@agent-cards/checkout 0.18.0 → 0.19.0

package/dist/adyen-merchant-hosted.generated.js

@@ -0,0 +1,1902 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 582753ad6e0ff77d4f5c10416b259928d1e00ea236a2f9d55af5865ef9c08243
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+var MAX_PATH_STEPS = 16;
+function isJsonPath(path) {
+    return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+function pathsOverlap(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+function describePath(path) {
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+}
+// src/url-template.js
+var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
+var PLACEHOLDER_NAME = /^[A-Za-z][A-Za-z0-9_]{0,31}$/;
+var LITERAL_SEGMENT = /^[A-Za-z0-9._~@+-]{1,256}$/;
+var QUERY_KEY = /^[A-Za-z0-9._~-]{1,64}$/;
+var QUERY_LITERAL = /^[A-Za-z0-9._~,-]{0,256}$/;
+var MAX_QUERIES = 8;
+var MAX_PAIRS = 16;
+var placeholderValue = (value) => PLACEHOLDER_VALUE.test(value) && value !== "." && !value.includes("..");
+function pathPlaceholders(template, pathname) {
+    if (typeof template !== "string" || typeof pathname !== "string")
+        return null;
+    if (!template.startsWith("/") || !pathname.startsWith("/"))
+        return null;
+    const want = template.split("/");
+    const got = pathname.split("/");
+    if (want.length !== got.length)
+        return null;
+    const values = {};
+    for (const [i, segment] of want.entries()) {
+        if (segment.startsWith(":")) {
+            if (!placeholderValue(got[i]))
+                return null;
+            values[segment.slice(1)] = got[i];
+        }
+        else if (segment !== got[i]) {
+            return null;
+        }
+    }
+    return values;
+}
+function pathMatchesTemplate(template, pathname) {
+    return pathPlaceholders(template, pathname) !== null;
+}
+function queryPlaceholders(query, text) {
+    if (!query || typeof query !== "object" || Array.isArray(query))
+        return null;
+    const pairs = Object.entries(query);
+    if (pairs.length === 0)
+        return text === null ? {} : null;
+    if (typeof text !== "string")
+        return null;
+    const got = text.split("&");
+    if (got.length !== pairs.length)
+        return null;
+    const values = {};
+    for (const [i, [key, value]] of pairs.entries()) {
+        const mark = got[i].indexOf("=");
+        if (mark === -1 || got[i].slice(0, mark) !== key)
+            return null;
+        const written = got[i].slice(mark + 1);
+        if (typeof value !== "string")
+            return null;
+        if (value.startsWith(":")) {
+            if (!placeholderValue(written))
+                return null;
+            values[value.slice(1)] = written;
+        }
+        else if (written !== value) {
+            return null;
+        }
+    }
+    return values;
+}
+function strictUrl(rawUrl) {
+    if (typeof rawUrl !== "string" || rawUrl.includes("#"))
+        return null;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    if (url.href !== rawUrl || url.protocol !== "https:" || url.port || url.username || url.password)
+        return null;
+    return url;
+}
+function urlTemplateMatch(template, rawUrl) {
+    const url = strictUrl(rawUrl);
+    if (!url || !template || typeof template !== "object")
+        return null;
+    const fromPath = pathPlaceholders(template.path, url.pathname);
+    if (!fromPath)
+        return null;
+    const mark = rawUrl.indexOf("?");
+    const text = mark === -1 ? null : rawUrl.slice(mark + 1);
+    const queries = Array.isArray(template.queries) ? template.queries : [template.query];
+    for (const query of queries) {
+        const fromQuery = queryPlaceholders(query, text);
+        if (fromQuery)
+            return { origin: url.origin, placeholders: { ...fromPath, ...fromQuery } };
+    }
+    return null;
+}
+function templatePlaceholders(template) {
+    const names = [];
+    if (typeof template?.path === "string") {
+        for (const segment of template.path.split("/"))
+            if (segment.startsWith(":"))
+                names.push(segment.slice(1));
+    }
+    const queries = Array.isArray(template?.queries) ? template.queries : [template?.query];
+    for (const query of queries) {
+        if (query && typeof query === "object") {
+            for (const value of Object.values(query))
+                if (typeof value === "string" && value.startsWith(":"))
+                    names.push(value.slice(1));
+        }
+    }
+    return names;
+}
+function pathTemplateRefusal(template) {
+    if (typeof template !== "string" || !template.startsWith("/") || template.length > 1024)
+        return "the path is not a template starting with /";
+    const names = [];
+    for (const segment of template.split("/").slice(1)) {
+        if (segment.startsWith(":")) {
+            if (!PLACEHOLDER_NAME.test(segment.slice(1)))
+                return `the path placeholder ${segment} is not a name`;
+            names.push(segment.slice(1));
+        }
+        else if (!LITERAL_SEGMENT.test(segment) || segment === "." || segment === "..") {
+            return `the path segment "${segment}" is not one literal segment`;
+        }
+    }
+    if (new Set(names).size !== names.length)
+        return "a path placeholder is named twice";
+    const literal = template.split("/").slice(1).map((segment) => segment.startsWith(":") ? "x" : segment).join("/");
+    return new URL(`https://template.invalid/${literal}`).pathname === `/${literal}` ? null : "the path is not written the way a URL writes it";
+}
+function queryTemplateRefusal(query) {
+    if (!query || typeof query !== "object" || Array.isArray(query))
+        return "the query is not an object of key=value pairs";
+    const pairs = Object.entries(query);
+    if (pairs.length > MAX_PAIRS)
+        return `the query has more than ${MAX_PAIRS} pairs`;
+    for (const [key, value] of pairs) {
+        if (!QUERY_KEY.test(key))
+            return `the query key "${key}" is not unreserved characters`;
+        if (typeof value !== "string")
+            return `the query value of ${key} is not text`;
+        if (value.startsWith(":") ? !PLACEHOLDER_NAME.test(value.slice(1)) : !QUERY_LITERAL.test(value)) {
+            return `the query value of ${key} is neither a literal nor a :name placeholder`;
+        }
+    }
+    return null;
+}
+function urlTemplateRefusal(template) {
+    if (!template || typeof template !== "object")
+        return "the template is not an object";
+    const pathRefusal2 = pathTemplateRefusal(template.path);
+    if (pathRefusal2)
+        return pathRefusal2;
+    const hasQuery = Object.prototype.hasOwnProperty.call(template, "query");
+    const hasQueries = Object.prototype.hasOwnProperty.call(template, "queries");
+    if (hasQuery === hasQueries)
+        return "the template names exactly one of query and queries";
+    const queries = hasQueries ? template.queries : [template.query];
+    if (!Array.isArray(queries) || queries.length === 0 || queries.length > MAX_QUERIES)
+        return `queries is not a list of 1 to ${MAX_QUERIES}`;
+    const pathNames = templatePlaceholders({ path: template.path, query: {} });
+    for (const query of queries) {
+        const refusal = queryTemplateRefusal(query);
+        if (refusal)
+            return refusal;
+        const names = [...pathNames, ...templatePlaceholders({ query })];
+        if (new Set(names).size !== names.length)
+            return "a placeholder is named twice in one request shape";
+    }
+    const texts = queries.map((query) => JSON.stringify(Object.entries(query)));
+    return new Set(texts).size === texts.length ? null : "a query is listed twice";
+}
+// src/merchant-amount.js
+var MERCHANT_AMOUNT_REFUSE_KINDS = /* @__PURE__ */ deepFreeze(["present", "absent", "true", "unset", "false", "nonzero", "nonEmpty", "empty"]);
+var MERCHANT_EXCHANGES_MAX = 16;
+var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var FORMATS = ["decimal2", "decimal", "number"];
+var SOURCE_MEMBERS = [
+    "id",
+    "origin",
+    "format",
+    "responses",
+    "total",
+    "unit",
+    "currency",
+    "currencyPath",
+    "bind",
+    "match",
+    "requires",
+    "refuse",
+    "voidedBy",
+    "maxAgeMs",
+    "afterPayment"
+];
+var SOURCE_REQUIRED = ["id", "origin", "format", "responses", "total", "unit", "currency", "bind", "maxAgeMs"];
+var AFTER_MEMBERS = ["origin", "format", "responses", "total", "unit", "currency", "currencyPath", "bind", "requires", "refuse"];
