@agent-cards/sdk 0.23.28 → 0.24.1

package/dist/primer.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: f3160b14c70e44a64e4799066f3afca92b1e372e427c60aaee5b8c2ae401fd6e
+// artifact-sha256: 6c0e945e1d49960ab9a1af9cdcfc73ca013e927dda8e75bed8f1a19d39e81d3f
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -109,8 +109,8 @@ function parseConvergeBody(body) {
     return parsed;
 }
 function convergeAmountCents(value) {
-    const text10 = typeof value === "number" && Number.isFinite(value) ? String(value) : value;
-    const m = typeof text10 === "string" ? AMOUNT.exec(text10) : null;
+    const text11 = typeof value === "number" && Number.isFinite(value) ? String(value) : value;
+    const m = typeof text11 === "string" ? AMOUNT.exec(text11) : null;
     if (!m)
         return null;
     const cents2 = Number(m[1]) * 100 + Number(((m[2] ?? "") + "00").slice(0, 2));
@@ -365,8 +365,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
 var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -590,9 +590,9 @@ var K = /* @__PURE__ */ new Uint32Array([
     3329325298
 ]);
 var rotr = (x, n) => x >>> n | x << 32 - n;
-function utf8(text10) {
+function utf8(text11) {
     const out = [];
-    for (const char of text10) {
+    for (const char of text11) {
         let cp = char.codePointAt(0);
         if (cp >= 55296 && cp <= 57343)
             cp = 65533;
@@ -667,6 +667,7 @@ var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 var MODULUS_BYTES = [128, 256, 384, 512];
+var SMALL_MODULUS_BYTES = 64;
 var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
 var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
 function parseRsaPublicKey(key) {
@@ -675,6 +676,9 @@ function parseRsaPublicKey(key) {
     const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
     if (named !== void 0 && named !== 17)
         throw refuse6("key");
+    const sized = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "bits") ? key.bits : void 0;
+    if (sized !== void 0 && sized !== 512)
+        throw refuse6("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse6("key");
     if (typeof pin10 !== "string" || !SHA256_HEX.test(pin10))
@@ -707,7 +711,8 @@ function parseRsaPublicKey(key) {
     if (exponent.end !== rsa.end)
         throw refuse6("key");
     const n = modulus.bytes;
-    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+    const sizes = sized === 512 ? [SMALL_MODULUS_BYTES] : MODULUS_BYTES;
+    if (!sizes.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse6("key");
     const e = exponent.bytes;
     const expected = named === 17 ? [17] : [1, 0, 1];
@@ -721,13 +726,13 @@ function readElement(der, at, tag) {
     let length = der[at + 1];
     let start = at + 2;
     if (length & 128) {
-        const count = length & 127;
-        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+        const count2 = length & 127;
+        if (count2 === 0 || count2 > 2 || start + count2 > der.length || der[start] === 0)
             throw refuse6("key");
-        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        length = count2 === 1 ? der[start] : der[start] * 256 + der[start + 1];
         if (length < 128)
             throw refuse6("key");
-        start += count;
+        start += count2;
     }
     if (start + length > der.length)
         throw refuse6("key");
@@ -779,8 +784,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
 var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
 var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys2 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -850,8 +855,8 @@ function readPay(body, line, environment2) {
     const card = record4(method) && sameKeys2(method, ["card"]) ? method.card : null;
     if (!record4(card) || !(sameKeys2(card, PAY_CARD_KEYS) || sameKeys2(card, [...PAY_CARD_KEYS, "session_tracking"])))
         return null;
-    const metadata = card.metadata;
-    if (!record4(metadata) || !sameKeys2(metadata, METADATA_KEYS2) || typeof metadata.cardholder_name !== "string" || metadata.cardholder_name.length > NAME_LIMIT2 || CONTROL2.test(metadata.cardholder_name) || cardLikeName2(metadata.cardholder_name) || typeof metadata.card_first_six !== "string" || !FIRST_SIX.test(metadata.card_first_six) || typeof metadata.card_last_four !== "string" || !LAST_FOUR.test(metadata.card_last_four) || !expiryMonth(metadata.expiry_month) || !expiryYear(metadata.expiry_year) || !FRAME_BRANDS.includes(metadata.card_brand))
+    const metadata2 = card.metadata;
+    if (!record4(metadata2) || !sameKeys2(metadata2, METADATA_KEYS2) || typeof metadata2.cardholder_name !== "string" || metadata2.cardholder_name.length > NAME_LIMIT2 || CONTROL2.test(metadata2.cardholder_name) || cardLikeName2(metadata2.cardholder_name) || typeof metadata2.card_first_six !== "string" || !FIRST_SIX.test(metadata2.card_first_six) || typeof metadata2.card_last_four !== "string" || !LAST_FOUR.test(metadata2.card_last_four) || !expiryMonth(metadata2.expiry_month) || !expiryYear(metadata2.expiry_year) || !FRAME_BRANDS.includes(metadata2.card_brand))
         return null;
     const details = card.three_d_s;
     if (!record4(details) || !sameKeys2(details, ["browser_info"]) || typeof details.browser_info !== "string" || !BROWSER_INFO.test(details.browser_info))
@@ -1269,8 +1274,8 @@ var TEXT_LIMIT = 256;
 var CONTROL4 = /[\u0000-\u001f\u007f]/;
 var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys3 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1300,13 +1305,13 @@ function billingFields(value) {
     if (names.length > MAX_FIELDS)
         return false;
     return names.every((name) => {
-        const field2 = value[name];
+        const field5 = value[name];
         if (!FIELD_NAME.test(name))
             return false;
-        if (!record6(field2))
-            return billingText(field2);
-        const nested = Object.keys(field2);
-        return nested.length <= MAX_NESTED_FIELDS && nested.every((key) => FIELD_NAME.test(key) && billingText(field2[key]));
+        if (!record6(field5))
+            return billingText(field5);
+        const nested = Object.keys(field5);
+        return nested.length <= MAX_NESTED_FIELDS && nested.every((key) => FIELD_NAME.test(key) && billingText(field5[key]));
     });
 }
 function wixPaymentsBodyVerdict(body) {
@@ -1380,14 +1385,14 @@ function readJson2(body) {
     catch {
         return { parsed: null, exact: false };
     }
-    let exact5 = false;
+    let exact6 = false;
     try {
-        exact5 = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
+        exact6 = body.length <= BODY_LIMIT6 && JSON.stringify(parsed) === body;
     }
     catch {
-        exact5 = false;
+        exact6 = false;
     }
-    return { parsed, exact: exact5 };
+    return { parsed, exact: exact6 };
 }
 function billingValue(value) {
     if (value === UNDEFINED)
@@ -1401,15 +1406,15 @@ function judgeCardAttach(args, session) {
         return "paymongo_body_unsupported";
     }
     const id = args[0].slice(3);
-    const attributes = args[1].data.attributes;
-    const details = attributes.details;
+    const attributes2 = args[1].data.attributes;
+    const details = attributes2.details;
     if (record7(details) && CLICK_TO_PAY_KEYS.some((key) => own(details, key)))
         return "paymongo_click_to_pay";
-    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
+    if (!keysAre(args[1], ["data"]) || !keysAre(args[1].data, ["attributes"]) || !keysAre(attributes2, PAYMONGO_ATTRIBUTE_KEYS) || !record7(details) || !keysAre(details, PAYMONGO_CARD_KEYS))
         return "paymongo_body_unsupported";
     if (typeof details.card_number !== "string" || !NUMBER.test(details.card_number) || !Number.isSafeInteger(details.exp_month) || details.exp_month < 1 || details.exp_month > 12 || !Number.isSafeInteger(details.exp_year) || details.exp_year < 0 || details.exp_year > 99 || typeof details.cvc !== "string" || !SECURITY_CODE6.test(details.cvc))
         return "paymongo_body_unsupported";
-    const billing = attributes.billing;
+    const billing = attributes2.billing;
     if (!record7(billing) || !keysAre(billing, PAYMONGO_BILLING_KEYS) || !record7(billing.address) || !keysAre(billing.address, PAYMONGO_ADDRESS_KEYS))
         return "paymongo_body_unsupported";
     if (billing.name === UNDEFINED || !billingValue(billing.name) || !billingValue(billing.email) || !billingValue(billing.phone) || !PAYMONGO_ADDRESS_KEYS.every((key) => billingValue(billing.address[key])))
@@ -1417,7 +1422,7 @@ function judgeCardAttach(args, session) {
     const third = args[2];
     if (!record7(third) || !keysAre(third, ["viewerAccept"]) || !billingValue(third.viewerAccept))
         return "paymongo_body_unsupported";
-    if (attributes.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
+    if (attributes2.return_url !== `${ORIGIN}${id}` || session !== void 0 && session !== id)
         return "paymongo_session_mismatch";
     return null;
 }
@@ -1442,14 +1447,14 @@ function attachType(parsed) {
     return typeof type === "string" ? type : null;
 }
 function paymongoBodyVerdict(body, session) {
-    const { parsed, exact: exact5 } = readJson2(body);
+    const { parsed, exact: exact6 } = readJson2(body);
     const type = parsed === null ? null : attachType(parsed);
     if (type !== "card") {
         if (parsed === null)
             return body === void 0 || body === null || body === "" ? CONTINUE4 : refuse10("paymongo_body_unsupported");
         return namesCardValue(parsed) ? refuse10("paymongo_body_unsupported") : CONTINUE4;
     }
-    if (!exact5)
+    if (!exact6)
         return refuse10("paymongo_body_unsupported");
     const code = judgeCardAttach(parsed, session);
     return code === null ? CARD9 : refuse10(code);
@@ -1472,8 +1477,8 @@ var EXPIRATION = /^[0-9]{2}(?:0[1-9]|1[0-2])$/;
 var CARD_PAYMENT = "PAYMENT_CARD";
 var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys4 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse11 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD10 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1703,8 +1708,8 @@ var LOCALE = /^[a-z]{2}(?:-[A-Za-z]{2,4})?$/;
 var PAN_LIKE3 = /(?:[0-9][ _.:-]*){12,}/;
 var record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys5 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse13 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD12 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1956,10 +1961,10 @@ function judge(body, contentType, rule) {
     if (read.parts.some((part) => !listed(rule.parts, part.name)))
         return refusal("multipart_unknown_part");
     for (const name of rule.card) {
-        const count = read.parts.filter((part) => part.name === name).length;
-        if (count === 0)
+        const count2 = read.parts.filter((part) => part.name === name).length;
+        if (count2 === 0)
             return refusal("multipart_missing_card_part");
-        if (count > 1)
+        if (count2 > 1)
             return refusal("multipart_duplicate_card_part");
     }
     return read;
@@ -1968,6 +1973,25 @@ function multipartFormRefusal(body, contentType, rule) {
     const read = judge(body, contentType, rule);
     return read.refusal ?? null;
 }
+// src/answer-card-leak.js
+var DECIMAL = /\p{Nd}/u;
+function digitValue(char) {
+    const point = char.codePointAt(0);
+    let first = point;
+    while (DECIMAL.test(String.fromCodePoint(first - 1)))
+        first -= 1;
+    return String((point - first) % 10);
+}
+var ENCLOSED = /* @__PURE__ */ Object.freeze([[9451, 10, 11], [9461, 10, 1], [9471, 1, 0], [10102, 30, 1], [127243, 2, 0]]);
+var ENCLOSED_CHAR = /[\u24eb-\u24ff\u2776-\u2793\u{1f10b}\u{1f10c}]/gu;
+function enclosedValue(char) {
+    const point = char.codePointAt(0);
+    const [first, , start] = ENCLOSED.find(([from, size]) => point >= from && point < from + size);
+    return String(first === 127243 ? 0 : first === 10102 ? (point - first) % 10 + 1 : start + point - first);
+}
+var asciiDigits = (text11) => (typeof text11.normalize === "function" ? text11.normalize("NFKC") : text11).replace(ENCLOSED_CHAR, enclosedValue).replace(/\p{Nd}/gu, (char) => char >= "0" && char <= "9" ? char : digitValue(char));
+var digitCount = (text11) => (asciiDigits(String(text11)).match(/\p{N}/gu) ?? []).length;
+var NAME_DIGITS = 3;
 // src/pay-nl.js
 var PAY_NL_PSP = "pay_nl";
 var PAY_NL_TOKEN_URL = "https://payment.pay.nl/v1/Payment/getCardToken/json";
@@ -2120,7 +2144,7 @@ var luhn2 = (digits4) => {
     return sum % 10 === 0;
 };
 var ANY_NETWORK = /^[2-6][0-9]{12,18}$/;
-var holdsCardShape = (text10, shape = NETWORK) => (text10.match(/[0-9]{13,}/g) ?? []).some((run) => run.length > 19 || shape.test(run) && luhn2(run));
+var holdsCardShape = (text11, shape = NETWORK) => (text11.match(/[0-9]{13,}/g) ?? []).some((run) => run.length > 19 || shape.test(run) && luhn2(run));
 var phone = (value) => typeof value === "string" && PHONE.test(value) && (value.match(/[0-9]/g) ?? []).length >= 6 && (value.match(/[0-9]/g) ?? []).length <= 15;
 var refuse16 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD15 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -2348,13 +2372,13 @@ var printable = (value) => [...value].every((ch) => ch.charCodeAt(0) >= 32 && ch
 function typed(value, limit = 256) {
     return typeof value === "string" && value.length >= 1 && value.length <= limit && !PAN_LIKE4.test(value) && printable(value);
 }
-function decodeBase64(text10) {
-    if (typeof text10 !== "string" || !BASE643.test(text10) || text10.length % 4 !== 0)
+function decodeBase64(text11) {
+    if (typeof text11 !== "string" || !BASE643.test(text11) || text11.length % 4 !== 0)
         return null;
     let bits = 0;
     let value = 0;
     let out = "";
-    for (const ch of text10.replace(/=+$/, "")) {
+    for (const ch of text11.replace(/=+$/, "")) {
         value = (value << 6 | BASE64_ALPHABET.indexOf(ch)) & 16777215;
         bits += 6;
         if (bits >= 8) {
@@ -2364,8 +2388,8 @@ function decodeBase64(text10) {
     }
     return out;
 }
-function soundDevice(text10) {
-    const json = decodeBase64(text10);
+function soundDevice(text11) {
+    const json = decodeBase64(text11);
     if (json === null)
         return false;
     let value;
@@ -2483,17 +2507,17 @@ function sumupBodyVerdict(body, url) {
 var SALTED = /* @__PURE__ */ Object.freeze([83, 97, 108, 116, 101, 100, 95, 95]);
 var B64 = /^[A-Za-z0-9+/]+={0,2}$/;
 var FIELD_LIMIT = 1024;
-function decodeCanonical(text10) {
-    if (typeof text10 !== "string" || text10.length === 0 || text10.length % 4 !== 0 || !B64.test(text10))
+function decodeCanonical(text11) {
+    if (typeof text11 !== "string" || text11.length === 0 || text11.length % 4 !== 0 || !B64.test(text11))
         return null;
     let binary;
     try {
-        binary = atob(text10);
+        binary = atob(text11);
     }
     catch {
         return null;
     }
-    if (btoa(binary) !== text10)
+    if (btoa(binary) !== text11)
         return null;
     return Uint8Array.from(binary, (char) => char.charCodeAt(0));
 }
@@ -2735,8 +2759,8 @@ var TEXT_LIMIT3 = 256;
 var CONTROL7 = /[\u0000-\u001f\u007f]/;
 var record13 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys7 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var plainText3 = (value) => typeof value === "string" && value.length <= TEXT_LIMIT3 && !CONTROL7.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
 var refuse19 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -3013,10 +3037,10 @@ function paypalBodyVerdict(body) {
     if (number === void 0 || number === null || number === "")
         return CONTINUE9;
     const context = value.application_context;
-    const attributes = record14(card.attributes) ? card.attributes : null;
-    if (record14(context) && context.vault === true || own3(card, "stored_credential") || attributes && (own3(attributes, "vault") || own3(attributes, "customer")))
+    const attributes2 = record14(card.attributes) ? card.attributes : null;
+    if (record14(context) && context.vault === true || own3(card, "stored_credential") || attributes2 && (own3(attributes2, "vault") || own3(attributes2, "customer")))
         return refuse20("paypal_card_on_file");
-    if (attributes && record14(attributes.verification) && attributes.verification.method === "SCA_ALWAYS")
+    if (attributes2 && record14(attributes2.verification) && attributes2.verification.method === "SCA_ALWAYS")
         return refuse20("paypal_three_ds");
     if (!keysWithin2(value, ["payment_source"]) || !keysWithin2(source, ["card"]) || !keysWithin2(card, CARD_KEYS8) || !typedNumber(card.number) || typeof card.expiry !== "string" || !/^[0-9]{4}-(?:0[1-9]|1[0-2])$/.test(card.expiry))
         return refuse20("paypal_body_unsupported");
@@ -3030,7 +3054,7 @@ function paypalBodyVerdict(body) {
     if (own3(card, "billing_address") && !(keysWithin2(card.billing_address, ADDRESS_KEYS3) && Object.values(card.billing_address).every(text3))) {
         return refuse20("paypal_body_unsupported");
     }
-    if (own3(card, "attributes") && !(keysWithin2(attributes, ["installments"]) && installmentsOk(attributes.installments))) {
+    if (own3(card, "attributes") && !(keysWithin2(attributes2, ["installments"]) && installmentsOk(attributes2.installments))) {
         return refuse20("paypal_body_unsupported");
     }
     return CARD19;
@@ -3432,7 +3456,7 @@ var YEAR11 = /^[0-9]{2}$/;
 var CODE4 = /^[0-9]{3}$/;
 var NAME_LIMIT3 = 100;
 var NAME_WORD = /[a-z]+/gi;
-var printable2 = (text10) => [...text10].every((character) => {
+var printable2 = (text11) => [...text11].every((character) => {
     const point = character.codePointAt(0);
     return point >= 32 && !(point >= 127 && point <= 159) && point !== 8232 && point !== 8233;
 });
@@ -3441,8 +3465,8 @@ var HOSTNAME = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](
 var PUBLISHABLE_KEY = /^[A-Za-z0-9]{16,64}$/;
 var record18 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys8 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse24 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD23 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -3812,7 +3836,7 @@ var POSTAL_CODE3 = /^[A-Za-z0-9_]{0,16}$/;
 var COUNTRY4 = /^[A-Z]{2}$/;
 var TEXT_LIMIT7 = 256;
 var CONTROL10 = /[\u0000-\u001f\u007f]/;
-var cardLike2 = (text10) => (text10.match(/[0-9]/g) ?? []).length >= 12;
+var cardLike2 = (text11) => (text11.match(/[0-9]/g) ?? []).length >= 12;
 var text5 = (value) => typeof value === "string" && value.length <= TEXT_LIMIT7 && !CONTROL10.test(value) && !cardLike2(value);
 var record21 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var own5 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
@@ -4133,11 +4157,11 @@ var LONG_TEXT_LIMIT = BODY_LIMIT25;
 var record22 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns6 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var sameKeys9 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var exact3 = (pattern, value) => typeof value === "string" && pattern.test(value);
-var printable3 = (text10) => [...text10].every((character) => {
+var printable3 = (text11) => [...text11].every((character) => {
     const point = character.codePointAt(0);
     return point >= 32 && !(point >= 127 && point <= 159) && point !== 8232 && point !== 8233;
 });
@@ -4210,7 +4234,7 @@ function companyStore(value) {
     return record22(value) && sameKeys9(value, COMPANY_KEYS) && whole(value.CompanyNumber, 1) && COMPANY_KEYS.slice(1).every((key) => key.startsWith("Show") ? flag(value[key]) : pageText(value[key]));
 }
 var SUM_TEXT = /^(?:0*[1-9][0-9]*(?:\.[0-9]+)?|0+\.[0-9]*[1-9][0-9]*)$/;
-var sumText = (text10, sum) => text10 === null || typeof text10 === "string" && SUM_TEXT.test(text10) && Number.parseFloat(text10) === sum;
+var sumText = (text11, sum) => text11 === null || typeof text11 === "string" && SUM_TEXT.test(text11) && Number.parseFloat(text11) === sum;
 function chosenProduct(value) {
     return record22(value) && sameKeys9(value, PRODUCT_KEYS) && whole(value.MinQuantity) && whole(value.MaxQuantity) && whole(value.JumpsInQuantity) && value.SelectedBuyQuantity === 1 && Array.isArray(value.QuantityOptions) && value.QuantityOptions.length === 0 && pageText(value.Comments) && flag(value.IsManualSum) && Array.isArray(value.PaymentsOptions) && flag(value.IsCouponActive) && typeof value.ManualPrice === "number" && sumText(value.ManualPriceTxt, value.ManualPrice) && flag(value.IsVatFree) && Array.isArray(value.SpecialPrices) && (value.PreConfiguredPrice === null || typeof value.PreConfiguredPrice === "number") && flag(value.IsPreSelected) && typeof value.CurrentInventory === "number" && flag(value.CheckInventory) && exact3(PRODUCT_ID, value.uid) && pageText(value.imageUrl) && typeof value.name === "string" && pageText(value.name) && pageText(value.description) && typeof value.BasePrice === "number" && typeof value.PriceBeforeDiscount === "number" && whole(value.BaseISOCurrency) && typeof value.PriceToShow === "number" && typeof value.PriceBeforeDiscountToShow === "number" && flag(value.IsCurrent);
 }
@@ -4441,7 +4465,7 @@ var sameKeys10 = (value, keys) => {
 };
 var refuse28 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD27 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
-var printable4 = (text10) => [...text10].every((character) => {
+var printable4 = (text11) => [...text11].every((character) => {
     const point = character.codePointAt(0);
     return point >= 32 && !(point >= 127 && point <= 159) && point !== 8232 && point !== 8233;
 });
@@ -4533,8 +4557,8 @@ var POSTAL_CODE4 = /^[A-Za-z0-9 -]{0,16}$/;
 var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
 var record24 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var sameKeys11 = (value, keys) => {
-    const own13 = Object.keys(value);
-    return own13.length === keys.length && own13.every((key, at) => key === keys[at]);
+    const own23 = Object.keys(value);
+    return own23.length === keys.length && own23.every((key, at) => key === keys[at]);
 };
 var refuse29 = (code) => Object.freeze({ verdict: "refuse", code });
 var failed = (code) => (
@@ -4685,14 +4709,14 @@ function readJson7(body) {
     catch {
         return { parsed: null, exact: false };
     }
-    let exact5 = false;
+    let exact6 = false;
     try {
-        exact5 = JSON.stringify(parsed) === body;
+        exact6 = JSON.stringify(parsed) === body;
     }
     catch {
-        exact5 = false;
+        exact6 = false;
     }
-    return { parsed, exact: exact5 };
+    return { parsed, exact: exact6 };
 }
 function numberDigits(number) {
