@agent-cards/sdk 0.23.9 → 0.23.11

package/dist/aci.d.ts

@@ -140,15 +140,17 @@ export declare class AciGate {
     /** The card-number request's approval ended, answered or not; unanswered siblings fail. */
     end(): void;
     /**
-     * A request on this checkout was refused before any card-number request began (a card-number
-     * request that asks ACI to keep the card, a leg the widget never sends): the siblings waiting for
-     * one fail now, and so does every later sibling until a card-number request begins. A running or
-     * answered card-number request keeps its siblings.
+     * A request on this checkout was refused. When it names the card number (a card-number request
+     * that asks ACI to keep the card, or carries a field the widget never sends with it) and no
+     * card-number request began, the siblings waiting for one fail now, and so does every later sibling
+     * until a card-number request begins. A refused request that names no card number, such as a
+     * fingerprint longer than ACI takes, says nothing about the card-number request a later Pay sends,
+     * so its siblings keep waiting for it. A running or answered card-number request keeps its siblings.
      */
     refused(leg: {
         host: string;
         checkoutId: string;
-    }): void;
+    }, body: string | null | undefined): void;
     /**
      * A sibling leg (the page's CVC or expiry request): the answer to hand it, once its checkout's
      * card-number request was answered, or null when that request failed, never began within

package/dist/aci.generated.d.ts

@@ -11,6 +11,7 @@ declare var ACI_ABSORBED_FIELDS: readonly string[];
 declare var ACI_PASSED_FIELDS: readonly string[];
 declare var ACI_SIBLING_KEYS: readonly string[];
 declare var ACI_REMOVED_ON_CONTINUATION: readonly string[];
+declare var ACI_FINGERPRINT_FIELD: string;
 declare function aciEndpoint(url: any): {
     kind: string;
     host: string;
@@ -84,4 +85,4 @@ declare function aciResponseOutcome(status: any, text: any): {
     reason?: undefined;
 };
 declare function sanitizeAciResponse(text: any): string;
-export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };
+export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_FINGERPRINT_FIELD, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };

package/dist/aci.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: b5b6d696111cb2906b73f99dc9ed21cbf51580bd0799183694ed5147c8a10e66
+// artifact-sha256: 624ca03645e28d72156188c850b3650fd0f5162b0366475e6a124657120f7f11
 // src/aci.js
 var ACI_HOSTS = Object.freeze(["eu-prod.oppwa.com", "oppwa.com", "eu-test.oppwa.com", "test.oppwa.com"]);
 var ACI_TEST_HOSTS = Object.freeze(["eu-test.oppwa.com", "test.oppwa.com"]);
@@ -22,6 +22,9 @@ var ACI_ABSORBED_FIELDS = Object.freeze(["card.cvv", "card.expiryMonth", "card.e
 var ACI_PASSED_FIELDS = Object.freeze(["card.holder"]);
 var ACI_SIBLING_KEYS = Object.freeze(["customParameters[SHOPPER_EndToEndIdentity]"]);
 var ACI_REMOVED_ON_CONTINUATION = Object.freeze(["card.expiryMonth", "card.expiryYear"]);
+var ACI_FINGERPRINT_FIELD = "customer.browserFingerprint.value";
+var FINGERPRINT_LENGTH = 4096;
+var LEG_BODY_LIMIT = 16384;
 var END_TO_END = ACI_SIBLING_KEYS[0];
 var CHECKOUT_ID = /^[0-9A-F]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}$/i;
 var ENDPOINT_PATH = /^\/v1\/checkouts\/([^/]+?)(\/payment|\/registration)?$/;
@@ -76,7 +79,8 @@ function readAciForm(body, limit = 8192) {
         catch {
             return null;
         }
-        if (!key || key.length > 128 || CONTROL.test(key) || CONTROL.test(value) || value.length > 2048 || seen.has(key))
