@agent-cards/sdk 0.24.0 → 0.24.1

package/CHANGELOG.md

@@ -4,6 +4,32 @@ An unreleased change waits as a file of its own in `changes/` (`changes/README.m
 
 ## Unreleased
 
+## 0.24.1
+
+- Pause eGHL's payment page entry for the cardholder's device. This build declares `eghl_hosted_payment_page`, and for a company the API turns the lane on for, Agentcard's own for now, it pauses the merchant's entry, a `GET` of `https://securepay.e-ghl.com/IPG/payment.aspx` whose query names the payment, creates a `hosted_form` authorization for it, and fails every post a page it watches sends to eGHL's hosts, so eGHL never receives the card your agent typed. The entry names its amount, and the API answers `amount_mismatch` for any other. No eGHL payment completes yet: while the relay route stays closed the API answers every create with `503 eghl_relay_unavailable`, which is expected, not a setup error.
+
+- Refuse Frisbii Checkout's two other card requests for a company Agentcard turned Frisbii on for: a stored card's token (`https://card.reepay.com/v1/token/cof/`, or `card.frisbii.com`) and Click to Pay (`/v1/token/create_click_to_pay`). The SDK now holds both and fails them in your browser before anything is created, whatever their body, as it already did for any body on `/v1/token/?session=<id>` other than the page's own card body. Agentcard pays a Frisbii page only with the cardholder's Vault card.
+
+- Pause Paystack's hosted checkout charge for the cardholder's device, for a company Agentcard turned Paystack on for. The SDK declares `paystack_pinned_key` and pauses the card page's form `POST` to `https://standard.paystack.co/charge/`; the cardholder's device encrypts the real card under Paystack's pinned key and sends the charge itself. The charge names no price, so `authorize()` needs `amount` and `currency` above zero (`AmountRequiredError` otherwise).
+
+- Pause Viva Wallet's Smart Checkout card request for the cardholder's device, for a company Agentcard turned Viva Wallet on for. Viva's checkout page (`https://www.vivapayments.com/web2?ref=<order code>`, where a Viva payment link sends a shopper) posts the card as JSON to `https://www.vivapayments.com/web2/checkout/v2/chargetokens` (`demo.vivapayments.com` in test) when the shopper presses Pay. The sync now also asks for `capabilities=viva_smart_checkout_chargetoken`, and the API serves Viva Wallet's recognizer only for a company Agentcard turned Viva Wallet on for. The SDK pauses only the page's own card body at that exact URL: a body that asks Viva to keep the card, pays with a stored card, takes Viva's currency conversion or is the page's second try after a decline fails in your browser before anything is created. The cardholder's device sends the card through Agentcard's checkout relay with the real card, and the page gets Viva's single-use charge token, which it charges itself. The body names its amount, so pass the same `amount` and `currency`: a pair that differs is refused before anything is created. A Viva Wallet payment also needs the matching API and Vault releases. Viva Wallet stays off for every company Agentcard has not turned it on for.
+
+- The SDK declares `aurus_one_time_token`. For a company Agentcard turns Aurus on for, it pauses the card request Aurus Pay's ecom card frame sends to `pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken`, only when Aurus's own card frame sent it, and `authorize()` needs `amount` above zero and `currency` for it ("An Aurus payment request names no amount"). No Aurus payment is approved yet.
+
+- Pause the card request LEGO's checkout sends to its own server. Its checkout on `www.lego.com` encrypts the card with adyen-web and posts it, in the GraphQL mutation `AddAdyenPayment`, to `https://www.lego.com/checkout/api/graphql/AddAdyenPayment`. The adapters now pause that request and refuse it as `unsupported_checkout` while the new profile, `lego_checkout_add_adyen_payment`, is in `observe`, so the agent's dummy card never reaches the store. A body that keeps the card for later or names a stored card is aborted, and the checkout's other operations, which carry no card, pass as before.
+
+- The payment core knows eGHL's hosted payment page (securepay.e-ghl.com), the gateway behind many Malaysian stores and eGHL's own Shopify app. Its recognizer sits behind the `eghl_hosted_payment_page` capability, which this build declares (the eGHL entry above). Its entry names the payment and the customer in its query, which every URL the SDK writes into an event or an error already drops, so no mask is added.
+
+- Pause the card request of Frisbii Checkout, the hosted payment page Frisbii (formerly Reepay) opens on `checkout.reepay.com` or `checkout.frisbii.com`, for the cardholder's device, for a company Agentcard turned Frisbii on for. The page posts the card as JSON with the merchant's public key to `https://card.reepay.com/v1/token/?session=<id>` (or `card.frisbii.com`). The sync now also asks for `capabilities=frisbii_card_token`, and the API serves Frisbii's recognizer only for a company Agentcard turned Frisbii on for. The SDK pauses only the page's own card body at that exact URL, and any other body there, one that keeps the card on file included, fails in your browser before anything is created. A stored card's token (`/v1/token/cof/`) and Click to Pay (`/v1/token/create_click_to_pay`) are refused, as the Frisbii entry above says. Pass `amount` and `currency`, above zero, equal to the page's own total: without them `authorize()` throws `AmountRequiredError` ("A Frisbii payment request names no amount"), and the API refuses an amount the page's 3-D Secure data does not name. A Frisbii payment also needs the matching Vault release. Frisbii stays off for every company Agentcard has not turned it on for.
