN_URL)
+        return "production";
+    return url === PAYMENTWALL_SANDBOX_TOKEN_URL ? "sandbox" : null;
+}
+function isPaymentwallTokenUrl(url) {
+    return paymentwallUrlEnvironment(url) !== null;
+}
+function paymentwallKeyEnvironment(publicKey) {
+    if (typeof publicKey !== "string" || !PUBLIC_KEY.test(publicKey))
+        return null;
+    return publicKey.startsWith("t_") ? "sandbox" : "production";
+}
+function readPairs2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT5 || !/^[A-Za-z0-9_[\]=&]+$/.test(body))
+        return null;
+    const pairs = /* @__PURE__ */ new Map();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq <= 0 || chunk.indexOf("=", eq + 1) !== -1)
+            return null;
+        const key = chunk.slice(0, eq);
+        if (pairs.has(key))
+            return null;
+        pairs.set(key, chunk.slice(eq + 1));
+    }
+    return pairs;
+}
+function paymentwallBodyVerdict(body, url) {
+    if (url !== void 0 && !isPaymentwallTokenUrl(url))
+        return refuse4("paymentwall_url_refused");
+    const pairs = readPairs2(body);
+    if (pairs === null)
+        return refuse4("paymentwall_body_unsupported");
+    if (pairs.has("card[token]") && !pairs.has("card[number]"))
+        return refuse4("paymentwall_saved_card");
+    const keys = Object.keys(SHAPES2);
+    if (pairs.size !== keys.length || !keys.every((key) => pairs.has(key) && SHAPES2[key].test(pairs.get(key)))) {
+        return refuse4("paymentwall_body_unsupported");
+    }
+    if (!luhn(pairs.get("card[number]")))
+        return refuse4("paymentwall_body_unsupported");
+    if (url !== void 0 && paymentwallKeyEnvironment(pairs.get(KEY)) !== paymentwallUrlEnvironment(url))
+        return refuse4("paymentwall_key_refused");
+    return CARD4;
+}
+var paymentwall_default = /* @__PURE__ */ registerProcessor({
+    psp: PAYMENTWALL_PSP,
+    definitions: [
+        {
+            psp: "paymentwall",
+            // Brick's token request, as the header above reads it. A test key's request has its own host, so the device sends
+            // it only Paymentwall's documented test cards (hostEnvironmentPinned, device-replay.js S7). Ships dark: served only
+            // to a client that declares `paymentwall_card_token`, for a company the backend's gate turns it on for
+            // (checkout-processor-gate.ts), and the device sends a live card only under a key a reviewed pin names.
+            capability: "paymentwall_card_token",
+            match: "(?:pwgateway\\.com/api/token|api\\.paymentwall\\.com/api/brick/token)",
+            hosts: ["^pwgateway\\.com$", "^api\\.paymentwall\\.com$"],
+            sandboxHosts: ["^api\\.paymentwall\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "form",
+            // Brick's XHR sets the form Content-Type alone, and that always rides. Origin, Referer and cookies never do.
+            passthroughHeaders: [],
+            cardFields: ["card[number]"]
+        }
+    ],
+    // Only the cardholder's device sends a card request, after a person approves; no reviewed list names paymentwall.
+    refusedOperations: [PAYMENTWALL_OPERATION],
+    // Not surveyed: the token moves no money, and the charge that spends it happens out of this request.
+    settlementReadback: "not_surveyed",
+    exactUrl: isPaymentwallTokenUrl,
+    bodyGate: (url, body) => paymentwallBodyVerdict(body, url)
+});
+// src/processors/ekashu.js
+var EKASHU_HOSTS = Object.freeze(["live.ekashu.com", "test.ekashu.com"]);
+var EKASHU_TEST_PANS = Object.freeze(["4100000000000100", "5100000000000107"]);
+var EKASHU_SIGNED_FIELDS = Object.freeze([
+    "ekashu_3d_secure_verify",
+    "ekashu_amount",
+    "ekashu_amount_format",
+    "ekashu_auto_confirm",
+    "ekashu_callback_failure_url",
+    "ekashu_callback_include_post",
+    "ekashu_callback_success_url",
+    "ekashu_card_address_editable",
+    "ekashu_card_address_required",
+    "ekashu_card_address_verify",
+    "ekashu_card_email_address_mandatory",
+    "ekashu_card_phone_number_mandatory",
+    "ekashu_card_title_mandatory",
+    "ekashu_card_zip_code_verify",
+    "ekashu_currency",
+    "ekashu_delivery_address_editable",
+    "ekashu_delivery_address_required",
+    "ekashu_delivery_email_address_mandatory",
+    "ekashu_delivery_phone_number_mandatory",
+    "ekashu_delivery_title_mandatory",
+    "ekashu_description",
+    "ekashu_device",
+    "ekashu_duplicate_check",
+    "ekashu_duplicate_minutes",
+    "ekashu_failure_return_text",
+    "ekashu_failure_url",
+    "ekashu_hash_code_format",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_include_post",
+    "ekashu_invoice_address_editable",
+    "ekashu_invoice_address_required",
+    "ekashu_invoice_email_address_mandatory",
+    "ekashu_invoice_phone_number_mandatory",
+    "ekashu_invoice_title_mandatory",
+    "ekashu_locale",
+    "ekashu_payment_methods",
+    "ekashu_reference",
+    "ekashu_request_type",
+    "ekashu_return_text",
+    "ekashu_seller_address",
+    "ekashu_seller_email_address",
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_seller_name",
+    "ekashu_shortcut_icon",
+    "ekashu_style_sheet",
+    "ekashu_success_url",
+    "ekashu_title",
+    "ekashu_verification_value_mask",
+    "ekashu_verification_value_verify",
+    "ekashu_viewport"
+]);
+var REQUIRED = Object.freeze([
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_amount",
+    "ekashu_currency",
+    "ekashu_reference",
+    "ekashu_hash_code",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_success_url",
+    "ekashu_failure_url",
+    "ekashu_callback_success_url"
+]);
+var CARD_KEYS = Object.freeze([
+    "ekashu_card_number",
+    "ekashu_expires_end_month",
+    "ekashu_expires_end_year",
+    "ekashu_verification_value",
+    "ekashu_valid_from_month",
+    "ekashu_valid_from_year",
+    "ekashu_issue_number"
+]);
+var PAGE_KEYS = Object.freeze(["ekashu_stage", "ekashu_context", "ekashu_submission_id"]);
+var STORED_KEYS = Object.freeze(["ekashu_card_hash", "ekashu_card_reference", "ekashu_cof_initiated_by", "ekashu_cof_reason", "ekashu_cof_id"]);
+var REDIRECT_KEYS = Object.freeze(["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]);
+var CALLBACK_KEYS = Object.freeze(["ekashu_callback_success_url", "ekashu_callback_failure_url"]);
+var MAX_ENTRY = 16 * 1024;
+var MAX_PAGE = 256 * 1024;
+var EKASHU_SELLERS = Object.freeze([
+    Object.freeze({ sellerId: "25060100", merchant: "Heathrow Drop-off", entryHost: "heathrowdropoff.apcoa.com", callbackHost: "incomingapi.apcoa.co.uk" })
+]);
+var CARD_FIELDS = Object.freeze({
+    number: "ekashu_card_number",
+    month: "ekashu_expires_end_month",
+    year: "ekashu_expires_end_year",
+    cvc: "ekashu_verification_value"
+});
+var NAME_FIELDS = Object.freeze({ first: "ekashu_card_first_name", last: "ekashu_card_last_name" });
+var LEFT_EMPTY = Object.freeze(["ekashu_card_title", "ekashu_valid_from_month", "ekashu_valid_from_year", "ekashu_issue_number"]);
+var VISIBLE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS), ...Object.values(NAME_FIELDS), ...LEFT_EMPTY]);
+// src/processors/payplug.js
+var PAYPLUG_PSP = "payplug";
+var PAYPLUG_OPERATION = "payplug.hosted_sale";
+var PAYPLUG_HOST = "secure.payplug.com";
+var ENTRY_PATH = /^\/pay\/(?:(test)\/)?([A-Za-z0-9]{22})$/;
+var MAX_URL = 256;
+var field = (name, reason) => ({ ok: false, code: "hosted_form_field_refused", field: name, reason });
+function payplugEntry(raw) {
+    if (typeof raw !== "string" || raw.length > MAX_URL || raw.includes("?") || raw.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.href !== raw || url.protocol !== "https:" || url.hostname !== PAYPLUG_HOST || url.port || url.username || url.password)
+        return null;
+    const match = ENTRY_PATH.exec(url.pathname);
+    return match ? Object.freeze({ id: match[2], test: match[1] === "test" }) : null;
+}
+function isPayplugEntryUrl(raw) {
+    return payplugEntry(raw) !== null;
+}
+var PAYPLUG_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "Lazartigue", origins: Object.freeze(["https://lazartigue.com"]), payee: null, account: null })
+]);
+var ACCOUNT_ID = /^[A-Za-z0-9-]{1,64}$/;
+function payplugMerchant(checkoutOrigin, merchants = PAYPLUG_MERCHANTS) {
+    if (typeof checkoutOrigin !== "string" || checkoutOrigin.length > MAX_URL || !Array.isArray(merchants))
+        return null;
+    let url;
+    try {
+        url = new URL(checkoutOrigin);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.origin !== checkoutOrigin || url.port)
+        return null;
+    const found = merchants.filter((row) => !!row && typeof row.merchant === "string" && row.merchant.trim() !== "" && typeof row.payee === "string" && row.payee.trim() !== "" && typeof row.account === "string" && ACCOUNT_ID.test(row.account) && Array.isArray(row.origins) && row.origins.includes(checkoutOrigin));
+    return found.length === 1 ? found[0] : null;
+}
+function checkPayplugEntry(body, { url = null, checkoutOrigin = null, merchants = PAYPLUG_MERCHANTS } = {}) {
+    if (body !== void 0 && body !== null && body !== "")
+        return field("(body)", "not_an_entry");
+    const entry = payplugEntry(url);
+    if (!entry)
+        return field("(url)", "malformed_field");
+    const seller = payplugMerchant(checkoutOrigin, merchants);
+    if (!seller)
+        return field("(checkout_origin)", "seller_unreviewed");
+    return { ok: true, pairs: [], gated: false, dedupe: [entry.id], paymentId: entry.id, sandbox: entry.test, seller };
+}
+var MAX_PAGE2 = 512 * 1024;
+var PAYPLUG_REFUSALS = Object.freeze(["payplug_failed", "payplug_expired", "payplug_cancelled"]);
+var payplug_default = /* @__PURE__ */ registerProcessor({
+    psp: PAYPLUG_PSP,
+    definitions: [
+        {
+            psp: "payplug",
+            // The merchant's redirect to PayPlug's payment page, as the header above reads it: a Document navigation that
+            // carries no card. The cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug
+            // returns to it, and the runtime resolves the paused navigation with the hosted_form notice. Only the entry is
+            // matched (isPayplugEntryUrl): the page's card post and its 3-D Secure steps share the host, and none of them is
+            // the entry. Test and live payments share the host, and the entry's path says which it is. Ships dark: served
+            // only to a client that declares `payplug_hosted_payment_page`, and the backend's gate serves only Agentcard's
+            // own company until a reviewed merchant pays.