+        const longest = key === ACI_FINGERPRINT_FIELD ? FINGERPRINT_LENGTH : 2048;
+        if (!key || key.length > 128 || CONTROL.test(key) || CONTROL.test(value) || value.length > longest || seen.has(key))
             return null;
         seen.add(key);
         pairs.push({ key, value, raw });
@@ -117,11 +121,13 @@ function classifyAciRequest(request) {
         return refuse(ACI_CARD_ON_FILE_REFUSED);
     if (endpoint.kind === "payment")
         return { leg: "continuation", ...at };
-    const pairs = readAciForm(request.body);
+    const pairs = readAciForm(request.body, LEG_BODY_LIMIT);
     if (!pairs)
         return refuse(ACI_UNSUPPORTED_REQUEST);
     if (pairs.some(({ key }) => isAciCardOnFileKey(key)))
         return refuse(ACI_CARD_ON_FILE_REFUSED);
+    if (pairs.length === 1 && pairs[0].key === ACI_FINGERPRINT_FIELD)
+        return { leg: "pass", ...at };
     if (!pairs.every(({ key, value }) => validField(key, value)))
         return refuse(ACI_UNSUPPORTED_REQUEST);
     const own = pairs.map(({ key }) => key).filter((key) => key !== END_TO_END);
@@ -199,6 +205,7 @@ function aciPlaceholderBrandRefusal(templateBody, card) {
 var CONTINUATION_KEYS = /* @__PURE__ */ new Set([
     "paymentBrand",
     "shopperResultUrl",
+    "shopperResultTarget",
     "shopOrigin",
     "forceUtf8",
     "card.holder",
@@ -250,6 +257,9 @@ function prepareAciContinuation(request, context) {
     if (!pairs.every(({ key }) => continuationKey(key)))
         return refuse(ACI_UNSUPPORTED_REQUEST);
     const value = (key) => pairs.find((pair) => pair.key === key)?.value;
+    const target = value("shopperResultTarget");
+    if (target !== void 0 && target !== "_top")
+        return refuse(ACI_UNSUPPORTED_REQUEST);
     if (typeof brand !== "string" || !/^[A-Z]{2,16}$/.test(brand) || value("paymentBrand") !== brand)
         return refuse(ACI_BRAND_MISMATCH);
     if (!onOrigin(value("shopperResultUrl"), merchantOrigin))
@@ -303,4 +313,4 @@ function sanitizeAciResponse(text) {
         throw new Error("Refusing to store an unconfirmed ACI answer.");
     return JSON.stringify({ result: { code: ACI_CHECKOUT_UPDATED, description: "successfully updated checkout" } });
 }
-export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };
+export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_FINGERPRINT_FIELD, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };

package/dist/aci.js

@@ -12,7 +12,10 @@
 //   - the page's own CVC and expiry requests carry the agent's placeholder values: they are held
 //     and answered with the card-number request's answer once it lands, never forwarded, and
 //     failed when it does not (or when no card-number request for their checkout ever begins);
-//   - the holder request carries nothing secret and continues;
+//   - the holder request and the ReD Shield device fingerprint the widget posts on load carry
+//     nothing secret and continue;
+//   - a refused request fails the checkout's waiting CVC and expiry requests only when it is that
+//     checkout's card-number request: a refusal that names no card number leaves them waiting;
 //   - a second card-number request on a checkout whose first one is running or was answered here
 //     is refused: that answer put the real card on the checkout and may already have let /payment
 //     through, and ACI warns that one checkout id reused can carry a second transaction;
@@ -22,7 +25,7 @@
 //     It continues only as a frame navigation, which is how the widget's form posts it into its
 //     hidden iframe, and a classic-mode body only on a browser shown to send the body the SDK
 //     replaced on a navigation (Chromium; see playwrightReplacesNavigationBody).
