@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: ae602a804a759165b26cb804547bdc99792036a22cc355a6dba49cfb11e92897
+// artifact-sha256: 0abf1d62c20303c4496e1d26b64b1c36ad517919d23f2d14e3f0b6763694551f
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -169,15 +169,60 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             // supplier (the terminal) + benid (the iframe session) + the amount:
             // one submission, whatever nonce the form regenerated on a re-click.
             dedupe: ["supplier", "benid", "sum", "currency"],
+            // Tranzila's servers are PHP (PHPSESSID on direct, CodeIgniter's
+            // ci_session on directng): of a field posted twice they act on the last
+            // copy, and they read `cred.type` as cred_type and `sum[]` as sum. Every
+            // rule here reads the first copy under the name as written, so such a
+            // form is refused before them (backend.js phpFormKeyRefusal).
+            serverKeys: "php",
             // One plain sale, reporting to the merchant the person sees: tranmode
             // A (or absent) only (V verifies, K charges a token, C refunds, D
             // forces), no TranzilaTK in either direction (`1` asks for a reusable
-            // token back, a token charges one), and every *_url_address on the
-            // merchant's host (Tranzila redirects the device there and POSTs the
-            // result there with the card's last four, expiry and ID number).
+            // token back, a token charges one), and every callback URL on the
+            // merchant's host or on Tranzila's own result page (Tranzila redirects
+            // the device there and POSTs the result there with the card's last
+            // four, expiry and ID number).
             sale: { key: "tranmode", values: ["A"] },
             token: "TranzilaTK",
-            callbackUrls: ["success_url_address", "fail_url_address", "notify_url_address"]
+            // One charge, never a plan: cred_type 1 (one payment, Tranzila's
+            // default; 6 is credit installments, 8 installments), tash 1 (a
+            // merchant page posts it beside cred_type 8 as the installment count,
+            // and Tranzila copies both into its card form: Mehubarim La'am's
+            // donation page, 2026-10-10), npay 0 (payments after the first), no
+            // installment amounts, and no My Billing recurring charge (recur_*, and
+            // the legacy page's make_recur_transaction box). A value outside a key's
+            // list is refused as special_flow; an empty list takes no value at all.
+            singleCharge: {
+                cred_type: ["1"],
+                tash: ["1"],
+                npay: ["0"],
+                fpay: [],
+                spay: [],
+                recur_transaction: [],
+                recur_sum: [],
+                recur_payments: [],
+                recur_start_date: [],
+                make_recur_transaction: []
+            },
+            // The merchant posts success_url_address, fail_url_address and
+            // notify_url_address to iframenew.php, and Tranzila's own card form, on
+            // both hosts, carries them as success_url, fail_url and notify_url.
+            callbackUrls: ["success_url_address", "fail_url_address", "notify_url_address", "success_url", "fail_url", "notify_url"],
+            // The result page Tranzila's card form names when the terminal set no
+            // return URL of its own (read on both hosts on 2026-10-10): the result
+            // goes back to Tranzila, which already holds it. Matched exactly.
+            processorResultUrls: ["https://direct.tranzila.com/done/", "https://directng.tranzila.com/process/fail"],
+            // Tranzila's own ALTCHA proof of work, on every card form read on both
+            // hosts on 2026-10-10 (altcha 1.0.7, SHA-256, searched up to 50,000):
+            // Tranzila's script hashes the page's challenge until it finds the
+            // number, writes base64 JSON {algorithm, challenge, number, salt,
+            // signature, took} into `altcha`, and only then submits the form.
+            // Nobody answers anything and the proof names no browser, cookie or
+            // address, so it rides the device's one send as the page wrote it, once
+            // the create finds it is one solved proof (backend.js isAltchaProof).
+            // Every other challenge field is still refused (hosted_form_gated).
+            // Removing this line refuses `altcha` again.