+var AFTER_REQUIRED = ["origin", "format", "responses", "total", "unit", "currency", "bind"];
+var MAX = { responses: 16, bind: 6, match: 4, requires: 8, refuse: 12, voidedBy: 16, request: 4 };
+var MAX_AGE_MS = { min: 1e3, max: 36e5 };
+var INPUT_ID = /^[A-Za-z][A-Za-z0-9_-]{0,127}$/;
+var SCRIPT_VAR = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+var PLACEHOLDER_NAME2 = /^[A-Za-z][A-Za-z0-9_]{0,31}$/;
+var ZERO_DECIMAL = /* @__PURE__ */ new Set(["BIF", "CLP", "DJF", "GNF", "ISK", "JPY", "KMF", "KRW", "PYG", "RWF", "UGX", "VND", "VUV", "XAF", "XOF", "XPF"]);
+var THREE_DECIMAL = /* @__PURE__ */ new Set(["BHD", "IQD", "JOD", "KWD", "LYD", "OMR", "TND"]);
+var minorDigits = (currency) => ZERO_DECIMAL.has(currency) ? 0 : THREE_DECIMAL.has(currency) ? 3 : 2;
+var primitive = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+var has = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+function membersRefusal(entry, allowed, required, label) {
+    if (!isPlainObject(entry))
+        return `${label} is not an object`;
+    const keys = Object.keys(entry);
+    const extra = keys.find((key) => !allowed.includes(key));
+    if (extra)
+        return `${label} carries ${extra}, which is not a member`;
+    const missing = required.find((key) => !keys.includes(key));
+    return missing ? `${label} names no ${missing}` : null;
+}
+function listRefusal(list, max, label, each, { optional = true, min = 0 } = {}) {
+    if (list === void 0 && optional)
+        return null;
+    if (!Array.isArray(list) || list.length < min || list.length > max)
+        return `${label} is not a list of ${min} to ${max}`;
+    for (const [i, entry] of list.entries()) {
+        const refusal = each(entry, `${label} ${i}`);
+        if (refusal)
+            return refusal;
+    }
+    return null;
+}
+var pathRefusal = (path, label) => isJsonPath(path) && path.length > 0 ? null : `${label} is not a JSON path of keys and indices`;
+function equalsRuleRefusal(rule, label, { root }) {
+    const byPath = root && isPlainObject(rule) && has(rule, "equalsPath");
+    if (byPath && has(rule, "equals"))
+        return `${label} names both equals and equalsPath`;
+    const members = root ? ["path", byPath ? "equalsPath" : "equals", "root"] : ["path", "equals"];
+    return membersRefusal(rule, members, ["path", byPath ? "equalsPath" : "equals"], label) ?? pathRefusal(rule.path, `${label}'s path`) ?? (byPath ? pathRefusal(rule.equalsPath, `${label}'s equalsPath`) : primitive(rule.equals) ? null : `${label} compares with something other than text, a number or a boolean`) ?? (rule.root === void 0 || rule.root === true ? null : `${label}'s root is not true`);
+}
+function refuseRuleRefusal(rule, label) {
+    return membersRefusal(rule, ["path", "when", "root"], ["path", "when"], label) ?? pathRefusal(rule.path, `${label}'s path`) ?? (MERCHANT_AMOUNT_REFUSE_KINDS.includes(rule.when) ? null : `${label} fires on ${String(rule.when)}, which is not a kind`) ?? (rule.root === void 0 || rule.root === true ? null : `${label}'s root is not true`);
+}
+function shapeRefusal(entry, label, { format, response }) {
+    const allowed = response ? ["method", "path", "query", "queries", "status", "request", "at"] : ["method", "path", "query", "queries"];
+    const members = membersRefusal(entry, allowed, ["method", "path"], label);
+    if (members)
+        return members;
+    if (!METHODS.includes(entry.method))
+        return `${label}'s method is not one of ${METHODS.join(", ")}`;
+    const template = urlTemplateRefusal(entry);
+    if (template)
+        return `${label}: ${template}`;
+    if (entry.status !== void 0 && !["2xx", "4xx"].includes(entry.status))
+        return `${label}'s status is not 2xx or 4xx`;
+    if ((entry.request !== void 0 || entry.at !== void 0) && format !== "json")
+        return `${label} reads JSON from an HTML source`;
+    if (entry.at !== void 0 && !isJsonPath(entry.at))
+        return `${label}'s at is not a JSON path`;
+    return listRefusal(entry.request, MAX.request, `${label}'s request rule`, (rule, ruleLabel) => equalsRuleRefusal(rule, ruleLabel, { root: false }), { min: 1 });
+}
+function totalRefusal(total, format, unit, currency) {
+    if (format === "json") {
+        const members = membersRefusal(total, ["path", "format"], ["path", "format"], "the total");
+        if (members)
+            return members;
+        const path = pathRefusal(total.path, "the total's path");
+        if (path)
+            return path;
+    }
+    else {
+        const members = membersRefusal(total, ["input", "scriptVar", "format"], ["input", "format"], "the total");
+        if (members)
+            return members;
+        if (!INPUT_ID.test(total.input ?? ""))
+            return "the total's input is not an element id";
+        if (total.scriptVar !== void 0 && !SCRIPT_VAR.test(total.scriptVar))
+            return "the total's scriptVar is not a script name";
+        if (total.format !== "decimal")
+            return "an HTML total is decimal text";
+    }
+    if (!FORMATS.includes(total.format))
+        return `the total's format is not one of ${FORMATS.join(", ")}`;
+    if (!["major", "minor"].includes(unit))
+        return "the unit is not major or minor";
+    if (total.format !== "number" && unit !== "major")
+        return "a decimal total is in major units";
+    if (total.format === "decimal2" && minorDigits(currency) !== 2)
+        return `a decimal2 total needs a currency with two decimals, and ${currency} has ${minorDigits(currency)}`;
+    return null;
+}
+function bindRefusal(rule, label, { format, shapes, profile }) {
+    if (!isPlainObject(rule))
+        return `${label} is not an object`;
+    const keys = Object.keys(rule).sort().join(",");
+    const cardPath = (path) => pathRefusal(path, `${label}'s card path`) ?? (Array.isArray(profile.holder) && pathsOverlap(path, profile.holder) ? `${label} reads the card object` : null);
+    switch (keys) {
+        case "card,source":
+            if (format !== "json")
+                return `${label} reads JSON from an HTML source`;
+            return pathRefusal(rule.source, `${label}'s source path`) ?? cardPath(rule.card);
+        case "card,request":
+            if (format !== "json")
+                return `${label} reads JSON from an HTML source`;
+            return pathRefusal(rule.request, `${label}'s request path`) ?? cardPath(rule.card);
+        case "card,placeholder":
+        case "cardPlaceholder,placeholder": {
+            if (!PLACEHOLDER_NAME2.test(rule.placeholder ?? "") || !shapes.some((shape) => templatePlaceholders(shape).includes(rule.placeholder))) {
+                return `${label} names a placeholder no request shape has`;
+            }
+            if (keys === "card,placeholder")
+                return cardPath(rule.card);
+            return templatePlaceholders({ path: profile.path, query: profile.query }).includes(rule.cardPlaceholder) ? null : `${label} names a placeholder the card URL does not have`;
+        }
+        case "samePage":
+            return rule.samePage === true ? null : `${label}'s samePage is not true`;
+        default:
+            return `${label} is not one of the bind shapes`;
+    }
+}
+var bindApplies = (rule, shape) => !has(rule, "placeholder") || templatePlaceholders(shape).includes(rule.placeholder);
+function matchRefusal(rule, label, profile) {
+    return membersRefusal(rule, ["source", "card", "whenCard", "sourceDefault"], ["source", "card"], label) ?? pathRefusal(rule.source, `${label}'s source path`) ?? pathRefusal(rule.card, `${label}'s card path`) ?? (Array.isArray(profile.holder) && pathsOverlap(rule.card, profile.holder) ? `${label} reads the card object` : null) ?? (rule.whenCard === void 0 ? null : pathRefusal(rule.whenCard, `${label}'s whenCard path`)) ?? (rule.sourceDefault === void 0 || primitive(rule.sourceDefault) ? null : `${label}'s sourceDefault is not text, a number or a boolean`);
+}
+function stageRefusal(stage, profile, { after }) {
+    const label = after ? "afterPayment" : "the amount source";
+    const members = membersRefusal(stage, after ? AFTER_MEMBERS : SOURCE_MEMBERS, after ? AFTER_REQUIRED : SOURCE_REQUIRED, label);
+    if (members)
+        return members;
+    if (!after && !/^[a-z][a-z0-9_]{2,63}$/.test(stage.id))
+        return "the amount source's id is not a lower-case name";
+    if (!["checkout", "endpoint"].includes(stage.origin))
+        return `${label}'s origin is not checkout or endpoint`;
+    const format = stage.format;