-import { aciBrandOfCardLeg as brandOfCardLeg, aciEndpoint, classifyAciRequest, prepareAciContinuation, sanitizeAciResponse, } from './aci.generated.js';
+import { ACI_CARD_FIELD, aciBrandOfCardLeg as brandOfCardLeg, aciEndpoint, classifyAciRequest, prepareAciContinuation, sanitizeAciResponse, } from './aci.generated.js';
 const classifyLeg = classifyAciRequest;
 const judgePayment = prepareAciContinuation;
 /** The processor id, as the registry and the API name it. */
@@ -164,6 +167,20 @@ export async function playwrightReplacesNavigationBody(page, probeMs = ACI_ENGIN
     }
 }
 const groupKey = (leg) => `${leg.host}/${leg.checkoutId}`;
+/** Whether a form body has a card.number key, whatever else it carries and however it broke the rules. */
+function namesCardNumber(body) {
+    if (typeof body !== 'string')
+        return false;
+    return body.split('&').some((pair) => {
+        const eq = pair.indexOf('=');
+        try {
+            return decodeURIComponent((eq < 0 ? pair : pair.slice(0, eq)).replace(/\+/g, ' ')) === ACI_CARD_FIELD;
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /**
  * One attachment's ACI state, keyed by checkout (host and checkout id). Every sibling and every
  * /payment submission is matched against a card-number request this attachment itself paused and
@@ -280,12 +297,16 @@ export class AciGate {
         this.prune();
     }
     /**
-     * A request on this checkout was refused before any card-number request began (a card-number
-     * request that asks ACI to keep the card, a leg the widget never sends): the siblings waiting for
-     * one fail now, and so does every later sibling until a card-number request begins. A running or
-     * answered card-number request keeps its siblings.
+     * A request on this checkout was refused. When it names the card number (a card-number request
+     * that asks ACI to keep the card, or carries a field the widget never sends with it) and no
+     * card-number request began, the siblings waiting for one fail now, and so does every later sibling
+     * until a card-number request begins. A refused request that names no card number, such as a
+     * fingerprint longer than ACI takes, says nothing about the card-number request a later Pay sends,
+     * so its siblings keep waiting for it. A running or answered card-number request keeps its siblings.
      */
-    refused(leg) {
+    refused(leg, body) {
+        if (!namesCardNumber(body))
+            return;
         const key = groupKey(leg);
         const known = this.groups.get(key);
         if (known && known.state !== 'failed')

package/dist/amadeus-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: bc8b9a0ad66eb321bec67650079b2d157a84f9f8de4ad79cc9006b937a9a5a58
+// artifact-sha256: d537d04a5cd64f34af196a0f6cec7a7f5319bb396d94824131857a04632aab0a
 // src/amadeus-body.js
 var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -44,7 +44,7 @@ var AMADEUS_CARD_URLS = Object.freeze({
     })
 });
 var AMADEUS_MERCHANT_EXPIRY_POLICIES = Object.freeze(["refuse", "fill"]);
-var AMADEUS_MERCHANT_EXPIRY_POLICY = "refuse";
+var AMADEUS_MERCHANT_EXPIRY_POLICY = "fill";
 var AMADEUS_REFUSAL_REASONS = Object.freeze([
     "unsupported",
     "card_on_file",

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "sandboxHosts": ["^esqa\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }, { "psp": "gravy", "match": /api(\.sandbox)?\.[a-z0-9-]+\.gr4vy\.app\/checkout\/sessions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/fields/i, "hosts": ["^api\\.[a-z0-9-]+\\.gr4vy\\.app$", "^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "sandboxHosts": ["^api\\.sandbox\\.[a-z0-9-]+\\.gr4vy\\.app$"], "encoding": "json", "passthroughHeaders": [] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/card-fields.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 5c2c8becc2301811aee1b42b47148039ab07c8854932a21e80687e18090f1a93