+
+- Pause MONEI's card frame request for the cardholder's device, for a company Agentcard turned MONEI on for. MONEI's payment page (`https://secure.monei.com/payments/<id>`, where a store on MONEI Payments sends its shopper) posts the card as JSON with the payment's id to `https://api.monei.com/v1/tokens`. The sync now also asks for `capabilities=monei_card_token`, and the API serves MONEI's recognizer only for a company Agentcard turned MONEI on for. The SDK pauses only the frame's own card body at that exact URL: MONEI's account flow, Click to Pay and a wallet sent to the same URL fail in your browser before anything is created. The request names no amount, so pass `amount` and `currency`, above zero, equal to the payment's own total: without them `authorize()` throws `AmountRequiredError`, and the API refuses any other amount after reading MONEI's record of the payment. A MONEI payment also needs the matching Vault release. MONEI stays off for every company Agentcard has not turned it on for.
+
+- Pause Cardlink's VPOS entry for the cardholder's device. This build declares `cardlink_vpos_hosted_payment_page`, and for a company the API turns the lane on for, Agentcard's own for now, it pauses the merchant's signed entry, a form post to `https://<host>/vpos/shophandlermpi` on `vpos.eurocommerce.gr`, `ecommerce.cardlink.gr` or `www.alphaecommerce.gr`, creates a `hosted_form` authorization for it, and fails every other post a page it watches sends to those hosts, so the VPOS never receives the card your agent typed. The entry names its amount in euros, and the API answers `amount_mismatch` for any other. No Cardlink payment completes yet: while the relay route stays closed the API answers every create with `503 cardlink_vpos_relay_unavailable`, and once it opens it refuses every entry with `seller_unreviewed` until Agentcard reviews the merchant's mid on its host. Both refusals are expected, not a setup error.
+
+- The SDK pauses the card request Checkout.com's card fields send to your account's own subdomain, its base URL prefix. Frames sends the card to `/tokens` on the prefix's API host, such as `4k2njisl.api.checkout.com`, when you set `baseURLPrefix`. Flow sends it to `/cag/tokens`, then `/tokens`, on `devices.api.checkout.com` or `4k2njisl.devices.api.checkout.com` when its payment session turns on Checkout.com's devices API, as the hosted payments page does. Before this release those requests reached Checkout.com unpaused, carrying the placeholder card. Any alphanumeric prefix works, on the production hosts and their `.sandbox.checkout.com` counterparts, and `prepare({ psp: 'checkout_com' })` binds these requests too. An SDK that calls `vault.syncRegistry()` pauses them once Agentcard's API serves the hosts; `prepare()` on them needs this release, and the cardholder's approval page sends the card there from Agentcard's next Vault release.
+
+- `attachToCdp` keeps a ready `prepare()` when the checkout page moves within its own document and keeps the same origin, path and query: a `history.replaceState` to the page's own URL, which single-page checkouts call after each server action, or a change to the URL's `#` fragment alone. A history update to another path or query still ends the preparation with `merchant_document_changed`.
+
 ## 0.24.0
 
 ### Upgrading from 0.23.28

package/README.md

@@ -167,8 +167,16 @@ what this package encapsulates.
 | | Sees the real card |
 |---|---|
 | Your agent / browser | **no**, only a dummy PAN and a token |
-| Agentcard servers | **no**, a request template and a token |
-| Cardholder's device | yes, decrypts locally, calls the merchant directly |
+| Agentcard servers | no for a card the cardholder stored, only a request template and a token; yes for a card your company issued, for the one payment it pays |
+| Cardholder's device | yes, decrypts a stored card locally or receives your company's card from Agentcard, and calls the merchant directly |
+
+The cardholder's Vault keeps no copy of a card your company issued, only a link
+to it, so their device has nothing to decrypt. When the cardholder approves a
+payment with that card, Agentcard's servers fetch its number and CVC from the
+card's issuer and send them to the cardholder's device in the response to that
+approval. The servers hold the card in memory for that one response and never
+log or store it. Your agent and browser still see only the dummy card and the
+token.
 
 On a reviewed merchant's own card endpoint (mode `card_endpoint`, below) the
 device sends the card to the merchant through Agentcard's checkout relay, which
@@ -176,6 +184,18 @@ carries end-to-end TLS it cannot read. Agentcard's servers hold the paused
 request's session and the merchant's answer encrypted, for minutes, and hand
 each over once.
 
+Agentcard's own shopping agent (/buy) has one more lane, built and switched
+off, the typed card lane, which this package never runs in your process. Once
+it is on, at a store whose card request no swap can reach, the shopper approves
+Agentcard typing their card into the store's page, and Agentcard's card typer
+types it there and presses the store's Pay, in Agentcard's own hosted browser.
+The card reaches the typer sealed by the shopper's device, and your agent never
+sees it. Agentcard's backend and its checkout agent let go of that page before
+the card goes in and connect again only once the store's page settled after
+Pay, so the requests that carry the card reach the typer's connection alone.
+Until then, /buy answers such a store as it does today: the card form is not
+one it pays at.
+
 Because your process only ever handles a dummy card and an opaque token, this
 integration is designed to keep you out of PCI scope. Get your own QSA's read
 before you put that in writing.