+            proofOfWork: "altcha"
         }
     },
     {
@@ -187,7 +232,7 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // The merchant's page posts an ENTRY form top-level to live.ekashu.com/ (test:
         // test.ekashu.com/) with the amount, the result URLs and a SHA256HMAC over them (hash
         // code 2.0.0), and no card. NMI answers with its own card page under an HttpOnly session
-        // cookie and an anti-forgery token, so a card form rebuilt away from that session is
+        // cookie and session fields of its own, so a card form rebuilt away from that session is
         // refused by NMI (processors/ekashu.js has the recorded shapes). The paused request is
         // therefore the entry, a Document navigation that carries no card: the cardholder's
         // device repeats it over the end-to-end TLS relay, fills the card into the page NMI
@@ -207,11 +252,20 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         encoding: "form",
         passthroughHeaders: [],
         mode: "hosted_form",
+        // NMI sends the merchant's server a reusable card reference (EKASHU_CARD_REFERENCE) with every
+        // payment, so the merchant keeps the card that pays. Only a card the person stored pays such a
+        // checkout: the API refuses a company's added card at create, card choice and lease (409
+        // card_not_stored), and the approval page never offers one and says the merchant can keep it.
+        keepsCardOnFile: true,
         hostedForm: {
             // The card goes into the page NMI returns to the device, not into the paused entry,
             // which must carry none (processors/ekashu.js checkEkashuEntry). The device never
             // posts a form of its own: the Vault's form-action policy leaves these hosts out.
             cardIn: "processor_page",
+            // The entry's own rules (processors/ekashu.js checkEkashuEntry), the reviewed sellers among
+            // them: the create runs them, and naming them here makes the cardholder's device run them
+            // again on the entry it is about to repeat (forms.js hostedFormTemplateRefusal).
+            policy: "ekashu",
             // The server callback too: the device never returns the buyer's browser to the merchant,
             // so a merchant NMI tells of a payment only through that return never records it.
             required: [
@@ -558,16 +612,24 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
     },
     {
         psp: "moneris",
-        compose: { input_exp: "MMYY" },
         // Hosted Tokenization. VERIFIED live against hpp_common.js on all six
         // hosts: the iframe does `request.open('POST', 'request.php')` (XHR, relative to
         // /HPPtoken/index.php) with Content-Type application/x-www-form-urlencoded and
-        // PAN@ input_data. It sets no auth header (the HT profile is the ?id= on the iframe
-        // URL), so passthroughHeaders is correctly empty. hpp_common.js references exactly
-        // one URL and one method, so there is no second tokenization path to cover.
+        // PAN@ input_data, expiry@ input_exp (MMYY) and CVD@ input_cvd. moneris.js holds the body
+        // rules and the card fill (read from the live frame on 2026-10-10). It sets no auth header (the
+        // HT profile rides in the body as hpt_id), so passthroughHeaders is correctly empty. hpp_common.js
+        // references exactly one URL and one method, so there is no second tokenization path to cover.
         // NOTE: do NOT add Moneris Checkout (chkt/) as a separate entry. It shares these
         // hosts and resolveRecognizerForUrl .find()s on host first, so one would permanently
         // shadow the other; chkt/ instead falls out at the path check (refused, not leaked).
+        // request.php answers no browser origin, so the card leaves the cardholder's device only through
+        // the checkout relay, which carries www3 and gateway for a live row and esqa for a test row
+        // (moneris.js MONERIS_TOKENIZE_HOSTS), and Moneris's answer is judged by moneris.js
+        // monerisAnswerOutcome, since its refusals arrive inside HTTP 200.
+        // Ships dark: served only to a client that declares `moneris_hosted_tokenization`, gated off for
+        // every org until an operator lists it (`moneris:<org>`, or `moneris:*` once a live purchase proved
+        // it), and the internal spine never mints a Moneris row.
+        capability: "moneris_hosted_tokenization",
         match: "(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\\.moneris\\.com/HPPtoken/request\\.php",
         hosts: [
             "^www3\\.moneris\\.com$",
@@ -577,8 +639,11 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
             "^gatewayt\\.moneris\\.com$",
             "^gatewaydev\\.moneris\\.com$"
         ],
-        // Live: www3, gateway. Test/QA/dev: esqa, gatewayqa, gatewayt, gatewaydev.
+        // Live: www3, gateway. Test/QA/dev: esqa, gatewayqa, gatewayt, gatewaydev. Pinned (S7): a create
+        // refuses a test host on a live row and a live host on a test row, and the device sends a test host
+        // only the shared documented test cards (test-pans.js), never a real card.
         sandboxHosts: ["^esqa\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"],
+        hostEnvironmentPinned: true,
         encoding: "form",
         passthroughHeaders: []
     },
@@ -702,8 +767,8 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // points at it. The request names no amount: the token is charged later.