+    if (!["json", "html"].includes(format))
+        return `${label}'s format is not json or html`;
+    if (!/^[A-Z]{3}$/.test(stage.currency ?? ""))
+        return `${label}'s currency is not an ISO code`;
+    const shapes = stage.responses;
+    const listed = listRefusal(shapes, MAX.responses, `${label}'s response`, (entry, entryLabel) => shapeRefusal(entry, entryLabel, { format, response: true }), { optional: false, min: 1 }) ?? totalRefusal(stage.total, format, stage.unit, stage.currency);
+    if (listed)
+        return listed;
+    if (stage.currencyPath !== void 0 && (format !== "json" || pathRefusal(stage.currencyPath, "currencyPath")))
+        return `${label}'s currencyPath is not a JSON path`;
+    const bound = listRefusal(stage.bind, MAX.bind, `${label}'s bind rule`, (rule, ruleLabel) => bindRefusal(rule, ruleLabel, { format, shapes, profile }), { optional: false, min: 1 });
+    if (bound)
+        return bound;
+    const unbound = shapes.findIndex((shape) => !stage.bind.some((rule) => bindApplies(rule, shape)));
+    if (unbound !== -1)
+        return `${label}'s response ${unbound} is tied to the card request by no bind rule`;
+    if (format !== "json" && ["match", "requires", "refuse"].some((key) => stage[key] !== void 0))
+        return `${label} reads JSON rules from an HTML source`;
+    return listRefusal(stage.requires, MAX.requires, `${label}'s requires rule`, (rule, ruleLabel) => equalsRuleRefusal(rule, ruleLabel, { root: true })) ?? listRefusal(stage.refuse, MAX.refuse, `${label}'s refuse rule`, refuseRuleRefusal) ?? (after ? null : listRefusal(stage.match, MAX.match, "the amount source's match rule", (rule, ruleLabel) => matchRefusal(rule, ruleLabel, profile))) ?? (after ? null : listRefusal(stage.voidedBy, MAX.voidedBy, "the amount source's voidedBy shape", (entry, entryLabel) => shapeRefusal(entry, entryLabel, { format, response: false }))) ?? (after || Number.isSafeInteger(stage.maxAgeMs) && stage.maxAgeMs >= MAX_AGE_MS.min && stage.maxAgeMs <= MAX_AGE_MS.max ? null : `maxAgeMs is not a whole number of milliseconds from ${MAX_AGE_MS.min} to ${MAX_AGE_MS.max}`);
+}
+function merchantAmountSourceRefusal(profile) {
+    if (!isPlainObject(profile))
+        return "the profile is not an object";
+    const source = profile.amountSource;
+    if (source === void 0)
+        return null;
+    const refusal = stageRefusal(source, profile, { after: false });
+    if (refusal)
+        return refusal;
+    return source.afterPayment === void 0 ? null : stageRefusal(source.afterPayment, profile, { after: true });
+}
+var fail = (code, reason) => ({ ok: false, code, reason });
+function minorFromDecimalText(text, digits, places) {
+    const m = /^(\d{1,13})(?:\.(\d+))?$/.exec(text);
+    if (!m)
+        return null;
+    const fraction = m[2] ?? "";
+    if (fraction.length > places || /[^0]/.test(fraction.slice(digits)))
+        return null;
+    const minor = Number(m[1]) * 10 ** digits + Number((fraction + "0".repeat(digits)).slice(0, digits) || "0");
+    return Number.isSafeInteger(minor) ? minor : null;
+}
+function totalMinor(value, format, unit, currency) {
+    const digits = minorDigits(currency);
+    if (format === "decimal2")
+        return typeof value === "string" && digits === 2 && /^\d{1,13}\.\d{2}$/.test(value) ? minorFromDecimalText(value, 2, 2) : null;
+    if (format === "decimal")
+        return typeof value === "string" ? minorFromDecimalText(value, digits, 4) : null;
+    if (format !== "number" || typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        return null;
+    if (unit === "minor")
+        return Number.isSafeInteger(value) ? value : null;
+    const text = String(value);
+    return /e/i.test(text) ? null : minorFromDecimalText(text, digits, 17);
+}
+var INPUT_TAG = /<input\b([^<>]*)>/gi;
+var ATTRIBUTE = /([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+var withoutComments = (html) => html.replace(/<!--[\s\S]*?-->/g, "");
+function inputValues(html, id) {
+    const values = [];
+    for (const tag of withoutComments(html).matchAll(INPUT_TAG)) {
+        const attributes = /* @__PURE__ */ new Map();
+        for (const attribute of tag[1].matchAll(ATTRIBUTE)) {
+            const name = attribute[1].toLowerCase();
+            if (!attributes.has(name))
+                attributes.set(name, attribute[2] ?? attribute[3] ?? attribute[4] ?? "");
+        }
+        if (attributes.get("id") === id)
+            values.push(attributes.has("value") ? attributes.get("value") : null);
+    }
+    return values;
+}
+function scriptVarValues(html, name) {
+    const pattern = new RegExp(`(?:^|[^A-Za-z0-9_$.])var\\s+${name.replace(/\$/g, "\\$")}\\s*=\\s*([^;<\\n]*);`, "g");
+    return [...withoutComments(html).matchAll(pattern)].map((m) => m[1].trim());
+}
+function htmlTotal(html, total) {
+    if (typeof html !== "string")
+        return { found: false };
+    const inputs = inputValues(html, total.input);
+    if (inputs.length > 1)
+        return { ambiguous: true };
+    if (inputs.length === 1)
+        return { found: true, value: inputs[0] };
+    const vars = total.scriptVar ? scriptVarValues(html, total.scriptVar) : [];
+    if (vars.length > 1)
+        return { ambiguous: true };
+    return vars.length === 1 ? { found: true, value: vars[0] } : { found: false };
+}
+var zeroish = (value) => value === 0 || typeof value === "string" && /^0+(?:\.0+)?$/.test(value);
+var emptyish = (value) => value === null || value === false || value === "" || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0;
+function fires(when, at) {
+    const value = at.found ? at.value : void 0;
+    switch (when) {
+        case "present":
+            return at.found;
+        case "absent":
+            return !at.found;
+        case "true":
+            return at.found && value !== false && value !== null;
+        case "unset":
+            return !at.found || value === false || value === null;
+        case "false":
+            return at.found && value === false;
+        case "nonzero":
+            return at.found && value !== null && value !== false && !zeroish(value);
+        case "nonEmpty":
+            return at.found && !emptyish(value);
+        case "empty":
+            return !at.found || emptyish(value);
+        default:
+            return true;
+    }
+}
+function readerFor(exchange, shape) {
+    const at = shape.at ?? [];
+    const parse = (text) => {
+        try {
+            return typeof text === "string" ? JSON.parse(text) : void 0;
+        }
+        catch {
+            return void 0;
+        }
+    };
+    let body;
+    let request;
+    let bodyRead = false;
+    let requestRead = false;
+    const parsedBody = () => {
+        if (!bodyRead) {
+            bodyRead = true;
+            body = parse(exchange.body);
+        }
+        return body;
+    };
+    const parsedRequest = () => {
+        if (!requestRead) {
+            requestRead = true;
+            request = parse(exchange.requestBody);
+        }
+        return request;
+    };
+    return {
+        parsedBody,
+        read: (path, root) => parsedBody() === void 0 ? { found: false } : jsonAt(parsedBody(), root ? path : [...at, ...path]),
+        readRequest: (path) => parsedRequest() === void 0 ? { found: false } : jsonAt(parsedRequest(), path)
+    };
+}
+function shapeFor(shapes, exchange, origin, { response }) {
+    if (typeof exchange.method !== "string" || typeof exchange.url !== "string")
+        return null;
+    for (const shape of shapes) {
+        if (exchange.method.toUpperCase() !== shape.method)
+            continue;
+        const match = urlTemplateMatch(shape, exchange.url);
+        if (!match || origin !== null && match.origin !== origin)
+            continue;
+        if (response) {
+            const status = shape.status ?? "2xx";
+            if (!(status === "2xx" ? exchange.status >= 200 && exchange.status < 300 : exchange.status >= 400 && exchange.status < 500))
+                continue;
+            const reader = readerFor(exchange, shape);
+            if (shape.request && !shape.request.every((rule) => {
+                const at = reader.readRequest(rule.path);
+                return at.found && at.value === rule.equals;
+            }))
+                continue;
+            return { shape, placeholders: match.placeholders, reader };
+        }
+        return { shape, placeholders: match.placeholders };
+    }
+    return null;
+}
+function isOrigin(value) {
+    if (typeof value !== "string")