+            capability: "payplug_hosted_payment_page",
+            match: "secure\\.payplug\\.com/pay/(?:test/)?[A-Za-z0-9]{22}",
+            hosts: ["^secure\\.payplug\\.com$"],
+            // `encoding` describes the page's own card post, which the device makes as the page does, since the entry has no
+            // body. No captured header is ever replayed.
+            encoding: "form",
+            passthroughHeaders: [],
+            request: { method: "GET", cardIn: "none", response: "html_page" },
+            mode: "hosted_form",
+            hostedForm: {
+                // The card goes into PayPlug's page on the device, never into the entry, which carries no body at all. The
+                // entry's own rules come with this registration (hostedEntry below), so no policy is named here.
+                cardIn: "processor_page",
+                required: [],
+                // The page's card inputs, by the data-payplug role its script reads them by: they carry no name, and the
+                // script posts the card only as its ciphertext, encryptedCard.
+                card: { number: "card_number", expiry: "card_month_year", cvc: "card_cvv" },
+                // The payment's id in the entry's URL names the one payment the merchant created; the entry's rules read it
+                // there (checkPayplugEntry's dedupe), since no form field holds it.
+                dedupe: ["(paymentId)"]
+            }
+        }
+    ],
+    // Only the cardholder's device repeats an entry, after a person approves; no reviewed list names payplug.
+    refusedOperations: [PAYPLUG_OPERATION],
+    // Not surveyed: PayPlug tells only the merchant's server the result, and the browser returns whatever it was.
+    settlementReadback: "not_surveyed",
+    exactUrl: isPayplugEntryUrl,
+    hostedEntry: checkPayplugEntry,
+    limitations: [
+        "The paused request is the merchant's redirect to PayPlug's payment page, a GET that carries only the payment's id and no card; the cardholder's device opens that page over the end-to-end TLS relay.",
+        "The redirect names no merchant and no amount, so Agentcard takes one only from the checkout page of a merchant it reviewed, the approval names that merchant and the amount you send, and the cardholder's device pays only a PayPlug page that names that merchant and that amount.",
+        "PayPlug runs 3-D Secure on the card. A challenge ends the payment on the device with nothing charged.",
+        "PayPlug sends the buyer to the merchant's return page whether the payment succeeded or not, so the browser receives a submission notice, not the processor result."
+    ]
+});
+// src/processors/processout.js
+var PROCESSOUT_PSP = "processout";
+var PROCESSOUT_OPERATION = "processout.card_request";
+var URL_LIMIT2 = 512;
+var BODY_LIMIT6 = 4096;
+var CARD_URL = /^https:\/\/api\.processout\.com\/cards\?legacyrequest=true&project_id=((?:test-)?proj_[A-Za-z0-9]{16,64})&x-Content-Type=application\/json&x-API-Version=1\.3\.0\.0&x-Authorization=Basic%20([A-Za-z0-9+/]{4,256}={0,2})$/;
+var PAGE_KEYS2 = /* @__PURE__ */ Object.freeze(["name", "contact", "preferred_scheme"]);
+var CONTACT_KEYS = /* @__PURE__ */ Object.freeze(["address1", "address2", "city", "state", "country_code", "zip"]);
+var DEVICE_KEYS = /* @__PURE__ */ Object.freeze([
+    "request_origin",
+    "app_color_depth",
+    "app_language",
+    "app_screen_height",
+    "app_screen_width",
+    "app_timezone_offset",
+    "app_java_enabled"
+]);
+var PROCESSOUT_CARD_KEYS = /* @__PURE__ */ Object.freeze(["number", "exp_month", "exp_year", "cvc2"]);
+var BODY_KEYS = /* @__PURE__ */ new Set([...PAGE_KEYS2, "device", ...DEVICE_KEYS, ...PROCESSOUT_CARD_KEYS]);
+var NUMBER = /^[0-9]{12,19}$/;
+var MONTH3 = /^(?:[1-9]|1[0-2])$/;
+var YEAR3 = /^20[0-9]{2}$/;
+var CODE = /^[0-9]{3,4}$/;
+var TEXT_LIMIT = 256;
+var SCHEME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
+var LANGUAGE2 = /^[A-Za-z]{1,8}(?:-[A-Za-z0-9]{1,8}){0,4}$/;
+var PAN_LIKE = /(?:[0-9][^0-9A-Za-z]*){12,}/;
+var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own5 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse5 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD5 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Of(text2) {
+    let out = "";
+    for (let at = 0; at < text2.length; at += 3) {
+        const a = text2.charCodeAt(at);
+        const b = at + 1 < text2.length ? text2.charCodeAt(at + 1) : NaN;
+        const c = at + 2 < text2.length ? text2.charCodeAt(at + 2) : NaN;
+        out += BASE64[a >> 2] + BASE64[(a & 3) << 4 | (Number.isNaN(b) ? 0 : b >> 4)] + (Number.isNaN(b) ? "=" : BASE64[(b & 15) << 2 | (Number.isNaN(c) ? 0 : c >> 6)]) + (Number.isNaN(c) ? "=" : BASE64[c & 63]);
+    }
+    return out;
+}
+var basicOf = (projectId) => base64Of(`${projectId}:`);
+function luhn2(digits2) {
+    let sum = 0;
+    for (let at = 0; at < digits2.length; at += 1) {
+        let digit = Number(digits2[digits2.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function processoutCardTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT2)
+        return null;
+    const match = CARD_URL.exec(url);
+    if (!match || match[2] !== basicOf(match[1]))
+        return null;
+    return Object.freeze({ projectId: match[1], environment: match[1].startsWith("test-") ? "sandbox" : "production" });
+}
+function isProcessoutCardUrl(url) {
+    return processoutCardTarget(url) !== null;
+}
+function readBody4(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT6)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record4(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var pageText = (value) => value === null || typeof value === "string" && value.length <= TEXT_LIMIT && !PAN_LIKE.test(value);
+var DEVICE_RULES = /* @__PURE__ */ Object.freeze({
+    request_origin: (value) => value === "web",
+    app_color_depth: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 64,
+    app_language: (value) => typeof value === "string" && value.length <= 64 && LANGUAGE2.test(value),
+    app_screen_height: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_screen_width: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_timezone_offset: (value) => Number.isSafeInteger(value) && value >= -1440 && value <= 1440,
+    app_java_enabled: (value) => typeof value === "boolean"
+});
+function soundDevice(value) {
+    const device = value.device;
+    if (!record4(device) || !own5(device, "request_origin") || !own5(device, "app_timezone_offset"))
+        return false;
+    return DEVICE_KEYS.every((key) => own5(device, key) ? DEVICE_RULES[key](device[key]) && own5(value, key) && value[key] === device[key] : !own5(value, key)) && Object.keys(device).every((key) => DEVICE_KEYS.includes(key));
+}
+function soundPageData(value) {
+    if (own5(value, "name") && !pageText(value.name))
+        return false;
+    if (own5(value, "preferred_scheme") && !(value.preferred_scheme === null || typeof value.preferred_scheme === "string" && SCHEME.test(value.preferred_scheme)))
+        return false;
+    const contact = value.contact;
+    return record4(contact) && Object.keys(contact).every((key) => CONTACT_KEYS.includes(key) && pageText(contact[key]));
+}
+function processoutBodyVerdict(body, url) {
+    if (url !== void 0 && processoutCardTarget(url) === null)
+        return refuse5("processout_url_refused");
+    const value = readBody4(body);
+    if (value === null || !Object.keys(value).every((key) => BODY_KEYS.has(key)))
+        return refuse5("processout_body_unsupported");