     if (typeof number !== "string")
@@ -4769,7 +4793,7 @@ function judgeCard2(parsed) {
     return null;
 }
 function fastspringBodyVerdict(body) {
-    const { parsed, exact: exact5 } = readJson7(body);
+    const { parsed, exact: exact6 } = readJson7(body);
     if (!record25(parsed))
         return body === void 0 || body === null || body === "" ? CONTINUE11 : refuse30("fastspring_body_unsupported");
     if (parsed.paymentType !== "card") {
@@ -4777,7 +4801,7 @@ function fastspringBodyVerdict(body) {
             return refuse30("fastspring_body_unsupported");
         return typeof parsed.paymentType === "string" && parsed.paymentType !== "" ? CONTINUE11 : refuse30("fastspring_body_unsupported");
     }
-    if (!exact5)
+    if (!exact6)
         return refuse30("fastspring_body_unsupported");
     const code = judgeCard2(parsed);
     return code === null ? CARD29 : refuse30(code);
@@ -5003,20 +5027,20 @@ function readBody18(body) {
 function amountValue(value) {
     if (typeof value === "number" && !Number.isFinite(value))
         return false;
-    const text10 = typeof value === "number" ? String(value) : value;
-    if (typeof text10 !== "string" || !AMOUNT_TEXT.test(text10))
+    const text11 = typeof value === "number" ? String(value) : value;
+    if (typeof text11 !== "string" || !AMOUNT_TEXT.test(text11))
         return false;
-    const amount2 = Number(text10);
+    const amount2 = Number(text11);
     return amount2 > 0 && amount2 <= AMOUNT_LIMIT3;
 }
 function billingDetails(value) {
     if (!record27(value) || !inOrder5(value, BILLING_KEYS))
         return false;
     return Object.keys(value).every((key) => {
-        const field2 = value[key];
+        const field5 = value[key];
         if (key !== "address")
-            return key === "mobile_number" || key === "phone_number" ? typeof field2 === "string" && PHONE4.test(field2) : plainText6(field2);
-        return record27(field2) && inOrder5(field2, ADDRESS_KEYS5) && Object.keys(field2).every((name) => plainText6(field2[name]));
+            return key === "mobile_number" || key === "phone_number" ? typeof field5 === "string" && PHONE4.test(field5) : plainText6(field5);
+        return record27(field5) && inOrder5(field5, ADDRESS_KEYS5) && Object.keys(field5).every((name) => plainText6(field5[name]));
     });
 }
 function cardData(value) {
@@ -5046,8 +5070,8 @@ function xenditBodyVerdict(body) {
     if (own9(value, "fp_session_id") && (typeof value.fp_session_id !== "string" || !FP_SESSION.test(value.fp_session_id)))
         return refuse32("xendit_body_unsupported");
     if (own9(value, "metadata")) {
-        const metadata = value.metadata;
-        if (!record27(metadata) || Object.keys(metadata).length !== 1 || !record27(metadata._forter) || Object.keys(metadata._forter).length !== 1 || typeof metadata._forter.token !== "string" || !FORTER_TOKEN.test(metadata._forter.token))
+        const metadata2 = value.metadata;
+        if (!record27(metadata2) || Object.keys(metadata2).length !== 1 || !record27(metadata2._forter) || Object.keys(metadata2._forter).length !== 1 || typeof metadata2._forter.token !== "string" || !FORTER_TOKEN.test(metadata2._forter.token))
             return refuse32("xendit_body_unsupported");
     }
     if (own9(value, "mid_label") && (typeof value.mid_label !== "string" || !MID_LABEL.test(value.mid_label)))
@@ -5204,10 +5228,10 @@ function isPaymobPayUrl(url) {
 var BASE645 = /^[A-Za-z0-9+/]+={0,2}$/;
 var BASE64URL = /^[A-Za-z0-9_-]+$/;
 var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-function decodeBase642(text10, url) {
-    if (typeof text10 !== "string" || text10 === "")
+function decodeBase642(text11, url) {
+    if (typeof text11 !== "string" || text11 === "")
         return null;
-    let body = text10;
+    let body = text11;
     if (url) {
         if (!BASE64URL.test(body) || body.length % 4 === 1)
             return null;
@@ -5240,15 +5264,15 @@ function decodeBase642(text10, url) {
 function jsonOf(bytes) {
     if (!bytes)
         return null;
-    let text10;
+    let text11;
     try {
-        text10 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        text11 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
     }
     catch {
         return null;
     }
     try {
-        const value = JSON.parse(text10);
+        const value = JSON.parse(text11);
         return record29(value) ? value : null;
     }
     catch {
@@ -5325,14 +5349,14 @@ function readJson8(body) {
     catch {
         return { parsed: null, exact: false };
     }
-    let exact5 = false;
+    let exact6 = false;
     try {
-        exact5 = body.length <= BODY_LIMIT32 && JSON.stringify(parsed) === body;
+        exact6 = body.length <= BODY_LIMIT32 && JSON.stringify(parsed) === body;
     }
     catch {
-        exact5 = false;
+        exact6 = false;
     }
-    return { parsed, exact: exact5 };
+    return { parsed, exact: exact6 };
 }
 function namesCardValue3(parsed) {
     const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
@@ -5349,7 +5373,7 @@ function namesCardValue3(parsed) {
     return false;
 }
 function addressBlock(value) {
-    return record29(value) && Object.keys(value).length <= 32 && Object.entries(value).every(([key, text10]) => FIELD.test(key) && !CARD_MEMBER4.test(key) && (text10 === null || typeof text10 === "string" && TEXT3.test(text10)));
+    return record29(value) && Object.keys(value).length <= 32 && Object.entries(value).every(([key, text11]) => FIELD.test(key) && !CARD_MEMBER4.test(key) && (text11 === null || typeof text11 === "string" && TEXT3.test(text11)));
 }
 function judgeCardPayment(parsed) {
     const source = parsed.source;
@@ -5393,8 +5417,8 @@ function judgeCardPayment(parsed) {
 function paymobBodyVerdict(body) {
     if (body === void 0 || body === null || body === "")
         return CONTINUE12;
-    const { parsed, exact: exact5 } = readJson8(body);
-    if (!exact5 || !record29(parsed) || !record29(parsed.source) || typeof parsed.source.subtype !== "string")
+    const { parsed, exact: exact6 } = readJson8(body);
+    if (!exact6 || !record29(parsed) || !record29(parsed.source) || typeof parsed.source.subtype !== "string")
         return refuse34("paymob_body_unsupported");
     const subtype = parsed.source.subtype;
     if (subtype === "CARD") {
@@ -5847,8 +5871,8 @@ function cardNamed2(key) {
     const phrase = words.join(" ");
     return words.some((word) => CARD_WORDS.includes(word)) || ["security code", "codigo seguridad", "codigo verificacion"].some((said) => phrase.includes(said));
 }
-function carriesCardNumber(text10) {
-    for (const [run] of text10.matchAll(/[0-9]+(?:[ ._/,-][0-9]+)*/g)) {
+function carriesCardNumber(text11) {
+    for (const [run] of text11.matchAll(/[0-9]+(?:[ ._/,-][0-9]+)*/g)) {
         const groups = run.split(/[ ._/,-]/);
         for (let first = 0; first < groups.length; first += 1) {
             let digits4 = "";
@@ -5861,17 +5885,17 @@ function carriesCardNumber(text10) {
     }
     return false;
 }
-var wholeCardNumber = (text10) => /^[2-6][0-9]{12,18}$/.test(text10) && luhn7(text10);
+var wholeCardNumber = (text11) => /^[2-6][0-9]{12,18}$/.test(text11) && luhn7(text11);
 function membersRefusal(root) {
     const pending = [[root, ""]];
     while (pending.length > 0) {
         const [node, path] = pending.pop();
-        const own13 = path === "" ? TRANSACTION_MEMBERS : owns7(RECORD_MEMBERS, path) ? RECORD_MEMBERS[path] : null;
+        const own23 = path === "" ? TRANSACTION_MEMBERS : owns7(RECORD_MEMBERS, path) ? RECORD_MEMBERS[path] : null;
         for (const [key, child] of Object.entries(node)) {
             const at = Array.isArray(node) ? path : path === "" ? key : `${path}.${key}`;
             if (at === "checkoutCreditCard")
                 continue;
-            if (own13 !== null && !own13.includes(key))
+            if (own23 !== null && !own23.includes(key))
                 return true;
             if (TEXT_RECORDS.includes(path) && child !== null && typeof child !== "string")
                 return true;
@@ -6092,7 +6116,17 @@ var TOKEN_FACTS = /* @__PURE__ */ Object.freeze([
     "primary"
 ]);
 // src/registration.js
-var PARTS = { psp: "id", definitions: "list", refusedOperations: "list", settlementReadback: "any", exactUrl: "rule", bodyGate: "rule", amount: "rule" };
+var PARTS = {
+    psp: "id",
+    definitions: "list",
+    refusedOperations: "list",
+    settlementReadback: "any",
+    exactUrl: "rule",
+    bodyGate: "rule",
+    amount: "rule",
+    hostedEntry: "rule",
+    limitations: "sentences"
+};
 var PSP_ID = /^[a-z][a-z0-9_]*$/;
 var registrationProblems = (spec) => problemsOf(spec, PARTS);
 function problemsOf(spec, parts) {
@@ -6108,9 +6142,14 @@ function problemsOf(spec, parts) {
             continue;
         if (kind === "rule" && typeof value !== "function")
             problems2.push(`${psp}: ${key} is not a function`);
+        if (kind === "flag" && value !== true)
+            problems2.push(`${psp}: ${key} is not true`);
         if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
             problems2.push(`${psp}: ${key} is not a list of card numbers`);
         }
+        if (kind === "sentences" && !(Array.isArray(value) && value.length > 0 && value.every((s) => typeof s === "string" && s.trim() !== ""))) {
+            problems2.push(`${psp}: ${key} is not a list of sentences`);
+        }
     }
     if ("definitions" in parts) {
         if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
@@ -6121,6 +6160,10 @@ function problemsOf(spec, parts) {
             if (typeof id !== "string" || !id.startsWith(`${psp}.`))
                 problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
         }
+        const pages = Array.isArray(spec.definitions) ? spec.definitions.filter((d) => d?.hostedForm?.cardIn === "processor_page") : [];
+        if (spec.hostedEntry !== void 0 && (pages.length === 0 || pages.some((d) => d.hostedForm.policy !== void 0))) {
+            problems2.push(`${psp}: hostedEntry needs a definition whose hosted form takes the card on the processor's page and names no policy`);
+        }
     }
     return problems2;
 }
@@ -6133,178 +6176,2754 @@ function registered(spec, parts) {
 function registerProcessor(spec) {
     return registered(spec, PARTS);
 }
-// src/processors/midtrans.js
-var MIDTRANS_PSP = "midtrans";
-var MIDTRANS_OPERATION = "midtrans.card_request";
-var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
-var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
-var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
-var BODY_LIMIT35 = 4096;
-var CARD_NUMBER18 = /^[0-9]{12,19}$/;
-var SECURITY_CODE22 = /^[0-9]{3,4}$/;
-var MONTH19 = /^(?:0[1-9]|1[0-2])$/;
-var YEAR20 = /^20[0-9]{2}$/;
-var TERM = /^[0-9]{1,3}$/;
-var record32 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var own12 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var inOrder6 = (value, keys) => {
-    let at = 0;
-    for (const name of Object.keys(value)) {
-        while (at < keys.length && keys[at] !== name)
-            at += 1;
-        if (at === keys.length)
-            return false;
-        at += 1;
-    }
-    return true;
-};
+// src/processors/aurus.js
+var AURUS_PSP = "aurus";
+var AURUS_OPERATION = "aurus.card_request";
+var AURUS_FRAME_HOST = /^pecst[0-9]{2}\.aurusepay\.com$/;
+var AURUS_TOKEN_PATH = "/storeservices/ecom/oneTimeToken";
+var AURUS_PARTS = /* @__PURE__ */ Object.freeze(["Param", "formFactorId", "txnDateTime", "encryptionFlag", "sha256Flag", "hmacAuthData", "payload"]);
+var URL_LIMIT14 = 256;
+var BODY_LIMIT35 = 32768;
+var SERVER = /^es[0-9]{2}\.auruspay\.com$/;
+var HEX = /^[0-9A-Fa-f]{2,8192}$/;
+var FORM_FACTOR = /^[0-9]{1,16}$/;
+var DATE_TIME = /^[0-9]{14}$/;
+var FRAMED = /^STX[0-9]{1,6}\[FS\][0-9A-Fa-f]{2,16384}\[FS\]7[Bb][0-9A-Fa-f]{0,24576}7[Dd]ETX$/;
 var refuse37 = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD36 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
-function isMidtransTokenUrl(url) {
-    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+function aurusTokenUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT14 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !AURUS_FRAME_HOST.test(parsed.hostname) || parsed.pathname !== AURUS_TOKEN_PATH)
+        return null;
+    const query = parsed.search.startsWith("?") ? parsed.search.slice(1).split("&") : [];
+    if (query.length !== 2)
+        return null;
+    const [d1, d2] = query.map((pair) => pair.split("="));
+    if (d1.length !== 2 || d2.length !== 2 || d1[0] !== "d1" || d2[0] !== "d2" || !SERVER.test(d1[1]) || !SERVER.test(d2[1]))
+        return null;
+    return Object.freeze({ host: parsed.hostname });
 }
+var isAurusTokenUrl = (url) => aurusTokenUrl(url) !== null;
 function readBody21(body) {
     if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT35)
         return null;
-    let value;
-    try {
-        value = JSON.parse(body);
-        if (!record32(value) || JSON.stringify(value) !== body)
+    const pairs = body.split("&");
+    if (pairs.length !== AURUS_PARTS.length)
+        return null;
+    const value = {};
+    for (const [at, pair] of pairs.entries()) {
+        const cut = pair.indexOf("=");
+        if (cut < 0 || pair.slice(0, cut) !== AURUS_PARTS[at])
             return null;
+        value[AURUS_PARTS[at]] = pair.slice(cut + 1);
     }
-    catch {
+    if (!HEX.test(value.Param) || !FORM_FACTOR.test(value.formFactorId) || !DATE_TIME.test(value.txnDateTime) || value.encryptionFlag !== "00" || value.sha256Flag !== "1" || !FRAMED.test(value.hmacAuthData) || !FRAMED.test(value.payload))
         return null;
-    }
     return value;
 }
-function midtransBodyVerdict(body) {
-    const value = readBody21(body);
-    if (value === null || !inOrder6(value, MIDTRANS_TOKEN_KEYS)) {
-        if (record32(value) && (own12(value, "token_id") || own12(value, "two_click")) && !own12(value, "card_number"))
-            return refuse37("midtrans_saved_card");
-        return refuse37("midtrans_body_unsupported");
+function aurusBodyVerdict(body) {
+    return readBody21(body) === null ? refuse37("aurus_body_unsupported") : CARD36;
+}
+var aurus_default = /* @__PURE__ */ registerProcessor({
+    psp: AURUS_PSP,
+    definitions: [
+        {
+            psp: "aurus",
+            // The frame's card request, as the header above reads it. No sandbox host is known: Aurus's test instances were
+            // not read, so none is listed and no environment is pinned.
+            // Ships dark: served only to a client that declares `aurus_one_time_token`, and only for a company the backend's
+            // processor gate turns Aurus on for. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+            capability: "aurus_one_time_token",
+            match: "pecst[0-9]{2}\\.aurusepay\\.com/storeservices/ecom/oneTimeToken(?![\\w/.%-])",
+            hosts: ["^pecst[0-9]{2}\\.aurusepay\\.com$"],
+            encoding: "form",
+            // The frame's XHR marker. Origin, Referer and cookies never ride.
+            passthroughHeaders: ["^x-requested-with$"]
+        }
+    ],
+    // Only the cardholder's device would send this card, after a person approves; no reviewed list names aurus.
+    refusedOperations: [AURUS_OPERATION],
+    // The frame mints a one-time token and reads nothing: the store's server charges it with its own credentials.
+    settlementReadback: {
+        answer: "none",
+        reason: "tokenization_credential_cannot_read_charges",
+        note: "The tokenization credential cannot read a charge; the shop charges the token later with its own credentials.",
+        source: "https://www.oreillyauto.com/checkout (Aurus's ecom iframe, read 2026-10-31)"
+    },
+    exactUrl: isAurusTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isAurusTokenUrl(url) ? refuse37("aurus_url_refused") : aurusBodyVerdict(body),
+    limitations: ["The card frame seals the card in the page under a public key its own script carries; the cardholder's device does not seal for Aurus yet, so a held request opens no approval that pays."]
+});
+// src/processors/bluesnap.js
+var BLUESNAP_PSP = "bluesnap";
+var BLUESNAP_OPERATION = "bluesnap.card_request";
+var BLUESNAP_HOSTS = /* @__PURE__ */ Object.freeze({ 1: "ws1.bluesnap.com", 2: "ws2.bluesnap.com", _: "sandpay.bluesnap.com" });
+var BLUESNAP_SANDBOX_HOST = "sandpay.bluesnap.com";
+var BLUESNAP_CARD_KEYS = /* @__PURE__ */ Object.freeze(["cvv", "ccNumber", "expDate"]);
+var BLUESNAP_LEG_KEYS = /* @__PURE__ */ Object.freeze(["cvv", "expDate"]);
+var BODY_LIMIT36 = 1024;
+var TOKEN_URL2 = /^https:\/\/(ws1|ws2|sandpay)\.bluesnap\.com\/services\/2\/payment-fields-tokens\/([0-9a-f]{64}_[12]?)$/;
+var CARD_NUMBER18 = /^[0-9]{12,19}$/;
+var SECURITY_CODE22 = /^[0-9]{3,4}$/;
+var EXPIRY3 = /^(?:0[1-9]|1[0-2])\/20[0-9]{2}$/;
+var SAVED_CARD_KEYS2 = ["last4Digits", "lastFourDigits", "ccType"];
+var record32 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own12 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse38 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD37 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var LEG = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+function bluesnapTokenUrl(url) {
+    const match = typeof url === "string" ? TOKEN_URL2.exec(url) : null;
+    if (!match || BLUESNAP_HOSTS[match[2].slice(-1)] !== `${match[1]}.bluesnap.com`)
+        return null;
+    const host = `${match[1]}.bluesnap.com`;
+    return Object.freeze({ host, token: match[2], environment: host === BLUESNAP_SANDBOX_HOST ? "sandbox" : "production" });
+}
+function isBluesnapTokenUrl(url) {
+    return bluesnapTokenUrl(url) !== null;
+}
+function readBody22(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT36)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record32(value) && JSON.stringify(value) === body ? value : null;
     }
-    if (!own12(value, "card_cvv") || !own12(value, "card_number") || !own12(value, "card_exp_month") || !own12(value, "card_exp_year")) {
-        return refuse37("midtrans_body_unsupported");
+    catch {
+        return null;
     }
-    if (typeof value.card_cvv !== "string" || !SECURITY_CODE22.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER18.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH19.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR20.test(value.card_exp_year))
-        return refuse37("midtrans_body_unsupported");
-    if (own12(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
-        return refuse37("midtrans_body_unsupported");
-    return CARD36;
 }
-var midtrans_default = /* @__PURE__ */ registerProcessor({
-    psp: MIDTRANS_PSP,
+function bluesnapBodyVerdict(body) {
+    const value = readBody22(body);
+    if (value === null)
+        return refuse38("bluesnap_body_unsupported");
+    const keys = Object.keys(value);
+    if (keys.some((key) => SAVED_CARD_KEYS2.includes(key)))
+        return refuse38(own12(value, "ccNumber") ? "bluesnap_body_unsupported" : "bluesnap_saved_card");
+    if (keys.length === 0 || keys.some((key, i) => !BLUESNAP_CARD_KEYS.includes(key) || i > 0 && BLUESNAP_CARD_KEYS.indexOf(keys[i - 1]) >= BLUESNAP_CARD_KEYS.indexOf(key))) {
+        return refuse38("bluesnap_body_unsupported");
+    }
+    if (own12(value, "ccNumber") && !(typeof value.ccNumber === "string" && CARD_NUMBER18.test(value.ccNumber)) || own12(value, "cvv") && !(typeof value.cvv === "string" && SECURITY_CODE22.test(value.cvv)) || own12(value, "expDate") && !(typeof value.expDate === "string" && EXPIRY3.test(value.expDate)))
+        return refuse38("bluesnap_body_unsupported");
+    return own12(value, "ccNumber") ? CARD37 : LEG;
+}
+var bluesnap_default = /* @__PURE__ */ registerProcessor({
+    psp: BLUESNAP_PSP,
     definitions: [
         {
-            psp: "midtrans",
-            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
-            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
-            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
-            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
-            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
-            capability: "midtrans_card_token",
-            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
-            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
-            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
+            psp: "bluesnap",
+            // The card fields' PUTs, as the header above reads them. The sandbox has its own server, so the device sends a
+            // test-mode request only documented test cards (hostEnvironmentPinned, device-replay.js S7). `(?![\w/.%-])`
+            // ends the token for a consumer that tests `match` unanchored; the exact-URL rule pins each server to its suffix.
+            // Ships dark: served only to a client that declares `bluesnap_hosted_payment_fields`, and the backend's gate turns
+            // it on for Agentcard's own company alone, in code.
+            capability: "bluesnap_hosted_payment_fields",
+            match: "(?:ws1|ws2|sandpay)\\.bluesnap\\.com/services/2/payment-fields-tokens/[0-9a-f]{64}_[12]?(?![\\w/.%-])",
+            hosts: ["^ws1\\.bluesnap\\.com$", "^ws2\\.bluesnap\\.com$", "^sandpay\\.bluesnap\\.com$"],
+            sandboxHosts: ["^sandpay\\.bluesnap\\.com$"],
             hostEnvironmentPinned: true,
             encoding: "json",
-            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
-            // cookies never ride.
-            passthroughHeaders: ["^authorization$", "^x-service$"],
-            jsonCardFields: [["card_number"]]
+            // The frames' own headers, each held to its shape by bluesnapRequestRefusal. Origin, Referer and cookies never
+            // ride (the frames send no cookie).
+            passthroughHeaders: ["^authorization$", "^bluesnap_version_header$", "^bluesnap_origin_version_header$", "^bluesnap_origin_header$"],
+            jsonCardFields: [["ccNumber"]],
+            // The expiry and code frames' PUTs: held by the checkout SDK and answered with the card request's answer.
+            splitCard: { absorb: [...BLUESNAP_LEG_KEYS], pass: [], siblingKeys: [] },
+            request: { method: "PUT", cardIn: "body", response: "json" }
         }
     ],
-    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
-    refusedOperations: [MIDTRANS_OPERATION],
-    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    // Only the cardholder's device sends the card, after a person approves; no reviewed list names bluesnap.