@@ -234,7 +254,7 @@ so new processors work without you shipping a release. `attachToCdp` derives the
 `Fetch.enable` url patterns from that same list rather than a constant, which is
 why the sync call belongs before the attach. `agentcard.checkout.cardUrlPatterns()` returns
 those patterns if you arm a CDP connection yourself. Call
-`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay,pin_payments_card_token,paymentwall_card_token,oceanpayment_hosted_payment_page,payplug_hosted_payment_page,processout_card_token,aps_custom_merchant_page,bluesnap_hosted_payment_fields,iyzico_checkout_form,midtrans_card_token,sbps_token_jsonp,tap_card_sdk_token,usaepay_payment_key,vtex_payments_card_payment`
+`GET /v2/checkout/recognizers?modes=token,cse,hosted_form,device_encrypt&capabilities=fiserv_card_capture,gmo_shared_pk,capture_context,juspay_txns.v1,datatrans_secure_fields_tokenize,authorize_net_dpm_form,pelecard_transaction,aci_split_card.v1,creditguard_pps_process,primer_payment_instruments,payrails_device_encrypt,converge_hpp_process,worldpay_eprotect_jsonp,wspay_confirm,shiji_sts_pinned_key,amadeus_checkout_actions.v1,worldline_mycheckout_form,verifone_card_capture,ekashu_hosted_payment_page,cybersource_sa_token_create,gravy_session_fields_put,moneris_hosted_tokenization,paddle_vgs_cards,paddle_tokenex_pay,redsys_hosted_payment_page,lyra_krypton_payment,payfast_card_pay,wix_payments_tokenize,paymongo_checkout_pay,paygent_token,pay_nl_card_token,hipay_vault_token,twoc2p_secure_pay,quickpay_hosted_payment_page,revolut_card_field,paypal_card_fields,gopay_card_form,payrexx_card_frame,comgate_hosted_payment_page,przelewy24_hosted_payment_page,makecommerce_card_frame,poynt_collect_nonce,tokenex_iframe_tokenize,transbank_webpay_hosted_payment_page,sumup_checkout_process,clover_card_token,eximbay_hosted_payment_page,toast_pinned_key,xendit_card_token,omise_card_token,paytrail_hosted_payment_page,fastspring_card_payment,openpay_tokenizer,barion_hosted_payment_page,paymob_checkout_pay,payu_latam_webcheckout_card,nexi_checkout_pay,pin_payments_card_token,paymentwall_card_token,oceanpayment_hosted_payment_page,payplug_hosted_payment_page,processout_card_token,aps_custom_merchant_page,bluesnap_hosted_payment_fields,iyzico_checkout_form,midtrans_card_token,sbps_token_jsonp,tap_card_sdk_token,usaepay_payment_key,vtex_payments_card_payment,viva_smart_checkout_chargetoken,cardlink_vpos_hosted_payment_page,eghl_hosted_payment_page`
 for the list this build syncs. The API serves Fiserv's card capture only to a
 build that lists `fiserv_card_capture`, and only for a company Agentcard turned
 Fiserv on for. An older SDK never pauses a Fiserv request it could not finish,
@@ -326,6 +346,29 @@ PayPlug to Agentcard's own company alone for now, and takes no PayPlug payment
 until Agentcard has reviewed the name and the PayPlug account a merchant's
 PayPlug page shows: until then it refuses every PayPlug link with
 `seller_unreviewed`, which is expected and not a setup error.
+Cardlink's VPOS (`cardlink_vpos_hosted_payment_page`), the payment page Greek
+banks give their merchants on `vpos.eurocommerce.gr`, `ecommerce.cardlink.gr`
+and `www.alphaecommerce.gr`, is served the same way: this build pauses the
+merchant's signed entry, a form post to `/vpos/shophandlermpi`, for the
+cardholder's device and fails every other post a page it watches makes to those
+hosts, the card page's own post to the same URL included. The entry names its
+amount in euros, and the API holds your `amount` to it exactly. The API serves
+the lane to Agentcard's own company alone for now. While the relay route stays
+closed, every Cardlink create answers `503 cardlink_vpos_relay_unavailable`
+before any prompt. Once the route opens, the API takes an entry only for a
+merchant Agentcard has reviewed by its mid on its host, one so far, and refuses
+every other entry with `seller_unreviewed`, whose answer names the `mid`,
+`vpos_host` and `result_host` a review needs. Both refusals are expected and not
+a setup error.
+eGHL's payment page (`eghl_hosted_payment_page`, sold as ADAPTIS) on
+`securepay.e-ghl.com` is served the same way: this build pauses the merchant's
+entry, a `GET` of `/IPG/payment.aspx` whose query names the payment, for the
+cardholder's device and fails every post a page it watches makes to eGHL's
+hosts, the card page's own post to the same address included. The entry names
+its amount, and the API holds your `amount` to it exactly. The API serves the
+lane to Agentcard's own company alone for now. While the relay route stays
+closed, every eGHL create answers `503 eghl_relay_unavailable` before any
+prompt, which is expected and not a setup error.
 Revolut Business's card field (`revolut_card_field`) is served on the same
 terms: this build pauses the frame's card payment on `merchant.revolut.com`,
 the cardholder's device sends it to Revolut itself, and the frame gets
@@ -1384,7 +1427,15 @@ Prepare a Checkout.com checkout before the agent clicks Pay:
 await controller.prepare({ psp: 'checkout_com', environment: 'production' });
 ```
 
-Keep the phone approval page open, then click Pay once after readiness. Checkout.com Flow 1.228.0 gives its card iframe 12 seconds to return a token; approval before Pay leaves that interval for request binding and tokenization. Prepared requests must use an exact `/tokens` URL on `api.checkout.com` or `card-acquisition-gateway.checkout.com`, or the corresponding `.sandbox.checkout.com` host for `sandbox`. The request must describe a fresh card with a CVV and public-key authentication. Wallet, saved-card, reusable-token and recurring variants are refused. A native API fallback after the first CAG request cannot reuse approval. Match the actual merchant charge to the approved amount separately; a token does not enforce that amount.