+    if (!PROCESSOUT_CARD_KEYS.every((key) => typeof value[key] === "string"))
+        return refuse5("processout_body_unsupported");
+    if (!NUMBER.test(value.number) || !luhn2(value.number) || !MONTH3.test(value.exp_month) || !YEAR3.test(value.exp_year) || !CODE.test(value.cvc2))
+        return refuse5("processout_body_unsupported");
+    if (!soundPageData(value) || !soundDevice(value))
+        return refuse5("processout_body_unsupported");
+    return CARD5;
+}
+var processout_default = /* @__PURE__ */ registerProcessor({
+    psp: PROCESSOUT_PSP,
+    definitions: [
+        {
+            psp: "processout",
+            // ProcessOut.js's card request, as the header above reads it. One host serves every project, live and sandbox
+            // alike, so no sandbox host is marked: the project id names the environment, and the device sends a sandbox
+            // project only ProcessOut's documented test cards (processoutDeviceRefusal). The page gives up 20 seconds after
+            // its tokenize message, so the lane is prepared only (preparationRequired). The match reads the host and the path,
+            // and ends where the path does, as Pin Payments' does: a card's own record under /cards/, where the code refresh
+            // goes, is never paused. The exact-URL rule below holds the query, the project id and its Basic credential among it.
+            // Ships dark: served only to a client that declares `processout_card_token`, and gated off for every org until
+            // the backend's gate names one.
+            capability: "processout_card_token",
+            match: "api\\.processout\\.com/cards(?![\\w/.%-])",
+            hosts: ["^api\\.processout\\.com$"],
+            preparationRequired: true,
+            encoding: "json",
+            // ProcessOut.js's own headers: the project's Basic credential and the API version. Origin, Referer and cookies
+            // never ride.
+            passthroughHeaders: ["^authorization$", "^api-version$"],
+            jsonCardFields: [["number"]]
+        }
+    ],
+    // Only the cardholder's device sends a card, after a person approves; no reviewed list names processout.
+    refusedOperations: [PROCESSOUT_OPERATION],
+    // Not surveyed: the card request mints a token and moves no money; the store's server charges it under its own
+    // secret key, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isProcessoutCardUrl,
+    bodyGate: (url, body) => processoutBodyVerdict(body, url)
+});
+// src/processors/usaepay.js
+var USAEPAY_PSP = "usaepay";
+var USAEPAY_OPERATION = "usaepay.card_request";
+var USAEPAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    "www.usaepay.com": "production",
+    "secure.usaepay.com": "production",
+    "sandbox.usaepay.com": "sandbox"
+});
+var USAEPAY_PAYMENT_KEYS_PATH = "/api/v2/pub/payment_keys";
+var BODY_LIMIT7 = 512;
+var URL_LIMIT3 = 256;
+var CARD_NUMBER4 = /^[0-9]{13,19}$/;
+var EXPIRATION = /^(?:0[1-9]|1[0-2])[0-9]{2}$/;
+var SECURITY_CODE4 = /^(?:[0-9]{3,4})?$/;
+var record5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own6 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse6 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function usaepayPaymentKeysUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT3 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
     }
-    if ("definitions" in parts) {
-        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
-            problems2.push(`${psp}: names no definition`);
-        else if (spec.definitions.some((definition) => definition?.psp !== psp))
-            problems2.push(`${psp}: a definition names another processor`);
-        for (const id of spec.refusedOperations ?? []) {
-            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
-                problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
-        }
+    catch {
+        return null;
     }
-    return problems2;
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own6(USAEPAY_HOSTS, parsed.hostname) || parsed.pathname !== USAEPAY_PAYMENT_KEYS_PATH)
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: USAEPAY_HOSTS[parsed.hostname] });
 }
-function registered(spec, parts) {
-    const problems2 = problemsOf(spec, parts);
-    if (problems2.length)
-        throw new Error(`payment-core registration refused: ${problems2.join("; ")}`);
-    return deepFreeze({ ...spec });
+var isUsaepayPaymentKeysUrl = (url) => usaepayPaymentKeysUrl(url) !== null;
+function luhn3(digits2) {
+    let sum = 0;
+    for (let at = digits2.length - 1, double = false; at >= 0; at -= 1, double = !double) {
+        let digit = digits2.charCodeAt(at) - 48;
+        if (double)
+            digit = digit * 2 > 9 ? digit * 2 - 9 : digit * 2;
+        sum += digit;
+    }
+    return sum % 10 === 0;
 }
-function registerProcessor(spec) {
-    return registered(spec, PARTS);
+function readBody5(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT7)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record5(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
 }
-// src/processors/midtrans.js
-var MIDTRANS_PSP = "midtrans";
-var MIDTRANS_OPERATION = "midtrans.card_request";
-var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
-var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
-var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
-var BODY_LIMIT = 4096;
-var CARD_NUMBER = /^[0-9]{12,19}$/;
-var SECURITY_CODE = /^[0-9]{3,4}$/;
-var MONTH = /^(?:0[1-9]|1[0-2])$/;
-var YEAR = /^20[0-9]{2}$/;
-var TERM = /^[0-9]{1,3}$/;
-var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var inOrder = (value, keys) => {
+function usaepayBodyVerdict(body) {
+    const value = readBody5(body);
+    const card = value === null ? null : value.creditcard;
+    if (value === null || Object.keys(value).join() !== "creditcard" || !record5(card) || Object.keys(card).join() !== "number,expiration,cvc" || typeof card.number !== "string" || !CARD_NUMBER4.test(card.number) || !luhn3(card.number) || typeof card.expiration !== "string" || !EXPIRATION.test(card.expiration) || typeof card.cvc !== "string" || !SECURITY_CODE4.test(card.cvc))
+        return refuse6("usaepay_body_unsupported");
+    return CARD6;
+}
+var usaepay_default = /* @__PURE__ */ registerProcessor({
+    psp: USAEPAY_PSP,
+    definitions: [
+        {
+            psp: "usaepay",
+            // The frame's card request, as the header above reads it. sandbox.usaepay.com is USAePay's sandbox, pinned to test
+            // rows, which send only USAePay's documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `usaepay_payment_key`, and only for a company the backend's
+            // processor gate turns USAePay on for. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+            capability: "usaepay_payment_key",
+            match: "(?:www|secure|sandbox)\\.usaepay\\.com/api/v2/pub/payment_keys(?![\\w/.%-])",
+            hosts: ["^www\\.usaepay\\.com$", "^secure\\.usaepay\\.com$", "^sandbox\\.usaepay\\.com$"],
+            sandboxHosts: ["^sandbox\\.usaepay\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The frame's Authorization, which carries the merchant's public key. Origin, Referer and cookies never ride.
+            passthroughHeaders: ["^authorization$"],
+            jsonCardFields: [["creditcard", "number"]]
+        }
+    ],
+    // Only the cardholder's device sends this card, after a person approves; no reviewed list names usaepay.
+    refusedOperations: [USAEPAY_OPERATION],
+    // The public key mints a payment key and reads nothing: the merchant's server runs the sale with its private key.