+    refusedOperations: [BLUESNAP_OPERATION],
+    // Not surveyed: the PUT moves no money, and the merchant's own charge is a server call Agentcard never sees.
     settlementReadback: "not_surveyed",
-    exactUrl: isMidtransTokenUrl,
-    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+    exactUrl: isBluesnapTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isBluesnapTokenUrl(url) ? { verdict: "refuse", code: "bluesnap_url_refused" } : bluesnapBodyVerdict(body)
 });
-// src/processors/index.generated.js
-var REGISTERED_MODULES = Object.freeze({
-    midtrans: midtrans_default
+// src/processors/ekashu.js
+var EKASHU_HOSTS = Object.freeze(["live.ekashu.com", "test.ekashu.com"]);
+var EKASHU_TEST_PANS = Object.freeze(["4100000000000100", "5100000000000107"]);
+var EKASHU_SIGNED_FIELDS = Object.freeze([
+    "ekashu_3d_secure_verify",
+    "ekashu_amount",
+    "ekashu_amount_format",
+    "ekashu_auto_confirm",
+    "ekashu_callback_failure_url",
+    "ekashu_callback_include_post",
+    "ekashu_callback_success_url",
+    "ekashu_card_address_editable",
+    "ekashu_card_address_required",
+    "ekashu_card_address_verify",
+    "ekashu_card_email_address_mandatory",
+    "ekashu_card_phone_number_mandatory",
+    "ekashu_card_title_mandatory",
+    "ekashu_card_zip_code_verify",
+    "ekashu_currency",
+    "ekashu_delivery_address_editable",
+    "ekashu_delivery_address_required",
+    "ekashu_delivery_email_address_mandatory",
+    "ekashu_delivery_phone_number_mandatory",
+    "ekashu_delivery_title_mandatory",
+    "ekashu_description",
+    "ekashu_device",
+    "ekashu_duplicate_check",
+    "ekashu_duplicate_minutes",
+    "ekashu_failure_return_text",
+    "ekashu_failure_url",
+    "ekashu_hash_code_format",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_include_post",
+    "ekashu_invoice_address_editable",
+    "ekashu_invoice_address_required",
+    "ekashu_invoice_email_address_mandatory",
+    "ekashu_invoice_phone_number_mandatory",
+    "ekashu_invoice_title_mandatory",
+    "ekashu_locale",
+    "ekashu_payment_methods",
+    "ekashu_reference",
+    "ekashu_request_type",
+    "ekashu_return_text",
+    "ekashu_seller_address",
+    "ekashu_seller_email_address",
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_seller_name",
+    "ekashu_shortcut_icon",
+    "ekashu_style_sheet",
+    "ekashu_success_url",
+    "ekashu_title",
+    "ekashu_verification_value_mask",
+    "ekashu_verification_value_verify",
+    "ekashu_viewport"
+]);
+var REQUIRED = Object.freeze([
+    "ekashu_seller_id",
+    "ekashu_seller_key",
+    "ekashu_amount",
+    "ekashu_currency",
+    "ekashu_reference",
+    "ekashu_hash_code",
+    "ekashu_hash_code_type",
+    "ekashu_hash_code_version",
+    "ekashu_success_url",
+    "ekashu_failure_url",
+    "ekashu_callback_success_url"
+]);
+var CARD_KEYS16 = Object.freeze([
+    "ekashu_card_number",
+    "ekashu_expires_end_month",
+    "ekashu_expires_end_year",
+    "ekashu_verification_value",
+    "ekashu_valid_from_month",
+    "ekashu_valid_from_year",
+    "ekashu_issue_number"
+]);
+var PAGE_KEYS = Object.freeze(["ekashu_stage", "ekashu_context", "ekashu_submission_id"]);
+var STORED_KEYS = Object.freeze(["ekashu_card_hash", "ekashu_card_reference", "ekashu_cof_initiated_by", "ekashu_cof_reason", "ekashu_cof_id"]);
+var REDIRECT_KEYS = Object.freeze(["ekashu_success_url", "ekashu_failure_url", "ekashu_return_url"]);
+var CALLBACK_KEYS = Object.freeze(["ekashu_callback_success_url", "ekashu_callback_failure_url"]);
+var MAX_ENTRY = 16 * 1024;
+var MAX_PAGE = 256 * 1024;
+var EKASHU_SELLERS = Object.freeze([
+    Object.freeze({ sellerId: "25060100", merchant: "Heathrow Drop-off", entryHost: "heathrowdropoff.apcoa.com", callbackHost: "incomingapi.apcoa.co.uk" })
+]);
+var CARD_FIELDS = Object.freeze({
+    number: "ekashu_card_number",
+    month: "ekashu_expires_end_month",
+    year: "ekashu_expires_end_year",
+    cvc: "ekashu_verification_value"
 });
-// src/registry.js
-var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
-var ids = REGISTERED_PROCESSORS.map((processor) => processor.psp);
-var problems = REGISTERED_PROCESSORS.flatMap(registrationProblems);
-for (const [name, processor] of Object.entries(REGISTERED_MODULES)) {
-    if (processor.psp !== name)
-        problems.push(`processors/${name}.js registers ${JSON.stringify(processor.psp)}`);
-}
-if (ids.some((id, i) => i > 0 && ids[i - 1] >= id))
-    problems.push(`registered processors out of id order: ${ids.join(", ")}`);
-if (problems.length)
-    throw new Error(`payment-core registry refused: ${problems.join("; ")}`);
-var BY_PSP = new Map(REGISTERED_PROCESSORS.map((processor) => [processor.psp, processor]));
-var REGISTERED_IDS = Object.freeze(ids);
-var REGISTERED_DEFINITIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.definitions));
-var REGISTERED_REFUSED_OPERATIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.refusedOperations ?? []));
-var REGISTERED_SETTLEMENT_READBACK = Object.freeze(REGISTERED_PROCESSORS.filter((processor) => processor.settlementReadback !== void 0).map((processor) => [processor.psp, processor.settlementReadback]));
-function registeredRule(psp, name) {
-    return typeof psp === "string" ? BY_PSP.get(psp)?.[name] : void 0;
+var NAME_FIELDS = Object.freeze({ first: "ekashu_card_first_name", last: "ekashu_card_last_name" });
+var LEFT_EMPTY = Object.freeze(["ekashu_card_title", "ekashu_valid_from_month", "ekashu_valid_from_year", "ekashu_issue_number"]);
+var VISIBLE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS), ...Object.values(NAME_FIELDS), ...LEFT_EMPTY]);
+// src/processors/redsys.js
+var REDSYS_HOSTS = Object.freeze(["sis.redsys.es"]);
+var REDSYS_ENTRY_PATHS = Object.freeze(["/sis/realizarPago", "/sis/realizarPago/utf-8"]);
+var REDSYS_MERCHANTS = Object.freeze([]);
+var MAX_ENTRY2 = 16 * 1024;
+var MAX_PARAMETERS = 8 * 1024;
+var FORM_KEY = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+var ENTRY_KEYS = Object.freeze(["Ds_SignatureVersion", "Ds_MerchantParameters", "Ds_Signature"]);
+var REQUIRED2 = Object.freeze([
+    "DS_MERCHANT_AMOUNT",
+    "DS_MERCHANT_CURRENCY",
+    "DS_MERCHANT_MERCHANTCODE",
+    "DS_MERCHANT_ORDER",
+    "DS_MERCHANT_TERMINAL",
+    "DS_MERCHANT_TRANSACTIONTYPE",
+    "DS_MERCHANT_MERCHANTURL",
+    "DS_MERCHANT_URLOK",
+    "DS_MERCHANT_URLKO"
+]);
+var STORED = Object.freeze([
+    "DS_MERCHANT_IDENTIFIER",
+    "DS_MERCHANT_GROUP",
+    "DS_MERCHANT_COF_INI",
+    "DS_MERCHANT_COF_TYPE",
+    "DS_MERCHANT_COF_TXNID"
+]);
+var SPECIAL = Object.freeze([
+    "DS_MERCHANT_DIRECTPAYMENT",
+    "DS_MERCHANT_SUMTOTAL",
+    "DS_MERCHANT_DATEFRECUENCY",
+    "DS_MERCHANT_CHARGEEXPIRYDATE",
+    "DS_MERCHANT_IDOPER"
+]);
+var CARD_PARAMETERS = Object.freeze(["DS_MERCHANT_PAN", "DS_MERCHANT_EXPIRYDATE", "DS_MERCHANT_CVV2"]);
+var CURRENCIES = Object.freeze({ 978: "eur", 840: "usd", 826: "gbp", 756: "chf" });
+function decode(text11) {
+    return decodeURIComponent(text11.replace(/\+/g, " "));
 }
-// src/card-fields.js
-function processorGate(recognizer, url, body) {
-    if (recognizer && recognizer.psp === LYRA_PSP)
-        return lyraBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === WIX_PAYMENTS_PSP) {
-        if (url !== void 0 && !isWixPaymentsTokenizeUrl(url))
-            return { verdict: "refuse", code: "wix_payments_url_refused" };
-        return wixPaymentsBodyVerdict(body);
+function parseRedsysForm(body) {
+    if (typeof body !== "string" || body.length === 0 || body.length > MAX_ENTRY2 || /[^\x21-\x7e]/.test(body))
+        return null;
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            return null;
+        let key;
+        let value;
+        try {
+            key = decode(chunk.slice(0, eq));
+            value = decode(chunk.slice(eq + 1));
+        }
+        catch {
+            return null;
+        }
+        if (!FORM_KEY.test(key) || value.length > MAX_PARAMETERS || /[\u0000-\u001f\u007f]/.test(value))
+            return null;
+        const folded = key.toLowerCase();
+        if (seen.has(folded))
+            return null;
+        seen.add(folded);
+        pairs.push({ key, value });
     }
-    if (recognizer && recognizer.psp === KOMOJU_PSP)
-        return komojuBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === HIPAY_PSP) {
-        if (url !== void 0 && !isHipayTokenUrl(url))
-            return { verdict: "refuse", code: "hipay_url_refused" };
-        return hipayBodyVerdict(body);
+    return pairs;
+}
+var MAX_PAGE2 = 256 * 1024;
+var CARD_FIELDS2 = Object.freeze({
+    shown: "Sis_card-number",
+    expiry: "SIS_card-expiration",
+    cvc: "Sis_Tarjeta_CVV2",
+    holder: "cardholderName",
+    number: "Sis_Numero_Tarjeta",
+    month: "Sis_Caducidad_Tarjeta_Mes",
+    year: "Sis_Caducidad_Tarjeta_Anno"
+});
+var BROWSER_FIELDS = Object.freeze([
+    "browserJavaEnabled",
+    "browserJavascriptEnabled",
+    "browserLanguage",
+    "browserColorDepth",
+    "browserScreenHeight",
+    "browserScreenWidth",
+    "browserTZ",
+    "browserUserAgent"
+]);
+var AS_SERVED = Object.freeze(["cvvObligatorio", "threeDSCompInd", "fuc", "terminal", "merchantOrder", "bcancel"]);
+var CARD_PAGE = /* @__PURE__ */ new Set([...Object.values(CARD_FIELDS2), ...BROWSER_FIELDS, ...AS_SERVED]);
+var VISIBLE2 = /* @__PURE__ */ new Set([CARD_FIELDS2.shown, CARD_FIELDS2.expiry, CARD_FIELDS2.cvc, CARD_FIELDS2.holder]);
+var METHOD_PAGE = /* @__PURE__ */ new Set(["resultadoMethod", ...BROWSER_FIELDS, "threeDSCompInd"]);
+var REDSYS_REFUSALS = Object.freeze(["redsys_card_page", "redsys_3ds_challenge", "redsys_declined"]);
+// src/processors/cardlink_vpos.js
+var CARDLINK_VPOS_PSP = "cardlink_vpos";
+var CARDLINK_VPOS_HOSTS = Object.freeze({
+    "vpos.eurocommerce.gr": "worldline",
+    "ecommerce.cardlink.gr": "cardlink",
+    "www.alphaecommerce.gr": "nexi"
+});
+var CARDLINK_VPOS_TEST_HOSTS = Object.freeze([
+    "eurocommerce-test.cardlink.gr",
+    "ecommerce-test.cardlink.gr",
+    "alphaecommerce-test.cardlink.gr"
+]);
+var CARDLINK_VPOS_ENTRY_PATH = "/vpos/shophandlermpi";
+var CARDLINK_VPOS_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "Holy Great Monastery of Vatopedi", mid: "0021713862", vposHost: "vpos.eurocommerce.gr", host: "www.vatopedi.gr" })
+]);
+var CARDLINK_VPOS_ENTRY_FIELDS = Object.freeze([
+    "version",
+    "mid",
+    "lang",
+    "deviceCategory",
+    "orderid",
+    "orderDesc",
+    "orderAmount",
+    "currency",
+    "payerEmail",
+    "payerPhone",
+    "billCountry",
+    "billState",
+    "billZip",
+    "billCity",
+    "billAddress",
+    "weight",
+    "dimensions",
+    "shipCountry",
+    "shipState",
+    "shipZip",
+    "shipCity",
+    "shipAddress",
+    "addFraudScore",
+    "maxPayRetries",
+    "reject3dsU",
+    "payMethod",
+    "trType",
+    "extInstallmentoffset",
+    "extInstallmentperiod",
+    "extRecurringfrequency",
+    "extRecurringenddate",
+    "blockScore",
+    "cssUrl",
+    "confirmUrl",
+    "cancelUrl",
+    "extTokenOptions",
+    "extToken",
+    "var1",
+    "var2",
+    "var3",
+    "var4",
+    "var5",
+    "var6",
+    "var7",
+    "var8",
+    "var9",
+    "digest"
+]);
+var KNOWN = new Set(CARDLINK_VPOS_ENTRY_FIELDS);
+var REQUIRED3 = Object.freeze([
+    "version",
+    "mid",
+    "orderid",
+    "orderDesc",
+    "orderAmount",
+    "currency",
+    "payerEmail",
+    "confirmUrl",
+    "cancelUrl",
+    "digest"
+]);
+var STORED2 = Object.freeze(["extTokenOptions", "extToken"]);
+var SPECIAL2 = Object.freeze(["extInstallmentoffset", "extInstallmentperiod", "extRecurringfrequency", "extRecurringenddate"]);
+var CURRENCIES2 = Object.freeze({ EUR: "eur" });
+var MAX_URL = 512;
+var MAX_ENTRY3 = 8 * 1024;
+var MAX_VALUE = 256;
+var own13 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var field2 = (name, reason) => ({ ok: false, code: "hosted_form_field_refused", field: name, reason });
+function cardlinkVposEntryHost(raw) {
+    if (typeof raw !== "string" || raw.length > MAX_URL || raw.includes("?") || raw.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
     }
-    if (recognizer && recognizer.psp === PAYPAL_PSP) {
-        if (url !== void 0 && !isPaypalConfirmUrl(url))
-            return { verdict: "refuse", code: "paypal_url_refused" };
-        return paypalBodyVerdict(body);
+    catch {
+        return null;
     }
-    if (recognizer && recognizer.psp === MAKECOMMERCE_PSP)
-        return makecommerceBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === OPENPAY_PSP)
-        return openpayBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === POYNT_PSP) {
-        if (url !== void 0 && !isPoyntNonceUrl(url))
-            return { verdict: "refuse", code: "poynt_url_refused" };
-        return poyntBodyVerdict(body);
+    if (url.href !== raw || url.protocol !== "https:" || url.port || url.username || url.password || !own13(CARDLINK_VPOS_HOSTS, url.hostname) || url.pathname !== CARDLINK_VPOS_ENTRY_PATH)
+        return null;
+    return url.hostname;
+}
+function isCardlinkVposEntryUrl(raw) {
+    return cardlinkVposEntryHost(raw) !== null;
+}
+function parseCardlinkVposForm(body) {
+    if (typeof body !== "string" || body.length === 0 || body.length > MAX_ENTRY3 || /[^\x21-\x7e]/.test(body))
+        return null;
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            return null;
+        let key;
+        let value;
+        try {
+            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return null;
+        }
+        if (!/^[A-Za-z_.][A-Za-z0-9_.-]{0,63}$/.test(key) || value.length > MAX_VALUE || /[\u0000-\u001f\u007f]/.test(value))
+            return null;
+        if (seen.has(key))
+            return null;
+        seen.add(key);
+        pairs.push({ key, value });
     }
-    if (recognizer && recognizer.psp === CARDCOM_PSP)
-        return cardcomBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === TOAST_PSP) {
-        if (url !== void 0 && !isToastPaymentMethodsUrl(url))
-            return { verdict: "refuse", code: "toast_url_refused" };
-        return toastBodyVerdict(body);
+    return pairs;
+}
+function cardlinkVposMerchant(mid, vposHost, merchants = CARDLINK_VPOS_MERCHANTS) {
+    if (typeof mid !== "string" || typeof vposHost !== "string" || !Array.isArray(merchants))
+        return null;
+    const found = merchants.filter((row) => !!row && typeof row.merchant === "string" && row.merchant.trim() !== "" && row.mid === mid && row.vposHost === vposHost && typeof row.host === "string" && row.host !== "");
+    return found.length === 1 ? found[0] : null;
+}
+function entryAmount(values) {
+    const amount2 = values.get("orderAmount");
+    const code = values.get("currency");
+    const currency = typeof code === "string" && own13(CURRENCIES2, code) ? CURRENCIES2[code] : null;
+    if (!currency || typeof amount2 !== "string" || !/^(?:0|[1-9]\d{0,11})(?:\.\d{1,2})?$/.test(amount2))
+        return null;
+    const [whole2, fraction = ""] = amount2.split(".");
+    const cents2 = Number(whole2) * 100 + Number(fraction.padEnd(2, "0"));
+    return Number.isSafeInteger(cents2) && cents2 > 0 ? { amountCents: cents2, currency } : null;
+}
+function httpsUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
     }
-    if (recognizer && recognizer.psp === PAYU_LATAM_PSP)
-        return payuLatamBodyVerdict(body, url);
-    if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
-        if (url !== void 0 && !isPaddleVgsCardsUrl(url))
-            return { verdict: "refuse", code: "paddle_vgs_url_refused" };
-        return paddleVgsBodyVerdict(body);
+    catch {
+        return null;
     }
-    if (recognizer && recognizer.psp === PAYFAST_PSP) {
-        if (url !== void 0 && !isPayfastPayUrl(url))
-            return { verdict: "refuse", code: "payfast_url_refused" };
-        return payfastBodyVerdict(body);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.hash)
+        return null;
+    return url;
+}
+function checkCardlinkVposEntry(body, { url = null, merchants = CARDLINK_VPOS_MERCHANTS } = {}) {
+    const vposHost = cardlinkVposEntryHost(url);
+    if (!vposHost)
+        return field2("(url)", "malformed_field");
+    const pairs = parseCardlinkVposForm(body);
+    if (!pairs)
+        return field2("(body)", "malformed");
+    const values = new Map(pairs.map(({ key, value }) => [key, value]));
+    for (const { key } of pairs) {
+        if (KNOWN.has(key))
+            continue;
+        return field2(key, /^(?:card[._]|cvv|cmd$|trid$|st$|paystep$|paymentmethod$)/i.test(key) ? "card_in_entry" : "not_an_entry");
+    }
+    const missing = REQUIRED3.filter((name) => !values.get(name));
+    if (missing.length)
+        return { ok: false, code: "hosted_form_template_incomplete", missing };
+    if (values.get("version") !== "2")
+        return field2("version", "malformed");
+    if (!/^[A-Za-z0-9+/]{43}=$/.test(values.get("digest")))
+        return field2("digest", "unsigned");
+    for (const name of STORED2)
+        if (values.has(name))
+            return field2(name, "stored_credential");
+    for (const name of SPECIAL2)
+        if (values.get(name))
+            return field2(name, "special_flow");
+    for (let i = 1; i <= 9; i += 1)
+        if (/moto\s*=\s*true/i.test(values.get(`var${i}`) ?? ""))
+            return field2(`var${i}`, "moto");
+    if (values.has("trType") && values.get("trType") !== "1")
+        return field2("trType", "not_a_sale");
+    const method = values.get("payMethod");
+    if (method)
+        return field2("payMethod", /^iris$/i.test(method) ? "not_a_card_payment" : "special_flow");
+    const amount2 = entryAmount(values);
+    if (!amount2)
+        return field2(own13(CURRENCIES2, values.get("currency")) ? "orderAmount" : "currency", "malformed");
+    if (!/^\d{1,30}$/.test(values.get("mid")))
+        return field2("mid", "malformed");
+    if (!/^[A-Za-z0-9]{1,50}$/.test(values.get("orderid")))
+        return field2("orderid", "malformed");
+    const seller = cardlinkVposMerchant(values.get("mid"), vposHost, merchants);
+    if (!seller)
+        return field2("mid", "seller_unreviewed");
+    for (const name of ["confirmUrl", "cancelUrl"]) {
+        const target = httpsUrl(values.get(name));
+        if (!target || target.hostname !== seller.host)
+            return field2(name, "callback_host");
     }
-    if (recognizer && recognizer.psp === PAYREXX_PSP) {
-        return url !== void 0 ? payrexxGateVerdict(url, body) : payrexxBodyVerdict(body);
+    return {
+        ok: true,
+        pairs,
+        gated: false,
+        dedupe: [vposHost, values.get("mid"), values.get("orderid"), values.get("orderAmount"), values.get("currency")],
+        seller
+    };
+}
+function cardlinkVposEntryAmount(body) {
+    const pairs = parseCardlinkVposForm(body);
+    return pairs ? entryAmount(new Map(pairs.map(({ key, value }) => [key, value]))) : null;
+}
+var CARDLINK_VPOS_TDS2_FIELDS = Object.freeze([
+    "TDS2_Navigator_language",
+    "TDS2_Navigator_jsEnabled",
+    "TDS2_Navigator_javaEnabled",
+    "TDS2_Screen_colorDepth",
+    "TDS2_Screen_height",
+    "TDS2_Screen_width",
+    "TDS2_screen_pixelDepth",
+    "TDS2_TimezoneOffset"
+]);
+var PAGE_FIELDS = Object.freeze(["trid", "st", "payStep", "cmd", "startbonus", "bonusdata"]);
+var WALLET_FIELDS2 = Object.freeze(["walletId", "applePayResponse"]);
+var CARD38 = Object.freeze({ number: "card.pan", holder: "card.holderName", month: "card.expiryMonth", year: "card.expiryYear", cvc: "card.cvv" });
+var TEXT_CONTROLS = /* @__PURE__ */ new Set([CARD38.number, CARD38.holder, CARD38.cvc]);
+var SELECT_CONTROLS = /* @__PURE__ */ new Set([CARD38.month, CARD38.year]);
+var MAX_PAGE3 = 256 * 1024;
+var COOKIE_DOMAINS = Object.freeze({
+    "vpos.eurocommerce.gr": "eurocommerce.gr",
+    "ecommerce.cardlink.gr": "cardlink.gr",
+    "www.alphaecommerce.gr": "alphaecommerce.gr"
+});
+var POST_REQUIRED = Object.freeze(["trid", "st", "cmd", CARD38.number, CARD38.holder, CARD38.month, CARD38.year, CARD38.cvc, "makepayment"]);
+var POST_EMPTY = Object.freeze(["payStep", "startbonus", "bonusdata", ...WALLET_FIELDS2]);
+var POST_ALLOWED = /* @__PURE__ */ new Set([...POST_REQUIRED, ...POST_EMPTY, "paymentMethod", ...CARDLINK_VPOS_TDS2_FIELDS]);
+var CARDLINK_VPOS_REFUSALS = Object.freeze([
+    "cardlink_vpos_card_refused",
+    "cardlink_vpos_card_page",
+    "cardlink_vpos_3ds_challenge",
+    "cardlink_vpos_declined"
+]);
+var REFUSAL_FOR = Object.freeze({
+    card_refused: "cardlink_vpos_card_refused",
+    card_page: "cardlink_vpos_card_page",
+    challenge: "cardlink_vpos_3ds_challenge",
+    declined: "cardlink_vpos_declined"
+});
+var CARDLINK_VPOS_CAPABILITY = "cardlink_vpos_hosted_payment_page";
+var CARDLINK_VPOS_OPERATION = "cardlink_vpos.hosted_sale";
+var cardlink_vpos_default = /* @__PURE__ */ registerProcessor({
+    psp: CARDLINK_VPOS_PSP,
+    definitions: [
+        {
+            psp: "cardlink_vpos",
+            // The merchant's signed entry, as the header above reads it: a Document navigation that carries no card. The
+            // cardholder's device repeats it over the end-to-end TLS relay, fills the card into the page the VPOS returns
+            // and posts it in that same session, and the runtime resolves the paused navigation with the hosted_form notice.