+        return false;
+    let url;
+    try {
+        url = new URL(`${value}/`);
+    }
+    catch {
+        return false;
+    }
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && url.origin === value;
+}
+var bindKey = (value) => typeof value === "string" && value.length > 0 || typeof value === "number" && Number.isFinite(value) ? value : void 0;
+function cardContext(profile, card) {
+    const merchant = profile.merchant;
+    if (!isPlainObject(card))
+        return fail("invalid", `the paused ${merchant} card request is missing`);
+    const { url, method, body, pausedAt, checkoutOrigin, page, declaredEndpoint } = card;
+    const methodOk = typeof method === "string" && method.toUpperCase() === profile.method;
+    let match;
+    let pairs;
+    if (declaredEndpoint !== void 0) {
+        const declared = methodOk && typeof declaredEndpoint === "string" && url === declaredEndpoint ? strictUrl(url)?.origin ?? null : null;
+        if (!declared || checkoutOrigin !== void 0 && !isOrigin(checkoutOrigin)) {
+            return fail("invalid", `the paused request is not the declared endpoint shaped like ${merchant}'s card request, from its declared checkout page`);
+        }
+        const shaped = urlTemplateMatch({ path: profile.path, query: profile.query }, url);
+        match = { origin: declared, placeholders: shaped ? shaped.placeholders : {} };
+        pairs = [{ endpoint: declared, checkout: checkoutOrigin }];
+    }
+    else {
+        match = methodOk ? urlTemplateMatch({ path: profile.path, query: profile.query }, url) : null;
+        pairs = match ? profile.origins.filter((pair) => pair.endpoint === match.origin && (checkoutOrigin === void 0 || pair.checkout === checkoutOrigin)) : [];
+    }
+    if (pairs.length === 0)
+        return fail("invalid", `the paused request is not ${merchant}'s card request from its checkout page`);
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        parsed = void 0;
+    }
+    if (!isPlainObject(parsed))
+        return fail("invalid", `the paused ${merchant} card request is not a JSON object`);
+    if (typeof pausedAt !== "number" || !Number.isFinite(pausedAt) || pausedAt < 0)
+        return fail("invalid", "the time the card request paused is missing");
+    if (page !== void 0 && (typeof page !== "string" || page.length === 0 || page.length > 256))
+        return fail("invalid", "the card request's page is not an id");
+    return {
+        ok: true,
+        merchant,
+        origin: match.origin,
+        placeholders: match.placeholders,
+        body: parsed,
+        pausedAt,
+        page,
+        checkoutOrigins: [...new Set(pairs.map((pair) => pair.checkout).filter((origin) => origin !== void 0))]
+    };
+}
+var stageOrigin = (stage, ctx) => stage.origin === "endpoint" ? ctx.origin : ctx.checkoutOrigins.length === 1 ? ctx.checkoutOrigins[0] : null;
+function cardBindValue(rule, ctx) {
+    if (has(rule, "samePage"))
+        return ctx.page;
+    if (has(rule, "cardPlaceholder"))
+        return ctx.placeholders[rule.cardPlaceholder];
+    const at = jsonAt(ctx.body, rule.card);
+    return at.found ? bindKey(at.value) : void 0;
+}
+function responseBindValue(rule, exchange, candidate) {
+    if (has(rule, "samePage"))
+        return typeof exchange.page === "string" && exchange.page ? exchange.page : void 0;
+    if (has(rule, "placeholder"))
+        return candidate.placeholders[rule.placeholder];
+    const at = has(rule, "request") ? candidate.reader.readRequest(rule.request) : candidate.reader.read(rule.source);
+    return at.found ? bindKey(at.value) : void 0;
+}
+var describeBind = (rule) => has(rule, "samePage") ? "page id" : has(rule, "cardPlaceholder") ? `:${rule.cardPlaceholder} in its URL` : describePath(rule.card);
+function tie(stage, exchange, candidate, ctx) {
+    let state = "bound";
+    for (const rule of stage.bind) {
+        if (!bindApplies(rule, candidate.shape))
+            continue;
+        const got = responseBindValue(rule, exchange, candidate);
+        if (got === void 0)
+            state = "unknown";
+        else if (got !== cardBindValue(rule, ctx))
+            return "other";
+    }
+    return state;
+}
+function commonInput(profile, stage, input) {
+    const refusal = merchantAmountSourceRefusal(profile);
+    if (refusal)
+        return fail("unreviewed", `${profile.merchant}'s amount source is not a reviewed declaration: ${refusal}`);
+    const ctx = cardContext(profile, input?.card);
+    if (!ctx.ok)
+        return ctx;
+    const responses = input?.responses;
+    const valid = Array.isArray(responses) && responses.length <= MERCHANT_EXCHANGES_MAX && responses.every((r) => isPlainObject(r) && typeof r.method === "string" && typeof r.url === "string" && Number.isSafeInteger(r.status) && r.status >= 100 && r.status <= 599 && typeof r.completedAt === "number" && Number.isFinite(r.completedAt) && r.completedAt >= 0 && (r.sentAt === void 0 || typeof r.sentAt === "number" && Number.isFinite(r.sentAt) && r.sentAt >= 0) && (r.page === void 0 || typeof r.page === "string") && (r.requestBody === void 0 || typeof r.requestBody === "string") && typeof r.body === "string");
+    if (!valid)
+        return fail("invalid", `the ${profile.merchant} responses are not a list of at most ${MERCHANT_EXCHANGES_MAX} the rules can read`);
+    const origin = stageOrigin(stage, ctx);
+    if (!origin)
+        return fail("invalid", `the checkout page is not named, so ${profile.merchant}'s responses have no one origin`);
+    const unbound = stage.bind.find((rule) => cardBindValue(rule, ctx) === void 0);
+    if (unbound)
+        return fail("unbound", `the paused card request carries no ${describeBind(unbound)} to tie ${profile.merchant}'s total to`);
+    return { ok: true, ctx, responses, origin };
+}
+function readResponse(stage, candidate, ctx, { after }) {
+    const merchant = ctx.merchant;
+    const { reader } = candidate;
+    if (stage.format === "json" && reader.parsedBody() === void 0)
+        return fail("unreadable", `${merchant}'s response is not JSON`);
+    for (const rule of stage.requires ?? []) {
+        const at = reader.read(rule.path, rule.root);
+        if (has(rule, "equalsPath")) {
+            const other = reader.read(rule.equalsPath, rule.root);
+            if (!at.found || !other.found || !primitive(at.value) || at.value !== other.value) {
+                return fail("refused", `${merchant}'s response does not say ${describePath(rule.path)} equals ${describePath(rule.equalsPath)}`);
+            }
+            continue;
+        }
+        if (!at.found || at.value !== rule.equals)
+            return fail("refused", `${merchant}'s response does not say ${describePath(rule.path)} is ${JSON.stringify(rule.equals)}`);
+    }
+    for (const rule of stage.refuse ?? []) {
+        if (fires(rule.when, reader.read(rule.path, rule.root)))
+            return fail("refused", `${merchant}'s response refuses this payment: ${describePath(rule.path)} is ${rule.when}`);
+    }
+    const total = stage.format === "json" ? reader.read(stage.total.path) : htmlTotal(candidate.exchange.body, stage.total);
+    if (total.ambiguous)
+        return fail("unreadable", `${merchant}'s page names its total more than once`);
+    const minor = total.found ? totalMinor(total.value, stage.total.format, stage.unit, stage.currency) : null;
+    if (minor === null)
+        return fail("unreadable", `${merchant}'s total is not a ${stage.total.format} amount in ${stage.unit} units of ${stage.currency}`);
+    if (!after && minor <= 0)
+        return fail("refused", `${merchant}'s total is not above zero, so there is nothing for the card to pay`);
+    let currency = stage.currency;
+    if (stage.currencyPath) {
+        const named = reader.read(stage.currencyPath);
+        if (!named.found || typeof named.value !== "string" || !/^[A-Za-z]{3}$/.test(named.value))
+            return fail("unreadable", `${merchant}'s response names no currency`);
+        if (!after && named.value !== stage.currency)
+            return fail("mismatch", `${merchant}'s total is in ${named.value}, not the ${stage.currency} Agentcard reviewed`);
+        currency = named.value.toUpperCase();
+    }
+    return { ok: true, amountCents: minor, currency };
+}
+function adyenAmount(value) {
+    if (!isPlainObject(value))
+        return null;
+    const minor = typeof value.value === "number" ? Number.isSafeInteger(value.value) && value.value >= 0 ? value.value : null : typeof value.value === "string" && /^\d{1,15}$/.test(value.value) ? Number(value.value) : null;