+// artifact-sha256: 35f4549be2f1addcdcbaf1c7874a5022db72c1b74f27d85119b8c7da7757bd8c
 // src/card-number-key.js
 var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
 // src/json-path.js
@@ -29,7 +29,8 @@ function jsonAt(root, path) {
 // src/elavon-converge.js
 var CONVERGE_PROCESS_URLS = /* @__PURE__ */ Object.freeze([
     "https://api.convergepay.com/hosted-payments/service/payment/hpp/process",
-    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process"
+    "https://api.demo.convergepay.com/hosted-payments/service/payment/hpp/process",
+    "https://www.convergepay.com/hosted-payments/service/payment/hpp/process"
 ]);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ Object.freeze(["paymentType", "paymentData", "context", "captchaToken", "shippingSameAsBilling"]);
 var WALLET_FIELDS = /* @__PURE__ */ Object.freeze([
@@ -70,15 +71,18 @@ var RECURRING_FIELDS = /* @__PURE__ */ Object.freeze([
     "ssl_recurring_batch_count",
     "ssl_installment_id"
 ]);
+var ONE_TIME_RECURRING_FLAG = "false";
 var CARD_SAVING_FLAGS = /* @__PURE__ */ Object.freeze(["ssl_get_token", "ssl_add_token"]);
 var CREDENTIAL_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_account_id", "ssl_merchant_id", "ssl_user_id", "ssl_pin", "ssl_vendor_id"]);
 var AMOUNT_ADD_ON_FIELDS = /* @__PURE__ */ Object.freeze(["ssl_tip_amount", "ssl_cashback_amount"]);
+var SOLVED_CAPTCHA = /^[A-Za-z0-9_-]{1,4096}$/;
 var CARD_NUMBER = /^\d{12,19}$/;
 var EXPIRY_MMYY = /^(0[1-9]|1[0-2])\d{2}$/;
 var CVC = /^\d{3,4}$/;
 var AMOUNT = /^(\d{1,13})(?:\.(\d{1,2}))?$/;
 var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var recurringRequested = (data) => RECURRING_FIELDS.some((key) => owns(data, key) && !(key === "recurring" && data[key] === ONE_TIME_RECURRING_FLAG));
 var refuse = (code) => Object.freeze({ verdict: "refuse", code });
 var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
 var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
@@ -127,7 +131,7 @@ function convergeBodyVerdict(body) {
         return refuse("converge_credential_refused");
     if (WALLET_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_wallet_refused");
-    if (owns(parsed, "captchaToken"))
+    if (owns(parsed, "captchaToken") && !(typeof parsed.captchaToken === "string" && SOLVED_CAPTCHA.test(parsed.captchaToken)))
         return refuse("converge_captcha_refused");
     if (SERVICE_FEE_FIELDS.some((key) => owns(data, key)))
         return refuse("converge_service_fee_refused");
@@ -140,7 +144,7 @@ function convergeBodyVerdict(body) {
     if (owns(data, "ssl_token") || CARD_SAVING_FLAGS.some((key) => owns(data, key) && !(typeof data[key] === "string" && /^n$/i.test(data[key])))) {
         return refuse("converge_card_saving_refused");
     }
-    if (RECURRING_FIELDS.some((key) => owns(data, key)))
+    if (recurringRequested(data))
         return refuse("converge_recurring_refused");
     if (owns(data, "ssl_transaction_currency") && !(typeof data.ssl_transaction_currency === "string" && /^usd$/i.test(data.ssl_transaction_currency))) {
         return refuse("converge_currency_refused");
@@ -169,11 +173,155 @@ function isConvergeProcessUrl(url) {
     }
     return parsed.href === url && CONVERGE_PROCESS_URLS.includes(parsed.href);
 }
-// src/amadeus-body.js
-var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
+// src/gravy.js
+var GRAVY_PSP = "gravy";
+var BODY_LIMIT = 4096;
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["method", "number", "expiration_date", "security_code"]);
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["payment_method", "postal_code"]);
+var CARD_NUMBER2 = /^[0-9]{12,19}$/;