+Keep the phone approval page open, then click Pay once after readiness. Checkout.com Flow 1.228.0 gives its card iframe 12 seconds to return a token; approval before Pay leaves that interval for request binding and tokenization.
+
+Prepared requests must use an exact URL that Checkout.com's card fields send the card to:
+
+- `/tokens` on `api.checkout.com` or `card-acquisition-gateway.checkout.com`.
+- `/tokens` on your account's own API host, named by its base URL prefix, such as `4k2njisl.api.checkout.com`. Frames sends the card there when you set `baseURLPrefix`.
+- `/cag/tokens`, or `/tokens` after a failed gateway call, on `devices.api.checkout.com` or under your prefix, such as `4k2njisl.devices.api.checkout.com`. Flow sends the card there when its payment session turns on Checkout.com's devices API, as the hosted payments page does.
+
+Any alphanumeric prefix works. For `sandbox`, each host is its `.sandbox.checkout.com` counterpart, such as `4k2njisl.api.sandbox.checkout.com`. The request must describe a fresh card with a CVV and public-key authentication. Wallet, saved-card, reusable-token and recurring variants are refused. A native API fallback after the first CAG request cannot reuse approval. Match the actual merchant charge to the approved amount separately; a token does not enforce that amount.
 
 Prepare an Adyen Sessions checkout before the agent clicks Pay:
 
@@ -1500,6 +1551,12 @@ Pass `amount` and `currency`, above zero: the request names no price, so that is
 
 The store's server charges the token afterwards, and its charge can ask BlueSnap to keep the card. So a live BlueSnap payment takes only a card the person stored, never one a company added (`card_not_stored`), and the approval says the store can keep it.
 
+### Pay a Paystack checkout
+
+Paystack's hosted checkout (`checkout.paystack.com`) sends the card in one form `POST` to `https://standard.paystack.co/charge/`, as `clientdata`: the card number, code and expiry encrypted under the one RSA key Paystack's page carries, with the card's last four digits beside it. Paystack launches dark: `syncRegistry()` declares `paystack_pinned_key`, the API serves Paystack only to an SDK that declares it, and only for Agentcard's own company.
+
+Pass `amount` and `currency`, above zero: the charge names no price, so that is the amount the cardholder approves. Type a placeholder card of the paying card's network, since Paystack's page reads the card's first six digits before the charge. The SDK pauses the charge, and the cardholder's device encrypts the real card under the same pinned key and sends the charge to Paystack itself. The page receives Paystack's answer: paid, declined, or the issuer's 3-D Secure step, which the page runs in the agent's browser. A charge that keeps the card (`paystack_saved_card`), starts a plan (`paystack_subscription`) or carries a PIN is refused before anything is created. Autopilot is unavailable for Paystack.
+
 ### Use Checkout Pro in Mexico
 
 Attach the SDK before entering card fields on `www.mercadopago.com.mx`, then prepare the guest card checkout:

package/dist/adyen-merchant-hosted.generated.d.ts

@@ -1,8 +1,8 @@
 declare var MERCHANT_EXCHANGES_MAX: number;
 declare var MERCHANT_PROFILE_RECOGNIZERS: any;
 declare function declaredEndpointRefusal(endpoint: any): string | null;
-declare function isAdyenWebJweCompact(s: any): boolean;
 declare function sha256Hex(input: any): string;
+declare function isAdyenWebJweCompact(s: any): boolean;
 declare function merchantAmountFromResponses(profile: any, input: any): {
     ok: boolean;
     code: any;

package/dist/adyen-merchant-hosted.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 86399b941b10d14455119f42141475bdcd524b5e55375ca1e2d3d82548076ecd
+// artifact-sha256: 7f066dc9de1de76fd2dce4d9ac940e653010b8cd3e9d45c3bb4fd04d006f7c16
 // src/deep-freeze.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -1906,6 +1906,99 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             clientKey: "live_P7RRXHAHEVFTLPS3XUD3ML7ZWUEZ6BXN",
             publicKeySha256: "3e0d4366563b714feb233d12ce98adcef3b606381596e097ca3a8123b9a91d67"
         }
+    },
+    {
+        // Read Nov 3, 2026, from www.lego.com's shipped US checkout (a Next.js app under /checkout, Apollo GraphQL) and a
+        // card-free run on its guest checkout up to the card form (test contact details, no card typed, nothing pressed;
+        // every non-GET to adyen.com aborted). The checkout's cart answer (CheckoutV2State, paymentMethodsV3.primary) names
+        // CREDIT_CARD_ADYEN with environment 'live' and this client key, and the card form is adyen-web 6's secured fields
+        // (securedFields 6.0.0 on checkoutshopper-live.adyen.com). Place order's handler (chunk 487, the CreditCard submit)
+        // copies encryptedCardNumber, encryptedExpiryMonth, encryptedExpiryYear, encryptedSecurityCode, type and holderName
+        // out of adyen-web's state.data.paymentMethod, with no brand, and sends the Apollo mutation AddAdyenPayment with
+        // variables {input: {paymentReference: <the cart's orderNumber>, telephoneNumber, browserInfo, origin, paymentMethod,
+        // returnUrl, storePaymentMethod, tracking}}. Apollo posts {operationName, variables, query} as JSON to the gateway
+        // (www.lego.com/checkout/api/graphql), whose link adds the operation name to the path: every checkout operation in
+        // the run went to /checkout/api/graphql/<operationName>. So the card request is Lego's own server, Adyen's Advanced
+        // flow. A saved card goes as AddAdyenSavedCardPaymentV2, a gift card as AddGiftCardPaymentV2Mutation, each on its
+        // own path. The body names no amount. Public key read from checkoutshopper-live.adyen.com on 2026-11-03 (UTC). Not
+        // yet seen on the wire: the card request itself, which leaves only on Place order.