+    const currency = typeof value.currency === "string" && /^[A-Za-z]{3}$/.test(value.currency) ? value.currency.toUpperCase() : null;
+    return minor === null || !currency ? null : { minor, currency };
+}
+function readMerchantAmount(profile, input) {
+    const stage = isPlainObject(profile) ? profile.amountSource : void 0;
+    if (!isPlainObject(stage))
+        return fail("no_source", `${profile?.merchant ?? "This merchant"}'s profile names no source for its own total`);
+    const common = commonInput(profile, stage, input);
+    if (!common.ok)
+        return common;
+    const { ctx, responses, origin } = common;
+    const merchant = profile.merchant;
+    const seen = [];
+    let inFlight = false;
+    for (const exchange of responses) {
+        const match = shapeFor(stage.responses, exchange, origin, { response: true });
+        if (!match)
+            continue;
+        const candidate = { exchange, ...match };
+        if (exchange.completedAt > ctx.pausedAt) {
+            if (exchange.sentAt !== void 0 && exchange.sentAt <= ctx.pausedAt && tie(stage, exchange, candidate, ctx) !== "other")
+                inFlight = true;
+            continue;
+        }
+        seen.push({ ...candidate, tie: tie(stage, exchange, candidate, ctx) });
+    }
+    const bound = seen.filter((candidate) => candidate.tie === "bound");
+    if (bound.length === 0)
+        return fail("no_source", `no ${merchant} response with the total of this order was seen before the card request`);
+    const latest = Math.max(...bound.map((candidate) => candidate.exchange.completedAt));
+    const tied = bound.filter((candidate) => candidate.exchange.completedAt === latest);
+    const chosen = tied[tied.length - 1];
+    if (seen.some((candidate) => candidate.tie === "unknown" && candidate.exchange.completedAt > latest)) {
+        return fail("stale", `a newer ${merchant} response could not be tied to this order, so its latest total is not known`);
+    }
+    if (inFlight)
+        return fail("stale", `a ${merchant} request that left before the card request answered only after it, so the total the card pays is not known`);
+    const ageMs = ctx.pausedAt - latest;
+    if (ageMs > stage.maxAgeMs) {
+        return fail("stale", `${merchant}'s latest total for this order was read ${Math.round(ageMs / 1e3)} s before the card request, past the ${stage.maxAgeMs / 1e3} s its profile allows`);
+    }
+    const voided = (stage.voidedBy ?? []).length > 0 && responses.some((exchange) => {
+        const at = exchange.sentAt ?? exchange.completedAt;
+        return at > latest && at <= ctx.pausedAt && shapeFor(stage.voidedBy, exchange, origin, { response: false }) !== null;
+    });
+    if (voided)
+        return fail("stale", `${merchant}'s order changed after its latest total was read`);
+    const reading = readResponse(stage, chosen, ctx, { after: false });
+    if (!reading.ok)
+        return reading;
+    for (const other of tied.slice(0, -1)) {
+        const again = readResponse(stage, other, ctx, { after: false });
+        if (!again.ok || again.amountCents !== reading.amountCents || again.currency !== reading.currency) {
+            return fail("stale", `two ${merchant} responses for this order at the same instant disagree`);
+        }
+    }
+    for (const rule of stage.match ?? []) {
+        if (rule.whenCard && !jsonAt(ctx.body, rule.whenCard).found)
+            continue;
+        const card = jsonAt(ctx.body, rule.card);
+        const source = chosen.reader.read(rule.source);
+        const want = source.found ? source.value : rule.sourceDefault;
+        if (!card.found || want === void 0 || card.value !== want) {
+            return fail("stale", `the card request was built from another ${merchant} response than the latest one (${describePath(rule.card)})`);
+        }
+    }
+    let bodyAmount = "none";
+    if (Array.isArray(profile.amount)) {
+        const at = jsonAt(ctx.body, profile.amount);
+        bodyAmount = at.found ? "equal" : "absent";
+        if (at.found) {
+            const named = adyenAmount(at.value);
+            if (!named)
+                return fail("unreadable", `the amount in ${merchant}'s card request is not the {value, currency} Agentcard reviewed`);
+            if (named.currency !== reading.currency || named.minor !== reading.amountCents) {
+                return fail("mismatch", `${merchant}'s card request asks for ${named.minor} ${named.currency}, but its own total is ${reading.amountCents} ${reading.currency}`);
+            }
+        }
+    }
+    return {
+        ok: true,
+        amount: { amountCents: reading.amountCents, currency: reading.currency.toLowerCase() },
+        source: { kind: "response", id: stage.id, method: chosen.shape.method, path: chosen.shape.path, completedAt: latest, ageMs, bodyAmount }
+    };
+}
+function readMerchantCharged(profile, input) {
+    const stage = isPlainObject(profile) && isPlainObject(profile.amountSource) ? profile.amountSource.afterPayment : void 0;
+    if (!isPlainObject(stage))
+        return fail("no_reader", `${profile?.merchant ?? "This merchant"}'s profile reads no total after payment`);
+    const common = commonInput(profile, stage, input);
+    if (!common.ok)
+        return common;
+    const { ctx, responses, origin } = common;
+    const readings = [];
+    for (const exchange of responses) {
+        if (exchange.completedAt < ctx.pausedAt)
+            continue;
+        const match = shapeFor(stage.responses, exchange, origin, { response: true });
+        if (!match)
+            continue;
+        const candidate = { exchange, ...match };
+        if (tie(stage, exchange, candidate, ctx) !== "bound")
+            continue;
+        const reading = readResponse(stage, candidate, ctx, { after: true });
+        if ("amountCents" in reading)
+            readings.push({ amountCents: reading.amountCents, currency: reading.currency, shape: match.shape, completedAt: exchange.completedAt });
+    }
+    if (readings.length === 0)
+        return fail("unread", `no ${profile.merchant} response after the card request says what it charged`);
+    const other = readings.filter((reading) => reading.currency !== stage.currency);
+    const worst = (other.length > 0 ? other : readings).reduce((top, reading) => reading.amountCents > top.amountCents ? reading : top);
+    return {
+        ok: true,
+        charged: { amountCents: worst.amountCents, currency: worst.currency.toLowerCase() },
+        source: { kind: "response", id: `${profile.amountSource.id}.after_payment`, method: worst.shape.method, path: worst.shape.path, completedAt: worst.completedAt },
+        readings: readings.length
+    };
+}
+function newestMerchantExchanges(exchanges) {
+    if (!Array.isArray(exchanges))
+        return [];
+    return exchanges.map((exchange, index) => ({ exchange, index })).filter(({ exchange }) => isPlainObject(exchange) && typeof exchange.completedAt === "number" && Number.isFinite(exchange.completedAt)).sort((a, b) => a.exchange.completedAt - b.exchange.completedAt || a.index - b.index).slice(-MERCHANT_EXCHANGES_MAX).map(({ exchange }) => exchange);
+}
+function standIn(value) {
+    if (Array.isArray(value))
+        return value.map(() => true);
+    if (isPlainObject(value))
+        return Object.fromEntries(Object.keys(value).filter((key) => !FORBIDDEN_KEYS.has(key)).map((key) => [key, true]));
+    return typeof value === "string" ? value === "" ? "" : "*" : value;
+}
+function assign(node, step, value) {
+    if (typeof step === "number") {
+        while (node.length < step)
+            node.push(null);
+        node[step] = value;
+    }
+    else {
+        Object.defineProperty(node, step, { value, enumerable: true, writable: true, configurable: true });
+    }
+}
+function setAt(root, path, value) {
+    if (path.length === 0)
+        return value;
+    const container = (typeof path[0] === "number" ? Array.isArray(root) : isPlainObject(root)) ? root : typeof path[0] === "number" ? [] : {};
+    let node = container;
+    for (const [i, step] of path.entries()) {
+        if (i === path.length - 1) {
+            assign(node, step, value);
+            break;
+        }
+        const wantArray = typeof path[i + 1] === "number";
+        let child = typeof step === "number" ? node[step] : has(node, step) ? node[step] : void 0;
+        if (wantArray ? !Array.isArray(child) : !isPlainObject(child)) {