+    settlementReadback: {
+        answer: "none",
+        reason: "tokenization_credential_cannot_read_charges",
+        note: "The tokenization credential cannot read a charge; the shop charges the token later with its own credentials.",
+        source: "https://help.usaepay.info/developer/payjs-v2/ , https://help.usaepay.info/api/rest/"
+    },
+    exactUrl: isUsaepayPaymentKeysUrl,
+    bodyGate: (url, body) => url !== void 0 && !isUsaepayPaymentKeysUrl(url) ? refuse6("usaepay_url_refused") : usaepayBodyVerdict(body)
+    // No amount reader: the request names none, so the agent's pair is the figure the cardholder approves.
+});
+// src/processors/vtex_payments.js
+var VTEX_PAYMENTS_PSP = "vtex_payments";
+var VTEX_PAYMENTS_OPERATION = "vtex_payments.card_request";
+var VTEX_PAYMENTS_FALLBACK_HOST = "api.vtexvault.com";
+var VTEX_PAYMENTS_LINE_KEYS = /* @__PURE__ */ Object.freeze([
+    "currencyCode",
+    "paymentSystem",
+    "accountId",
+    "value",
+    "referenceValue",
+    "installments",
+    "installmentsInterestRate",
+    "installmentsValue",
+    "groupName",
+    "fields",
+    "transaction",
+    "id"
+]);
+var VTEX_PAYMENTS_FIELD_KEYS = /* @__PURE__ */ Object.freeze([
+    "address",
+    "accountId",
+    "validationCode",
+    "metadata",
+    "document",
+    "holderName",
+    "cardNumber",
+    "dueDate",
+    "deviceFingerprint",
+    "addressId"
+]);
+var VTEX_PAYMENTS_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
+    "street",
+    "complement",
+    "number",
+    "city",
+    "reference",
+    "addressType",
+    "neighborhood",
+    "addressId",
+    "state",
+    "country",
+    "postalCode"
+]);
+var VTEX_PAYMENTS_NETWORKS = /* @__PURE__ */ Object.freeze({ 1: "amex", 2: "visa", 4: "mastercard", 5: "discover" });
+var VTEX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ account: "alssports", origin: "https://www.als.com", merchant: "Al's Sporting Goods", currency: "USD" }),
+    Object.freeze({ account: "roadrunnersports", origin: "https://www.roadrunnersports.com", merchant: "Road Runner Sports", currency: "USD" })
+]);
+var BODY_LIMIT8 = 16384;
+var ACCOUNT_HOST = /^([a-z0-9]{1,63})\.vtexvault\.com$/;
+var PATH = /^\/api\/payments\/transactions\/([0-9A-Fa-f]{32})\/payments$/;
+var ORDER_GROUP = /^[0-9]{6,24}$/;
+var BASE642 = /^[A-Za-z0-9+/]{4,1020}={0,2}$/;
+var CARD_NUMBER5 = /^[0-9]{12,19}$/;
+var SECURITY_CODE5 = /^[0-9]{3,4}$/;
+var DUE_DATE = /^(?:0[1-9]|1[0-2])\/[0-9]{2}$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var TRANSACTION_ID = /^[0-9A-Fa-f]{32}$/;
+var MERCHANT_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var SHORT_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var FINGERPRINT = /^[A-Za-z0-9_.:=+/-]{1,256}$/;
+var TEXT = /^[^\u0000-\u001f\u007f]{1,200}$/;
+var CARD_DIGITS = /[0-9]{12,}/;
+var DEVICE_INFO_KEYS = Object.freeze(["sw", "sh", "cd", "tz", "lang", "java", "sourceApplication"]);
+var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own7 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD7 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var inOrder3 = (value, keys) => {
     let at = 0;
     for (const name of Object.keys(value)) {
         while (at < keys.length && keys[at] !== name)
@@ -77,18 +1182,108 @@ var inOrder = (value, keys) => {
     }
     return true;
 };
-var refuse = (code) => Object.freeze({ verdict: "refuse", code });
-var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
-function isMidtransTokenUrl(url) {
-    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+var cardDigits = (text2) => CARD_DIGITS.test(text2.replace(/[^0-9A-Za-z]/g, ""));
+var plainText = (value) => typeof value === "string" && TEXT.test(value) && !cardDigits(value);
+var count = (value) => Number.isSafeInteger(value) && value >= 0;
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Text(input) {
+    if (input.length % 4 !== 0)
+        return null;
+    const stripped = input.replace(/={1,2}$/, "");
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const character of stripped) {
+        const sextet = BASE64_ALPHABET.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits & 255);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
 }
-function readBody(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+function deviceInfoSound(text2) {
+    if (typeof text2 !== "string" || !BASE642.test(text2))
+        return false;
+    const decoded = base64Text(text2);
+    if (decoded === null)
+        return false;
+    let info;
+    try {
+        info = JSON.parse(decoded);
+    }
+    catch {
+        return false;
+    }
+    if (!record6(info) || !Object.keys(info).every((key) => DEVICE_INFO_KEYS.includes(key)))
+        return false;
+    for (const key of ["sw", "sh", "cd"])
+        if (own7(info, key) && !(count(info[key]) && info[key] <= 1e5))
+            return false;
+    if (own7(info, "tz") && !(Number.isSafeInteger(info.tz) && Math.abs(info.tz) <= 1440))
+        return false;
+    if (own7(info, "lang") && !(typeof info.lang === "string" && /^[A-Za-z]{0,8}$/.test(info.lang)))
+        return false;
+    if (own7(info, "java") && typeof info.java !== "boolean")
+        return false;
+    return !own7(info, "sourceApplication") || typeof info.sourceApplication === "string" && /^[A-Za-z0-9_.-]{1,32}$/.test(info.sourceApplication);
+}
+function vtexPaymentsCardTarget(url) {
+    if (typeof url !== "string" || url.length > 8192)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hash)
+        return null;
+    const path = PATH.exec(parsed.pathname);
+    const host = ACCOUNT_HOST.exec(parsed.hostname);
+    if (!path || !host)
+        return null;
+    const fallback = parsed.hostname === VTEX_PAYMENTS_FALLBACK_HOST;
+    const names = [...parsed.searchParams.keys()];
+    const expected = ["orderId", "deviceInfo", ...parsed.searchParams.has("callbackUrl") ? ["callbackUrl"] : [], ...fallback ? ["an"] : []];
+    if (names.length !== expected.length || names.some((name, i) => name !== expected[i]))
+        return null;
+    const orderId = parsed.searchParams.get("orderId");
+    if (!ORDER_GROUP.test(orderId) || !deviceInfoSound(parsed.searchParams.get("deviceInfo")))
+        return null;
+    if (parsed.searchParams.has("callbackUrl")) {
+        let callback;
+        try {
+            callback = new URL(parsed.searchParams.get("callbackUrl"));
+        }
+        catch {
+            return null;
+        }
+        if (callback.protocol !== "https:" || callback.username || callback.password || callback.searchParams.get("step") !== "payment" || callback.searchParams.get("og") !== orderId)
+            return null;
+    }
+    const account = fallback ? parsed.searchParams.get("an") : host[1];
+    if (!/^[a-z0-9]{1,63}$/.test(account) || account === "api")
+        return null;
+    return Object.freeze({ account, transactionId: path[1], orderId, fallback });
+}
+function isVtexPaymentsCardUrl(url) {
+    const target = vtexPaymentsCardTarget(url);
+    return target !== null && !target.fallback;
+}
+function readBody6(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT8)
         return null;
     let value;
     try {
         value = JSON.parse(body);
-        if (!record(value) || JSON.stringify(value) !== body)
+        if (!Array.isArray(value) || JSON.stringify(value) !== body)
             return null;
     }
     catch {
@@ -96,54 +1291,136 @@ function readBody(body) {
     }
     return value;
 }
-function midtransBodyVerdict(body) {
-    const value = readBody(body);
-    if (value === null || !inOrder(value, MIDTRANS_TOKEN_KEYS)) {
-        if (record(value) && (own(value, "token_id") || own(value, "two_click")) && !own(value, "card_number"))
-            return refuse("midtrans_saved_card");
-        return refuse("midtrans_body_unsupported");
-    }
-    if (!own(value, "card_cvv") || !own(value, "card_number") || !own(value, "card_exp_month") || !own(value, "card_exp_year")) {
-        return refuse("midtrans_body_unsupported");
+function cardLine(line) {
+    if (!record6(line))
+        return false;
+    const fields = record6(line.fields) ? line.fields : {};
+    return line.groupName === "creditCardPaymentGroup" || line.groupName === "debitCardPaymentGroup" || own7(line, "accountId") || own7(fields, "accountId") || own7(fields, "cardNumber") || own7(fields, "validationCode") || own7(fields, "dueDate");
+}
+function addressSound(address) {
+    if (!record6(address) || !inOrder3(address, VTEX_PAYMENTS_ADDRESS_KEYS))
+        return false;
+    for (const [key, value] of Object.entries(address)) {
+        if (key === "addressType") {
+            if (value !== "billing")
+                return false;
+            continue;
+        }
+        if (key === "addressId") {
+            if (!(typeof value === "string" && SHORT_ID.test(value)))
+                return false;
+            continue;
+        }
+        if (value === null && (key === "complement" || key === "reference"))
+            continue;
+        if (!(value === "" || plainText(value)))