+        // Enabled on Nov 4, 2026 under D1, so the Vault's bundled copy of this table carries it at the next Vault release. No
+        // company is admitted yet: Agentcard's proof company joins through a flip in backend merchant-profile-orgs.ts after that
+        // release. Felipe's approval of this change is his D1 decision for LEGO, and Karen's its PCI review.
+        // No afterPayment reader yet: nobody has seen what LEGO answers after a placed order, so the charge is not compared with
+        // the approved amount after payment and merchantChargeVerdict has nothing to read (Greptile on this change). The amount
+        // is checked before payment (amountSource below). Until a reviewed afterPayment lands, built from the response the first
+        // live run captures, Agentcard's proof company makes no purchase LEGO's Adyen approves: its runs use a card Adyen declines.
+        id: "lego_checkout_add_adyen_payment",
+        merchant: "LEGO",
+        status: "enabled",
+        origins: [{ checkout: "https://www.lego.com", endpoint: "https://www.lego.com" }],
+        method: "POST",
+        path: "/checkout/api/graphql/AddAdyenPayment",
+        query: {},
+        requires: [
+            { path: ["operationName"], equals: "AddAdyenPayment" },
+            { path: ["variables", "input", "paymentMethod", "type"], equals: "scheme" }
+        ],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // The page copies no brand out of adyen-web's state.
+        remove: [],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: null,
+        // Read Nov 3, 2026 (the run above). The checkout's cart answers carry the whole cart: CheckoutV2State at
+        // data.me.cart, the address step at data.updateCartAddresses and the shipping step at data.setCartShippingMethod.
+        // remainingTotalToPay is what is left for the card, in cents (1191 in the run, the page's Order Total $11.91), and
+        // orderNumber is the paymentReference the card request sends, which ties each answer to it. A gift card already
+        // applied shows in payments and lowers what is left below the order's total, so a cart with one is refused. Cart
+        // changes whose answers were not seen in the run make the chosen answer stale.
+        amountSource: {
+            id: "lego_cart_remaining_total",
+            origin: "endpoint",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/checkout/api/graphql/CheckoutV2State", query: {}, at: ["data", "me", "cart"] },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutation", query: {}, at: ["data", "updateCartAddresses"] },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodV2Mutation", query: {}, at: ["data", "setCartShippingMethod"] }
+            ],
+            total: { path: ["remainingTotalToPay", "centAmount"], format: "number" },
+            unit: "minor",
+            currency: "USD",
+            currencyPath: ["remainingTotalToPay", "currencyCode"],
+            bind: [{ source: ["orderNumber"], card: ["variables", "input", "paymentReference"] }],
+            refuse: [
+                { path: ["payments"], when: "nonEmpty" },
+                // A GraphQL error result is not a total, even beside partial data.
+                { path: ["errors"], when: "present", root: true }
+            ],
+            voidedBy: [
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardPaymentV2Mutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddGiftCardOnlyPayment", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveGiftCardPaymentMutations", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/AddVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/EditVipLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/RemoveVipPointsLineItemCheckout", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetShippingMethodOnlyMutation", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressMutationWithoutEmail", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/SetAddressesMutationV2", query: {} },
+                { method: "POST", path: "/checkout/api/graphql/saveCollectionPointMutation", query: {} }
+            ],
+            maxAgeMs: 9e5
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_P34BZ2Q6ANHNHAUEKOFOX3IMHQHZ75ES",
+            publicKeySha256: "5659f43faa157b82b45844fdf35382a8b83b7bb24662b5e0fbcca15fd120bcc2"
+        }
     }
 ]);
 function adyenKeyHost(environment) {
@@ -2067,40 +2160,6 @@ function merchantBodyRefusal(profile, body) {
     }
     return null;
 }
-// src/adyen-jwe.js
-var BASE64URL = /^[A-Za-z0-9_-]+$/;
-var ADYEN_WEB_JWE_FORMATS = /* @__PURE__ */ Object.freeze([
-    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP-256", enc: "A256GCM", iv: 16, tag: 22 }),
-    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP", enc: "A256CBC-HS512", iv: 22, tag: 43 })
-]);
-var ADYEN_WEB_CIPHERTEXT_MAX = 8192;
-var ADYEN_WEB_HEADER_MAX = 128;
-function adyenWebJweHeader(segment) {
-    if (!BASE64URL.test(segment) || segment.length > ADYEN_WEB_HEADER_MAX)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
-    }
-    catch {
-        return null;
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return null;
-    return Object.keys(parsed).sort().join(",") === "alg,enc,version" && parsed.version === "1" ? parsed : null;
-}
-function isAdyenWebJweCompact(s) {
-    if (typeof s !== "string" || s.length > ADYEN_WEB_HEADER_MAX + 342 + 22 + ADYEN_WEB_CIPHERTEXT_MAX + 43 + 4)
-        return false;
-    const parts = s.split(".");
-    if (parts.length !== 5 || !parts.every((p) => p.length > 0 && BASE64URL.test(p)))
-        return false;
-    const [header, encryptedKey, iv, ciphertext, tag] = parts;