+            child = wantArray ? [] : {};
+            assign(node, step, child);
+        }
+        node = child;
+    }
+    return container;
+}
+function projectJson(text, reads) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return "";
+    }
+    let out = {};
+    const ordered = [...reads].sort((a, b) => a.path.length - b.path.length || (a.keep === b.keep ? 0 : a.keep === "shape" ? -1 : 1));
+    for (const read of ordered) {
+        const at = jsonAt(parsed, read.path);
+        if (!at.found)
+            continue;
+        const primitiveValue = at.value === null || typeof at.value !== "object";
+        out = setAt(out, read.path, read.keep === "value" && primitiveValue ? at.value : standIn(at.value));
+    }
+    return JSON.stringify(out);
+}
+function projectHtml(html, total) {
+    if (typeof html !== "string")
+        return "";
+    const inputs = inputValues(html, total.input);
+    const safe = (value, pattern) => pattern.test(value) ? value : "!";
+    if (inputs.length) {
+        return inputs.map((value) => value === null ? `<input id="${total.input}">` : `<input id="${total.input}" value="${safe(value, /^[^"<>]*$/)}">`).join("");
+    }
+    return (total.scriptVar ? scriptVarValues(html, total.scriptVar) : []).map((value) => `<script>var ${total.scriptVar} = ${safe(value, /^[^;<\n]*$/)};</script>`).join("");
+}
+function projectMerchantResponse(profile, stageName, exchange) {
+    const source = isPlainObject(profile) ? profile.amountSource : void 0;
+    const stage = stageName === "source" ? source : stageName === "charged" && isPlainObject(source) ? source.afterPayment : void 0;
+    if (!isPlainObject(stage) || !isPlainObject(exchange) || merchantAmountSourceRefusal(profile) !== null)
+        return null;
+    const base = {
+        method: exchange.method,
+        url: exchange.url,
+        status: exchange.status,
+        completedAt: exchange.completedAt,
+        ...exchange.sentAt !== void 0 ? { sentAt: exchange.sentAt } : {},
+        ...exchange.page !== void 0 ? { page: exchange.page } : {}
+    };
+    const match = shapeFor(stage.responses, exchange, null, { response: true });
+    if (!match) {
+        const voids = stageName === "source" && Array.isArray(stage.voidedBy) && shapeFor(stage.voidedBy, exchange, null, { response: false });
+        return voids ? { ...base, body: "" } : null;
+    }
+    const at = match.shape.at ?? [];
+    const from = (path, root) => root ? path : [...at, ...path];
+    const value = (path, root) => ({ path: from(path, root), keep: "value" });
+    const reads = stage.format === "json" ? [
+        value(stage.total.path),
+        ...stage.currencyPath ? [value(stage.currencyPath)] : [],
+        ...stage.bind.filter((rule) => has(rule, "source")).map((rule) => value(rule.source)),
+        ...(stage.match ?? []).map((rule) => value(rule.source)),
+        ...(stage.requires ?? []).flatMap((rule) => [value(rule.path, rule.root), ...has(rule, "equalsPath") ? [value(rule.equalsPath, rule.root)] : []]),
+        ...(stage.refuse ?? []).map((rule) => ({ path: from(rule.path, rule.root), keep: rule.when === "nonzero" ? "value" : "shape" }))
+    ] : [];
+    const requestReads = [...(match.shape.request ?? []).map((rule) => rule.path), ...stage.bind.filter((rule) => has(rule, "request")).map((rule) => rule.request)];
+    return {
+        ...base,
+        ...requestReads.length ? { requestBody: projectJson(exchange.requestBody, requestReads.map((path) => ({ path, keep: "value" }))) } : {},
+        body: stage.format === "json" ? projectJson(exchange.body, reads) : projectHtml(exchange.body, stage.total)
+    };
+}
+function stageNamed(profile, stageName) {
+    const source = isPlainObject(profile) ? profile.amountSource : void 0;
+    if (stageName === "source")
+        return isPlainObject(source) ? source : void 0;
+    return stageName === "charged" && isPlainObject(source) && isPlainObject(source.afterPayment) ? source.afterPayment : void 0;
+}
+function requestShapeFor(shapes, exchange, origin) {
+    const match = shapeFor(shapes, exchange, origin, { response: false });
+    if (!match || !match.shape.request)
+        return match;
+    const reader = readerFor(exchange, match.shape);
+    return match.shape.request.every((rule) => {
+        const at = reader.readRequest(rule.path);
+        return at.found && at.value === rule.equals;
+    }) ? match : null;
+}
+function stageRequest(stage, stageName, exchange, origin) {
+    if (requestShapeFor(stage.responses, exchange, origin))
+        return true;
+    return stageName === "source" && Array.isArray(stage.voidedBy) && shapeFor(stage.voidedBy, exchange, origin, { response: false }) !== null;
+}
+function stageOriginsBefore(profile, stage, declaredEndpoint) {
+    if (declaredEndpoint !== void 0) {
+        if (stage.origin !== "endpoint")
+            return null;
+        const origin = typeof declaredEndpoint === "string" ? strictUrl(declaredEndpoint)?.origin : void 0;
+        return typeof origin === "string" ? [origin] : [];
+    }
+    const pairs = Array.isArray(profile.origins) ? profile.origins : [];
+    return [...new Set(pairs.map((pair) => isPlainObject(pair) ? stage.origin === "endpoint" ? pair.endpoint : pair.checkout : void 0).filter((origin) => typeof origin === "string"))];
+}
+function merchantAmountRequestStages(profile, request, scope) {
+    if (!isPlainObject(request) || merchantAmountSourceRefusal(profile) !== null)
+        return [];
+    const declaredEndpoint = isPlainObject(scope) ? scope.declaredEndpoint : void 0;
+    return ["source", "charged"].filter((name) => {
+        const stage = stageNamed(profile, name);
+        if (stage === void 0)
+            return false;
+        const origins = stageOriginsBefore(profile, stage, declaredEndpoint);
+        return origins === null ? stageRequest(stage, name, request, null) : origins.some((origin) => stageRequest(stage, name, request, origin));
+    });
+}
+function stageContext(profile, stageName, card) {
+    const stage = stageNamed(profile, stageName);
+    if (!stage)
+        return fail(stageName === "charged" ? "no_reader" : "no_source", `${profile?.merchant ?? "This merchant"}'s profile names no ${stageName === "charged" ? "total after payment" : "source for its own total"}`);
+    const refusal = merchantAmountSourceRefusal(profile);
+    if (refusal)
+        return fail("unreviewed", `${profile.merchant}'s amount source is not a reviewed declaration: ${refusal}`);
+    const ctx = cardContext(profile, card);
+    if (!ctx.ok)
+        return ctx;
+    const origin = stageOrigin(stage, ctx);
+    if (!origin)
+        return fail("invalid", `the checkout page is not named, so ${profile.merchant}'s responses have no one origin`);
+    return { ok: true, stage, origin };
+}
+function merchantExchangePending(profile, stageName, card, request) {
+    const context = stageContext(profile, stageName, card);
+    return context.ok && isPlainObject(request) && stageRequest(context.stage, stageName, request, context.origin);
+}
+function selectMerchantExchanges(profile, stageName, input) {
+    const context = stageContext(profile, stageName, input?.card);
+    if (!context.ok)
+        return context;
+    const list = Array.isArray(input?.responses) ? input.responses : [];
+    const kept = list.filter((exchange) => isPlainObject(exchange) && typeof exchange.completedAt === "number" && stageRequest(context.stage, stageName, exchange, context.origin)).map((exchange) => projectMerchantResponse(profile, stageName, exchange)).filter((exchange) => exchange !== null);
+    return { ok: true, responses: newestMerchantExchanges(kept) };
+}
+// src/merchant-profiles.js
+var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
+    {
+        // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
+        // sends {operationName: 'AdyenPayment', variables: {input: {paymentMethod,
+        // browserInfo, idempotencyKey, amount, order, provisionalOrderId,
+        // shopperInteraction, storePaymentMethod}}, query} through Apollo to the
+        // page config's was.url, https://was.dunelm.com/graphql. The same config
+        // names the client key and environment 'live' (adyen-web 5.31.3). Every other
+        // GraphQL operation shares this endpoint, gift card redemption included, with
+        // its own encrypted fields, so only operationName AdyenPayment is this
+        // profile's card request. Public key read from checkoutshopper-live.adyen.com
+        // on 2026-09-25 (UTC).