         // Ships dark: served only to a client that declares `primer_payment_instruments`, gated off for every
         // org until an operator allowlists one, and never replayed by autopilot (EXCLUDED_OPERATIONS). A client
-        // session can save the card with no sign in the request, so the API also refuses every live row at
-        // create until the cardholder can consent to that save; only a test row pays.
+        // session can save the card with no sign in the request, so a live row pays only with a card the person
+        // stored, on an approval that shows the keep-on-file note (primer.js PRIMER_SESSION_CARD_ON_FILE).
         capability: "primer_payment_instruments",
         match: "sdk\\.api(?:\\.sandbox)?\\.primer\\.io/payment-instruments(?![\\w/.-])",
         hosts: ["^sdk\\.api\\.primer\\.io$", "^sdk\\.api\\.sandbox\\.primer\\.io$"],
@@ -848,34 +913,50 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
     {
         psp: "gravy",
         // Gravy (Gr4vy) payment orchestration, Secure Fields. PAN@ payment_method.number,
-        // expiry@ payment_method.expiration_date as ONE `MM/YY` string (hence `compose`), CVC@
-        // payment_method.security_code. The merchant page never sees the card: Secure Fields
-        // renders each input in a frame Gravy serves and sends the request from there, so an
-        // in-page hook cannot observe it and only the CDP and Playwright transports can pause it.
+        // expiry@ payment_method.expiration_date as ONE `MM/YY` string, CVC@
+        // payment_method.security_code. gravy.js holds the body rule, the card fill and the answer
+        // judge: the pause decision, the API's create and the device read one verdict on the whole
+        // body (payment_method's new card in the controller's shape, at most a postal_code beside it,
+        // nothing card-shaped anywhere else), and the device writes the card into those three fields
+        // alone, never through the generic walk; there is no `compose` on purpose (it widens what the
+        // generic walk would call a card). Only Gravy's empty answer is approved.
+        // The merchant page never sees the card: Secure Fields renders each input in a frame Gravy
+        // serves and sends the request from its hidden controller frame
+        // (secure-fields.<merchant id>.gr4vy.app/controller.html), so an in-page hook cannot observe
+        // it and only the CDP and Playwright transports can pause it.
         // Every merchant on Gravy gets its OWN API host, api.<merchant id>.gr4vy.app, with
         // api.sandbox.<merchant id>.gr4vy.app for test. The merchant label is a bounded wildcard
         // on purpose, the same footing as deposit.<shop>.shopifycs.com and <prefix>.adyenpayments.com
         // above: Gravy assigns the label under a domain only Gravy controls, so no third party can
         // register a host that satisfies it. Only the `api.` host ever carries a card; cdn.<id>
-        // serves secure-fields.js and embed.<id> the hosted Embed frame, and both fall out of `hosts`.
-        // The card request is Secure Fields' "update checkout session fields" call,
-        // /checkout/sessions/<session id>/fields. The id segment is pinned to UUID shape so neither
-        // a sibling (the session itself at /checkout/sessions/<id>, which carries no card) nor any
-        // extension of the path is admitted. The session id IS the credential: the request carries
-        // no auth header, so passthroughHeaders is empty on purpose.
-        // Gravy publishes this request as an HTTP PUT. Every card gate here and in the SDK admits
-        // POST only (isCardRequest, prepareDeviceReplay, the enclave dispatcher), so this entry
-        // recognizes the destination and fills the body but pauses NOTHING until a recognizer can
-        // declare its method. Inert, never leaky: a PUT on this host continues to Gravy untouched.
-        // The shape is taken from Gravy's published Secure Fields contract and pinned in
-        // test/fixtures/gravy-secure-fields.json; a capture from a live merchant form
-        // (payments.wikimedia.org) has not yet confirmed it.
+        // serves secure-fields.js, secure-fields.<id> the input and controller frames and embed.<id>
+        // the hosted Embed frame, and all three fall out of `hosts`.