+            // Only the entry path on the three live hosts is matched (isCardlinkVposEntryUrl). The card page posts to the same
+            // path, so the SDK fails every other post to these hosts in the agent's browser, and no placeholder card reaches
+            // the VPOS. The test hosts are listed so a live host classifies as live and the create refuses a test row there;
+            // no entry on them is paused. Ships dark: served only to a client that declares
+            // `cardlink_vpos_hosted_payment_page`, and gated off for every company the operator has not turned it on for.
+            capability: CARDLINK_VPOS_CAPABILITY,
+            match: "(?:vpos\\.eurocommerce\\.gr|ecommerce\\.cardlink\\.gr|www\\.alphaecommerce\\.gr)/vpos/shophandlermpi(?![\\w/.%;=!-])",
+            hosts: [
+                "^vpos\\.eurocommerce\\.gr$",
+                "^ecommerce\\.cardlink\\.gr$",
+                "^www\\.alphaecommerce\\.gr$",
+                "^eurocommerce-test\\.cardlink\\.gr$",
+                "^ecommerce-test\\.cardlink\\.gr$",
+                "^alphaecommerce-test\\.cardlink\\.gr$"
+            ],
+            sandboxHosts: ["^eurocommerce-test\\.cardlink\\.gr$", "^ecommerce-test\\.cardlink\\.gr$", "^alphaecommerce-test\\.cardlink\\.gr$"],
+            hostEnvironmentPinned: true,
+            encoding: "form",
+            // A form navigation: no captured header is ever replayed.
+            passthroughHeaders: [],
+            mode: "hosted_form",
+            hostedForm: {
+                // The card goes into the VPOS's own page on the device, never into the entry, which must carry none
+                // (checkCardlinkVposEntry). The entry's rules come with this registration (hostedEntry below), so no policy is
+                // named here.
+                cardIn: "processor_page",
+                required: [...REQUIRED3],
+                // The card page's own fields, which the device fills on that page.
+                card: { number: "card.pan", month: "card.expiryMonth", year: "card.expiryYear", cvc: "card.cvv" },
+                // The host, the mid, the order id and the amount name one payment; the entry's rules read the host from its URL.
+                dedupe: ["(vposHost)", "mid", "orderid", "orderAmount", "currency"]
+            }
+        }
+    ],
+    // Only the cardholder's device repeats an entry, after a person approves; no reviewed list names cardlink_vpos.
+    refusedOperations: [CARDLINK_VPOS_OPERATION],
+    // Not surveyed: the VPOS tells the merchant the result through the browser's return and a copy to its server, both
+    // signed under the merchant's secret, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isCardlinkVposEntryUrl,
+    hostedEntry: (body, { url }) => checkCardlinkVposEntry(body, { url }),
+    amount: (template) => template && isCardlinkVposEntryUrl(template.url) ? cardlinkVposEntryAmount(template.body) : null,
+    limitations: [
+        "The paused request is the merchant's signed entry form, which carries no card; the cardholder's device sends it to Cardlink's VPOS over the end-to-end TLS relay and fills the card into the page the VPOS returns.",
+        "Agentcard takes only a reviewed merchant's entry: its mid and the host it posts to name the merchant the cardholder is shown, and its confirm and cancel URLs must sit on that merchant's own host.",
+        "Agentcard takes one plain payment only and refuses an entry that asks for a stored card, installments, a recurring schedule, a pre-authorization, MOTO or a preselected payment method.",
+        "The VPOS runs EMV 3-D Secure on the card. A frictionless answer pays; a challenge ends the payment on the device with nothing charged.",
+        "The browser receives a submission notice, not the processor result."
+    ]
+});
+// src/processors/eghl.js
+var EGHL_PSP = "eghl";
+var EGHL_OPERATION = "eghl.hosted_sale";
+var EGHL_HOST = "securepay.e-ghl.com";
+var EGHL_SANDBOX_HOST = "test2pay.ghl.com";
+var LIVE_PATH = "/ipg/payment.aspx";
+var SANDBOX_PATH = "/ipgsg/payment.aspx";
+var MAX_URL2 = 8192;
+var field3 = (name, reason) => ({ ok: false, code: "hosted_form_field_refused", field: name, reason });
+function eghlEntry(raw) {
+    if (typeof raw !== "string" || raw.length > MAX_URL2 || raw.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
     }
-    if (recognizer && recognizer.psp === PAYGENT_PSP) {
-        return url !== void 0 ? paygentRequestVerdict(url, body) : paygentBodyVerdict(body);
+    catch {
+        return null;
     }
-    if (recognizer && recognizer.psp === PAY_NL_PSP) {
-        if (url !== void 0 && !isPayNlTokenUrl(url))
-            return { verdict: "refuse", code: "pay_nl_url_refused" };
-        return payNlBodyVerdict(body);
+    if (url.href !== raw || url.protocol !== "https:" || url.port || url.username || url.password || url.search.length < 2)
+        return null;
+    const path = url.pathname.toLowerCase();
+    const query = url.search.slice(1);
+    if (url.hostname === EGHL_HOST && path === LIVE_PATH)
+        return Object.freeze({ test: false, query });
+    if (url.hostname === EGHL_SANDBOX_HOST && path === SANDBOX_PATH)
+        return Object.freeze({ test: true, query });
+    return null;
+}
+function isEghlEntryUrl(raw) {
+    return eghlEntry(raw) !== null;
+}
+var EGHL_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "BookXcess", serviceId: "BXS", payee: "BookXcess Sdn Bhd", returnHosts: Object.freeze(["shopify.ghl.com:11443"]), test: false })
+]);
+var SERVICE_ID2 = /^[A-Za-z0-9]{3}$/;
+var HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+(?::[1-9]\d{0,4})?$/;
+function eghlMerchant(serviceId, { test = false, merchants = EGHL_MERCHANTS } = {}) {
+    if (typeof serviceId !== "string" || !SERVICE_ID2.test(serviceId) || !Array.isArray(merchants))
+        return null;
+    const found = merchants.filter((row) => !!row && typeof row.merchant === "string" && row.merchant.trim() !== "" && typeof row.payee === "string" && row.payee.trim() !== "" && row.serviceId === serviceId && row.test === test && Array.isArray(row.returnHosts) && row.returnHosts.length > 0 && row.returnHosts.every((host) => typeof host === "string" && HOST.test(host)));
+    return found.length === 1 ? found[0] : null;
+}
+var REQUIRED4 = Object.freeze([
+    "TransactionType",
+    "PymtMethod",
+    "ServiceID",
+    "PaymentID",
+    "OrderNumber",
+    "MerchantReturnURL",
+    "MerchantCallBackURL",
+    "Amount",
+    "CurrencyCode",
+    "HashValue"
+]);
+var CARD_KEYS17 = /* @__PURE__ */ new Set(["cardno", "cardexp", "cardcvv2", "cardholder", "param2", "param4", "cvv2", "epmonth2", "epyear2", "custocp"]);
+var SECRET_KEYS = /* @__PURE__ */ new Set(["password"]);
+var STORED_KEYS2 = /* @__PURE__ */ new Set([
+    "tokentype",
+    "token",
+    "cardid",
+    "precheckoutid",
+    "reqtoken",
+    "pairingtoken",
+    "reqverifier",
+    "pairingverifier",
+    "checkoutresourceurl"
+]);
+var SPECIAL_KEYS = /* @__PURE__ */ new Set(["eppmonth", "promocode"]);
+var RESULT_KEYS = Object.freeze(["MerchantReturnURL", "MerchantCallBackURL", "MerchantApprovalURL", "MerchantUnApprovalURL"]);
+var CURRENCIES3 = /* @__PURE__ */ new Set(["MYR", "SGD", "USD", "PHP", "THB"]);
+var AMOUNT3 = /^(0|[1-9]\d{0,8})\.(\d{2})$/;
+function httpsUrl2(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash)
+        return null;
+    return url;
+}
+function entryFields(text11) {
+    const pairs = parseRedsysForm(text11);
+    if (!pairs)
+        return null;
+    return { pairs, values: new Map(pairs.map(({ key, value }) => [key.toLowerCase(), value])) };
+}
+function entryAmount2(values) {
+    const currency = values.get("currencycode");
+    const amount2 = AMOUNT3.exec(values.get("amount") ?? "");
+    if (!amount2 || typeof currency !== "string" || !CURRENCIES3.has(currency))
+        return null;
+    const cents2 = Number(amount2[1]) * 100 + Number(amount2[2]);
+    return cents2 > 0 && Number.isSafeInteger(cents2) ? { amountCents: cents2, currency: currency.toLowerCase() } : null;
+}
+function checkEghlEntry(body, { url = null, merchants = EGHL_MERCHANTS } = {}) {
+    if (body !== void 0 && body !== null && body !== "")
+        return field3("(body)", "not_an_entry");
+    const entry = eghlEntry(url);
+    if (!entry)
+        return field3("(url)", "malformed_field");
+    const fields = entryFields(entry.query);
+    if (!fields)
+        return field3("(query)", "malformed");
+    const { pairs, values } = fields;
+    for (const { key, value } of pairs) {
+        if (value === "")
+            continue;
+        const folded = key.toLowerCase();
+        if (CARD_KEYS17.has(folded))
+            return field3(key, "card_in_entry");
+        if (SECRET_KEYS.has(folded))
+            return field3(key, "not_an_entry");
+        if (STORED_KEYS2.has(folded))
+            return field3(key, "stored_credential");
+        if (SPECIAL_KEYS.has(folded))
+            return field3(key, "special_flow");
+    }
+    const missing = REQUIRED4.filter((name) => !values.get(name.toLowerCase()));
+    if (missing.length)
+        return { ok: false, code: "hosted_form_template_incomplete", missing };
+    if (values.get("transactiontype") !== "SALE")
+        return field3("TransactionType", "not_a_sale");
+    if (!["ANY", "CC"].includes(values.get("pymtmethod")))
+        return field3("PymtMethod", "special_flow");
+    if (!/^[0-9A-Fa-f]{64}$/.test(values.get("hashvalue")))
+        return field3("HashValue", "unsigned");
+    if (!entryAmount2(values))
+        return field3(CURRENCIES3.has(values.get("currencycode")) ? "Amount" : "CurrencyCode", "malformed");
+    if (!SERVICE_ID2.test(values.get("serviceid")))
+        return field3("ServiceID", "malformed");
+    if (!/^[A-Za-z0-9._-]{1,20}$/.test(values.get("paymentid")))
+        return field3("PaymentID", "malformed");
+    if (values.get("ordernumber").length > 20)
+        return field3("OrderNumber", "malformed");
+    const pageTimeout = values.get("pagetimeout");
+    if (pageTimeout !== void 0 && !/^[1-9]\d{1,4}$/.test(pageTimeout))
+        return field3("PageTimeout", "malformed");
+    const seller = eghlMerchant(values.get("serviceid"), { test: entry.test, merchants });
+    if (!seller)
+        return field3("ServiceID", "seller_unreviewed");
+    for (const name of RESULT_KEYS) {
+        const value = values.get(name.toLowerCase());
+        if (!value)
+            continue;
+        const target = httpsUrl2(value);
+        if (!target || !seller.returnHosts.includes(target.host) || [EGHL_HOST, EGHL_SANDBOX_HOST].includes(target.hostname))
+            return field3(name, "callback_host");
+    }
+    return { ok: true, pairs, gated: false, dedupe: [values.get("serviceid"), values.get("paymentid")], sandbox: entry.test, seller };
+}
+function eghlEntryAmount(body, url) {
+    if (body !== void 0 && body !== null && body !== "")
+        return null;
+    const entry = eghlEntry(url);
+    const fields = entry ? entryFields(entry.query) : null;
+    return fields ? entryAmount2(fields.values) : null;
+}
+var MAX_PAGE4 = 1024 * 1024;
+var NEVER_SENT = new Set(["expressCheckoutType", "c2pRememberMeBrowser", "CustOCP", "CustRecurr", "CustAddress"].map((name) => name.toLowerCase()));
+var PAGE_REQUIRED = Object.freeze([
+    "TransactionType",
+    "ServiceID",
+    "MerchantName",
+    "PaymentID",
+    "Amount",
+    "BaseTxnAmount",
+    "CurrencyCode",
+    "BaseCurrencyCode",
+    "HashValue",
+    "Param2",
+    "Param4",
+    "CardExp",
+    "CVV2",
+    "PymtMethod"
+]);
+var EGHL_REFUSALS = Object.freeze(["eghl_failed", "eghl_cancelled"]);
+var MAX_ANSWER = 256 * 1024;
+var RESULT_FIELDS = Object.freeze(["TxnStatus", "ServiceID", "PaymentID", "Amount", "CurrencyCode"]);
+var eghl_default = /* @__PURE__ */ registerProcessor({
+    psp: EGHL_PSP,
+    definitions: [
+        {
+            psp: "eghl",
+            // The merchant's entry to eGHL's payment page, as the header above reads it: a GET Document navigation whose
+            // query names the payment and which carries no card. The cardholder's device repeats it over the end-to-end TLS
+            // relay and pays on the page eGHL returns to it, and the runtime resolves the paused navigation with the
+            // hosted_form notice. Only the entry is matched (isEghlEntryUrl): the card page's own card post goes to the same
+            // path as a POST. The path is matched in any letter case, as IIS reads it; `(?![\\w/.%-])` ends it for a consumer
+            // that tests `match` unanchored. Ships dark: served only to a client that declares `eghl_hosted_payment_page`, and
+            // gated off for every company the operator has not allowlisted.
+            capability: "eghl_hosted_payment_page",
+            match: "securepay\\.e-ghl\\.com/[Ii][Pp][Gg]/[Pp][Aa][Yy][Mm][Ee][Nn][Tt]\\.[Aa][Ss][Pp][Xx](?![\\w/.%-])|test2pay\\.ghl\\.com/[Ii][Pp][Gg][Ss][Gg]/[Pp][Aa][Yy][Mm][Ee][Nn][Tt]\\.[Aa][Ss][Pp][Xx](?![\\w/.%-])",
+            hosts: ["^securepay\\.e-ghl\\.com$", "^test2pay\\.ghl\\.com$"],
+            sandboxHosts: ["^test2pay\\.ghl\\.com$"],
+            hostEnvironmentPinned: true,
+            // `encoding` describes the card page's own card post, which the device makes as the page does, since the entry
+            // has no body. No captured header is ever replayed.
+            encoding: "form",
+            passthroughHeaders: [],
+            // The paused request is the navigation itself, a GET with the payment in its query.
+            request: { method: "GET", cardIn: "processor_page", response: "document" },
+            mode: "hosted_form",
+            hostedForm: {
+                // The card goes into eGHL's page on the device, never into the entry (checkEghlEntry refuses one there). The
+                // entry's own rules come with this registration (hostedEntry below), so no policy is named here.
+                cardIn: "processor_page",
+                required: ["TransactionType", "PymtMethod", "ServiceID", "PaymentID", "OrderNumber", "MerchantReturnURL", "MerchantCallBackURL", "Amount", "CurrencyCode", "HashValue"],
+                // The card page's own inputs in its card form (frmProcessPayment, read card free on 2026-11-05): the number in
+                // Param2, the expiry in CardExp as YYYYMM, which the page builds from its month and year selects, the code in
+                // CVV2. The cardholder's name goes in Param4.
+                card: { number: "Param2", expiry: "CardExp", cvc: "CVV2" },
+                // eGHL takes one PaymentID once per merchant.
+                dedupe: ["ServiceID", "PaymentID"]
+            }
+        }
+    ],
+    // Only the cardholder's device repeats an entry, after a person approves; no reviewed list names eghl.
+    refusedOperations: [EGHL_OPERATION],
+    // Not surveyed: eGHL tells the merchant's server the result (MerchantCallBackURL), and its return carries a hash only
+    // the merchant can check.
+    settlementReadback: "not_surveyed",
+    exactUrl: isEghlEntryUrl,
+    amount: (template) => template && typeof template === "object" ? eghlEntryAmount(template.body, template.url) : null,
+    hostedEntry: (body, { url = null } = {}) => checkEghlEntry(body, { url }),
+    limitations: [
+        "The paused request is the merchant's redirect to eGHL's payment page, a GET whose query names the payment and carries no card; the cardholder's device repeats it over the end-to-end TLS relay and pays on the page eGHL returns.",
+        "Agentcard takes an entry only for a merchant it reviewed, by the ServiceID inside the merchant's signed entry, and the approval names that merchant and the amount the entry names.",
+        "eGHL runs 3-D Secure on the card. A challenge ends the payment on the device with nothing charged.",
+        "eGHL sends the buyer to the merchant's return page with a result only the merchant can verify, so the browser receives a submission notice, not the processor result."
+    ]
+});
+// src/processors/frisbii.js
+var FRISBII_PSP = "frisbii";
+var FRISBII_OPERATION = "frisbii.card_request";
+var FRISBII_HOSTS = /* @__PURE__ */ Object.freeze({ "card.reepay.com": "reepay", "card.frisbii.com": "frisbii" });
+var FRISBII_TOKEN_PATH = "/v1/token/";
+var FRISBII_REFUSED_PATHS = /* @__PURE__ */ Object.freeze({
+    "/v1/token/cof/": "frisbii_stored_card_unsupported",
+    "/v1/token/create_click_to_pay": "frisbii_click_to_pay_unsupported"
+});
+var BODY_LIMIT37 = 8192;
+var URL_LIMIT15 = 256;
+var CARD_NUMBER19 = /^[0-9]{12,19}$/;
+var MONTH19 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR20 = /^[0-9]{2}$/;
+var SECURITY_CODE23 = /^(?:[0-9]{3,4})?$/;
+var IDENTIFIER2 = /^[A-Za-z0-9_-]{8,128}$/;
+var SCA_RULES = /* @__PURE__ */ Object.freeze([
+    "DO_NOT_USE_SCA",
+    "MUST_USE_SCA_AUTH",
+    "MUST_USE_SCA_PREAUTH",
+    "USE_SCA_IF_AVAILABLE_AUTH",
+    "USE_SCA_IF_AVAILABLE_PREAUTH"
+]);
+var BODY_ORDER = /* @__PURE__ */ Object.freeze([
+    "number",
+    "month",
+    "year",
+    "cvv",
+    "cardTypeOverride",
+    "click_to_pay_encrypt",
+    "billing_address",
+    "pkey",
+    "recurring",
+    "cardholder_name",
+    "intent",
+    "recurringAverageAmount",
+    "agreementFilter",
+    "strongAuthenticationRule",
+    "tokenStrongAuthenticationRequest"
+]);
+var BODY_REQUIRED = /* @__PURE__ */ Object.freeze(["number", "month", "year", "cvv", "pkey", "recurring", "strongAuthenticationRule"]);
+var BODY_REFUSED = /* @__PURE__ */ Object.freeze(["cardTypeOverride", "click_to_pay_encrypt", "billing_address"]);
+var SCA_ORDER = /* @__PURE__ */ Object.freeze(["amount", "currency", "orderId", "orderText", "merchantScaData", "returnUrl", "tokenBrowserInfo"]);
+var BROWSER_ORDER = /* @__PURE__ */ Object.freeze([
+    "javascriptEnabled",
+    "challengeWindowSize",
+    "colorDepth",
+    "javaEnabled",
+    "screenHeight",
+    "screenWidth",
+    "tz"
+]);
+var LABEL = /^[A-Za-z0-9_-]{1,64}$/;
+var record33 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own14 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse39 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD39 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var text9 = (value, max) => typeof value === "string" && value.length <= max;
+var absentOrNull = (value) => value === void 0 || value === null;
+var inOrder6 = (value, order) => Object.keys(value).every((key) => order.includes(key)) && Object.keys(value).join() === order.filter((key) => own14(value, key)).join();
+function frisbiiTokenUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT15 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own14(FRISBII_HOSTS, parsed.hostname) || parsed.pathname !== FRISBII_TOKEN_PATH)
+        return null;
+    const match = /^\?session=([A-Za-z0-9_-]{8,128})$/.exec(parsed.search);
+    return match ? Object.freeze({ host: parsed.hostname, brand: FRISBII_HOSTS[parsed.hostname], session: match[1] }) : null;
+}
+var isFrisbiiTokenUrl = (url) => frisbiiTokenUrl(url) !== null;
+function frisbiiRefusedFlowUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT15 || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own14(FRISBII_HOSTS, parsed.hostname) || !own14(FRISBII_REFUSED_PATHS, parsed.pathname))
+        return null;
+    return FRISBII_REFUSED_PATHS[parsed.pathname];
+}
+function luhn9(digits4) {
+    let sum = 0;
+    for (let at = digits4.length - 1, double = false; at >= 0; at -= 1, double = !double) {
+        let digit = digits4.charCodeAt(at) - 48;
+        if (double)
+            digit = digit * 2 > 9 ? digit * 2 - 9 : digit * 2;
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function readBody23(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT37)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record33(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function browserInfo(info) {
+    return record33(info) && Object.keys(info).join() === BROWSER_ORDER.join() && info.javascriptEnabled === true && typeof info.javaEnabled === "boolean" && /^size_[0-9]{3}x[0-9]{3}$/.test(info.challengeWindowSize) && [info.colorDepth, info.screenHeight, info.screenWidth].every((n) => Number.isSafeInteger(n) && n >= 0 && n <= 1e5) && Number.isSafeInteger(info.tz) && Math.abs(info.tz) <= 1440;
+}
+function scaBlock(block, target) {
+    if (!record33(block) || !inOrder6(block, SCA_ORDER) || !own14(block, "returnUrl") || !own14(block, "tokenBrowserInfo"))
+        return false;
+    if (!Number.isSafeInteger(block.amount) || block.amount < 0 || typeof block.currency !== "string" || !/^[A-Z]{3}$/.test(block.currency))
+        return false;
+    if (!(absentOrNull(block.orderId) || text9(block.orderId, 128)) || !(absentOrNull(block.orderText) || text9(block.orderText, 512)))
+        return false;
+    if (!(absentOrNull(block.merchantScaData) || record33(block.merchantScaData)))
+        return false;
+    if (!text9(block.returnUrl, 2048) || !browserInfo(block.tokenBrowserInfo))
+        return false;
+    const back = /^https:\/\/checkout\.(reepay|frisbii)\.com\/return\.001\.html\?id=([A-Za-z0-9_-]{8,128})(?:&[A-Za-z0-9_.~%=+/-]*)*$/.exec(block.returnUrl);
+    return back !== null && (target === null || back[1] === target.brand && back[2] === target.session);
+}
+function frisbiiBodyVerdict(body, url) {
+    const value = readBody23(body);
+    if (value === null || !inOrder6(value, BODY_ORDER) || !BODY_REQUIRED.every((key) => own14(value, key)) || BODY_REFUSED.some((key) => own14(value, key)))
+        return refuse39("frisbii_body_unsupported");
+    if (value.recurring === true || value.intent === "CHARGE_AND_STORE")
+        return refuse39("frisbii_card_on_file");
+    const target = url === void 0 ? null : frisbiiTokenUrl(url);
+    if (url !== void 0 && target === null)
+        return refuse39("frisbii_body_unsupported");
+    const sound = typeof value.number === "string" && CARD_NUMBER19.test(value.number) && luhn9(value.number) && typeof value.month === "string" && MONTH19.test(value.month) && typeof value.year === "string" && YEAR20.test(value.year) && typeof value.cvv === "string" && SECURITY_CODE23.test(value.cvv) && typeof value.pkey === "string" && IDENTIFIER2.test(value.pkey) && value.recurring === false && (value.cardholder_name === void 0 || text9(value.cardholder_name, 64)) && (value.intent === void 0 || value.intent === "CHARGE") && (absentOrNull(value.recurringAverageAmount) || Number.isSafeInteger(value.recurringAverageAmount) && value.recurringAverageAmount >= 0) && (absentOrNull(value.agreementFilter) || typeof value.agreementFilter === "string" && LABEL.test(value.agreementFilter) || Array.isArray(value.agreementFilter) && value.agreementFilter.length <= 16 && value.agreementFilter.every((entry) => typeof entry === "string" && LABEL.test(entry))) && SCA_RULES.includes(value.strongAuthenticationRule) && (value.tokenStrongAuthenticationRequest === void 0 || scaBlock(value.tokenStrongAuthenticationRequest, target));
+    return sound ? CARD39 : refuse39("frisbii_body_unsupported");
+}
+var frisbii_default = /* @__PURE__ */ registerProcessor({
+    psp: FRISBII_PSP,
+    definitions: [
+        {
+            psp: "frisbii",
+            // The hosted page's card request, as the header above reads it, on both brands' card hosts. A test account
+            // shares the live hosts, so no sandbox host is marked. The match reads the host and the path and ends with it. It
+            // also takes the page's two other card paths, /v1/token/cof/ and /v1/token/create_click_to_pay, so the pause
+            // decision holds them, and the body gate refuses every body there; the exact-URL rule below holds the session
+            // query of the card request. Ships dark: served only to a client that declares `frisbii_card_token`, and only for a company
+            // the backend's processor gate turns Frisbii on for.