+        id: "dunelm_was_graphql",
+        merchant: "Dunelm",
+        status: "observe",
+        origins: [{ checkout: "https://www.dunelm.com", endpoint: "https://was.dunelm.com" }],
+        method: "POST",
+        path: "/graphql",
+        query: {},
+        requires: [{ path: ["operationName"], equals: "AdyenPayment" }],
+        holder: ["variables", "input", "paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web stamps brand from the digits typed into its Card component, the
+        // agent's dummy; Adyen refuses a brand that disagrees with the decrypted card
+        // (422/109) and reads the brand off the card when none is sent.
+        remove: ["brand"],
+        refuse: [
+            { path: ["variables", "input", "storePaymentMethod"], when: "true" },
+            { path: ["variables", "input", "paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["variables", "input", "paymentMethod", "recurringDetailReference"], when: "present" }
+        ],
+        amount: ["variables", "input", "amount"],
+        // Read Sep 25, 2026 (research amount_source/dunelm). The body names an amount only
+        // when the gift_card flag is on and AdyenOrder answered, and then the card's share,
+        // so the total comes from CheckoutView, the provisional order the page shows and
+        // pays: a GraphQL query on the card request's own URL, told apart by operationName.
+        // prices.total is a GraphQL Float in pounds; the response names no currency and
+        // Dunelm sells only in GBP. After payment the card request's own answer carries
+        // transaction.amount (pounds, unit inferred until a HAR).
+        amountSource: {
+            id: "dunelm_checkout_view",
+            origin: "endpoint",
+            format: "json",
+            responses: [{
+                    method: "POST",
+                    path: "/graphql",
+                    query: {},
+                    request: [{ path: ["operationName"], equals: "CheckoutView" }],
+                    at: ["data", "viewer", "checkoutProvisionalOrder"]
+                }],
+            total: { path: ["prices", "total"], format: "number" },
+            unit: "major",
+            currency: "GBP",
+            bind: [{ source: ["provisionalOrderId"], card: ["variables", "input", "provisionalOrderId"] }],
+            // false means nothing is left for the card (a gift card paid it all).
+            requires: [{ path: ["flags", "paymentRequired"], equals: true }],
+            // A GraphQL error result is not a total, even beside partial data.
+            refuse: [{ path: ["errors"], when: "present", root: true }],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "endpoint",
+                format: "json",
+                responses: [{
+                        method: "POST",
+                        path: "/graphql",
+                        query: {},
+                        request: [{ path: ["operationName"], equals: "AdyenPayment" }],
+                        at: ["data", "adyenPayment"]
+                    }],
+                total: { path: ["transaction", "amount"], format: "number" },
+                unit: "major",
+                currency: "GBP",
+                bind: [{ request: ["variables", "input", "provisionalOrderId"], card: ["variables", "input", "provisionalOrderId"] }]
+            }
+        },
+        adyen: {
+            environment: "live",
+            clientKey: "live_3APNTGTFX5FENHWGWUJEKGYSKY7YKURV",
+            publicKeySha256: "0fc63087b90dc0958fc2c024aafca1cd8b6feb34b6f53bb19b1b5649f3e6c316"
+        }
+    },
+    {
+        // Read Sep 23, 2026. www.cinemark.com/scripts/app/adyenIntegration.js posts
+        // state.data plus root amount, store and additionalData, through
+        // JSON.stringify, to /api/adyen/initiatePayment (stored cards go to its
+        // sibling initiateStoredPayment), and maps the environment 'live' to
+        // 'live-us'. A card-free observe run on the guest ticket checkout read the
+        // client key from the three securedFields iframes on
+        // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
+        // was not captured: the guest email gate stopped the run before Pay. Public
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        id: "cinemark_initiate",
+        merchant: "Cinemark",
+        status: "observe",
+        origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
+        method: "POST",
+        path: "/api/adyen/initiatePayment",
+        query: {},
+        requires: [],
+        holder: ["paymentMethod"],
+        fields: {
+            encryptedCardNumber: "encryptedCardNumber",
+            encryptedExpiryMonth: "encryptedExpiryMonth",
+            encryptedExpiryYear: "encryptedExpiryYear",
+            encryptedSecurityCode: "encryptedSecurityCode"
+        },
+        // adyen-web 6.x stamps brand after its bin lookup answers, so a body carries
+        // the dummy's brand on some Pay presses and not others: removed either way.
+        remove: ["brand"],
+        refuse: [
+            { path: ["storePaymentMethod"], when: "true" },
+            { path: ["paymentMethod", "storedPaymentMethodId"], when: "present" },
+            { path: ["paymentMethod", "recurringDetailReference"], when: "present" },
+            // adyenIntegration.js adds additionalData.existingPaymentId only when its
+            // caller passes one to submitCheckout; the guest flow passes none. What it
+            // points at (a stored card, or an earlier payment this one continues) is
+            // unread, so a body that carries one is refused until a card-free capture
+            // shows it.
+            { path: ["additionalData", "existingPaymentId"], when: "present" },
+            // Present only when Cinemark gift cards pay part of the order: the card then pays
+            // only its share, which is not the order's total.
+            { path: ["additionalData", "giftCardAmount"], when: "present" }
+        ],
+        amount: ["amount"],
+        // Read Sep 25, 2026 (research amount_source/cinemark). The body's amount is computed
+        // by the page's script in the agent's browser (total, plus any tip, minus gift
+        // cards); the server renders the total into the checkout HTML, as the hidden input
+        // CartSummary_TotalWithServiceFee (dollars), or the inline var cartTotal when that
+        // input is not there. The page reloads /Checkout after every cart change. The cart
+        // is the session's, so the response is tied to the card request by its page. A
+        // tip makes the body differ from the total and is refused, as the rule for a body
+        // amount beside a source says. After payment, initiatePayment's answer names the
+        // amount (minor units) when Cinemark relays Adyen's response: a HAR confirms it.
+        amountSource: {
+            id: "cinemark_checkout_page_total",
+            origin: "endpoint",
+            format: "html",
+            responses: [
+                { method: "GET", path: "/checkout", query: {} },
+                { method: "GET", path: "/Checkout", query: {} }
+            ],
+            total: { input: "CartSummary_TotalWithServiceFee", scriptVar: "cartTotal", format: "decimal" },
+            unit: "major",
+            currency: "USD",
+            bind: [{ samePage: true }],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "endpoint",
+                format: "json",
+                responses: [
+                    { method: "POST", path: "/api/adyen/initiatePayment", query: {} },
+                    { method: "POST", path: "/api/adyen/submitAdditionalDetails", query: {} }
+                ],
+                total: { path: ["amount", "value"], format: "number" },
+                unit: "minor",
+                currency: "USD",
+                currencyPath: ["amount", "currency"],
+                bind: [{ samePage: true }]
+            }
+        },
+        adyen: {
+            environment: "live-us",
+            clientKey: "live_AFKCBP443ZGQNIY4OCYW3YCKDY6VIKNN",
+            publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
+        }
+    },
+    {
+        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
+        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
+        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
+        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
+        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
+        // transactionReference, customer.device and any giftCardTenders to
+        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
+        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
+        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
+        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
+        // amount: the paygate charges the cart it holds for transactionReference.
+        // mountCCForm names the client key and environment 'live'. Public key read from
+        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+        id: "dsg_paygate_v2",
+        merchant: "Dick's Sporting Goods",
+        status: "observe",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
+            { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
+            { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
+            { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
+        ],
+        method: "POST",
+        path: "/prod/api/paygate/v2/authorization",
+        query: {},
+        // The page sends true for every checkout its translator read, the only checkouts
+        // the amount source below maps; a legacy checkout is not this card request.
+        requires: [{ path: ["isModernOrder"], equals: true }],
+        holder: ["tenders", "encryptedCardTenders", 0],
+        fields: {
+            encryptedCardNumber: "cardNumber",
+            encryptedExpiryMonth: "expirationMonth",
+            encryptedExpiryYear: "expirationYear",
+            encryptedSecurityCode: "cvv"
+        },
+        // cardType and vinBalue describe the dummy the agent typed: the facts below
+        // write the approved card's instead, so nothing is removed.
+        remove: [],
+        refuse: [
+            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+            // A saved card, or a second card tender the Vault never encrypted.
+            { path: ["tenders", "savedCardTender"], when: "present" },
+            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+            // A gift card pays part of the order, so the card pays less than the total.