+            return false;
     }
-    if (typeof value.card_cvv !== "string" || !SECURITY_CODE.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR.test(value.card_exp_year))
-        return refuse("midtrans_body_unsupported");
-    if (own(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
-        return refuse("midtrans_body_unsupported");
-    return CARD;
+    return true;
 }
-var midtrans_default = /* @__PURE__ */ registerProcessor({
-    psp: MIDTRANS_PSP,
+function fieldsSound(fields) {
+    if (!record6(fields) || !inOrder3(fields, VTEX_PAYMENTS_FIELD_KEYS) || own7(fields, "metadata"))
+        return false;
+    if (!(typeof fields.cardNumber === "string" && CARD_NUMBER5.test(fields.cardNumber)))
+        return false;
+    if (!(typeof fields.validationCode === "string" && SECURITY_CODE5.test(fields.validationCode)))
+        return false;
+    if (!(typeof fields.dueDate === "string" && DUE_DATE.test(fields.dueDate)))
+        return false;
+    if (!plainText(fields.holderName))
+        return false;
+    if (own7(fields, "document") && !(fields.document === "" || plainText(fields.document) && fields.document.length <= 32))
+        return false;
+    if (own7(fields, "address") && !addressSound(fields.address))
+        return false;
+    if (own7(fields, "deviceFingerprint") && !(typeof fields.deviceFingerprint === "string" && FINGERPRINT.test(fields.deviceFingerprint)))
+        return false;
+    return !own7(fields, "addressId") || typeof fields.addressId === "string" && SHORT_ID.test(fields.addressId);
+}
+function vtexPaymentsBodyVerdict(body, target) {
+    const lines = readBody6(body);
+    if (lines === null || lines.length === 0 || !lines.every(record6))
+        return refuse7("vtex_payments_body_unsupported");
+    const cards = lines.filter(cardLine);
+    if (cards.some((line2) => own7(line2, "accountId") || own7(line2.fields ?? {}, "accountId")))
+        return refuse7("vtex_payments_saved_card");
+    if (cards.length === 0)
+        return refuse7("vtex_payments_body_unsupported");
+    if (lines.length !== 1 || own7(lines[0], "id"))
+        return refuse7("vtex_payments_split_payment");
+    const line = lines[0];
+    if (!inOrder3(line, VTEX_PAYMENTS_LINE_KEYS) || line.groupName !== "creditCardPaymentGroup")
+        return refuse7("vtex_payments_body_unsupported");
+    if (!(typeof line.currencyCode === "string" && CURRENCY.test(line.currencyCode)) || !own7(VTEX_PAYMENTS_NETWORKS, line.paymentSystem) || !Number.isSafeInteger(line.paymentSystem) || !(count(line.value) && line.value > 0))
+        return refuse7("vtex_payments_body_unsupported");
+    if (line.installments !== 1 || line.referenceValue !== line.value || own7(line, "installmentsInterestRate") && line.installmentsInterestRate !== 0 || own7(line, "installmentsValue") && line.installmentsValue !== line.value)
+        return refuse7("vtex_payments_installments");
+    const transaction = line.transaction;
+    if (!record6(transaction) || Object.keys(transaction).join() !== "id,merchantName" || !(typeof transaction.id === "string" && TRANSACTION_ID.test(transaction.id)) || !(typeof transaction.merchantName === "string" && MERCHANT_NAME.test(transaction.merchantName)))
+        return refuse7("vtex_payments_body_unsupported");
+    if (target && transaction.id.toUpperCase() !== target.transactionId.toUpperCase())
+        return refuse7("vtex_payments_split_payment");
+    return fieldsSound(line.fields) ? CARD7 : refuse7("vtex_payments_body_unsupported");
+}
+function vtexPaymentsAmount(body) {
+    if (vtexPaymentsBodyVerdict(body).verdict !== "card")
+        return null;
+    const [line] = JSON.parse(body);
+    return { amountCents: line.value, currency: line.currencyCode.toLowerCase() };
+}
+var NETWORK_OF = Object.freeze({
+    visa: (number) => /^4[0-9]{12}(?:[0-9]{3}){0,2}$/.test(number),
+    mastercard: (number) => /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/.test(number),
+    amex: (number) => /^3[47][0-9]{13}$/.test(number),
+    discover: (number) => /^(?:6011[0-9]{12}|64[4-9][0-9]{13}|65[0-9]{14})$/.test(number)
+});
+var NETWORK_NAME = Object.freeze({ visa: "Visa", mastercard: "Mastercard", amex: "American Express", discover: "Discover" });
+var vtex_payments_default = /* @__PURE__ */ registerProcessor({
+    psp: VTEX_PAYMENTS_PSP,
     definitions: [
         {
-            psp: "midtrans",
-            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
-            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
-            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
-            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
-            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
-            capability: "midtrans_card_token",
-            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
-            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
-            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
-            hostEnvironmentPinned: true,
+            psp: "vtex_payments",
+            // Ollie's card post to a VTEX account's own vault, as the header above reads it, and the fallback host, which
+            // the gate recognizes only to refuse, so the agent's placeholder never reaches it either. VTEX has no test host:
+            // every request is live. Prepared only: Ollie gives the post 12 seconds. Ships dark: served only to a client that
+            // declares `vtex_payments_card_payment`, on for Agentcard's own company alone (backend
+            // checkout-processor-gate.ts), and autopilot never sends it.
+            capability: "vtex_payments_card_payment",
+            match: "[a-z0-9-]{1,63}\\.vtexvault\\.com/api/payments/transactions/[A-Za-z0-9-]{1,64}/payments(?![\\w/.%-])",
+            hosts: ["^[a-z0-9-]{1,63}\\.vtexvault\\.com$"],
+            preparationRequired: true,
             encoding: "json",
-            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
-            // cookies never ride.
-            passthroughHeaders: ["^authorization$", "^x-service$"],
-            jsonCardFields: [["card_number"]]
+            // Ollie's fetch sets the JSON content type alone. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            jsonCardFields: [[0, "fields", "cardNumber"]]
         }
     ],
-    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
-    refusedOperations: [MIDTRANS_OPERATION],
-    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    // Only the cardholder's device sends it, after a person approves; no reviewed list names vtex_payments.
+    refusedOperations: [VTEX_PAYMENTS_OPERATION],
+    // Not surveyed: VTEX names a payment's end only to the store's own API keys and at the gatewayCallback that follows.
     settlementReadback: "not_surveyed",
-    exactUrl: isMidtransTokenUrl,
-    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+    exactUrl: isVtexPaymentsCardUrl,
+    bodyGate: (url, body) => {
+        if (url === void 0)
+            return vtexPaymentsBodyVerdict(body);
+        const target = vtexPaymentsCardTarget(url);
+        if (target === null)
+            return refuse7("vtex_payments_url_refused");
+        return target.fallback ? refuse7("vtex_payments_fallback_refused") : vtexPaymentsBodyVerdict(body, target);
+    },
+    amount: (template) => record6(template) && isVtexPaymentsCardUrl(template.url) ? vtexPaymentsAmount(template.body) : null
 });
 // src/processors/index.generated.js
 var REGISTERED_MODULES = Object.freeze({
-    midtrans: midtrans_default
+    bluesnap: bluesnap_default,
+    iyzico: iyzico_default,
+    midtrans: midtrans_default,
+    oceanpayment: oceanpayment_default,
+    paymentwall: paymentwall_default,
+    payplug: payplug_default,
+    processout: processout_default,
+    usaepay: usaepay_default,
+    vtex_payments: vtex_payments_default
 });
 // src/registry.js
 var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
@@ -964,15 +2241,6 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         jsonCardFields: [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]],
         passWithoutCard: "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do"
     },
-    // bluesnap: DELIBERATELY NOT SHIPPED — it cannot be intercepted at all. Its tokenizer is a PUT, and isCardRequest
-    // gates on POST — but accepting PUT is not enough on its own. hpf.js fires the
-    // same token PUT SEVERAL TIMES per checkout (blur and submit each send a delta
-    // body), so intercepting it would raise one approval prompt per fire and hand the
-    // device partial card data. An entry that cannot actually be intercepted does not
-    // belong in an allowlist that advertises interception: it reads as support we do
-    // not have, and on the CDP path it arms Fetch.enable, gets refused by the POST
-    // gate, and is then continued straight to the PSP while the integrator believes
-    // the card was protected. Ship it when the multi-fire semantics are handled.