+            capability: "frisbii_card_token",
+            match: "card\\.(?:reepay|frisbii)\\.com/v1/token/(?:cof/|create_click_to_pay)?",
+            hosts: ["^card\\.reepay\\.com$", "^card\\.frisbii\\.com$"],
+            encoding: "json",
+            // The page sends no header but its content type. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            jsonCardFields: [["number"]]
+        }
+    ],
+    // Only the cardholder's device would send this card, after a person approves; no reviewed list names frisbii.
+    refusedOperations: [FRISBII_OPERATION],
+    // Not surveyed: the card request mints a token and moves no money, and the page then charges the session with it
+    // in a card-free request. Whether the session's own read (checkout-api /v1/checkout/<session>) can confirm that
+    // charge was not read.
+    settlementReadback: "not_surveyed",
+    exactUrl: (url) => isFrisbiiTokenUrl(url) || frisbiiRefusedFlowUrl(url) !== null,
+    // A stored card's token and Click to Pay are refused whatever their body; the card request is judged by its body.
+    bodyGate: (url, body) => {
+        if (url === void 0)
+            return frisbiiBodyVerdict(body);
+        const flow = frisbiiRefusedFlowUrl(url);
+        if (flow !== null)
+            return refuse39(flow);
+        return isFrisbiiTokenUrl(url) ? frisbiiBodyVerdict(body, url) : refuse39("frisbii_url_refused");
+    },
+    limitations: ["A live Frisbii card goes only to a merchant account a reviewed pin lists, and none is pinned yet."]
+});
+// src/processors/iyzico.js
+var IYZICO_PSP = "iyzico";
+var IYZICO_OPERATION = "iyzico.card_request";
+var PATHS = ["/payment/iyzipos/checkoutform/auth/ecom", "/payment/iyzipos/checkoutform/initialize3ds/ecom"];
+var IYZICO_CARD_URLS = /* @__PURE__ */ Object.freeze(["https://api.iyzipay.com", "https://sandbox-api.iyzipay.com"].flatMap((origin) => PATHS.map((path) => `${origin}${path}`)));
+var IYZICO_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "installment",
+    "paidPrice",
+    "paymentChannel",
+    "paymentCard",
+    "buyerProtected",
+    "gsmNumber",
+    "dccPayment",
+    "dccQueryRrn",
+    "pwiMetadata"
+]);
+var IYZICO_CARD_KEYS = /* @__PURE__ */ Object.freeze([
+    "cardNumber",
+    "cardHolderName",
+    "expireYear",
+    "expireMonth",
+    "cvc",
+    "registerConsumerCard",
+    "registerCard"
+]);
+var BODY_LIMIT38 = 4096;
+var CARD_NUMBER20 = /^[0-9]{12,19}$/;
+var SECURITY_CODE24 = /^[0-9]{3,4}$/;
+var MONTH20 = /^(?:0?[1-9]|1[0-2])$/;
+var YEAR21 = /^(?:[0-9]{2}|20[0-9]{2})$/;
+var PRICE = /^([1-9][0-9]{0,8}|0)(?:\.([0-9]{1,2}))?$/;
+var CHANNELS = /* @__PURE__ */ Object.freeze(["WEB", "MOBILE_WEB", "MOBILE_IOS", "MOBILE_ANDROID", "MOBILE_WINDOWS"]);
+var METADATA_KEYS3 = /* @__PURE__ */ Object.freeze(["lightRedesign", "pwiGrowthActionDisabled"]);
+var FLAG = /^[A-Za-z_]{1,16}$/;
+var HOLDER5 = /^[^\x00-\x1f\x7f0-9]{3,100}$/u;
+var record34 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own15 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder7 = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse40 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD40 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isIyzicoCardUrl(url) {
+    return typeof url === "string" && IYZICO_CARD_URLS.includes(url);
+}
+function readBody24(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT38)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record34(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hundredths(price) {
+    const match = typeof price === "number" && Number.isFinite(price) ? PRICE.exec(String(price)) : null;
+    const value = match ? Number(match[1]) * 100 + Number((match[2] ?? "").padEnd(2, "0")) : 0;
+    return value > 0 ? value : null;
+}
+var holderName2 = (name) => typeof name === "string" && HOLDER5.test(name) && name.trim().split(/\s+/).filter((word) => word.length > 1).length > 1;
+var metadata = (value) => record34(value) && inOrder7(value, METADATA_KEYS3) && Object.values(value).every((flag3) => Array.isArray(flag3) && flag3.length === 1 && typeof flag3[0] === "string" && FLAG.test(flag3[0]));
+function iyzicoBodyVerdict(body) {
+    const value = readBody24(body);
+    if (value === null)
+        return refuse40("iyzico_body_unsupported");
+    const card = value.paymentCard;
+    if (record34(card) && (own15(card, "cardToken") || own15(card, "ucsToken") || own15(card, "consumerToken")) && !own15(card, "cardNumber"))
+        return refuse40("iyzico_saved_card");
+    if (own15(value, "dccPayment") || own15(value, "dccQueryRrn"))
+        return refuse40("iyzico_dcc_refused");
+    if (own15(value, "gsmNumber") || own15(value, "buyerProtected") && value.buyerProtected !== false || record34(card) && (own15(card, "registerCard") && card.registerCard !== 0 || own15(card, "registerConsumerCard") && card.registerConsumerCard !== false)) {
+        return refuse40("iyzico_keeps_card");
+    }
+    if (Number.isSafeInteger(value.installment) && value.installment > 1)
+        return refuse40("iyzico_installments_refused");
+    if (!inOrder7(value, IYZICO_BODY_KEYS) || !["installment", "paidPrice", "paymentChannel", "paymentCard"].every((key) => own15(value, key)) || value.installment !== 1 || hundredths(value.paidPrice) === null || !CHANNELS.includes(value.paymentChannel) || own15(value, "pwiMetadata") && !metadata(value.pwiMetadata))
+        return refuse40("iyzico_body_unsupported");
+    if (!record34(card) || Object.keys(card).join() !== IYZICO_CARD_KEYS.join() || typeof card.cardNumber !== "string" || !CARD_NUMBER20.test(card.cardNumber) || !holderName2(card.cardHolderName) || typeof card.expireYear !== "string" || !YEAR21.test(card.expireYear) || typeof card.expireMonth !== "string" || !MONTH20.test(card.expireMonth) || typeof card.cvc !== "string" || !SECURITY_CODE24.test(card.cvc))
+        return refuse40("iyzico_body_unsupported");
+    return CARD40;
+}
+var iyzico_default = /* @__PURE__ */ registerProcessor({
+    psp: IYZICO_PSP,
+    definitions: [
+        {
+            psp: "iyzico",
+            // The Checkout Form's card payment, as the header above reads it. Sandbox has its own host, so the device sends
+            // a test-mode payment only iyzico's documented test cards (hostEnvironmentPinned, device-replay.js S7). Ships dark:
+            // served only to a client that declares `iyzico_checkout_form`, for a company the backend's gate turns iyzico on
+            // for, and autopilot never sends it.
+            capability: "iyzico_checkout_form",
+            match: "(?:sandbox-)?api\\.iyzipay\\.com/payment/iyzipos/checkoutform/(?:auth|initialize3ds)/ecom",
+            hosts: ["^api\\.iyzipay\\.com$", "^sandbox-api\\.iyzipay\\.com$"],
+            sandboxHosts: ["^sandbox-api\\.iyzipay\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The form's session token and its Accept. Origin, Referer and cookies never ride, and neither does IYZI_LC,
+            // which iyzico's preflight does not allow.
+            passthroughHeaders: ["^x-iyzi-token$", "^accept$"],
+            jsonCardFields: [["paymentCard", "cardNumber"]]
+        }
+    ],
+    // Only the cardholder's device sends it, after a person approves; 3-D Secure needs that person at the browser.
+    refusedOperations: [IYZICO_OPERATION],
+    // iyzico answers the form's result (CF retrieve) only to the merchant's API key and secret.
+    settlementReadback: {
+        answer: "none",
+        reason: "merchant_credential_required",
+        note: "The processor answers a payment result only to the server credentials of the shop; the intercepted request carries a checkout reference and no credential.",
+        source: "https://docs.iyzico.com/en/payment-methods/checkoutform/cf-implementation/cf-retrieve"
+    },
+    exactUrl: isIyzicoCardUrl,
+    bodyGate: (url, body) => url !== void 0 && !isIyzicoCardUrl(url) ? refuse40("iyzico_url_refused") : iyzicoBodyVerdict(body)
+});
+// src/processors/midtrans.js
+var MIDTRANS_PSP = "midtrans";
+var MIDTRANS_OPERATION = "midtrans.card_request";
+var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
+var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
+var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
+var BODY_LIMIT39 = 4096;
+var CARD_NUMBER21 = /^[0-9]{12,19}$/;
+var SECURITY_CODE25 = /^[0-9]{3,4}$/;
+var MONTH21 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR22 = /^20[0-9]{2}$/;
+var TERM = /^[0-9]{1,3}$/;
+var record35 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own16 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var inOrder8 = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var refuse41 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD41 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function isMidtransTokenUrl(url) {
+    return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
+}
+function readBody25(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT39)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record35(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function midtransBodyVerdict(body) {
+    const value = readBody25(body);
+    if (value === null || !inOrder8(value, MIDTRANS_TOKEN_KEYS)) {
+        if (record35(value) && (own16(value, "token_id") || own16(value, "two_click")) && !own16(value, "card_number"))
+            return refuse41("midtrans_saved_card");
+        return refuse41("midtrans_body_unsupported");
+    }
+    if (!own16(value, "card_cvv") || !own16(value, "card_number") || !own16(value, "card_exp_month") || !own16(value, "card_exp_year")) {
+        return refuse41("midtrans_body_unsupported");
+    }
+    if (typeof value.card_cvv !== "string" || !SECURITY_CODE25.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER21.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH21.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR22.test(value.card_exp_year))
+        return refuse41("midtrans_body_unsupported");
+    if (own16(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
+        return refuse41("midtrans_body_unsupported");
+    return CARD41;
+}
+var midtrans_default = /* @__PURE__ */ registerProcessor({
+    psp: MIDTRANS_PSP,
+    definitions: [
+        {
+            psp: "midtrans",
+            // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
+            // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
+            // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
+            // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
+            capability: "midtrans_card_token",
+            match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
+            hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
+            sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
+            // cookies never ride.
+            passthroughHeaders: ["^authorization$", "^x-service$"],
+            jsonCardFields: [["card_number"]]
+        }
+    ],
+    // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
+    refusedOperations: [MIDTRANS_OPERATION],
+    // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
+    settlementReadback: "not_surveyed",
+    exactUrl: isMidtransTokenUrl,
+    bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
+});
+// src/processors/monei.js
+var MONEI_PSP = "monei";
+var MONEI_OPERATION = "monei.card_request";
+var MONEI_TOKENS_URL = "https://api.monei.com/v1/tokens";
+var BODY_LIMIT40 = 1024;
+var PAYMENT_ID = /^(?:[0-9a-f]{32}|[0-9a-f]{40})$/;
+var MONEI_CARD_KEYS = /* @__PURE__ */ Object.freeze(["number", "expMonth", "expYear", "cvc"]);
+var NUMBER8 = /^[0-9]{12,19}$/;
+var MONTH22 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR23 = /^[0-9]{2}$/;
+var CODE8 = /^[0-9]{3,4}$/;
+var record36 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var keysAre2 = (value, keys) => {
+    const found = Object.keys(value);
+    return found.length === keys.length && found.every((key, at) => key === keys[at]);
+};
+var refuse42 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD42 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn10(digits4) {
+    let sum = 0;
+    for (let at = 0; at < digits4.length; at += 1) {
+        let digit = Number(digits4[digits4.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function isMoneiTokensUrl(url) {
+    return url === MONEI_TOKENS_URL;
+}
+function readBody26(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT40)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record36(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function moneiBodyVerdict(body, url) {
+    if (url !== void 0 && !isMoneiTokensUrl(url))
+        return refuse42("monei_url_refused");
+    const value = readBody26(body);
+    if (value === null || !keysAre2(value, ["paymentId", "paymentMethod"]) || typeof value.paymentId !== "string" || !PAYMENT_ID.test(value.paymentId))
+        return refuse42("monei_body_unsupported");
+    const method = value.paymentMethod;
+    if (!record36(method) || !keysAre2(method, ["card"]) || !record36(method.card) || !keysAre2(method.card, MONEI_CARD_KEYS))
+        return refuse42("monei_body_unsupported");
+    const { number, expMonth, expYear, cvc } = method.card;
+    if (![number, expMonth, expYear, cvc].every((part) => typeof part === "string"))
+        return refuse42("monei_body_unsupported");
+    if (!NUMBER8.test(number) || !luhn10(number) || !MONTH22.test(expMonth) || !YEAR23.test(expYear) || !CODE8.test(cvc))
+        return refuse42("monei_body_unsupported");
+    return CARD42;
+}
+var MONEI_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ merchant: "Genuins", accountIds: Object.freeze(["8d58ab4c-4ad0-4053-b18f-79d80e9ee158"]), merchantUrls: Object.freeze(["https://genuins.com/"]) })
+]);
+var monei_default = /* @__PURE__ */ registerProcessor({
+    psp: MONEI_PSP,
+    definitions: [
+        {
+            psp: "monei",
+            // The card frame's token request, as the header above reads it. One host serves test and live payments alike,
+            // so no sandbox host is marked: MONEI's record of the payment names its mode, and the device sends a test payment
+            // only MONEI's documented test cards (moneiDeviceRefusal). The frame sets no deadline on the fetch, so the
+            // cardholder approves at the shopper's Pay. `(?![\w/.%-])` ends the path for a consumer that tests `match`
+            // unanchored, and the exact-URL rule below holds the rest. Ships dark: served only to a client that declares
+            // `monei_card_token`, and gated off for every company until the backend's gate names one.
+            capability: "monei_card_token",
+            match: "api\\.monei\\.com/v1/tokens(?![\\w/.%-])",
+            hosts: ["^api\\.monei\\.com$"],
+            encoding: "json",
+            // The frame's two device headers. Origin, Referer and cookies never ride.
+            passthroughHeaders: ["^x-client-env$", "^x-client-fingerprint$"],
+            jsonCardFields: [["paymentMethod", "card", "number"]]
+        }
+    ],
+    // Only the cardholder's device sends a card, after a person approves; no reviewed list names monei.
+    refusedOperations: [MONEI_OPERATION],
+    // Not surveyed: the card request mints a token and moves no money; MONEI's confirm, which the page sends, charges it.
+    settlementReadback: "not_surveyed",
+    exactUrl: isMoneiTokensUrl,
+    bodyGate: (url, body) => moneiBodyVerdict(body, url)
+    // No amount reader: the request names none. MONEI's record of the payment names it, and the device holds that record
+    // to the approved amount before it writes any card.
+});
+// src/processors/oceanpayment.js
+var OCEANPAYMENT_PSP = "oceanpayment";
+var OCEANPAYMENT_OPERATION = "oceanpayment.card_request";
+var OCEANPAYMENT_HOSTS = /* @__PURE__ */ Object.freeze({ "secure.oceanpayment.com": "production", "test-secure.oceanpayment.com": "sandbox" });
+var OCEANPAYMENT_FORM_FIELDS = /* @__PURE__ */ Object.freeze([
+    "card_number_three",
+    "card_number_two",
+    "card_number_temp",
+    "card_number",
+    "card_date",
+    "card_year",
+    "card_month",
+    "card_secureCode",
+    "copyCard",
+    "closePage",
+    "starttime",
+    "endtime",
+    "comloadpage",
+    "timezone",
+    "OSLang",
+    "os",
+    "brower",
+    "BrowerLang",
+    "resolution",
+    "methods",
+    "reference_id",
+    "methods",
+    "reference"
+]);
+var URL_LIMIT16 = 2048;
+var BODY_LIMIT41 = 8192;
+var SEND_PAY = /^\/gateway\/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}$/;
+var own17 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact4 = (pattern, value) => typeof value === "string" && pattern.test(value);
+var CARD_RUN = /[0-9]{12}/;
+var printable5 = (max) => (value) => typeof value === "string" && value.length <= max && /^[\x20-\x7e]*$/.test(value) && !CARD_RUN.test(value);
+var STAMP = /^(?:|20[0-9]{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01]) (?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3})$/;
+var LANGUAGE4 = /^(?:|[A-Za-z]{2,8}(?:[-_][A-Za-z0-9]{1,8}){0,3})$/;
+var SHAPES2 = /* @__PURE__ */ new Map([
+    ["customerCardType", (v) => v === ""],
+    // The page's paste and typing markers: "0" until typed, the number's length when its key handler read it, or "N"
+    // after a paste.
+    ["card_number_three", (v) => exact4(/^(?:0|N|[1-9]|1[0-9])$/, v)],
+    ["card_number_two", (v) => exact4(/^(?:0|[1-9]|1[0-9])$/, v)],
+    ["card_number_temp", (v) => exact4(/^[0-9]{4}(?: ?[0-9]{4}){3}$/, v)],
+    ["card_number", (v) => exact4(/^[0-9]{16}$/, v)],
+    ["card_date", (v) => exact4(/^(?:0[1-9]|1[0-2])\/[0-9]{2}$/, v)],
+    ["card_year", (v) => exact4(/^20[0-9]{2}$/, v)],
+    ["card_month", (v) => exact4(/^(?:0[1-9]|1[0-2])$/, v)],
+    ["card_secureCode", (v) => exact4(/^[0-9]{3,4}$/, v)],
+    ["copyCard", (v) => v === "" || v === "0" || v === "1"],
+    // PAY NOW's handler sets it to 1 before the page submits.
+    ["closePage", (v) => v === "1"],
+    ["starttime", (v) => exact4(STAMP, v)],
+    ["endtime", (v) => exact4(STAMP, v)],
+    ["comloadpage", (v) => v === "0" || v === "1"],
+    // getTimezoneOffset()/60*-1: whole or fractional hours.
+    ["timezone", (v) => exact4(/^(?:|-?(?:[0-9]|1[0-4])(?:\.[0-9]{1,2})?)$/, v)],
+    ["OSLang", (v) => exact4(LANGUAGE4, v)],
+    ["os", printable5(64)],
+    ["brower", printable5(128)],
+    ["BrowerLang", (v) => exact4(LANGUAGE4, v)],
+    ["resolution", printable5(32)],
+    ["methods", (v) => v === "1"],
+    ["reference_id", (v) => v === ""],
+    // The page's own trade number.