+        // The card request is Secure Fields' "update checkout session fields" call, an HTTP PUT to
+        // /checkout/sessions/<session id>/fields, and the one card request here that is a PUT
+        // (`request.method`, read through recognizerRequestMethod): the SDK pauses the PUT, the API
+        // stores it as a PUT and the cardholder's device sends it as one, while a POST to the same URL
+        // is not this request and pauses nothing. Gravy answers 204 with no body. The id segment is
+        // pinned to UUID shape so neither a sibling (the session itself at /checkout/sessions/<id>,
+        // which carries no card) nor any extension of the path is admitted. The session id IS the
+        // credential: the request carries no auth header, so passthroughHeaders is empty on purpose.
+        // The shape was read on 2026-10-10 from the controller bundle Trek Bicycle and the Wikimedia
+        // Foundation both load (controller.d3ca784d5a714143771d.js) and is pinned in
+        // test/fixtures/gravy-secure-fields.json: payment_method.method 'card', and Content-Type
+        // application/json as the request's only header of its own.
+        // Ships dark: served only to an SDK that declares this capability, and gated off for every
+        // org until an operator lists one in CHECKOUT_GATED_PROCESSOR_ORGS (`gravy:*` once a live
+        // purchase proves the lane). The request names no amount and gravy is not on the
+        // reviewed autopilot list, so the cardholder approves every payment. The environment is
+        // pinned (S7), as every dark lane pins it: api.sandbox.<id> only on sandbox rows and only
+        // with documented test cards, and the live host only on live rows.
+        capability: "gravy_session_fields_put",
         match: "api(\\.sandbox)?\\.[a-z0-9-]+\\.gr4vy\\.app/checkout/sessions/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/fields",
         hosts: ["^api\\.[a-z0-9-]+\\.gr4vy\\.app$", "^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"],
         sandboxHosts: ["^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"],
+        hostEnvironmentPinned: true,
         encoding: "json",
         passthroughHeaders: [],
-        compose: { expiration_date: "MM/YY" }
+        request: { method: "PUT", cardIn: "body", response: "no_content" }
     },
     // ── Dark entries (a `capability` gates discovery, the SDK fallback and every org) ──
     {
@@ -1009,7 +1090,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // cardNumber: cardFields and passWithoutCard let them continue untouched. The GET that loads the
         // iframe document shares the path, and the POST gate keeps it out. datatrans.js judges the whole
         // request, refuses usage=REGISTRATION (card on file) until that decision is made and a
-        // paymentMethod that is not the card's own, and writes only cardNumber, cvv, expm and expy.
+        // paymentMethod that is not the card's own, and writes only cardNumber, cvv, expm and expy; a post
+        // whose expiry the merchant's own form keeps (RaiseNow's Tamaro: no expm or expy) gets cardNumber
+        // and cvv only.
         // Hosts are the two literal labels (never *.datatrans.com: api., 3d. and admin. are other
         // services, and PCI Proxy's custom domains are not recognized); the sandbox host is pinned (S7):
         // it takes only documented test cards, and a live row never points at it.
@@ -1149,23 +1232,35 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // device encrypts the real card and sends this request itself (payrails-replay.js), and the
         // ciphertext never returns to the page. Dynamic payment-method forms save non-card instruments
         // on the same URL with no data.encryptedData: jsonCardFields claims only a card save and
-        // passWithoutCard lets the rest continue untouched. payrails.js holds the request guard, the
-        // card-on-file policy, the session-key and workspace checks and the answer rules. NOT here:
-        // /public/payment/instruments/tokenize (web-cse used directly), api.payrails.io and the
-        // execution authorize links (card-form payments, stored-card CVC), and assets.payrails.io.
+        // passWithoutCard lets the rest continue untouched. The card form's Pay button (FlixBus's guest
+        // checkout, web SDK 5.50.0) pays through the execution's authorize link instead,
+        // /public/merchant/workflows/payment-acceptance/executions/<uuid>/authorize, with the same JWE at
+        // paymentComposition[0].paymentInstrumentData.encryptedData; a wallet, a stored card or a
+        // redirect method authorizes on the same link with none and continues untouched. Both links sit
+        // on Payrails' public API: the shared api-pub.payrails.io or a merchant's own
+        // api-pub.<merchant>.payrails.io (FlixBus: api-pub.flix.payrails.io), the one-label pattern in
+        // `hosts`; the backend's reviewed pin names the hosts each merchant may use. payrails.js holds the
+        // request guards, the card-on-file policy, the session-key and workspace checks and the answer
+        // rules. NOT here: /public/payment/instruments/tokenize (web-cse used directly), api.payrails.io,
+        // the other execution links, and assets.payrails.io.