     {
         psp: "airwallex",
         // PAN@ payment_method.card.number (payment_intents/confirm,
@@ -3173,7 +4441,7 @@ var PADDLE_VGS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin2({ id: "rectangle_pro", merchant: "Rectangle Pro", origins: ["https://rectangleapp.com"], sellerClaim: null })
 ]);
 var FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
-var METADATA_KEYS = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
+var METADATA_KEYS2 = /* @__PURE__ */ Object.freeze(["cardholder_name", ...FACT_KEYS]);
 // src/payfast.js
 var PAYFAST_PAY_HOSTS = /* @__PURE__ */ Object.freeze({
     production: Object.freeze(["payment.payfast.io", "www.payfast.co.za"]),
@@ -3208,7 +4476,7 @@ var PADDLE_TOKENEX_KEYS = /* @__PURE__ */ Object.freeze({
 });
 // src/paddle-tokenex.js
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
-var METADATA_KEYS2 = /* @__PURE__ */ Object.freeze(["cardholder_name", ...PADDLE_TOKENEX_FACT_KEYS]);
+var METADATA_KEYS3 = /* @__PURE__ */ Object.freeze(["cardholder_name", ...PADDLE_TOKENEX_FACT_KEYS]);
 var CARD_PATH = /* @__PURE__ */ Object.freeze(["data", "payment_method_data", "card"]);
 var TOKENEX_PATH = /* @__PURE__ */ Object.freeze([...CARD_PATH, "tokenex_card"]);
 // src/lyra.js
@@ -3297,7 +4565,7 @@ var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
 ]);
 // src/amazon-payment-services.js
-var BODY_LIMIT2 = 32 * 1024;
+var BODY_LIMIT9 = 32 * 1024;
 var ANSWER_LIMIT = 64 * 1024;
 // src/clover.js
 var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encrypted_pan", "exp_month", "exp_year", "cvv", "first6", "last4", "brand"]);
@@ -3308,8 +4576,8 @@ var LETTERS = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
 var PAGE_NAME = new RegExp(`^[${LETTERS} .'-]{1,64}$`);
 var HAS_LETTER = new RegExp(`[${LETTERS}]`);
 var ADDRESS_VALUE = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
-var PAN_LIKE = new RegExp(`(?:[0-9][^0-9${LETTERS}]*){12,}`);
-var HOLDER = new RegExp(`^[${LETTERS}](?:[${LETTERS} .'-]{0,62}[${LETTERS}.])?$`);
+var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS}]*){12,}`);
+var HOLDER2 = new RegExp(`^[${LETTERS}](?:[${LETTERS} .'-]{0,62}[${LETTERS}.])?$`);
 var ERROR_TYPE_STATUS = /* @__PURE__ */ Object.freeze({
     malformed_request_error: 400,
     authentication_error: 401,
@@ -3354,7 +4622,7 @@ var TOKENEX_IFRAME_ACCOUNT_NAMES = Object.freeze({
     "htp.tokenex.com": Object.freeze({ "9014311640612780": "JetBlue" }),
     "test-htp.tokenex.com": Object.freeze({})
 });
-var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var exact2 = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
 var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
 var panLike = (value) => (value.match(/\p{Nd}/gu) ?? []).length >= 12;
@@ -3373,10 +4641,10 @@ function isOrigin(value) {
     }
 }
 var BOUND = {
-    TokenExID: (value) => exact(TOKENEX_ID, value),
+    TokenExID: (value) => exact2(TOKENEX_ID, value),
     Origin: isOrigin,
-    AuthenticationKey: (value) => exact(AUTHENTICATION_KEY, value),
-    Timestamp: (value) => exact(TIMESTAMP, value),
+    AuthenticationKey: (value) => exact2(AUTHENTICATION_KEY, value),
+    Timestamp: (value) => exact2(TIMESTAMP, value),
     TokenScheme: (value) => TOKENEX_IFRAME_TOKEN_SCHEMES.includes(value)
 };
 var BOUND_KEYS = Object.keys(BOUND);
@@ -3384,19 +4652,19 @@ var BOOLEAN = /^(?:true|false)$/i;
 var QUERY_RULES = {
     ...BOUND,
     Mode: (value) => value === "Data",
-    PCI: (value) => exact(/^true$/i, value),
-    CVV: (value) => exact(/^true$/i, value),
-    Container: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
-    CvvContainer: (value) => exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
-    EnforceLuhnCompliance: (value) => exact(BOOLEAN, value),
+    PCI: (value) => exact2(/^true$/i, value),
+    CVV: (value) => exact2(/^true$/i, value),
+    Container: (value) => exact2(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    CvvContainer: (value) => exact2(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, value),
+    EnforceLuhnCompliance: (value) => exact2(BOOLEAN, value),
     CustomDataLabel: (value) => plain(value, 64),
     CustomCvvDataLabel: (value) => plain(value, 64),
-    ExpiresInSeconds: (value) => exact(/^[1-9][0-9]{0,3}$/, value),
-    ReturnAutoCompleteValues: (value) => exact(BOOLEAN, value)
+    ExpiresInSeconds: (value) => exact2(/^[1-9][0-9]{0,3}$/, value),
+    ReturnAutoCompleteValues: (value) => exact2(BOOLEAN, value)
 };
 var QUERY_REQUIRED = [...BOUND_KEYS, "Mode", "PCI", "CVV"];
 var PLACEHOLDER = /^[0-9]{1,19}(?: [0-9]{1,19}){0,5}$/;
-var placeholderDigits = (value) => exact(PLACEHOLDER, value) && value.length <= 23 ? value.replace(/ /g, "") : null;
+var placeholderDigits = (value) => exact2(PLACEHOLDER, value) && value.length <= 23 ? value.replace(/ /g, "") : null;
 var RULES = {
     ...BOUND,
     Data: (value) => {
@@ -3423,8 +4691,8 @@ var SUCCESS_RULES = {
     token: (value) => digits(value, 13, 19),
     firstSix: (value) => digits(value, 6, 6),
     lastFour: (value) => digits(value, 4, 4),
-    referenceNumber: (value) => exact(/^[A-Za-z0-9-]{1,64}$/, value),
-    tokenHMAC: (value) => exact(/^[A-Za-z0-9+/]{1,128}={0,2}$/, value),
+    referenceNumber: (value) => exact2(/^[A-Za-z0-9-]{1,64}$/, value),
+    tokenHMAC: (value) => exact2(/^[A-Za-z0-9+/]{1,128}={0,2}$/, value),
     cvvIncluded: (value) => typeof value === "boolean"
 };
 var SUCCESS_KEYS = Object.keys(SUCCESS_RULES);
@@ -3433,7 +4701,7 @@ var LETTERS2 = "A-Za-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u017F";
 var PAGE_NAME2 = new RegExp(`^[${LETTERS2} .'-]{1,64}$`);
 var HAS_LETTER2 = new RegExp(`[${LETTERS2}]`);
 var ADDRESS_VALUE2 = new RegExp(`^[\\x20-\\x7e\\u00a0-\\u017f]{0,128}$`);
-var PAN_LIKE2 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
+var PAN_LIKE3 = new RegExp(`(?:[0-9][^0-9${LETTERS2}]*){12,}`);
 var pin7 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), publicKeys: Object.freeze([...fields.publicKeys]) });
 var OPENPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
     pin7({
@@ -3487,7 +4755,7 @@ var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
     Object.freeze({ environment: "production", store: "stardock", storefront: "/popup-store", merchant: "Stardock" })
 ]);
 var STORE = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
-var CARD_URL = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
+var CARD_URL2 = new RegExp(`^https://(${STORE})(\\.test)?\\.onfastspring\\.com((?:/(?:popup|embedded)-[A-Za-z0-9_-]{1,64})?)/session/([A-Za-z0-9_-]{16,64})/payment$`);
 // src/omise.js
 var pin9 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), keys: Object.freeze([...fields.keys]) });
 var OMISE_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
@@ -3649,7 +4917,7 @@ var RECORD_MEMBERS = /* @__PURE__ */ Object.freeze({
     ]
 });
 // src/pin-payments.js
-var CARD_KEYS = /* @__PURE__ */ Object.freeze(["name", "number", "cvc", "expiry_month", "expiry_year"]);
+var CARD_KEYS2 = /* @__PURE__ */ Object.freeze(["name", "number", "cvc", "expiry_month", "expiry_year"]);
 var ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
     "address_line1",
     "address_line2",
@@ -3658,9 +4926,9 @@ var ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