+    ["reference", (v) => exact4(/^[0-9]{1,40}$/, v)],
+    ["button", (v) => v === ""]
+]);
+function oceanpaymentSendPayUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT16 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own17(OCEANPAYMENT_HOSTS, parsed.hostname) || !SEND_PAY.test(parsed.pathname))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: OCEANPAYMENT_HOSTS[parsed.hostname] });
+}
+var isOceanpaymentSendPayUrl = (url) => oceanpaymentSendPayUrl(url) !== null;
+function formEncode3(value) {
+    let encoded;
+    try {
+        encoded = encodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+    return encoded.replace(/[!'()~]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%20/g, "+");
+}
+function formDecode2(raw) {
+    if (!/^(?:[A-Za-z0-9*._+-]|%[0-9A-F]{2})*$/.test(raw))
+        return null;
+    let value;
+    try {
+        value = decodeURIComponent(raw.replace(/\+/g, "%20"));
+    }
+    catch {
+        return null;
+    }
+    return formEncode3(value) === raw ? value : null;
+}
+function readPairs2(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT41)
+        return null;
+    const pairs = [];
+    for (const chunk of body.split("&")) {
+        const separator = chunk.indexOf("=");
+        if (separator < 1)
+            return null;
+        const rawName = chunk.slice(0, separator), raw = chunk.slice(separator + 1);
+        const name = formDecode2(rawName), value = formDecode2(raw);
+        if (name === null || value === null)
+            return null;
+        pairs.push({ name, rawName, raw, value });
+    }
+    return pairs;
+}
+function formPairs(body) {
+    const pairs = readPairs2(body);
+    if (!pairs)
+        return null;
+    const start = pairs[0].name === "customerCardType" ? 1 : 0;
+    const end = pairs[pairs.length - 1].name === "button" ? pairs.length - 1 : pairs.length;
+    if (end - start !== OCEANPAYMENT_FORM_FIELDS.length || OCEANPAYMENT_FORM_FIELDS.some((name, i) => pairs[start + i].name !== name))
+        return null;
+    return pairs;
+}
+var valueOf = (pairs, name) => pairs.find((pair) => pair.name === name)?.value;
+function bodyRefusal(body) {
+    const pairs = formPairs(body);
+    if (!pairs)
+        return "oceanpayment_body_unsupported";
+    if (pairs[0].name === "customerCardType" && pairs[0].value !== "")
+        return "oceanpayment_card_brand_refused";
+    if (valueOf(pairs, "reference_id") !== "")
+        return "oceanpayment_device_data_refused";
+    if (pairs.some(({ name, value }) => !SHAPES2.get(name)(value)))
+        return "oceanpayment_body_unsupported";
+    const number = valueOf(pairs, "card_number");
+    const temp = valueOf(pairs, "card_number_temp");
+    const [month, year] = valueOf(pairs, "card_date").split("/");
+    if (temp.replace(/ /g, "") !== number || temp !== number && temp !== spaced(number))
+        return "oceanpayment_body_unsupported";
+    if (valueOf(pairs, "card_month") !== month || valueOf(pairs, "card_year") !== `20${year}`)
+        return "oceanpayment_body_unsupported";
+    return null;
+}
+var spaced = (number) => number.replace(/([0-9]{4})(?=[0-9])/g, "$1 ");
+function oceanpaymentBodyVerdict(body) {
+    const code = bodyRefusal(body);
+    return code ? Object.freeze({ verdict: "refuse", code }) : Object.freeze({ verdict: "card" });
+}
+var oceanpayment_default = /* @__PURE__ */ registerProcessor({
+    psp: OCEANPAYMENT_PSP,
+    definitions: [
+        {
+            psp: "oceanpayment",
+            // The hosted page's card post, as the header above reads it. The sandbox has its own host, so a test row's device
+            // sends only Oceanpayment's documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `oceanpayment_hosted_payment_page`, and only for a company the
+            // backend's processor gate turns Oceanpayment on for. `(?![\w/.%;=!-])` ends the path for a consumer that tests
+            // `match` unanchored.
+            capability: "oceanpayment_hosted_payment_page",
+            match: "(?:test-)?secure\\.oceanpayment\\.com/gateway/sendPay;jsessionid=[A-Za-z0-9._!-]{16,128}(?![\\w/.%;=!-])",
+            hosts: ["^secure\\.oceanpayment\\.com$", "^test-secure\\.oceanpayment\\.com$"],
+            sandboxHosts: ["^test-secure\\.oceanpayment\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "form",
+            // A form navigation: nothing but its type is replayed. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            cardFields: ["card_number"]
+        }
+    ],
+    // Only the cardholder's device sends this card, after a person approves; no reviewed list names oceanpayment.
+    refusedOperations: [OCEANPAYMENT_OPERATION],
+    // Not surveyed: Oceanpayment tells the merchant's server the result (its noticeUrl), and reading a payment back takes the
+    // merchant's own secure code, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isOceanpaymentSendPayUrl,
+    bodyGate: (url, body) => url !== void 0 && !isOceanpaymentSendPayUrl(url) ? Object.freeze({ verdict: "refuse", code: "oceanpayment_url_refused" }) : oceanpaymentBodyVerdict(body)
+    // No amount reader: the post names none, so the agent's pair is the figure the cardholder approves.
+});
+// src/processors/paymentwall.js
+var PAYMENTWALL_PSP = "paymentwall";
+var PAYMENTWALL_OPERATION = "paymentwall.card_request";
+var PAYMENTWALL_TOKEN_URL = "https://pwgateway.com/api/token";
+var PAYMENTWALL_SANDBOX_TOKEN_URL = "https://api.paymentwall.com/api/brick/token";
+var BODY_LIMIT42 = 2048;
+var KEY3 = "public_key";
+var PUBLIC_KEY2 = /^(?:t_)?[A-Za-z0-9]{16,64}$/;
+var SHAPES3 = /* @__PURE__ */ Object.freeze({
+    [KEY3]: PUBLIC_KEY2,
+    "card[number]": /^[0-9]{12,19}$/,
+    "card[exp_month]": /^(?:0?[1-9]|1[0-2])$/,
+    "card[exp_year]": /^(?:[0-9]{2}|20[0-9]{2})$/,
+    "card[cvv]": /^[0-9]{3,4}$/
+});
+var refuse43 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD43 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function luhn11(digits4) {
+    let sum = 0;
+    for (let at = 0; at < digits4.length; at += 1) {
+        let digit = Number(digits4[digits4.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function paymentwallUrlEnvironment(url) {
+    if (url === PAYMENTWALL_TOKEN_URL)
+        return "production";
+    return url === PAYMENTWALL_SANDBOX_TOKEN_URL ? "sandbox" : null;
+}
+function isPaymentwallTokenUrl(url) {
+    return paymentwallUrlEnvironment(url) !== null;
+}
+function paymentwallKeyEnvironment(publicKey) {
+    if (typeof publicKey !== "string" || !PUBLIC_KEY2.test(publicKey))
+        return null;
+    return publicKey.startsWith("t_") ? "sandbox" : "production";
+}
+function readPairs3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT42 || !/^[A-Za-z0-9_[\]=&]+$/.test(body))
+        return null;
+    const pairs = /* @__PURE__ */ new Map();
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq <= 0 || chunk.indexOf("=", eq + 1) !== -1)
+            return null;
+        const key = chunk.slice(0, eq);
+        if (pairs.has(key))
+            return null;
+        pairs.set(key, chunk.slice(eq + 1));
+    }
+    return pairs;
+}
+function paymentwallBodyVerdict(body, url) {
+    if (url !== void 0 && !isPaymentwallTokenUrl(url))
+        return refuse43("paymentwall_url_refused");
+    const pairs = readPairs3(body);
+    if (pairs === null)
+        return refuse43("paymentwall_body_unsupported");
+    if (pairs.has("card[token]") && !pairs.has("card[number]"))
+        return refuse43("paymentwall_saved_card");
+    const keys = Object.keys(SHAPES3);
+    if (pairs.size !== keys.length || !keys.every((key) => pairs.has(key) && SHAPES3[key].test(pairs.get(key)))) {
+        return refuse43("paymentwall_body_unsupported");
+    }
+    if (!luhn11(pairs.get("card[number]")))
+        return refuse43("paymentwall_body_unsupported");
+    if (url !== void 0 && paymentwallKeyEnvironment(pairs.get(KEY3)) !== paymentwallUrlEnvironment(url))
+        return refuse43("paymentwall_key_refused");
+    return CARD43;
+}
+var paymentwall_default = /* @__PURE__ */ registerProcessor({
+    psp: PAYMENTWALL_PSP,
+    definitions: [
+        {
+            psp: "paymentwall",
+            // Brick's token request, as the header above reads it. A test key's request has its own host, so the device sends
+            // it only Paymentwall's documented test cards (hostEnvironmentPinned, device-replay.js S7). Ships dark: served only
+            // to a client that declares `paymentwall_card_token`, for a company the backend's gate turns it on for
+            // (checkout-processor-gate.ts), and the device sends a live card only under a key a reviewed pin names.
+            capability: "paymentwall_card_token",
+            match: "(?:pwgateway\\.com/api/token|api\\.paymentwall\\.com/api/brick/token)",
+            hosts: ["^pwgateway\\.com$", "^api\\.paymentwall\\.com$"],
+            sandboxHosts: ["^api\\.paymentwall\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "form",
+            // Brick's XHR sets the form Content-Type alone, and that always rides. Origin, Referer and cookies never do.
+            passthroughHeaders: [],
+            cardFields: ["card[number]"]
+        }
+    ],
+    // Only the cardholder's device sends a card request, after a person approves; no reviewed list names paymentwall.
+    refusedOperations: [PAYMENTWALL_OPERATION],
+    // Not surveyed: the token moves no money, and the charge that spends it happens out of this request.
+    settlementReadback: "not_surveyed",
+    exactUrl: isPaymentwallTokenUrl,
+    bodyGate: (url, body) => paymentwallBodyVerdict(body, url)
+});
+// src/processors/payplug.js
+var PAYPLUG_PSP = "payplug";
+var PAYPLUG_OPERATION = "payplug.hosted_sale";
+var PAYPLUG_HOST = "secure.payplug.com";
+var ENTRY_PATH = /^\/pay\/(?:(test)\/)?([A-Za-z0-9]{22})$/;
+var MAX_URL3 = 256;
+var field4 = (name, reason) => ({ ok: false, code: "hosted_form_field_refused", field: name, reason });
+function payplugEntry(raw) {
+    if (typeof raw !== "string" || raw.length > MAX_URL3 || raw.includes("?") || raw.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.href !== raw || url.protocol !== "https:" || url.hostname !== PAYPLUG_HOST || url.port || url.username || url.password)
+        return null;
+    const match = ENTRY_PATH.exec(url.pathname);
+    return match ? Object.freeze({ id: match[2], test: match[1] === "test" }) : null;
+}
+function isPayplugEntryUrl(raw) {
+    return payplugEntry(raw) !== null;
+}
+var PAYPLUG_MERCHANTS = Object.freeze([
+    Object.freeze({ merchant: "Lazartigue", origins: Object.freeze(["https://lazartigue.com"]), payee: null, account: null })
+]);
+var ACCOUNT_ID = /^[A-Za-z0-9-]{1,64}$/;
+function payplugMerchant(checkoutOrigin, merchants = PAYPLUG_MERCHANTS) {
+    if (typeof checkoutOrigin !== "string" || checkoutOrigin.length > MAX_URL3 || !Array.isArray(merchants))
+        return null;
+    let url;
+    try {
+        url = new URL(checkoutOrigin);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.origin !== checkoutOrigin || url.port)
+        return null;
+    const found = merchants.filter((row) => !!row && typeof row.merchant === "string" && row.merchant.trim() !== "" && typeof row.payee === "string" && row.payee.trim() !== "" && typeof row.account === "string" && ACCOUNT_ID.test(row.account) && Array.isArray(row.origins) && row.origins.includes(checkoutOrigin));
+    return found.length === 1 ? found[0] : null;
+}
+function checkPayplugEntry(body, { url = null, checkoutOrigin = null, merchants = PAYPLUG_MERCHANTS } = {}) {
+    if (body !== void 0 && body !== null && body !== "")
+        return field4("(body)", "not_an_entry");
+    const entry = payplugEntry(url);
+    if (!entry)
+        return field4("(url)", "malformed_field");
+    const seller = payplugMerchant(checkoutOrigin, merchants);
+    if (!seller)
+        return field4("(checkout_origin)", "seller_unreviewed");
+    return { ok: true, pairs: [], gated: false, dedupe: [entry.id], paymentId: entry.id, sandbox: entry.test, seller };
+}
+var MAX_PAGE5 = 512 * 1024;
+var PAYPLUG_REFUSALS = Object.freeze(["payplug_failed", "payplug_expired", "payplug_cancelled"]);
+var payplug_default = /* @__PURE__ */ registerProcessor({
+    psp: PAYPLUG_PSP,
+    definitions: [
+        {
+            psp: "payplug",
+            // The merchant's redirect to PayPlug's payment page, as the header above reads it: a Document navigation that
+            // carries no card. The cardholder's device repeats it over the end-to-end TLS relay and pays on the page PayPlug
+            // returns to it, and the runtime resolves the paused navigation with the hosted_form notice. Only the entry is
+            // matched (isPayplugEntryUrl): the page's card post and its 3-D Secure steps share the host, and none of them is
+            // the entry. Test and live payments share the host, and the entry's path says which it is. Ships dark: served
+            // only to a client that declares `payplug_hosted_payment_page`, and the backend's gate serves only Agentcard's
+            // own company until a reviewed merchant pays.
+            capability: "payplug_hosted_payment_page",
+            match: "secure\\.payplug\\.com/pay/(?:test/)?[A-Za-z0-9]{22}",
+            hosts: ["^secure\\.payplug\\.com$"],
+            // `encoding` describes the page's own card post, which the device makes as the page does, since the entry has no
+            // body. No captured header is ever replayed.
+            encoding: "form",
+            passthroughHeaders: [],
+            request: { method: "GET", cardIn: "none", response: "html_page" },
+            mode: "hosted_form",
+            hostedForm: {
+                // The card goes into PayPlug's page on the device, never into the entry, which carries no body at all. The
+                // entry's own rules come with this registration (hostedEntry below), so no policy is named here.
+                cardIn: "processor_page",
+                required: [],
+                // The page's card inputs, by the data-payplug role its script reads them by: they carry no name, and the
+                // script posts the card only as its ciphertext, encryptedCard.
+                card: { number: "card_number", expiry: "card_month_year", cvc: "card_cvv" },
+                // The payment's id in the entry's URL names the one payment the merchant created; the entry's rules read it
+                // there (checkPayplugEntry's dedupe), since no form field holds it.
+                dedupe: ["(paymentId)"]
+            }
+        }
+    ],
+    // Only the cardholder's device repeats an entry, after a person approves; no reviewed list names payplug.
+    refusedOperations: [PAYPLUG_OPERATION],
+    // Not surveyed: PayPlug tells only the merchant's server the result, and the browser returns whatever it was.
+    settlementReadback: "not_surveyed",
+    exactUrl: isPayplugEntryUrl,
+    hostedEntry: checkPayplugEntry,
+    limitations: [
+        "The paused request is the merchant's redirect to PayPlug's payment page, a GET that carries only the payment's id and no card; the cardholder's device opens that page over the end-to-end TLS relay.",
+        "The redirect names no merchant and no amount, so Agentcard takes one only from the checkout page of a merchant it reviewed, the approval names that merchant and the amount you send, and the cardholder's device pays only a PayPlug page that names that merchant and that amount.",
+        "PayPlug runs 3-D Secure on the card. A challenge ends the payment on the device with nothing charged.",
+        "PayPlug sends the buyer to the merchant's return page whether the payment succeeded or not, so the browser receives a submission notice, not the processor result."
+    ]
+});
+// src/processors/paystack.js
+var PAYSTACK_PSP = "paystack";
+var PAYSTACK_OPERATION = "paystack.card_request";
+var PAYSTACK_CHARGE_URL = "https://standard.paystack.co/charge/";
+var PAYSTACK_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "clientdata",
+    "last4",
+    "trans",
+    "access_code",
+    "device",
+    "offset",
+    "remember_card",
+    "card_holder_name",
+    "transaction_type"
+]);
+var OPTIONAL = /* @__PURE__ */ new Set(["access_code", "card_holder_name", "transaction_type"]);
+var BODY_LIMIT43 = 4096;
+var CIPHERTEXT_BYTES2 = [62, 63, 64];
+var BASE646 = /^[A-Za-z0-9+/]+={0,2}$/;
+var SHAPES4 = /* @__PURE__ */ Object.freeze({
+    last4: /^[0-9]{4}$/,
+    trans: /^[0-9]{1,20}$/,
+    access_code: /^[A-Za-z0-9]{1,64}$/,
+    device: /^[\x21-\x7e]{1,512}$/,
+    offset: /^-?[0-9]{1,3}$/,
+    remember_card: /^false$/,
+    // A name carries no digit, so no card number can ride in it.
+    card_holder_name: /^[^\x00-\x1f\x7f0-9]{1,128}$/u,
+    transaction_type: /^[a-z_]{1,32}$/
+});
+var own18 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse44 = (code) => Object.freeze({ verdict: "refuse", code });
+function paystackFormValue(value) {
+    return encodeURIComponent(String(value)).replace(/%20/g, "+").replace(/[!'()*~]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function paystackFormBody(entries) {
+    return entries.map(([key, value]) => `${paystackFormValue(key)}=${paystackFormValue(value)}`).join("&");
+}
+function isPaystackChargeUrl(url) {
+    return url === PAYSTACK_CHARGE_URL;
+}
+function isCiphertext2(value) {
+    if (value.length % 4 !== 0 || !BASE646.test(value))
+        return false;
+    let binary;
+    try {
+        binary = atob(value);
+    }
+    catch {
+        return false;
+    }
+    return btoa(binary) === value && CIPHERTEXT_BYTES2.includes(binary.length);
+}
+function readForm3(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT43)
+        return null;
+    const entries = [];
+    for (const part of body.split("&")) {
+        const at = part.indexOf("=");
+        if (at <= 0)
+            return null;
+        try {
+            entries.push([decodeURIComponent(part.slice(0, at).replace(/\+/g, " ")), decodeURIComponent(part.slice(at + 1).replace(/\+/g, " "))]);
+        }
+        catch {
+            return null;
+        }
+    }
+    return paystackFormBody(entries) === body ? entries : null;
+}
+function paystackBodyVerdict(body) {
+    const entries = readForm3(body);
+    if (entries === null)
+        return refuse44("paystack_body_unsupported");
+    const keys = entries.map(([key]) => key);
+    if (keys.includes("subscription"))
+        return refuse44("paystack_subscription");
+    if (keys.includes("remember_card") && entries.find(([key]) => key === "remember_card")[1] !== "false")
+        return refuse44("paystack_saved_card");
+    const expected = PAYSTACK_BODY_KEYS.filter((key) => !OPTIONAL.has(key) || keys.includes(key));
+    if (keys.length !== expected.length || keys.some((key, i) => key !== expected[i]))
+        return refuse44("paystack_body_unsupported");
+    const fields = Object.fromEntries(entries);
+    if (!isCiphertext2(fields.clientdata))
+        return refuse44("paystack_body_unsupported");
+    for (const [key, shape] of Object.entries(SHAPES4)) {
+        if (own18(fields, key) && !shape.test(fields[key]))
+            return refuse44("paystack_body_unsupported");
+    }
+    return Object.freeze({ verdict: "card", fields: Object.freeze(fields) });
+}
+var paystack_default = /* @__PURE__ */ registerProcessor({
+    psp: PAYSTACK_PSP,
+    definitions: [
+        {
+            psp: "paystack",
+            // The card page's charge, as the header above reads it. Live and test transactions share standard.paystack.co,
+            // so no sandbox host is listed and no environment is pinned. Ships dark: served only to a client that declares
+            // `paystack_pinned_key`, and only for a company the backend's processor gate turns Paystack on for.
+            // `(?![\w/.%?#-])` ends the path for a consumer that tests `match` unanchored; the exact-URL rule takes no query.
+            capability: "paystack_pinned_key",
+            match: "standard\\.paystack\\.co/charge/(?![\\w/.%?#-])",
+            hosts: ["^standard\\.paystack\\.co$"],
+            encoding: "form",
+            // The browser's language rides as the page sent it; Origin, Referer and cookies never do (the page sends no cookie).
+            passthroughHeaders: ["^accept-language$"],
+            cardFields: ["clientdata"]
+        }
+    ],
+    // Only the cardholder's device sends this charge, after a person approves; no reviewed list names paystack.
+    refusedOperations: [PAYSTACK_OPERATION],
+    // Not surveyed: reading a charge back takes the merchant's secret key, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isPaystackChargeUrl,
+    bodyGate: (url, body) => url !== void 0 && !isPaystackChargeUrl(url) ? refuse44("paystack_url_refused") : paystackBodyVerdict(body),
+    // No amount reader: the charge names none, so the agent's pair is the figure the cardholder approves.
+    limitations: ["The charge names no merchant and no amount: Paystack's transaction binds both, so the cardholder approves the agent's figure for whichever Paystack merchant opened the checkout."]
+});
+// src/processors/processout.js
+var PROCESSOUT_PSP = "processout";
+var PROCESSOUT_OPERATION = "processout.card_request";
+var URL_LIMIT17 = 512;
+var BODY_LIMIT44 = 4096;
+var CARD_URL2 = /^https:\/\/api\.processout\.com\/cards\?legacyrequest=true&project_id=((?:test-)?proj_[A-Za-z0-9]{16,64})&x-Content-Type=application\/json&x-API-Version=1\.3\.0\.0&x-Authorization=Basic%20([A-Za-z0-9+/]{4,256}={0,2})$/;
+var PAGE_KEYS2 = /* @__PURE__ */ Object.freeze(["name", "contact", "preferred_scheme"]);
+var CONTACT_KEYS = /* @__PURE__ */ Object.freeze(["address1", "address2", "city", "state", "country_code", "zip"]);
+var DEVICE_KEYS4 = /* @__PURE__ */ Object.freeze([
+    "request_origin",
+    "app_color_depth",
+    "app_language",
+    "app_screen_height",
+    "app_screen_width",
+    "app_timezone_offset",
+    "app_java_enabled"
+]);
+var PROCESSOUT_CARD_KEYS = /* @__PURE__ */ Object.freeze(["number", "exp_month", "exp_year", "cvc2"]);
+var BODY_KEYS3 = /* @__PURE__ */ new Set([...PAGE_KEYS2, "device", ...DEVICE_KEYS4, ...PROCESSOUT_CARD_KEYS]);
+var NUMBER9 = /^[0-9]{12,19}$/;
+var MONTH23 = /^(?:[1-9]|1[0-2])$/;
+var YEAR24 = /^20[0-9]{2}$/;
+var CODE9 = /^[0-9]{3,4}$/;
+var TEXT_LIMIT14 = 256;
+var SCHEME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
+var LANGUAGE5 = /^[A-Za-z]{1,8}(?:-[A-Za-z0-9]{1,8}){0,4}$/;
+var PAN_LIKE7 = /(?:[0-9][^0-9A-Za-z]*){12,}/;
+var record37 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own19 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse45 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD44 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var BASE647 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Of(text11) {
+    let out = "";
+    for (let at = 0; at < text11.length; at += 3) {
+        const a = text11.charCodeAt(at);
+        const b = at + 1 < text11.length ? text11.charCodeAt(at + 1) : NaN;
+        const c = at + 2 < text11.length ? text11.charCodeAt(at + 2) : NaN;
+        out += BASE647[a >> 2] + BASE647[(a & 3) << 4 | (Number.isNaN(b) ? 0 : b >> 4)] + (Number.isNaN(b) ? "=" : BASE647[(b & 15) << 2 | (Number.isNaN(c) ? 0 : c >> 6)]) + (Number.isNaN(c) ? "=" : BASE647[c & 63]);
+    }
+    return out;
+}
+var basicOf = (projectId) => base64Of(`${projectId}:`);
+function luhn12(digits4) {
+    let sum = 0;
+    for (let at = 0; at < digits4.length; at += 1) {
+        let digit = Number(digits4[digits4.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function processoutCardTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT17)
+        return null;
+    const match = CARD_URL2.exec(url);
+    if (!match || match[2] !== basicOf(match[1]))
+        return null;
+    return Object.freeze({ projectId: match[1], environment: match[1].startsWith("test-") ? "sandbox" : "production" });
+}
+function isProcessoutCardUrl(url) {
+    return processoutCardTarget(url) !== null;
+}
+function readBody27(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT44)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record37(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var pageText2 = (value) => value === null || typeof value === "string" && value.length <= TEXT_LIMIT14 && !PAN_LIKE7.test(value);
+var DEVICE_RULES = /* @__PURE__ */ Object.freeze({
+    request_origin: (value) => value === "web",
+    app_color_depth: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 64,
+    app_language: (value) => typeof value === "string" && value.length <= 64 && LANGUAGE5.test(value),
+    app_screen_height: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_screen_width: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_timezone_offset: (value) => Number.isSafeInteger(value) && value >= -1440 && value <= 1440,
+    app_java_enabled: (value) => typeof value === "boolean"
+});
+function soundDevice3(value) {
+    const device = value.device;
+    if (!record37(device) || !own19(device, "request_origin") || !own19(device, "app_timezone_offset"))
+        return false;
+    return DEVICE_KEYS4.every((key) => own19(device, key) ? DEVICE_RULES[key](device[key]) && own19(value, key) && value[key] === device[key] : !own19(value, key)) && Object.keys(device).every((key) => DEVICE_KEYS4.includes(key));
+}
+function soundPageData(value) {
+    if (own19(value, "name") && !pageText2(value.name))
+        return false;
+    if (own19(value, "preferred_scheme") && !(value.preferred_scheme === null || typeof value.preferred_scheme === "string" && SCHEME.test(value.preferred_scheme)))
+        return false;
+    const contact = value.contact;
+    return record37(contact) && Object.keys(contact).every((key) => CONTACT_KEYS.includes(key) && pageText2(contact[key]));
+}
+function processoutBodyVerdict(body, url) {
+    if (url !== void 0 && processoutCardTarget(url) === null)
+        return refuse45("processout_url_refused");
+    const value = readBody27(body);
+    if (value === null || !Object.keys(value).every((key) => BODY_KEYS3.has(key)))
+        return refuse45("processout_body_unsupported");
+    if (!PROCESSOUT_CARD_KEYS.every((key) => typeof value[key] === "string"))
+        return refuse45("processout_body_unsupported");
+    if (!NUMBER9.test(value.number) || !luhn12(value.number) || !MONTH23.test(value.exp_month) || !YEAR24.test(value.exp_year) || !CODE9.test(value.cvc2))
+        return refuse45("processout_body_unsupported");
+    if (!soundPageData(value) || !soundDevice3(value))
+        return refuse45("processout_body_unsupported");
+    return CARD44;
+}
+var processout_default = /* @__PURE__ */ registerProcessor({
+    psp: PROCESSOUT_PSP,
+    definitions: [
+        {
+            psp: "processout",
+            // ProcessOut.js's card request, as the header above reads it. One host serves every project, live and sandbox
+            // alike, so no sandbox host is marked: the project id names the environment, and the device sends a sandbox
+            // project only ProcessOut's documented test cards (processoutDeviceRefusal). The page gives up 20 seconds after
+            // its tokenize message, so the lane is prepared only (preparationRequired). The match reads the host and the path,
+            // and ends where the path does, as Pin Payments' does: a card's own record under /cards/, where the code refresh
+            // goes, is never paused. The exact-URL rule below holds the query, the project id and its Basic credential among it.