-    if (encryptedKey.length !== 342 || ciphertext.length > ADYEN_WEB_CIPHERTEXT_MAX)
-        return false;
-    const parsed = adyenWebJweHeader(header);
-    return parsed !== null && ADYEN_WEB_JWE_FORMATS.some((form) => parsed.alg === form.alg && parsed.enc === form.enc && iv.length === form.iv && tag.length === form.tag);
-}
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -2232,6 +2291,40 @@ function sha256Hex(input) {
     }
     return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
 }
+// src/adyen-jwe.js
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var ADYEN_WEB_JWE_FORMATS = /* @__PURE__ */ Object.freeze([
+    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP-256", enc: "A256GCM", iv: 16, tag: 22 }),
+    /* @__PURE__ */ Object.freeze({ alg: "RSA-OAEP", enc: "A256CBC-HS512", iv: 22, tag: 43 })
+]);
+var ADYEN_WEB_CIPHERTEXT_MAX = 8192;
+var ADYEN_WEB_HEADER_MAX = 128;
+function adyenWebJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > ADYEN_WEB_HEADER_MAX)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    return Object.keys(parsed).sort().join(",") === "alg,enc,version" && parsed.version === "1" ? parsed : null;
+}
+function isAdyenWebJweCompact(s) {
+    if (typeof s !== "string" || s.length > ADYEN_WEB_HEADER_MAX + 342 + 22 + ADYEN_WEB_CIPHERTEXT_MAX + 43 + 4)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5 || !parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (encryptedKey.length !== 342 || ciphertext.length > ADYEN_WEB_CIPHERTEXT_MAX)
+        return false;
+    const parsed = adyenWebJweHeader(header);
+    return parsed !== null && ADYEN_WEB_JWE_FORMATS.some((form) => parsed.alg === form.alg && parsed.enc === form.enc && iv.length === form.iv && tag.length === form.tag);
+}
 // src/adyen-merchant-hosted.js
 function matchProfileEndpoint(profile, rawUrl, method, opts) {
     const p = trustedMerchantProfile(profile);

package/dist/agent-amount.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-agent-amount.mjs from agent-amount-processors.json. Do not edit; git ignores it.
 /** agent-amount-processors.json, sorted; client.ts reads its amount tables from it. */
-export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "barion", "bluesnap", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "gmo_pg", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "barion", "bluesnap", "clover", "comgate", "fastspring", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "pay_nl", "payfast", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "payu_latam", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "barion": "Barion", "bluesnap": "BlueSnap", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "iyzico": "iyzico", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "oceanpayment": "Oceanpayment", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymentwall": "Paymentwall", "paymongo": "PayMongo", "paypal": "PayPal", "payplug": "PayPlug", "payrexx": "Payrexx", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "processout": "ProcessOut", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "usaepay": "USAePay", "wix_payments": "Wix", "wspay": "WSPay" } };
+export const AGENT_AMOUNT = { "processors": ["amazon_payment_services", "aurus", "barion", "bluesnap", "clover", "comgate", "cybersource_secure_acceptance", "fastspring", "frisbii", "gmo_pg", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "monei", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "paddle_vgs", "pay_nl", "payfast", "paygent", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "paystack", "paytrail", "payu_latam", "pelecard", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay", "wix_payments", "wspay"], "aboveZero": ["amazon_payment_services", "aurus", "barion", "bluesnap", "clover", "comgate", "fastspring", "frisbii", "gopay", "hipay", "iyzico", "makecommerce", "midtrans", "monei", "moneris", "nexi_checkout", "oceanpayment", "omise", "openpay_bbva", "pay_nl", "payfast", "paymentwall", "paymongo", "paypal", "payplug", "payrexx", "paystack", "payu_latam", "pin_payments", "poynt", "processout", "przelewy24", "revolut", "sb_payment_service", "sumup", "tap_payments", "toast", "tokenex_iframe", "transbank_webpay", "twoc2p", "usaepay"], "pageAmount": ["pelecard", "sb_payment_service"], "names": { "amazon_payment_services": "Amazon Payment Services", "aurus": "Aurus", "barion": "Barion", "bluesnap": "BlueSnap", "clover": "Clover", "comgate": "ComGate", "cybersource_secure_acceptance": "CyberSource Secure Acceptance", "fastspring": "FastSpring", "frisbii": "Frisbii", "gmo_pg": "GMO", "gopay": "GoPay", "hipay": "HiPay", "iyzico": "iyzico", "makecommerce": "MakeCommerce", "midtrans": "Midtrans", "monei": "MONEI", "moneris": "Moneris", "nexi_checkout": "Nexi Checkout", "oceanpayment": "Oceanpayment", "omise": "Omise", "openpay_bbva": "Openpay", "paddle_vgs": "Paddle", "pay_nl": "Pay.", "payfast": "Payfast", "paygent": "Paygent", "paymentwall": "Paymentwall", "paymongo": "PayMongo", "paypal": "PayPal", "payplug": "PayPlug", "payrexx": "Payrexx", "paystack": "Paystack", "paytrail": "Paytrail", "payu_latam": "PayU Latam", "pelecard": "Pelecard", "pin_payments": "Pin Payments", "poynt": "GoDaddy Payments", "processout": "ProcessOut", "przelewy24": "Przelewy24", "revolut": "Revolut", "sb_payment_service": "SB Payment Service", "sumup": "SumUp", "tap_payments": "Tap", "toast": "Toast", "tokenex_iframe": "TokenEx", "transbank_webpay": "Webpay", "twoc2p": "2C2P", "usaepay": "USAePay", "wix_payments": "Wix", "wspay": "WSPay" } };

package/dist/aurus.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Aurus Pay's ecom card frame (O'Reilly Auto Parts' card form), as this SDK reads it.