         // `capability` keeps the entry out of BUILTIN_REGISTRY and every org until one opts in; the API
         // serves it only to a client that also asks for modes=device_encrypt. The two staging hosts are
         // pinned to sandbox rows (S7). Autopilot refuses it by operation (payrails.device_encrypted_card).
         capability: "payrails_device_encrypt",
-        match: "(?:api-pub|api-pub\\.staging|sandbox-api-pub\\.staging)\\.payrails\\.io/public/payment/instruments(?![\\w/.-])",
-        hosts: ["^api-pub\\.payrails\\.io$", "^api-pub\\.staging\\.payrails\\.io$", "^sandbox-api-pub\\.staging\\.payrails\\.io$"],
+        match: "(?:api-pub(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)?|sandbox-api-pub\\.staging)\\.payrails\\.io/public/(?:payment/instruments|merchant/workflows/payment-acceptance/executions/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/authorize)(?![\\w/.-])",
+        hosts: [
+            "^api-pub\\.payrails\\.io$",
+            "^api-pub\\.staging\\.payrails\\.io$",
+            "^sandbox-api-pub\\.staging\\.payrails\\.io$",
+            "^api-pub\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.payrails\\.io$"
+        ],
         sandboxHosts: ["^api-pub\\.staging\\.payrails\\.io$", "^sandbox-api-pub\\.staging\\.payrails\\.io$"],
         hostEnvironmentPinned: true,
         encoding: "json",
         // body shape; the SDK sends text/plain, replayed verbatim
         passthroughHeaders: ["^authorization$", "^x-idempotency-key$", "^x-client-version$", "^x-client-type$"],
-        jsonCardFields: [["data", "encryptedData"]],
-        passWithoutCard: "(?:api-pub|api-pub\\.staging|sandbox-api-pub\\.staging)\\.payrails\\.io/public/payment/instruments",
+        jsonCardFields: [["data", "encryptedData"], ["paymentComposition", 0, "paymentInstrumentData", "encryptedData"]],
+        passWithoutCard: "(?:api-pub(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)?|sandbox-api-pub\\.staging)\\.payrails\\.io/public/(?:payment/instruments|merchant/workflows/payment-acceptance/executions/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/authorize)",
         clientSideEncrypted: true,
         // older SDKs read this and refuse locally
         mode: "device_encrypt",
@@ -1188,20 +1283,21 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // own AngularJS page posts the card as same-origin JSON to /hosted-payments/service/payment/hpp/process.
         // PAN@ paymentData.ssl_card_number (digits), expiry@ paymentData.ssl_exp_date (MMYY), CVC@
         // paymentData.ssl_cvv2cvc2. No client-side encryption; the session rides in the body (`context`).
-        // Sources: assets/hpp-2.505.07.js, byte-identical on both hosts, reviewed 2026-09-25. The same URL
+        // Sources: assets/hpp-2.505.07.js, byte-identical on all three hosts, reviewed 2026-09-25. The same URL
         // carries wallet, ACH and loan payments and the follow-ups after 3DS2, Pay Defense or a surcharge
         // quote: the Converge body gate decides (elavon-converge.js convergeBodyVerdict, which card-fields.js
         // asks first, so the SDK's generated copy carries it). The lightbox (hpm/process), Checkout.js
         // (hpe/process) and every other hpp/ call fall out at the exact path; (?![\w/.%-]) is the right edge
-        // for the SDK's unanchored test. Hosts are two literal labels, never *.convergepay.com (www and demo
-        // are the merchant web UI).
+        // for the SDK's unanchored test. Hosts are three literal labels, never *.convergepay.com: api, its demo,
+        // and www, where every Buy Button and pay link opens the same page and bundle, which post the card to
+        // www's own origin (read 2026-10-10). demo.convergepay.com is the merchant web UI.