+            // Ships dark: served only to a client that declares `processout_card_token`, and gated off for every org until
+            // the backend's gate names one.
+            capability: "processout_card_token",
+            match: "api\\.processout\\.com/cards(?![\\w/.%-])",
+            hosts: ["^api\\.processout\\.com$"],
+            preparationRequired: true,
+            encoding: "json",
+            // ProcessOut.js's own headers: the project's Basic credential and the API version. Origin, Referer and cookies
+            // never ride.
+            passthroughHeaders: ["^authorization$", "^api-version$"],
+            jsonCardFields: [["number"]]
+        }
+    ],
+    // Only the cardholder's device sends a card, after a person approves; no reviewed list names processout.
+    refusedOperations: [PROCESSOUT_OPERATION],
+    // Not surveyed: the card request mints a token and moves no money; the store's server charges it under its own
+    // secret key, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isProcessoutCardUrl,
+    bodyGate: (url, body) => processoutBodyVerdict(body, url)
+});
+// src/processors/usaepay.js
+var USAEPAY_PSP = "usaepay";
+var USAEPAY_OPERATION = "usaepay.card_request";
+var USAEPAY_HOSTS = /* @__PURE__ */ Object.freeze({
+    "www.usaepay.com": "production",
+    "secure.usaepay.com": "production",
+    "sandbox.usaepay.com": "sandbox"
+});
+var USAEPAY_PAYMENT_KEYS_PATH = "/api/v2/pub/payment_keys";
+var BODY_LIMIT45 = 512;
+var URL_LIMIT18 = 256;
+var CARD_NUMBER22 = /^[0-9]{13,19}$/;
+var EXPIRATION2 = /^(?:0[1-9]|1[0-2])[0-9]{2}$/;
+var SECURITY_CODE26 = /^(?:[0-9]{3,4})?$/;
+var record38 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own20 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse46 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD45 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function usaepayPaymentKeysUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT18 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own20(USAEPAY_HOSTS, parsed.hostname) || parsed.pathname !== USAEPAY_PAYMENT_KEYS_PATH)
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: USAEPAY_HOSTS[parsed.hostname] });
+}
+var isUsaepayPaymentKeysUrl = (url) => usaepayPaymentKeysUrl(url) !== null;
+function luhn13(digits4) {
+    let sum = 0;
+    for (let at = digits4.length - 1, double = false; at >= 0; at -= 1, double = !double) {
+        let digit = digits4.charCodeAt(at) - 48;
+        if (double)
+            digit = digit * 2 > 9 ? digit * 2 - 9 : digit * 2;
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function readBody28(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT45)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record38(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function usaepayBodyVerdict(body) {
+    const value = readBody28(body);
+    const card = value === null ? null : value.creditcard;
+    if (value === null || Object.keys(value).join() !== "creditcard" || !record38(card) || Object.keys(card).join() !== "number,expiration,cvc" || typeof card.number !== "string" || !CARD_NUMBER22.test(card.number) || !luhn13(card.number) || typeof card.expiration !== "string" || !EXPIRATION2.test(card.expiration) || typeof card.cvc !== "string" || !SECURITY_CODE26.test(card.cvc))
+        return refuse46("usaepay_body_unsupported");
+    return CARD45;
+}
+var usaepay_default = /* @__PURE__ */ registerProcessor({
+    psp: USAEPAY_PSP,
+    definitions: [
+        {
+            psp: "usaepay",
+            // The frame's card request, as the header above reads it. sandbox.usaepay.com is USAePay's sandbox, pinned to test
+            // rows, which send only USAePay's documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `usaepay_payment_key`, and only for a company the backend's
+            // processor gate turns USAePay on for. `(?![\w/.%-])` ends the path for a consumer that tests `match` unanchored.
+            capability: "usaepay_payment_key",
+            match: "(?:www|secure|sandbox)\\.usaepay\\.com/api/v2/pub/payment_keys(?![\\w/.%-])",
+            hosts: ["^www\\.usaepay\\.com$", "^secure\\.usaepay\\.com$", "^sandbox\\.usaepay\\.com$"],
+            sandboxHosts: ["^sandbox\\.usaepay\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The frame's Authorization, which carries the merchant's public key. Origin, Referer and cookies never ride.
+            passthroughHeaders: ["^authorization$"],
+            jsonCardFields: [["creditcard", "number"]]
+        }
+    ],
+    // Only the cardholder's device sends this card, after a person approves; no reviewed list names usaepay.
+    refusedOperations: [USAEPAY_OPERATION],
+    // The public key mints a payment key and reads nothing: the merchant's server runs the sale with its private key.
+    settlementReadback: {
+        answer: "none",
+        reason: "tokenization_credential_cannot_read_charges",
+        note: "The tokenization credential cannot read a charge; the shop charges the token later with its own credentials.",
+        source: "https://help.usaepay.info/developer/payjs-v2/ , https://help.usaepay.info/api/rest/"
+    },
+    exactUrl: isUsaepayPaymentKeysUrl,
+    bodyGate: (url, body) => url !== void 0 && !isUsaepayPaymentKeysUrl(url) ? refuse46("usaepay_url_refused") : usaepayBodyVerdict(body)
+    // No amount reader: the request names none, so the agent's pair is the figure the cardholder approves.
+});
+// src/processors/viva_wallet.js
+var VIVA_WALLET_PSP = "viva_wallet";
+var VIVA_WALLET_OPERATION = "viva_wallet.card_request";
+var VIVA_WALLET_HOSTS = /* @__PURE__ */ Object.freeze({ "www.vivapayments.com": "production", "demo.vivapayments.com": "sandbox" });
+var VIVA_WALLET_CHARGE_TOKENS_PATH = "/web2/checkout/v2/chargetokens";
+var VIVA_WALLET_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "orderCode",
+    "amount",
+    "currencyCode",
+    "holderName",
+    "holderMail",
+    "cvc",
+    "number",
+    "expirationMonth",
+    "expirationYear",
+    "installments",
+    "customer",
+    "rememberCard",
+    "friendlyName",
+    "maskedNumber",
+    "bankId",
+    "selectedBrand",
+    "cardholderBrandSelection",
+    "dccOptions",
+    "dccAccepted",
+    "offerCodes",
+    "loyaltySupported",
+    "redeemedAmount",
+    "retrievalReferenceNumber",
+    "scaRequestedTransactionId",
+    "merchantTrns",
+    "captchaToken"
+]);
+var BODY_LIMIT46 = 16384;
+var URL_LIMIT19 = 256;
+var ORDER_CODE = /^[0-9]{16}$/;
+var CARD_NUMBER23 = /^[0-9]{13,19}$/;
+var MONTH24 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR25 = /^[0-9]{2}$/;
+var SECURITY_CODE27 = /^[0-9]{3,4}$/;
+var CAPTCHA_TOKEN = /^[A-Za-z0-9_.-]{20,8192}$/;
+var MEMBER_NAME = /^[A-Za-z][A-Za-z0-9]{0,31}$/;
+var SHORT_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var TEXT4 = /^[^\u0000-\u001f\u007f]{0,200}$/;
+var CARD_DIGITS2 = /[0-9]{12,}/;
+var record39 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own21 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse47 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD46 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var inOrder9 = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var cardDigits2 = (text11) => CARD_DIGITS2.test(text11.replace(/[^0-9A-Za-z]/g, ""));
+var plainText8 = (value) => typeof value === "string" && TEXT4.test(value) && !cardDigits2(value);
+var scalar = (value) => value === null || typeof value === "boolean" || Number.isSafeInteger(value) && Math.abs(value) < 1e9 || plainText8(value);
+var flatRecord = (value, limit) => record39(value) && Object.keys(value).length <= limit && Object.entries(value).every(([key, item]) => MEMBER_NAME.test(key) && scalar(item));
+function vivaWalletChargeTokensUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT19 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !own21(VIVA_WALLET_HOSTS, parsed.hostname) || parsed.pathname !== VIVA_WALLET_CHARGE_TOKENS_PATH)
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: VIVA_WALLET_HOSTS[parsed.hostname] });
+}
+var isVivaWalletChargeTokensUrl = (url) => vivaWalletChargeTokensUrl(url) !== null;
+function luhn14(digits4) {
+    let sum = 0;
+    for (let at = digits4.length - 1, double = false; at >= 0; at -= 1, double = !double) {
+        let digit = digits4.charCodeAt(at) - 48;
+        if (double)
+            digit = digit * 2 > 9 ? digit * 2 - 9 : digit * 2;
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function vivaWalletMaskedNumber(number) {
+    return `${number.slice(0, 6)}${"X".repeat(Math.max(0, number.length - 10))}${number.slice(-4)}`;
+}
+function readBody29(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT46)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record39(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function currencyNumber(value) {
+    if (Number.isSafeInteger(value) && value > 0 && value < 1e3)
+        return value;
+    return typeof value === "string" && /^[0-9]{3}$/.test(value) ? Number(value) : null;
+}
+function vivaWalletBodyVerdict(body) {
+    const value = readBody29(body);
+    if (value === null || !Object.keys(value).every((key) => VIVA_WALLET_BODY_KEYS.includes(key))) {
+        return value !== null && (own21(value, "creditCardId") || own21(value, "token")) ? refuse47("viva_wallet_stored_card") : refuse47("viva_wallet_body_unsupported");
+    }
+    if (value.rememberCard !== false)
+        return refuse47(value.rememberCard === true ? "viva_wallet_keep_on_file" : "viva_wallet_body_unsupported");
+    if (value.dccAccepted === true)
+        return refuse47("viva_wallet_currency_conversion");
+    if (own21(value, "dccAccepted") && value.dccAccepted !== false)
+        return refuse47("viva_wallet_body_unsupported");
+    if (own21(value, "scaRequestedTransactionId"))
+        return refuse47("viva_wallet_retry_refused");
+    if (!(value.installments === 0 || value.installments === 1)) {
+        return refuse47(Number.isSafeInteger(value.installments) && value.installments > 1 ? "viva_wallet_installments" : "viva_wallet_body_unsupported");
+    }
+    if (!inOrder9(value, VIVA_WALLET_BODY_KEYS) || ["offerCodes", "loyaltySupported", "redeemedAmount", "retrievalReferenceNumber", "merchantTrns"].some((key) => own21(value, key)))
+        return refuse47("viva_wallet_body_unsupported");
+    const number = value.number;
+    const sound = typeof value.orderCode === "string" && ORDER_CODE.test(value.orderCode) && Number.isSafeInteger(value.amount) && value.amount > 0 && currencyNumber(value.currencyCode) !== null && plainText8(value.holderName) && value.holderName.trim() !== "" && plainText8(value.holderMail) && (value.cvc === null || typeof value.cvc === "string" && SECURITY_CODE27.test(value.cvc)) && typeof number === "string" && CARD_NUMBER23.test(number) && luhn14(number) && typeof value.expirationMonth === "string" && MONTH24.test(value.expirationMonth) && typeof value.expirationYear === "string" && YEAR25.test(value.expirationYear) && flatRecord(value.customer, 12) && (!own21(value, "friendlyName") || plainText8(value.friendlyName)) && value.maskedNumber === vivaWalletMaskedNumber(number) && (!own21(value, "bankId") || typeof value.bankId === "string" && SHORT_ID.test(value.bankId) || Number.isSafeInteger(value.bankId) && value.bankId >= 0) && (!own21(value, "selectedBrand") || value.selectedBrand === null || flatRecord(value.selectedBrand, 16)) && (!own21(value, "cardholderBrandSelection") || typeof value.cardholderBrandSelection === "boolean") && (!own21(value, "dccOptions") || flatRecord(value.dccOptions, 16)) && (!own21(value, "captchaToken") || typeof value.captchaToken === "string" && CAPTCHA_TOKEN.test(value.captchaToken));
+    return sound ? CARD46 : refuse47("viva_wallet_body_unsupported");
+}
+var VIVA_WALLET_CURRENCIES = /* @__PURE__ */ Object.freeze({
+    978: "eur",
+    826: "gbp",
+    946: "ron",
+    985: "pln",
+    203: "czk",
+    348: "huf",
+    752: "sek",
+    208: "dkk"
+});
+function vivaWalletAmount(body) {
+    if (vivaWalletBodyVerdict(body).verdict !== "card")
+        return null;
+    const value = JSON.parse(body);
+    const currency = VIVA_WALLET_CURRENCIES[currencyNumber(value.currencyCode)];
+    return currency ? { amountCents: value.amount, currency } : null;
+}
+var VIVA_WALLET_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({
+        id: "klimaka_donation",
+        merchant: "Klimaka",
+        tradeName: "ΚΛΙΜΑΚΑ ΑΜΚΕ",
+        orderCodes: Object.freeze(["7871752880772607"]),
+        origin: "https://www.vivapayments.com",
+        currencyCode: 978
+    }),
+    Object.freeze({
+        id: "desmos_donation",
+        merchant: "Desmos",
+        tradeName: "DESMOS",
+        orderCodes: Object.freeze(["8156257435672606"]),
+        origin: "https://www.vivapayments.com",
+        currencyCode: 978
+    })
+]);
+var CARD_MEMBERS = Object.freeze(["cvc", "number", "expirationMonth", "expirationYear", "maskedNumber"]);
+var viva_wallet_default = /* @__PURE__ */ registerProcessor({
+    psp: VIVA_WALLET_PSP,
+    definitions: [
+        {
+            psp: "viva_wallet",
+            // The page's card request, as the header above reads it. demo.vivapayments.com is Viva's sandbox, pinned to test
+            // rows, which send only Viva's documented test cards (hostEnvironmentPinned, device-replay.js S7).
+            // Ships dark: served only to a client that declares `viva_smart_checkout_chargetoken`, and only for a company the
+            // backend's processor gate turns Viva Wallet on for. `(?![\w/.%-])` ends the path for a consumer that tests `match`
+            // unanchored.
+            capability: "viva_smart_checkout_chargetoken",
+            match: "(?:www|demo)\\.vivapayments\\.com/web2/checkout/v2/chargetokens(?![\\w/.%-])",
+            hosts: ["^www\\.vivapayments\\.com$", "^demo\\.vivapayments\\.com$"],
+            sandboxHosts: ["^demo\\.vivapayments\\.com$"],
+            hostEnvironmentPinned: true,
+            encoding: "json",
+            // The page sends no Authorization; Origin, Referer, cookies and the reCAPTCHA state never ride.
+            passthroughHeaders: [],
+            jsonCardFields: [["number"]]
+        }
+    ],
+    // Only the cardholder's device sends this card, after a person approves; no reviewed list names viva_wallet.
+    refusedOperations: [VIVA_WALLET_OPERATION],
+    settlementReadback: "not_surveyed",
+    exactUrl: isVivaWalletChargeTokensUrl,
+    bodyGate: (url, body) => url !== void 0 && !isVivaWalletChargeTokensUrl(url) ? refuse47("viva_wallet_url_refused") : vivaWalletBodyVerdict(body),
+    // The body names the order's amount in cents and its numeric currency, which the page's card-free charge repeats.