+ *
+ * The store frames https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, the card fields sit inside that frame,
+ * and when the store asks the frame for a token the frame's own script seals the card and posts it to
+ * /storeservices/ecom/oneTimeToken on its own host. That post is the one request this SDK pauses, and only when the frame
+ * that sent it is Aurus's card frame: the same post from the store's page, another frame, or a frame the adapter cannot
+ * read is stopped in the browser with nothing created, so no other page can hand the cardholder an Aurus approval.
+ *
+ * isAurusTokenRequestUrl takes the URLs payment-core's isAurusTokenUrl takes, and isAurusCardFrameUrl the frames its
+ * isAurusFrameUrl takes; aurus.test.mjs pins both to payment-core.
+ */
+import type { PreClaimGate } from './pre-claim.js';
+export declare const AURUS_PSP = "aurus";
+/** The dark-launch capability the API serves Aurus's recognizer behind (payment-core processors/aurus.js). */
+export declare const AURUS_CAPABILITY = "aurus_one_time_token";
+/** Exactly https://pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken?d1=es<NN>.auruspay.com&d2=es<NN>.auruspay.com. */
+export declare function isAurusTokenRequestUrl(url: string): boolean;
+/** Whether a frame's URL is Aurus's card frame: https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, any query. */
+export declare function isAurusCardFrameUrl(url: string | undefined): boolean;
+/**
+ * Who sent an Aurus card request, as far as it decides the pause: 'frame' when the sender is Aurus's card frame,
+ * 'outside' when it is any other frame or the page, 'unread' when the adapter could not read the sender.
+ */
+export declare function aurusSender(frames: readonly string[] | undefined): 'frame' | 'outside' | 'unread';
+/**
+ * The pre-claim gate (pre-claim.ts PSP_PRE_CLAIM_GATES). Once this build's registry serves Aurus's card request (a
+ * capability the API serves only to a company Aurus is turned on for), a POST to its exact URL that the registry
+ * recognizes is judged by who sent it: from Aurus's card frame it defers, and the terminal arbiter pauses it for the
+ * claim flow like any card request; from anywhere else, or from a sender the adapter could not read, it is aborted with
+ * a `blocked` event, `aurus_request_outside_frame`, and nothing is created. Every other request is not this gate's.
+ */
+export declare const aurusPreClaim: PreClaimGate;

package/dist/aurus.js

@@ -0,0 +1,75 @@
+export const AURUS_PSP = 'aurus';
+/** The dark-launch capability the API serves Aurus's recognizer behind (payment-core processors/aurus.js). */
+export const AURUS_CAPABILITY = 'aurus_one_time_token';
+const HOST = /^pecst[0-9]{2}\.aurusepay\.com$/;
+const SERVER = /^es[0-9]{2}\.auruspay\.com$/;
+/** Exactly https://pecst<NN>.aurusepay.com/storeservices/ecom/oneTimeToken?d1=es<NN>.auruspay.com&d2=es<NN>.auruspay.com. */
+export function isAurusTokenRequestUrl(url) {
+    if (typeof url !== 'string' || url.length > 256 || url.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.href !== url || parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password
+        || !HOST.test(parsed.hostname) || parsed.pathname !== '/storeservices/ecom/oneTimeToken')
+        return false;
+    const query = parsed.search.slice(1).split('&').map((pair) => pair.split('='));
+    return query.length === 2 && query[0].length === 2 && query[1].length === 2 && query[0][0] === 'd1' && query[1][0] === 'd2'
+        && SERVER.test(query[0][1]) && SERVER.test(query[1][1]);
+}
+/** Whether a frame's URL is Aurus's card frame: https://pecst<NN>.aurusepay.com/storeservices/ecom/getiframe, any query. */
+export function isAurusCardFrameUrl(url) {
+    if (typeof url !== 'string')
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.port && !parsed.username && !parsed.password
+        && HOST.test(parsed.hostname) && parsed.pathname === '/storeservices/ecom/getiframe';
+}
+/**
+ * Who sent an Aurus card request, as far as it decides the pause: 'frame' when the sender is Aurus's card frame,
+ * 'outside' when it is any other frame or the page, 'unread' when the adapter could not read the sender.
+ */
+export function aurusSender(frames) {
+    if (!frames || frames.length === 0)
+        return 'unread';
+    return isAurusCardFrameUrl(frames[0]) ? 'frame' : 'outside';
+}
+/**
+ * The pre-claim gate (pre-claim.ts PSP_PRE_CLAIM_GATES). Once this build's registry serves Aurus's card request (a
+ * capability the API serves only to a company Aurus is turned on for), a POST to its exact URL that the registry
+ * recognizes is judged by who sent it: from Aurus's card frame it defers, and the terminal arbiter pauses it for the
+ * claim flow like any card request; from anywhere else, or from a sender the adapter could not read, it is aborted with
+ * a `blocked` event, `aurus_request_outside_frame`, and nothing is created. Every other request is not this gate's.