     "address_state",
     "address_country"
 ]);
-var KEY = "publishable_api_key";
+var KEY2 = "publishable_api_key";
 var METHOD = "_method";
-var DOCUMENTED = /* @__PURE__ */ new Set([KEY, METHOD, ...CARD_KEYS, ...ADDRESS_KEYS]);
+var DOCUMENTED = /* @__PURE__ */ new Set([KEY2, METHOD, ...CARD_KEYS2, ...ADDRESS_KEYS]);
 var TOKEN_FACTS = /* @__PURE__ */ Object.freeze([
     "token",
     "scheme",
@@ -3747,103 +5015,6 @@ var DECLINE_LABELS = Object.freeze(["label_error_payment", "label_error_bin", "l
 var EXPIRED_LABELS = Object.freeze(["session_timeout", "ppid_expired"]);
 var REF_KEYS = Object.freeze(["recloc", "orderId", "mopId", "pri", "approvalcode", "externalId", "paymentMerchantReference", "prr"]);
 var PAYMENT_INFORMATION_KEYS = Object.freeze(["approvalcode", "pri", "externalId", "mopId"]);
-// src/processors/ekashu.js
-var EKASHU_HOSTS = Object.freeze(["live.ekashu.com", "test.ekashu.com"]);
-var EKASHU_TEST_PANS = Object.freeze(["4100000000000100", "5100000000000107"]);
-var EKASHU_SIGNED_FIELDS = Object.freeze([
-    "ekashu_3d_secure_verify",
-    "ekashu_amount",
-    "ekashu_amount_format",
-    "ekashu_auto_confirm",
-    "ekashu_callback_failure_url",
-    "ekashu_callback_include_post",
-    "ekashu_callback_success_url",
-    "ekashu_card_address_editable",
-    "ekashu_card_address_required",
-    "ekashu_card_address_verify",
-    "ekashu_card_email_address_mandatory",
-    "ekashu_card_phone_number_mandatory",
-    "ekashu_card_title_mandatory",
-    "ekashu_card_zip_code_verify",
-    "ekashu_currency",
-    "ekashu_delivery_address_editable",
-    "ekashu_delivery_address_required",
-    "ekashu_delivery_email_address_mandatory",
-    "ekashu_delivery_phone_number_mandatory",
-    "ekashu_delivery_title_mandatory",
-    "ekashu_description",
-    "ekashu_device",
-    "ekashu_duplicate_check",
-    "ekashu_duplicate_minutes",
-    "ekashu_failure_return_text",
-    "ekashu_failure_url",
-    "ekashu_hash_code_format",
-    "ekashu_hash_code_type",
-    "ekashu_hash_code_version",
-    "ekashu_include_post",
-    "ekashu_invoice_address_editable",
-    "ekashu_invoice_address_required",
-    "ekashu_invoice_email_address_mandatory",
-    "ekashu_invoice_phone_number_mandatory",
-    "ekashu_invoice_title_mandatory",
-    "ekashu_locale",
-    "ekashu_payment_methods",
-    "ekashu_reference",
-    "ekashu_request_type",
-    "ekashu_return_text",
-    "ekashu_seller_address",
-    "ekashu_seller_email_address",
-    "ekashu_seller_id",
-    "ekashu_seller_key",
-    "ekashu_seller_name",
-    "ekashu_shortcut_icon",
-    "ekashu_style_sheet",
-    "ekashu_success_url",
-    "ekashu_title",
-    "ekashu_verification_value_mask",
-    "ekashu_verification_value_verify",
-    "ekashu_viewport"
-]);
-var REQUIRED = Object.freeze([
-    "ekashu_seller_id",
-    "ekashu_seller_key",
-    "ekashu_amount",
-    "ekashu_currency",
-    "ekashu_reference",
-    "ekashu_hash_code",
-    "ekashu_hash_code_type",
-    "ekashu_hash_code_version",
-    "ekashu_success_url",
-    "ekashu_failure_url",
-    "ekashu_callback_success_url"
-]);
-var CARD_KEYS2 = Object.freeze([
-    "ekashu_card_number",
-    "ekashu_expires_end_month",
-    "ekashu_expires_end_year",
-    "ekashu_verification_value",
-    "ekashu_valid_from_month",
-    "ekashu_valid_from_year",
-    "ekashu_issue_number"
-]);
-var PAGE_KEYS = Object.freeze(["ekashu_stage", "ekashu_context", "ekashu_submission_id"]);
-var STORED_KEYS = Object.freeze(["ekashu_card_hash", "ekashu_card_reference", "ekashu_cof_initiated_by", "ekashu_cof_reason", "ekashu_cof_id"]);
-var REDIRECT_KEYS = Object.freeze(["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]);
-var CALLBACK_KEYS = Object.freeze(["ekashu_callback_success_url", "ekashu_callback_failure_url"]);
-var MAX_ENTRY = 16 * 1024;
-var MAX_PAGE = 256 * 1024;
-var EKASHU_SELLERS = Object.freeze([
-    Object.freeze({ sellerId: "25060100", merchant: "Heathrow Drop-off", entryHost: "heathrowdropoff.apcoa.com", callbackHost: "incomingapi.apcoa.co.uk" })
-]);
-var CARD_FIELDS = Object.freeze({
-    number: "ekashu_card_number",
-    month: "ekashu_expires_end_month",
-    year: "ekashu_expires_end_year",
-    cvc: "ekashu_verification_value"
-});
-var NAME_FIELDS = Object.freeze({ first: "ekashu_card_first_name", last: "ekashu_card_last_name" });
-var LEFT_EMPTY = Object.freeze(["ekashu_card_title", "ekashu_valid_from_month", "ekashu_valid_from_year", "ekashu_issue_number"]);
-var VISIBLE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS), ...Object.values(NAME_FIELDS), ...LEFT_EMPTY]);
 // src/processors/redsys.js
 var REDSYS_HOSTS = Object.freeze(["sis.redsys.es"]);
 var REDSYS_ENTRY_PATHS = Object.freeze(["/sis/realizarPago", "/sis/realizarPago/utf-8"]);
@@ -3878,7 +5049,7 @@ var SPECIAL = Object.freeze([
 ]);
 var CARD_PARAMETERS = Object.freeze(["DS_MERCHANT_PAN", "DS_MERCHANT_EXPIRYDATE", "DS_MERCHANT_CVV2"]);
 var CURRENCIES = Object.freeze({ 978: "eur", 840: "usd", 826: "gbp", 756: "chf" });
-var MAX_PAGE2 = 256 * 1024;
+var MAX_PAGE3 = 256 * 1024;
 var CARD_FIELDS2 = Object.freeze({
     shown: "Sis_card-number",
     expiry: "SIS_card-expiration",
@@ -3947,7 +5118,7 @@ var SCALARS = /* @__PURE__ */ new Set([
     "shipping_address_selection"
 ]);
 var CURRENCIES2 = Object.freeze({ DKK: "dkk", EUR: "eur", USD: "usd", SEK: "sek", NOK: "nok", GBP: "gbp", CHF: "chf", PLN: "pln" });
-var MAX_PAGE3 = 256 * 1024;
+var MAX_PAGE4 = 256 * 1024;
 var CARD_FIELDS3 = Object.freeze({ number: "cardnumber", month: "expiration[month]", year: "expiration[year]", cvc: "cvd", holder: "cardholder" });
 var TYPED = /* @__PURE__ */ new Set([CARD_FIELDS3.number, CARD_FIELDS3.month, CARD_FIELDS3.year, CARD_FIELDS3.cvc]);
 var CARD_PAGE2 = /* @__PURE__ */ new Set(["session_id", ...TYPED]);
@@ -3982,7 +5153,7 @@ var PRZELEWY24_SANDBOX_HOSTS = Object.freeze(["sandbox.przelewy24.pl"]);
 var PRZELEWY24_MERCHANTS = Object.freeze([
     Object.freeze({ id: "kupbilet", merchant: "KupBilet.pl", merchantId: null, origins: Object.freeze(["https://www.kupbilet.pl"]) })
 ]);
-var MAX_PAGE4 = 256 * 1024;
+var MAX_PAGE5 = 256 * 1024;
 var CURRENCIES3 = Object.freeze(["PLN", "EUR", "GBP", "USD", "CZK", "CHF", "DKK", "NOK", "SEK", "RON", "BGN", "HUF"]);
 var PRZELEWY24_AJAX_HEADERS = Object.freeze({ Accept: "*/*", "X-Requested-With": "XMLHttpRequest" });
 var MONTHS = Object.freeze(["01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12"]);
@@ -4014,7 +5185,7 @@ var TRANSBANK_MERCHANTS = Object.freeze([
         returnUrl: null
     })
 ]);
-var MAX_PAGE5 = 64 * 1024;
+var MAX_PAGE6 = 64 * 1024;
 var JSON_HEADERS = Object.freeze({ "content-type": "application/json", accept: "application/json, text/plain, */*" });
 var FORM_HEADERS = Object.freeze({ "content-type": "application/x-www-form-urlencoded", accept: "application/json, text/plain, */*" });
 var TRANSBANK_REFUSALS = Object.freeze(["transbank_3ds_challenge", "transbank_aborted", "transbank_error"]);
@@ -4034,11 +5205,11 @@ var PAYTRAIL_MERCHANTS = Object.freeze([
 ]);
 var UUID_SOURCE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 var UUID2 = new RegExp(`^${UUID_SOURCE}$`);
-var ENTRY_PATH = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