+    amount: (template) => record39(template) && isVivaWalletChargeTokensUrl(template.url) ? vivaWalletAmount(template.body) : null
+});
+// src/processors/vtex_payments.js
+var VTEX_PAYMENTS_PSP = "vtex_payments";
+var VTEX_PAYMENTS_OPERATION = "vtex_payments.card_request";
+var VTEX_PAYMENTS_FALLBACK_HOST = "api.vtexvault.com";
+var VTEX_PAYMENTS_LINE_KEYS = /* @__PURE__ */ Object.freeze([
+    "currencyCode",
+    "paymentSystem",
+    "accountId",
+    "value",
+    "referenceValue",
+    "installments",
+    "installmentsInterestRate",
+    "installmentsValue",
+    "groupName",
+    "fields",
+    "transaction",
+    "id"
+]);
+var VTEX_PAYMENTS_FIELD_KEYS = /* @__PURE__ */ Object.freeze([
+    "address",
+    "accountId",
+    "validationCode",
+    "metadata",
+    "document",
+    "holderName",
+    "cardNumber",
+    "dueDate",
+    "deviceFingerprint",
+    "addressId"
+]);
+var VTEX_PAYMENTS_ADDRESS_KEYS = /* @__PURE__ */ Object.freeze([
+    "street",
+    "complement",
+    "number",
+    "city",
+    "reference",
+    "addressType",
+    "neighborhood",
+    "addressId",
+    "state",
+    "country",
+    "postalCode"
+]);
+var VTEX_PAYMENTS_NETWORKS = /* @__PURE__ */ Object.freeze({ 1: "amex", 2: "visa", 4: "mastercard", 5: "discover" });
+var VTEX_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    Object.freeze({ account: "alssports", origin: "https://www.als.com", merchant: "Al's Sporting Goods", currency: "USD" }),
+    Object.freeze({ account: "roadrunnersports", origin: "https://www.roadrunnersports.com", merchant: "Road Runner Sports", currency: "USD" })
+]);
+var BODY_LIMIT47 = 16384;
+var ACCOUNT_HOST = /^([a-z0-9]{1,63})\.vtexvault\.com$/;
+var PATH = /^\/api\/payments\/transactions\/([0-9A-Fa-f]{32})\/payments$/;
+var ORDER_GROUP = /^[0-9]{6,24}$/;
+var BASE648 = /^[A-Za-z0-9+/]{4,1020}={0,2}$/;
+var CARD_NUMBER24 = /^[0-9]{12,19}$/;
+var SECURITY_CODE28 = /^[0-9]{3,4}$/;
+var DUE_DATE = /^(?:0[1-9]|1[0-2])\/[0-9]{2}$/;
+var CURRENCY6 = /^[A-Z]{3}$/;
+var TRANSACTION_ID = /^[0-9A-Fa-f]{32}$/;
+var MERCHANT_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var SHORT_ID2 = /^[A-Za-z0-9_-]{1,64}$/;
+var FINGERPRINT4 = /^[A-Za-z0-9_.:=+/-]{1,256}$/;
+var TEXT5 = /^[^\u0000-\u001f\u007f]{1,200}$/;
+var CARD_DIGITS3 = /[0-9]{12,}/;
+var DEVICE_INFO_KEYS = Object.freeze(["sw", "sh", "cd", "tz", "lang", "java", "sourceApplication"]);
+var record40 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own22 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse48 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD47 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var inOrder10 = (value, keys) => {
+    let at = 0;
+    for (const name of Object.keys(value)) {
+        while (at < keys.length && keys[at] !== name)
+            at += 1;
+        if (at === keys.length)
+            return false;
+        at += 1;
+    }
+    return true;
+};
+var cardDigits3 = (text11) => CARD_DIGITS3.test(text11.replace(/[^0-9A-Za-z]/g, ""));
+var plainText9 = (value) => typeof value === "string" && TEXT5.test(value) && !cardDigits3(value);
+var count = (value) => Number.isSafeInteger(value) && value >= 0;
+var BASE64_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Text2(input) {
+    if (input.length % 4 !== 0)
+        return null;
+    const stripped = input.replace(/={1,2}$/, "");
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const character of stripped) {
+        const sextet = BASE64_ALPHABET2.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits & 255);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+function deviceInfoSound(text11) {
+    if (typeof text11 !== "string" || !BASE648.test(text11))
+        return false;
+    const decoded = base64Text2(text11);
+    if (decoded === null)
+        return false;
+    let info;
+    try {
+        info = JSON.parse(decoded);
+    }
+    catch {
+        return false;
+    }
+    if (!record40(info) || !Object.keys(info).every((key) => DEVICE_INFO_KEYS.includes(key)))
+        return false;
+    for (const key of ["sw", "sh", "cd"])
+        if (own22(info, key) && !(count(info[key]) && info[key] <= 1e5))
+            return false;
+    if (own22(info, "tz") && !(Number.isSafeInteger(info.tz) && Math.abs(info.tz) <= 1440))
+        return false;
+    if (own22(info, "lang") && !(typeof info.lang === "string" && /^[A-Za-z]{0,8}$/.test(info.lang)))
+        return false;
+    if (own22(info, "java") && typeof info.java !== "boolean")
+        return false;
+    return !own22(info, "sourceApplication") || typeof info.sourceApplication === "string" && /^[A-Za-z0-9_.-]{1,32}$/.test(info.sourceApplication);
+}
+function vtexPaymentsCardTarget(url) {
+    if (typeof url !== "string" || url.length > 8192)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.hash)
+        return null;
+    const path = PATH.exec(parsed.pathname);
+    const host = ACCOUNT_HOST.exec(parsed.hostname);
+    if (!path || !host)
+        return null;
+    const fallback = parsed.hostname === VTEX_PAYMENTS_FALLBACK_HOST;
+    const names = [...parsed.searchParams.keys()];
+    const expected = ["orderId", "deviceInfo", ...parsed.searchParams.has("callbackUrl") ? ["callbackUrl"] : [], ...fallback ? ["an"] : []];
+    if (names.length !== expected.length || names.some((name, i) => name !== expected[i]))
+        return null;
+    const orderId = parsed.searchParams.get("orderId");
+    if (!ORDER_GROUP.test(orderId) || !deviceInfoSound(parsed.searchParams.get("deviceInfo")))
+        return null;
+    if (parsed.searchParams.has("callbackUrl")) {
+        let callback;
+        try {
+            callback = new URL(parsed.searchParams.get("callbackUrl"));
+        }
+        catch {
+            return null;
+        }
+        if (callback.protocol !== "https:" || callback.username || callback.password || callback.searchParams.get("step") !== "payment" || callback.searchParams.get("og") !== orderId)
+            return null;
+    }
+    const account = fallback ? parsed.searchParams.get("an") : host[1];
+    if (!/^[a-z0-9]{1,63}$/.test(account) || account === "api")
+        return null;
+    return Object.freeze({ account, transactionId: path[1], orderId, fallback });
+}
+function isVtexPaymentsCardUrl(url) {
+    const target = vtexPaymentsCardTarget(url);
+    return target !== null && !target.fallback;
+}
+function readBody30(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT47)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!Array.isArray(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function cardLine(line) {
+    if (!record40(line))
+        return false;
+    const fields = record40(line.fields) ? line.fields : {};
+    return line.groupName === "creditCardPaymentGroup" || line.groupName === "debitCardPaymentGroup" || own22(line, "accountId") || own22(fields, "accountId") || own22(fields, "cardNumber") || own22(fields, "validationCode") || own22(fields, "dueDate");
+}
+function addressSound(address2) {
+    if (!record40(address2) || !inOrder10(address2, VTEX_PAYMENTS_ADDRESS_KEYS))
+        return false;
+    for (const [key, value] of Object.entries(address2)) {
+        if (key === "addressType") {
+            if (value !== "billing")
+                return false;
+            continue;
+        }
+        if (key === "addressId") {
+            if (!(typeof value === "string" && SHORT_ID2.test(value)))
+                return false;
+            continue;
+        }
+        if (value === null && (key === "complement" || key === "reference"))
+            continue;
+        if (!(value === "" || plainText9(value)))
+            return false;
+    }
+    return true;
+}
+function fieldsSound(fields) {
+    if (!record40(fields) || !inOrder10(fields, VTEX_PAYMENTS_FIELD_KEYS) || own22(fields, "metadata"))
+        return false;
+    if (!(typeof fields.cardNumber === "string" && CARD_NUMBER24.test(fields.cardNumber)))
+        return false;
+    if (!(typeof fields.validationCode === "string" && SECURITY_CODE28.test(fields.validationCode)))
+        return false;
+    if (!(typeof fields.dueDate === "string" && DUE_DATE.test(fields.dueDate)))
+        return false;
+    if (!plainText9(fields.holderName))
+        return false;
+    if (own22(fields, "document") && !(fields.document === "" || plainText9(fields.document) && fields.document.length <= 32))
+        return false;
+    if (own22(fields, "address") && !addressSound(fields.address))
+        return false;
+    if (own22(fields, "deviceFingerprint") && !(typeof fields.deviceFingerprint === "string" && FINGERPRINT4.test(fields.deviceFingerprint)))
+        return false;
+    return !own22(fields, "addressId") || typeof fields.addressId === "string" && SHORT_ID2.test(fields.addressId);
+}
+function vtexPaymentsBodyVerdict(body, target) {
+    const lines = readBody30(body);
+    if (lines === null || lines.length === 0 || !lines.every(record40))
+        return refuse48("vtex_payments_body_unsupported");
+    const cards = lines.filter(cardLine);
+    if (cards.some((line2) => own22(line2, "accountId") || own22(line2.fields ?? {}, "accountId")))
+        return refuse48("vtex_payments_saved_card");
+    if (cards.length === 0)
+        return refuse48("vtex_payments_body_unsupported");
+    if (lines.length !== 1 || own22(lines[0], "id"))
+        return refuse48("vtex_payments_split_payment");
+    const line = lines[0];
+    if (!inOrder10(line, VTEX_PAYMENTS_LINE_KEYS) || line.groupName !== "creditCardPaymentGroup")
+        return refuse48("vtex_payments_body_unsupported");
+    if (!(typeof line.currencyCode === "string" && CURRENCY6.test(line.currencyCode)) || !own22(VTEX_PAYMENTS_NETWORKS, line.paymentSystem) || !Number.isSafeInteger(line.paymentSystem) || !(count(line.value) && line.value > 0))
+        return refuse48("vtex_payments_body_unsupported");
+    if (line.installments !== 1 || line.referenceValue !== line.value || own22(line, "installmentsInterestRate") && line.installmentsInterestRate !== 0 || own22(line, "installmentsValue") && line.installmentsValue !== line.value)
+        return refuse48("vtex_payments_installments");
+    const transaction = line.transaction;
+    if (!record40(transaction) || Object.keys(transaction).join() !== "id,merchantName" || !(typeof transaction.id === "string" && TRANSACTION_ID.test(transaction.id)) || !(typeof transaction.merchantName === "string" && MERCHANT_NAME.test(transaction.merchantName)))
+        return refuse48("vtex_payments_body_unsupported");
+    if (target && transaction.id.toUpperCase() !== target.transactionId.toUpperCase())
+        return refuse48("vtex_payments_split_payment");
+    return fieldsSound(line.fields) ? CARD47 : refuse48("vtex_payments_body_unsupported");
+}
+function vtexPaymentsAmount(body) {
+    if (vtexPaymentsBodyVerdict(body).verdict !== "card")
+        return null;
+    const [line] = JSON.parse(body);
+    return { amountCents: line.value, currency: line.currencyCode.toLowerCase() };
+}
+var NETWORK_OF = Object.freeze({
+    visa: (number) => /^4[0-9]{12}(?:[0-9]{3}){0,2}$/.test(number),
+    mastercard: (number) => /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/.test(number),
+    amex: (number) => /^3[47][0-9]{13}$/.test(number),
+    discover: (number) => /^(?:6011[0-9]{12}|64[4-9][0-9]{13}|65[0-9]{14})$/.test(number)
+});
+var NETWORK_NAME = Object.freeze({ visa: "Visa", mastercard: "Mastercard", amex: "American Express", discover: "Discover" });
+var vtex_payments_default = /* @__PURE__ */ registerProcessor({
+    psp: VTEX_PAYMENTS_PSP,
+    definitions: [
+        {
+            psp: "vtex_payments",
+            // Ollie's card post to a VTEX account's own vault, as the header above reads it, and the fallback host, which
+            // the gate recognizes only to refuse, so the agent's placeholder never reaches it either. VTEX has no test host:
+            // every request is live. Prepared only: Ollie gives the post 12 seconds. Ships dark: served only to a client that
+            // declares `vtex_payments_card_payment`, on for Agentcard's own company alone (backend
+            // checkout-processor-gate.ts), and autopilot never sends it.
+            capability: "vtex_payments_card_payment",
+            match: "[a-z0-9-]{1,63}\\.vtexvault\\.com/api/payments/transactions/[A-Za-z0-9-]{1,64}/payments(?![\\w/.%-])",
+            hosts: ["^[a-z0-9-]{1,63}\\.vtexvault\\.com$"],
+            preparationRequired: true,
+            encoding: "json",
+            // Ollie's fetch sets the JSON content type alone. Origin, Referer and cookies never ride.
+            passthroughHeaders: [],
+            jsonCardFields: [[0, "fields", "cardNumber"]]
+        }
+    ],
+    // Only the cardholder's device sends it, after a person approves; no reviewed list names vtex_payments.
+    refusedOperations: [VTEX_PAYMENTS_OPERATION],
+    // Not surveyed: VTEX names a payment's end only to the store's own API keys and at the gatewayCallback that follows.
+    settlementReadback: "not_surveyed",
+    exactUrl: isVtexPaymentsCardUrl,
+    bodyGate: (url, body) => {
+        if (url === void 0)
+            return vtexPaymentsBodyVerdict(body);
+        const target = vtexPaymentsCardTarget(url);
+        if (target === null)
+            return refuse48("vtex_payments_url_refused");
+        return target.fallback ? refuse48("vtex_payments_fallback_refused") : vtexPaymentsBodyVerdict(body, target);
+    },
+    amount: (template) => record40(template) && isVtexPaymentsCardUrl(template.url) ? vtexPaymentsAmount(template.body) : null
+});
+// src/processors/index.generated.js
+var REGISTERED_MODULES = Object.freeze({
+    aurus: aurus_default,
+    bluesnap: bluesnap_default,
+    cardlink_vpos: cardlink_vpos_default,
+    eghl: eghl_default,
+    frisbii: frisbii_default,
+    iyzico: iyzico_default,
+    midtrans: midtrans_default,
+    monei: monei_default,
+    oceanpayment: oceanpayment_default,
+    paymentwall: paymentwall_default,
+    payplug: payplug_default,
+    paystack: paystack_default,
+    processout: processout_default,
+    usaepay: usaepay_default,
+    viva_wallet: viva_wallet_default,
+    vtex_payments: vtex_payments_default
+});
+// src/registry.js
+var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
+var ids = REGISTERED_PROCESSORS.map((processor) => processor.psp);
+var problems = REGISTERED_PROCESSORS.flatMap(registrationProblems);
+for (const [name, processor] of Object.entries(REGISTERED_MODULES)) {
+    if (processor.psp !== name)
+        problems.push(`processors/${name}.js registers ${JSON.stringify(processor.psp)}`);
+}
+if (ids.some((id, i) => i > 0 && ids[i - 1] >= id))
+    problems.push(`registered processors out of id order: ${ids.join(", ")}`);
+if (problems.length)
+    throw new Error(`payment-core registry refused: ${problems.join("; ")}`);
+var BY_PSP = new Map(REGISTERED_PROCESSORS.map((processor) => [processor.psp, processor]));
+var REGISTERED_IDS = Object.freeze(ids);
+var REGISTERED_DEFINITIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.definitions));
+var REGISTERED_REFUSED_OPERATIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.refusedOperations ?? []));
+var REGISTERED_SETTLEMENT_READBACK = Object.freeze(REGISTERED_PROCESSORS.filter((processor) => processor.settlementReadback !== void 0).map((processor) => [processor.psp, processor.settlementReadback]));
+function registeredRule(psp, name) {
+    return typeof psp === "string" ? BY_PSP.get(psp)?.[name] : void 0;
+}
+// src/card-fields.js
+function processorGate(recognizer, url, body) {
+    if (recognizer && recognizer.psp === LYRA_PSP)
+        return lyraBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === WIX_PAYMENTS_PSP) {
+        if (url !== void 0 && !isWixPaymentsTokenizeUrl(url))
+            return { verdict: "refuse", code: "wix_payments_url_refused" };
+        return wixPaymentsBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === KOMOJU_PSP)
+        return komojuBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === HIPAY_PSP) {
+        if (url !== void 0 && !isHipayTokenUrl(url))
+            return { verdict: "refuse", code: "hipay_url_refused" };
+        return hipayBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYPAL_PSP) {
+        if (url !== void 0 && !isPaypalConfirmUrl(url))
+            return { verdict: "refuse", code: "paypal_url_refused" };
+        return paypalBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === MAKECOMMERCE_PSP)
+        return makecommerceBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === OPENPAY_PSP)
+        return openpayBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === POYNT_PSP) {
+        if (url !== void 0 && !isPoyntNonceUrl(url))
+            return { verdict: "refuse", code: "poynt_url_refused" };
+        return poyntBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === CARDCOM_PSP)
+        return cardcomBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === TOAST_PSP) {
+        if (url !== void 0 && !isToastPaymentMethodsUrl(url))
+            return { verdict: "refuse", code: "toast_url_refused" };
+        return toastBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYU_LATAM_PSP)
+        return payuLatamBodyVerdict(body, url);
+    if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
+        if (url !== void 0 && !isPaddleVgsCardsUrl(url))
+            return { verdict: "refuse", code: "paddle_vgs_url_refused" };
+        return paddleVgsBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYFAST_PSP) {
+        if (url !== void 0 && !isPayfastPayUrl(url))
+            return { verdict: "refuse", code: "payfast_url_refused" };
+        return payfastBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYREXX_PSP) {
+        return url !== void 0 ? payrexxGateVerdict(url, body) : payrexxBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAYGENT_PSP) {
+        return url !== void 0 ? paygentRequestVerdict(url, body) : paygentBodyVerdict(body);
+    }
+    if (recognizer && recognizer.psp === PAY_NL_PSP) {
+        if (url !== void 0 && !isPayNlTokenUrl(url))
+            return { verdict: "refuse", code: "pay_nl_url_refused" };
+        return payNlBodyVerdict(body);
     }
     if (recognizer && recognizer.psp === TWOC2P_PSP) {
         if (url === void 0)
@@ -6412,7 +9031,7 @@ function carriesCardFields(recognizer, body) {
     if (typeof body !== "string" || body === "")
         return false;
     const anyCase = recognizer.caseInsensitiveFormKeys === true;
-    const wanted = anyCase ? fields.map((field2) => String(field2).toLowerCase()) : fields;
+    const wanted = anyCase ? fields.map((field5) => String(field5).toLowerCase()) : fields;
     for (const chunk of body.split("&")) {
         const eq = chunk.indexOf("=");
         if (eq <= 0 || eq === chunk.length - 1)
@@ -6503,20 +9122,20 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
 var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
 var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
 var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
-var BODY_LIMIT36 = 16384;
+var BODY_LIMIT48 = 16384;
 var RESPONSE_LIMIT = 32768;
 var ROOT_KEYS10 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
 var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
 var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
-var record33 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record41 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns8 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var exact4 = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
-var text9 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var exact5 = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text10 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 var digits3 = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
 var panLike2 = (value) => /(?:[0-9][ _.:-]*){12,}/.test(value);
-var plain2 = (value, max) => text9(value, max) && !panLike2(value);
-var MONTH20 = /^(?:0[1-9]|1[0-2])$/;
-var YEAR21 = /^20[0-9]{2}$/;
+var plain2 = (value, max) => text10(value, max) && !panLike2(value);
+var MONTH25 = /^(?:0[1-9]|1[0-2])$/;
+var YEAR26 = /^20[0-9]{2}$/;
 var NETWORK3 = /^[A-Z][A-Z_]{1,31}$/;
 function isPrimerTokenizeUrl(url, method = "POST") {
     if (method !== "POST" || typeof url !== "string" || url.length > 256 || url.includes("?") || url.includes("#"))
@@ -6531,7 +9150,7 @@ function isPrimerTokenizeUrl(url, method = "POST") {
     return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
 }
 function judgeBody6(body) {
-    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT36)
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT48)
         return null;
     let value;
     try {
@@ -6540,16 +9159,16 @@ function judgeBody6(body) {
     catch {
         return null;
     }
-    if (!record33(value) || !roundTrips(value, body))
+    if (!record41(value) || !roundTrips(value, body))
         return null;
     if (!Object.keys(value).every((key) => ROOT_KEYS10.includes(key)) || !owns8(value, "paymentInstrument"))
         return null;
     const instrument = value.paymentInstrument;
-    if (!record33(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns8(instrument, key)))
+    if (!record41(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns8(instrument, key)))
         return null;
-    if (!digits3(instrument.number, 12, 19) || !digits3(instrument.cvv, 3, 4) || !exact4(MONTH20, instrument.expirationMonth) || !exact4(YEAR21, instrument.expirationYear))
+    if (!digits3(instrument.number, 12, 19) || !digits3(instrument.cvv, 3, 4) || !exact5(MONTH25, instrument.expirationMonth) || !exact5(YEAR26, instrument.expirationYear))
         return null;
-    if (owns8(instrument, "cardholderName") && instrument.cardholderName !== null && !plain2(instrument.cardholderName, 256) || owns8(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact4(NETWORK3, instrument.preferredNetwork) || owns8(value, "userDescription") && value.userDescription !== null && !plain2(value.userDescription, 256) || owns8(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns8(value, "paymentFlow") && value.paymentFlow !== "VAULT")
+    if (owns8(instrument, "cardholderName") && instrument.cardholderName !== null && !plain2(instrument.cardholderName, 256) || owns8(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact5(NETWORK3, instrument.preferredNetwork) || owns8(value, "userDescription") && value.userDescription !== null && !plain2(value.userDescription, 256) || owns8(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns8(value, "paymentFlow") && value.paymentFlow !== "VAULT")
         return null;
     return { value, keepOnFile: owns8(value, "tokenType") || owns8(value, "paymentFlow") };
 }
@@ -6573,7 +9192,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
 var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
 var API_VERSION = /^2\.[0-9]{1,2}$/;
 function readHeaders(headers) {
-    if (!record33(headers))
+    if (!record41(headers))
         return null;
     const folded = /* @__PURE__ */ new Map();
     for (const [name, value] of Object.entries(headers)) {
@@ -6591,9 +9210,9 @@ function headersRefusal(headers) {
     const version = folded.get("primer-sdk-version");
     if (typeof version !== "string")
         return "unsupported";
-    if (!exact4(LEGACY_SDK_VERSION, version))
+    if (!exact5(LEGACY_SDK_VERSION, version))
         return "unsupported_sdk";
-    if (!exact4(CONTENT_TYPE2, folded.get("content-type")) || !exact4(CLIENT_TOKEN, folded.get("primer-client-token")) || folded.has("primer-sdk-client") && folded.get("primer-sdk-client") !== "WEB" || folded.has("x-api-version") && !exact4(API_VERSION, folded.get("x-api-version")) || folded.has("primer-sdk-checkout-session-id") && !exact4(REQUEST_ID, folded.get("primer-sdk-checkout-session-id")) || folded.has("x-request-id") && !exact4(REQUEST_ID, folded.get("x-request-id")))
+    if (!exact5(CONTENT_TYPE2, folded.get("content-type")) || !exact5(CLIENT_TOKEN, folded.get("primer-client-token")) || folded.has("primer-sdk-client") && folded.get("primer-sdk-client") !== "WEB" || folded.has("x-api-version") && !exact5(API_VERSION, folded.get("x-api-version")) || folded.has("primer-sdk-checkout-session-id") && !exact5(REQUEST_ID, folded.get("primer-sdk-checkout-session-id")) || folded.has("x-request-id") && !exact5(REQUEST_ID, folded.get("x-request-id")))
         return "unsupported";
     return null;
 }
@@ -6620,7 +9239,7 @@ function onTokenizePath(url) {
     }
 }
 function primerTokenizeRefusal(request) {
-    if (!record33(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
+    if (!record41(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
         return "unsupported";
     return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
 }
@@ -6635,7 +9254,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
         return "unsupported";
     if (new URL(url).hostname !== LIVE_PCI_HOST)
         return null;
-    return primerCardOnFileDisclosure(url, policy) && record33(options) && options.keepOnFile === true ? null : "keep_on_file";
+    return primerCardOnFileDisclosure(url, policy) && record41(options) && options.keepOnFile === true ? null : "keep_on_file";
 }
 function primerRefusalMessage(reason) {
     if (reason === "keep_on_file")
@@ -6696,8 +9315,8 @@ function injectPrimerCard(body, card) {
 }
 var TOKEN4 = /^[A-Za-z0-9_-]{8,256}$/;
 var ERROR_ID = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
-var CODE8 = /^[A-Z][A-Z0-9_]{0,63}$/;
-var NETWORK_NAME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
+var CODE10 = /^[A-Z][A-Z0-9_]{0,63}$/;
+var NETWORK_NAME2 = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
 var RESPONSE_MONTH = /^(?:0?[1-9]|1[0-2])$/;
 var RESPONSE_YEAR = /^(?:[0-9]{2}|20[0-9]{2})$/;
 var PROTOCOL2 = /^[0-9]{1,2}(?:\.[0-9]{1,2}){0,2}$/;
@@ -6719,25 +9338,25 @@ function readAnswer(body) {
         return null;
     try {
         const value = JSON.parse(body);
-        return record33(value) ? value : null;
+        return record41(value) ? value : null;
     }
     catch {
         return null;
     }
 }
-var tokenValue = (value) => exact4(TOKEN4, value) && !panLike2(value);
+var tokenValue = (value) => exact5(TOKEN4, value) && !panLike2(value);
 var optional = (value, key, check) => !owns8(value, key) || value[key] === null || check(value[key]);
 function cardDetails(data) {
-    if (!record33(data) || !exact4(/^[0-9]{4}$/, data.last4Digits))
+    if (!record41(data) || !exact5(/^[0-9]{4}$/, data.last4Digits))
         return null;
-    if (!optional(data, "first6Digits", (v) => exact4(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact4(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact4(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain2(v, 256)) || !optional(data, "network", (v) => exact4(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record33))
+    if (!optional(data, "first6Digits", (v) => exact5(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact5(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact5(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain2(v, 256)) || !optional(data, "network", (v) => exact5(NETWORK_NAME2, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record41))
         return null;
     const safe = { last4Digits: data.last4Digits };
     for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
         if (owns8(data, key) && data[key] !== null)
             safe[key] = data[key];
     }
-    if (record33(data.binData)) {
+    if (record41(data.binData)) {
         const bin = {};
         for (const key of BIN_KEYS) {
             if (!owns8(data.binData, key) || data.binData[key] === null)
@@ -6748,12 +9367,14 @@ function cardDetails(data) {
         }
         safe.binData = bin;
     }
+    if ([safe.network, ...Object.values(safe.binData ?? {})].reduce((sum, value) => sum + (typeof value === "string" ? digitCount(value) : 0), 0) > NAME_DIGITS)
+        return null;
     return safe;
 }
 function threeDsSummary(value) {
     if (value === void 0 || value === null)
         return null;
-    if (!record33(value) || !exact4(CODE8, value.responseCode) || !optional(value, "reasonCode", (v) => exact4(CODE8, v)) || !optional(value, "reasonText", (v) => plain2(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact4(PROTOCOL2, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
+    if (!record41(value) || !exact5(CODE10, value.responseCode) || !optional(value, "reasonCode", (v) => exact5(CODE10, v)) || !optional(value, "reasonText", (v) => plain2(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact5(PROTOCOL2, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
         return void 0;
     const safe = { responseCode: value.responseCode };
     for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
@@ -6781,8 +9402,8 @@ function rebuildToken(value) {
 }
 function primerErrorId(body) {
     const value = readAnswer(body);
-    const id = value && record33(value.error) ? value.error.errorId : null;
-    return exact4(ERROR_ID, id) && !panLike2(id) ? id : null;
+    const id = value && record41(value.error) ? value.error.errorId : null;
+    return exact5(ERROR_ID, id) && !panLike2(id) ? id : null;
 }
 function matchesCard(details, card) {
     const number = card && typeof card.number === "string" ? card.number : "";