+var EXPIRY = /^(?:0[1-9]|1[0-2])\/[0-9]{2}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var PAN_LIKE = /(?:[0-9][ _.:-]*){12,}/;
+var EXPIRY_OR_CODE = /^(?:expiration_?date|expiry(?:_?date)?|exp_?date|card_?expiry|security_?code|cvc|cvc2|cvv|cvv2|cvd|card_?cvv|card_?cvc|verification_?value)$/i;
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var owns2 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var holdsPan = (mopdata) => record(mopdata) && owns2(mopdata, "pan") && mopdata.pan !== null && mopdata.pan !== "";
+function cardNamed(key) {
+    const name = key.slice(key.lastIndexOf(".") + 1);
+    return CARD_NUMBER_KEY.test(name) || /cardnumber$/i.test(name) || EXPIRY_OR_CODE.test(name);
+}
+function cardOutside(root) {
+    const pending = [];
+    for (const key of Object.keys(root)) {
+        const value = root[key];
+        if (key === "payment_method" && record(value)) {
+            for (const inner of Object.keys(value))
+                if (!CARD_KEYS.includes(inner))
+                    pending.push([inner, value[inner]]);
+        }
+        else {
+            pending.push([key, value]);
+        }
+    }
+    while (pending.length > 0) {
+        const [key, value] = pending.pop();
+        if (key !== null && cardNamed(key))
+            return true;
+        if (typeof value === "string" || typeof value === "number") {
+            if (PAN_LIKE.test(String(value)))
+                return true;
+        }
+        else if (Array.isArray(value)) {
+            for (const item of value)
+                pending.push([null, item]);
+        }
+        else if (record(value)) {
+            for (const inner of Object.keys(value))
+                pending.push([inner, value[inner]]);
+        }
+    }
+    return false;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+var refuse2 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD2 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function gravyBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse2("gravy_body_unsupported");
+    if (cardOutside(value))
+        return refuse2("gravy_card_outside_payment_method");
+    const card = value.payment_method;
+    if (!record(card) || card.method !== "card" || !CARD_KEYS.every((key) => owns2(card, key)))
+        return refuse2("gravy_new_card_missing");
+    if (!Object.keys(value).every((key) => ROOT_KEYS.includes(key)) || !Object.keys(card).every((key) => CARD_KEYS.includes(key)) || typeof card.number !== "string" || !CARD_NUMBER2.test(card.number) || typeof card.expiration_date !== "string" || !EXPIRY.test(card.expiration_date) || typeof card.security_code !== "string" || !SECURITY_CODE.test(card.security_code) || owns2(value, "postal_code") && (typeof value.postal_code !== "string" || !POSTAL_CODE.test(value.postal_code))) {
+        return refuse2("gravy_body_unsupported");
+    }
+    return CARD2;
+}
+// src/moneris.js
+var MONERIS_PSP = "moneris";
+var CARD_KEYS2 = /* @__PURE__ */ Object.freeze(["input_data", "input_exp", "input_cvd", "hpt_id", "hpt_ticket", "doTokenize"]);
+var PARTIAL_KEYS = /* @__PURE__ */ Object.freeze([
+    ["input_data", "hpt_id", "hpt_ticket", "doTokenize"],
+    ["input_data", "input_exp", "hpt_id", "hpt_ticket", "doTokenize"],
+    ["input_data", "input_cvd", "hpt_id", "hpt_ticket", "doTokenize"]
+]);
+var CARD_NUMBER3 = /^\d{12,19}$/;
+var GROUPED_DIGITS = /^\d+(?: \d+)*$/;
+var EXPIRY_MMYY2 = /^(0[1-9]|1[0-2])\d{2}$/;
+var CVD = /^\d{3,4}$/;
+var PROFILE_ID = /^ht[A-Za-z0-9]{1,64}$/;
+var TICKET = /^tt[A-Za-z0-9]{1,128}$/;
+var refuse3 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD3 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function readPairs(body) {
+    if (typeof body !== "string" || body === "" || body.length > 4096)
+        return null;