+var ENTRY_PATH2 = new RegExp(`^/payments/(${UUID_SOURCE})/click-to-pay/loading-and-redirect$`);
 var SIGNATURES = Object.freeze({ sha256: /^[0-9a-f]{64}$/, sha512: /^[0-9a-f]{128}$/ });
 var PAYMENT_HIGHWAY_HOSTS = Object.freeze(["v1.api.paymenthighway.io"]);
 var CARD_PAGE_PATH = new RegExp(`^/form/(${UUID_SOURCE})/pay_with_click_to_pay$`);
-var MAX_PAGE6 = 256 * 1024;
+var MAX_PAGE7 = 256 * 1024;
 var PAYTRAIL_CARD_HEADERS = Object.freeze({ "Content-Type": "application/json", "X-Requested-With": "PH-Form", Accept: "application/json" });
 var PAYTRAIL_REFUSALS = Object.freeze(["paytrail_3ds_challenge", "paytrail_card_refused"]);
 // src/processors/eximbay.js
@@ -4047,7 +5218,7 @@ var EXIMBAY_MERCHANTS = Object.freeze([]);
 var MAX_ENTRY4 = 16 * 1024;
 var REQUIRED4 = Object.freeze(["ver", "mid", "txntype", "ref", "cur", "amt", "buyer", "email", "lang", "returnurl", "statusurl", "fgkey"]);
 var CURRENCIES4 = Object.freeze({ USD: 2, KRW: 0, JPY: 0, EUR: 2, GBP: 2, SGD: 2, HKD: 2, CAD: 2, AUD: 2, THB: 2 });
-var MAX_PAGE7 = 512 * 1024;
+var MAX_PAGE8 = 512 * 1024;
 var ATTRS = `(?:[^>"']|"[^"]{0,1024}"|'[^']{0,1024}'){0,512}`;
 var startTag = (name) => new RegExp(`<${name}(?=[\\t\\n\\f\\r />])${ATTRS}>`, "gi");
 var FORM_START = startTag("form");
@@ -4100,7 +5271,7 @@ var RESULT_BINDS = Object.freeze(["mid", "txntype", "ref", "cur", "amt"]);
 var BARION_HOSTS = Object.freeze(["secure.barion.com", "secure.test.barion.com"]);
 var BARION_SANDBOX_HOSTS = Object.freeze(["secure.test.barion.com"]);
 var BARION_SHOPS = Object.freeze([]);
-var MAX_PAGE8 = 512 * 1024;
+var MAX_PAGE9 = 512 * 1024;
 var CURRENCIES5 = Object.freeze(["HUF", "EUR", "USD", "CZK", "RON", "PLN"]);
 var CARD_INPUTS = Object.freeze({ number: "cc-number", expiry: "cc-exp-date", cvc: "CardCVC", holder: "CardHolderName" });
 var CHECKBOXES = Object.freeze(["RegisterUser", "AcceptedTerms", "HasEmailConsent"]);
@@ -4152,7 +5323,7 @@ var SBPS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
 ]);
 var ERROR_TYPES = /* @__PURE__ */ Object.freeze(["03", "04", "05", "07", "99"]);
 var ERROR_FIELDS = /* @__PURE__ */ Object.freeze(["001", "002", "003", "004", "005", "999"]);
-var SBPS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(ERROR_TYPES.flatMap((type) => ERROR_FIELDS.map((field) => `${type}${field}`)));
+var SBPS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(ERROR_TYPES.flatMap((type) => ERROR_FIELDS.map((field2) => `${type}${field2}`)));
 // src/recognition.js
 var PATTERN_WITHOUT_CARD_FIELDS = Object.freeze({
     stripe: "api\\.stripe\\.com/v1/(payment_methods|tokens|setup_intents/seti_\\w+/confirm|payment_intents/pi_\\w+/confirm)"
@@ -4235,7 +5406,7 @@ var replayPolicy = Object.freeze({ contentTypeFor, HEADER_NEVER_FORWARD });
 var STRIPE_CHECKOUT_OPERATION = "stripe.device_checkout_confirm.v1";
 var STRIPE_CHECKOUT_CONTEXT_HEADER = "x-agentcard-stripe-checkout-context";
 var SESSION = /^cs_(?:test|live)_[A-Za-z0-9]{1,200}(?![\s\S])/;
-var KEY2 = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
+var KEY3 = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
 var SYNTHETIC = /^pm_agentcard_checkout_[A-Za-z0-9_-]{16,80}(?![\s\S])/;
 var STRIPE_CHECKOUT_VALIDATION_CODES = Object.freeze({
     unclassified: "unclassified",
@@ -4278,7 +5449,7 @@ function validateStripeCheckoutIdentity(value) {
         reject("mode_binding");
     const environment = value.environment ?? "test", livemode = environment === "production";
     const mode = livemode ? "live" : "test";
-    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY2.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
+    if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY3.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
         reject("mode_binding");
     return Object.freeze({ environment, livemode });
 }
@@ -4314,16 +5485,16 @@ function isStripeCheckoutHostedMode(value) {
     return value === "hosted" || value === "hosted_page";
 }
 function encodeAscii(value) {
-    let result = "", bits = 0, count = 0;
+    let result = "", bits = 0, count2 = 0;
     for (const char of value) {
         bits = bits << 8 | char.charCodeAt(0);
-        count += 8;
-        while (count >= 6) {
-            count -= 6;
-            result += alphabet[bits >>> count & 63];
+        count2 += 8;
+        while (count2 >= 6) {
+            count2 -= 6;
+            result += alphabet[bits >>> count2 & 63];
         }
     }
-    return result + (count ? alphabet[bits << 6 - count & 63] : "");
+    return result + (count2 ? alphabet[bits << 6 - count2 & 63] : "");
 }
 function context(value) {
     if (!object(value) || Object.keys(value).length !== 3 || value.version !== 1 || !["version", "session_id", "synthetic_payment_method_id"].every((key) => Object.hasOwn(value, key)) || !SESSION.test(value.session_id) || !SYNTHETIC.test(value.synthetic_payment_method_id))
@@ -4343,13 +5514,13 @@ function parseStripeCheckoutContext(request) {
     if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
         reject("context_invalid");
     const encoded = entries[0][1];
-    let text2 = "", bits = 0, count = 0;
+    let text2 = "", bits = 0, count2 = 0;
     for (const char of encoded) {
         bits = bits << 6 | alphabet.indexOf(char);
-        count += 6;
-        if (count >= 8) {
-            count -= 8;
-            text2 += String.fromCharCode(bits >>> count & 255);
+        count2 += 6;
+        if (count2 >= 8) {
+            count2 -= 8;
+            text2 += String.fromCharCode(bits >>> count2 & 255);
         }
     }
     let value;
@@ -4482,7 +5653,7 @@ function keyFor(request, values, expected) {
         headerKey = match[1];
     }
     const key = values.get("key") || headerKey;
-    if (!KEY2.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
+    if (!KEY3.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
         reject("publishable_key");
     return key;
 }
@@ -4504,13 +5675,13 @@ function attachStripeCheckoutBilling(request, captured, options) {
     const phase = classifyStripeCheckoutRequest(request, options);
     if (phase?.phase !== "final" || !object(captured) || Object.keys(captured).length !== 3 || !["session_id", "synthetic_payment_method_id", "email"].every((key) => Object.hasOwn(captured, key)) || captured.session_id !== phase.session_id || captured.synthetic_payment_method_id !== phase.synthetic_payment_method_id || !billingEmail(captured.email))
         reject("billing_binding");
-    const field = "payment_method_data[billing_details][email]";
-    const existing = form(request, finalFields).values.get(field);
+    const field2 = "payment_method_data[billing_details][email]";
+    const existing = form(request, finalFields).values.get(field2);
     if (existing !== void 0 && existing !== captured.email)
         reject("billing_conflict");
     if (captured.email === null || existing !== void 0)
         return { ...request };
-    const body = `${request.body}&${encodeURIComponent(field)}=${encodeURIComponent(captured.email)}`;
+    const body = `${request.body}&${encodeURIComponent(field2)}=${encodeURIComponent(captured.email)}`;
     const result = { ...request, body };
     classifyStripeCheckoutRequest(result, options);
     return result;