         // Ships dark: served only to a client that declares `converge_hpp_process`, gated off for every org
         // until an operator allowlists one, never replayed by autopilot (EXCLUDED_OPERATIONS).
         capability: "converge_hpp_process",
-        match: "api(?:\\.demo)?\\.convergepay\\.com/hosted-payments/service/payment/hpp/process(?![\\w/.%-])",
-        hosts: ["^api\\.convergepay\\.com$", "^api\\.demo\\.convergepay\\.com$"],
+        match: "(?:api(?:\\.demo)?|www)\\.convergepay\\.com/hosted-payments/service/payment/hpp/process(?![\\w/.%-])",
+        hosts: ["^api\\.convergepay\\.com$", "^api\\.demo\\.convergepay\\.com$", "^www\\.convergepay\\.com$"],
         // api.demo is Converge's demo environment. Pinned (S7): a create refuses it on a live row and the
-        // production host on a test row, and the device sends only documented test cards to it.
+        // production hosts, api and www, on a test row, and the device sends only documented test cards to it.
         sandboxHosts: ["^api\\.demo\\.convergepay\\.com$"],
         hostEnvironmentPinned: true,
         encoding: "json",
@@ -1209,7 +1305,7 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         passthroughHeaders: [],
         jsonCardFields: [["paymentData", "ssl_card_number"]],
         // An electronic check or financing payment on the same URL carries no card and continues untouched.
-        passWithoutCard: "api(?:\\.demo)?\\.convergepay\\.com/hosted-payments/service/payment/hpp/process"
+        passWithoutCard: "(?:api(?:\\.demo)?|www)\\.convergepay\\.com/hosted-payments/service/payment/hpp/process"
     },
     {
         psp: "wspay",
@@ -1263,8 +1359,9 @@ var PROCESSOR_DEFINITIONS = deepFreeze([
         // browser's host). `capability` keeps the entry out of BUILTIN_REGISTRY, serves it only to a client
         // that declares shiji_sts_pinned_key, and leaves it off for every org until one is opted in. The UAT
         // host is the sandbox host and the environment is pinned (S7): UAT only on sandbox rows, with
-        // documented test cards. Every getTokenId is refused as card on file (a hotel guarantee) until the
-        // consent decision is made (shiji-sts.js SHIJI_STS_KEEP_ON_FILE). `(?![\w/-])` ends the path as
+        // documented test cards. Every getTokenId keeps the card on file (a hotel guarantee), which the
+        // cardholder consents to on the approval screen (shiji-sts.js SHIJI_STS_KEEP_ON_FILE: 'ask', and
+        // 'refuse' is the kill switch that refuses each one before any prompt). `(?![\w/-])` ends the path as
         // on mercado_pago and paysafe: a consumer that tests `match` unanchored never takes
         // /v1/token/getTokenIdX or /v1/token/getTokenId/x for a card request.
         capability: "shiji_sts_pinned_key",
@@ -1345,6 +1442,8 @@ var PSP_CLIENT_TABLE = deepFreeze(PROCESSOR_DEFINITIONS.map((definition) => ({
             ...definition.hostedForm.optional ? { optional: definition.hostedForm.optional } : {}
         } } : {},
     ...definition.hostedForm?.cardIn ? { formCardIn: definition.hostedForm.cardIn } : {},
+    // The page's copy of the rule that only the person's own stored card pays (the API holds the same).
+    ...definition.keepsCardOnFile ? { keepsCardOnFile: true } : {},
     ...definition.deviceSteps ? { deviceSteps: Object.fromEntries(Object.entries(definition.deviceSteps).map(([step, source]) => [step, new RegExp(source, "i")])) } : {},
     ...definition.deviceEncrypt ? { deviceEncrypt: definition.deviceEncrypt } : {}
 })));
@@ -1412,6 +1511,15 @@ var DATATRANS_TEST_PANS = Object.freeze([
     "36000010000022",
     "3550998599961037"
 ]);
+// src/moneris.js
+var MONERIS_TOKENIZE_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["www3.moneris.com", "gateway.moneris.com"]),
+    sandbox: Object.freeze(["esqa.moneris.com"])
+});
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), profileIds: Object.freeze([...fields.profileIds]) });
+var MONERIS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "jack_org_raisin", merchant: "Jack.org", origins: ["https://jack.akaraisin.com"], profileIds: ["htL7TR9H7ICYN2B"] })
+]);
 // src/cybersource-secure-acceptance.js
 var SA_BODY_LIMIT = 32 * 1024;
 var SA_REPLY_LIMIT = 64 * 1024;