+    const pairs = [];
+    for (const chunk of body.split("&")) {
+        const eq = chunk.indexOf("=");
+        if (eq <= 0)
+            return null;
+        pairs.push([chunk.slice(0, eq), chunk.slice(eq + 1)]);
+    }
+    return pairs;
+}
+var hasKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function monerisBodyVerdict(body) {
+    const pairs = readPairs(body);
+    if (pairs === null)
+        return refuse3("moneris_body_malformed");
+    if (PARTIAL_KEYS.some((keys) => hasKeys(pairs, keys)))
+        return refuse3("moneris_partial_card");
+    if (!hasKeys(pairs, CARD_KEYS2))
+        return refuse3("moneris_body_malformed");
+    const [[, number], [, expiry], [, cvd], [, profile], [, ticket], [, tokenize]] = pairs;
+    if (!GROUPED_DIGITS.test(number) || !CARD_NUMBER3.test(number.replace(/ /g, "")) || !EXPIRY_MMYY2.test(expiry) || !CVD.test(cvd) || !PROFILE_ID.test(profile) || !TICKET.test(ticket) || tokenize !== "true")
+        return refuse3("moneris_body_malformed");
+    return CARD3;
+}
+var MONERIS_TOKENIZE_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["www3.moneris.com", "gateway.moneris.com"]),
+    sandbox: Object.freeze(["esqa.moneris.com"])
+});
+var MONERIS_TOKENIZE_PATH = "/HPPtoken/request.php";
+function monerisTokenizeEnvironment(url) {
+    if (typeof url !== "string")
+        return null;
+    for (const environment of 
+    /** @type {const} */
+    ["production", "sandbox"]) {
+        if (MONERIS_TOKENIZE_HOSTS[environment].some((host) => url === `https://${host}${MONERIS_TOKENIZE_PATH}`))
+            return environment;
+    }
+    return null;
+}
+function isMonerisTokenizeUrl(url) {
+    return monerisTokenizeEnvironment(url) !== null;
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), profileIds: Object.freeze([...fields.profileIds]) });
+var MONERIS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "jack_org_raisin", merchant: "Jack.org", origins: ["https://jack.akaraisin.com"], profileIds: ["htL7TR9H7ICYN2B"] })
+]);
+// src/amadeus-body.js
+var AMADEUS_CARD_MOPID = /^creditcard[0-9]*$/;
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns3 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var holdsPan = (mopdata) => record2(mopdata) && owns3(mopdata, "pan") && mopdata.pan !== null && mopdata.pan !== "";
 function amadeusBodyKind(body) {
     let value;
     try {
@@ -182,18 +330,25 @@ function amadeusBodyKind(body) {
     catch {
         return "card";
     }
-    if (!record(value))
+    if (!record2(value))
         return "card";
     if (value.action === "add") {
         const entries = Array.isArray(value.data) ? value.data : [value.data];
-        return entries.some((entry) => record(entry) && typeof entry.mopid === "string" && AMADEUS_CARD_MOPID.test(entry.mopid) && holdsPan(entry.mopdata)) ? "card" : "other";
+        return entries.some((entry) => record2(entry) && typeof entry.mopid === "string" && AMADEUS_CARD_MOPID.test(entry.mopid) && holdsPan(entry.mopdata)) ? "card" : "other";
     }
     if (value.action === "store")
-        return record(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
+        return record2(value.data) && holdsPan(value.data.mopdata) ? "card" : "other";
     return "other";
 }
 // src/card-fields.js
 function processorGate(recognizer, url, body) {
+    if (recognizer && recognizer.psp === GRAVY_PSP)
+        return gravyBodyVerdict(body);
+    if (recognizer && recognizer.psp === MONERIS_PSP) {
+        if (url !== void 0 && !isMonerisTokenizeUrl(url))
+            return { verdict: "refuse", code: "moneris_url_refused" };
+        return monerisBodyVerdict(body);
+    }
     if (!recognizer || recognizer.psp !== "elavon_converge")
         return null;
     if (url !== void 0 && !isConvergeProcessUrl(url))