+ */
+export const aurusPreClaim = (ctx) => {
+    const { url, method } = ctx.request;
+    if (String(method).toUpperCase() !== 'POST' || !isAurusTokenRequestUrl(url) || !ctx.vault.isCardRequest(url, method))
+        return undefined;
+    const decide = (frames) => {
+        const sender = aurusSender(frames);
+        return sender === 'frame' ? undefined : aurusOutsideFrame(ctx, sender);
+    };
+    let frames;
+    try {
+        frames = ctx.initiatorFrames?.();
+    }
+    catch {
+        frames = undefined;
+    }
+    return frames instanceof Promise ? frames.then(decide, () => decide(undefined)) : decide(frames);
+};
+async function aurusOutsideFrame(ctx, sender) {
+    ctx.onEvent?.({ type: 'blocked', detail: { reason: 'aurus_request_outside_frame', sender } });
+    await ctx.effects.abort();
+    return { kind: 'abort' };
+}

package/dist/builtin-registry.generated.js

@@ -1 +1 @@
-export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize|checkout\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i, /^x-internal-correlation-id$/i, /^x-app-version$/i, /^x-transactionsource$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];
+export const BUILTIN_REGISTRY = [{ "psp": "spreedly", "match": /core\.spreedly\.com\/v1\/payment_methods\/restricted\.json/i, "hosts": ["^core\\.spreedly\\.com$"], "encoding": "json", "passthroughHeaders": [/^spreedly-environment-key$/i] }, { "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|sources|confirmation_tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm|payment_pages\/cs_(?:test|live)_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i], "cardFields": ["card[number]", "payment_method_data[card][number]"], "passWithoutCard": "api\\.stripe\\.com/v1/(sources|confirmation_tokens|payment_pages/cs_(?:test|live)_\\w+/confirm)" }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "sandboxHosts": ["^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(?:card-acquisition-gateway(?:\.sandbox)?\.checkout\.com\/tokens|(?:[a-z0-9]+\.)?api(?:\.sandbox)?\.checkout\.com\/tokens|(?:[a-z0-9]+\.)?devices\.api(?:\.sandbox)?\.checkout\.com\/(?:cag\/)?tokens)/i, "hosts": ["^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.checkout\\.com$", "^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "sandboxHosts": ["^(?:[a-z0-9]+\\.)?(?:devices\\.)?api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "sandboxHosts": ["^checkoutshopper-test\\.adyen\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "sandboxHosts": ["^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "sandboxHosts": ["^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "sandboxHosts": ["^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "sandboxHosts": ["^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [], "jsonCardFields": [["paymentOption", "card", "cardNumber"], ["cardData", "cardNumber"]], "passWithoutCard": "(?:secure|ppp-test)\\.safecharge\\.com/ppp/api/v1/(?:clientPayment|websdk/initPaymentWithCardTokenization)\\.do" }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "sandboxHosts": ["^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "sandboxHosts": ["^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "sandboxHosts": ["^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "sandboxHosts": ["^sandbox\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "sandboxHosts": ["^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize|checkout\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "sandboxHosts": ["^api\\.test\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i, /^x-internal-correlation-id$/i, /^x-app-version$/i, /^x-transactionsource$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "sandboxHosts": ["^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/capabilities.generated.js

@@ -1,3 +1,3 @@
 // Written by scripts/generate-capabilities.mjs from capabilities.json. Do not edit; git ignores it.
 /** capabilities.json's list, sorted; client.ts exports it as SUPPORTED_CAPABILITIES. */
-export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "authorize_net_dpm_form", "barion_hosted_payment_page", "bluesnap_hosted_payment_fields", "capture_context", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "iyzico_checkout_form", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "oceanpayment_hosted_payment_page", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymentwall_card_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payplug_hosted_payment_page", "payrails_device_encrypt", "payrexx_card_frame", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "pin_payments_card_token", "poynt_collect_nonce", "primer_payment_instruments", "processout_card_token", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "usaepay_payment_key", "verifone_card_capture", "vtex_payments_card_payment", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];
+export const DECLARED_CAPABILITIES = ["aci_split_card.v1", "amadeus_checkout_actions.v1", "aps_custom_merchant_page", "aurus_one_time_token", "authorize_net_dpm_form", "barion_hosted_payment_page", "bluesnap_hosted_payment_fields", "capture_context", "cardlink_vpos_hosted_payment_page", "clover_card_token", "comgate_hosted_payment_page", "converge_hpp_process", "creditguard_pps_process", "cybersource_sa_token_create", "datatrans_secure_fields_tokenize", "eghl_hosted_payment_page", "ekashu_hosted_payment_page", "eximbay_hosted_payment_page", "fastspring_card_payment", "fiserv_card_capture", "frisbii_card_token", "gmo_shared_pk", "gopay_card_form", "gravy_session_fields_put", "hipay_vault_token", "iyzico_checkout_form", "juspay_txns.v1", "lyra_krypton_payment", "makecommerce_card_frame", "midtrans_card_token", "monei_card_token", "moneris_hosted_tokenization", "nexi_checkout_pay", "oceanpayment_hosted_payment_page", "omise_card_token", "openpay_tokenizer", "paddle_tokenex_pay", "paddle_vgs_cards", "pay_nl_card_token", "payfast_card_pay", "paygent_token", "paymentwall_card_token", "paymob_checkout_pay", "paymongo_checkout_pay", "paypal_card_fields", "payplug_hosted_payment_page", "payrails_device_encrypt", "payrexx_card_frame", "paystack_pinned_key", "paytrail_hosted_payment_page", "payu_latam_webcheckout_card", "pelecard_transaction", "pin_payments_card_token", "poynt_collect_nonce", "primer_payment_instruments", "processout_card_token", "przelewy24_hosted_payment_page", "quickpay_hosted_payment_page", "redsys_hosted_payment_page", "revolut_card_field", "sbps_token_jsonp", "shiji_sts_pinned_key", "sumup_checkout_process", "tap_card_sdk_token", "toast_pinned_key", "tokenex_iframe_tokenize", "transbank_webpay_hosted_payment_page", "twoc2p_secure_pay", "usaepay_payment_key", "verifone_card_capture", "viva_smart_checkout_chargetoken", "vtex_payments_card_payment", "wix_payments_tokenize", "worldline_mycheckout_form", "worldpay_eprotect_jsonp", "wspay_confirm", "xendit_card_token"];