+            { path: ["tenders", "giftCardTenders"], when: "present" }
+        ],
+        amount: null,
+        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+        // on the checkout page answers the whole checkout, camelCase on the wire: the page
+        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+        // units). transactionReference is the checkout key, in the body and the URL. After
+        // payment the order submit and the confirmation read return the placed checkout.
+        amountSource: {
+            id: "dsg_checkout_pricing",
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "POST", path: "/api/v1/checkouts", query: {} },
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+            ],
+            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            // The order total and the card's share are the same text. Anything that lowers the
+            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+            // the approved amount and the placed checkout's total read after payment agree.
+            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+            refuse: [
+                // A placed checkout is not the one being paid.
+                { path: ["orderPlacedTime"], when: "true" },
+                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+                { path: ["payment", "giftCards"], when: "nonEmpty" },
+                { path: ["addresses"], when: "empty" }
+            ],
+            maxAgeMs: 9e5,
+            afterPayment: {
+                origin: "checkout",
+                format: "json",
+                responses: [
+                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+                ],
+                // The order total, which the requires rule above held equal to the card's share
+                // before payment. totalRemaining is not read here: after placement it can drop to
+                // what is still unpaid, which would hide a higher charge.
+                total: { path: ["pricing", "total"], format: "decimal2" },
+                unit: "major",
+                currency: "USD",
+                currencyPath: ["pricing", "currency"],
+                bind: [
+                    { source: ["checkoutKey"], card: ["transactionReference"] },
+                    { placeholder: "checkoutKey", card: ["transactionReference"] }
+                ],
+                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+            }
+        },
+        facts: [
+            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+            {
+                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+                fact: "brand",
+                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+            },
+            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+        ],
+        adyen: {
+            environment: "live",
+            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+        }
+    }
+]);
+function adyenKeyHost(environment) {
+    return typeof environment === "string" && /^(?:test|live(?:-[a-z]+)?)$/.test(environment) ? `checkoutshopper-${environment}.adyen.com` : null;
+}
+function wireProjection(profiles) {
+    return deepFreeze(profiles.map(({ adyen, ...profile }) => ({
+        ...profile,
+        adyen: { environment: adyen.environment, clientKey: adyen.clientKey, keyHost: adyenKeyHost(adyen.environment) }
+    })));
+}
+function clientProjection(profiles) {
+    return deepFreeze(profiles.map((profile) => ({
+        id: profile.id,
+        merchant: profile.merchant,
+        status: profile.status,
+        origins: profile.origins,
+        method: profile.method,
+        path: profile.path,
+        query: profile.query,
+        ...profile.facts ? { facts: profile.facts } : {},
+        adyen: { ...profile.adyen, keyHost: adyenKeyHost(profile.adyen.environment) }
+    })));
+}
+var MERCHANT_PROFILE_RECOGNIZERS = /* @__PURE__ */ wireProjection(MERCHANT_HOSTED_PROFILES);
+var MERCHANT_PROFILE_CLIENT_TABLE = /* @__PURE__ */ clientProjection(MERCHANT_HOSTED_PROFILES);
+function merchantProfileById(id) {
+    return typeof id === "string" ? MERCHANT_PROFILE_CLIENT_TABLE.find((entry) => entry.id === id) ?? null : null;
+}
+function trustedMerchantProfile(idOrEntry) {
+    const id = typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id;
+    const profile = merchantProfileById(id);
+    if (!profile)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    return profile;
+}
+function merchantProfileRecognizerById(id) {
+    return typeof id === "string" ? MERCHANT_PROFILE_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
+}
+var ADYEN_DOMAINS = ["adyen.com", "adyenpayments.com"];
+var AGENTCARD_DOMAINS = ["agentcard.sh"];
+var IPV4_HOST = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+function underDomain(hostname, domain) {
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+function reviewedDomain(hostname) {
+    const labels = hostname.split(".");
+    return labels.length > 2 ? labels.slice(1).join(".") : hostname;
+}
+function declaredEndpointRefusal(endpoint) {
+    let url;
+    try {
+        url = typeof endpoint === "string" && !endpoint.includes("#") ? new URL(endpoint) : null;
+    }
+    catch {
+        url = null;
+    }
+    if (!url || url.href !== endpoint || url.protocol !== "https:" || url.port || url.username || url.password) {
+        return "the declared endpoint is not an HTTPS URL in its serialized form, with no port, credentials or fragment";
+    }
+    const host = url.hostname.endsWith(".") ? url.hostname.slice(0, -1) : url.hostname;
+    if (!host.includes(".") || host.startsWith("[") || IPV4_HOST.test(host) || underDomain(host, "localhost")) {
+        return `${url.hostname} is not a public domain name, so it cannot be declared`;
+    }
+    if (ADYEN_DOMAINS.some((domain) => underDomain(host, domain)))
+        return `${url.hostname} is a payment processor's host, not a merchant's own endpoint`;
+    if (AGENTCARD_DOMAINS.some((domain) => underDomain(host, domain)))
+        return `${url.hostname} is Agentcard's own host, not a merchant's endpoint`;
+    const reviewed = MERCHANT_PROFILE_CLIENT_TABLE.flatMap((profile) => profile.origins.flatMap((pair) => [pair.checkout, pair.endpoint]));
+    if (reviewed.some((origin) => underDomain(host, reviewedDomain(new URL(origin).hostname))))
+        return `${url.hostname} belongs to a merchant Agentcard reviewed, so it cannot be declared`;
+    return null;
+}
+function sameKeyIgnoringCase(key, step) {
+    return !FORBIDDEN_KEYS.has(key) && (key.toLowerCase() === step.toLowerCase() || key.toUpperCase() === step.toUpperCase());
+}
+function valuesIgnoringCase(root, path) {
+    let nodes = [root];
+    for (const step of path) {
+        const next = [];
+        for (const node of nodes) {
+            if (typeof step === "number") {
+                if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
+                    next.push(node[step]);
+            }
+            else if (isPlainObject(node)) {
+                for (const key of Object.keys(node))
+                    if (sameKeyIgnoringCase(key, step))
+                        next.push(node[key]);
+            }
+        }
+        nodes = next;
+    }
+    return nodes;
+}
+function merchantBodyRefusal(profile, body) {
+    const p = merchantProfileRecognizerById(typeof profile === "string" ? profile : profile?.id);
+    if (!p)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    let parsed;
+    try {
+        parsed = typeof body === "string" ? JSON.parse(body) : void 0;
+    }
+    catch {
+        return "the paused body is not JSON";
+    }
+    if (!isPlainObject(parsed))
+        return "the paused body is not a JSON object";
+    if (!roundTrips(parsed, body))
+        return "the paused body does not round-trip through JSON, so its rules cannot be read";
+    for (const rule of p.requires) {
+        const at = jsonAt(parsed, rule.path);
+        if (!at.found || at.value !== rule.equals || valuesIgnoringCase(parsed, rule.path).some((value) => value !== rule.equals)) {
+            return `the paused body is not ${p.merchant}'s card request: ${describePath(rule.path)} is not ${JSON.stringify(rule.equals)}`;
+        }
+    }
+    for (const rule of p.refuse) {
+        const values = valuesIgnoringCase(parsed, rule.path);
+        const fires2 = rule.when === "true" ? values.some((value) => value !== false && value !== null) : values.length > 0;
+        if (fires2)
+            return `the paused body asks ${p.merchant} for more than this purchase: ${describePath(rule.path)}`;
+    }
+    return null;
+}
+// src/adyen-jwe.js
+var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+function isAdyenJweCompact(s) {
+    if (typeof s !== "string" || s.length > 2048)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5)
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (!parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    if (encryptedKey.length !== 342 || iv.length !== 16 || tag.length !== 22)
+        return false;
+    if (ciphertext.length > 1024)
+        return false;
+    return isAdyenJweHeader(header);
+}
+function isAdyenJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > 128)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const obj = parsed;
+    const keys = Object.keys(obj).sort();
+    if (keys.join(",") !== "alg,enc,version")
+        return false;
+    return obj.alg === ADYEN_JWE_HEADER.alg && obj.enc === ADYEN_JWE_HEADER.enc && obj.version === ADYEN_JWE_HEADER.version;
+}
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/adyen-merchant-hosted.js
+function matchProfileEndpoint(profile, rawUrl, method, opts) {
+    const p = trustedMerchantProfile(profile);
+    if (typeof rawUrl !== "string" || typeof method !== "string" || method.toUpperCase() !== p.method)
+        return false;
+    const match = urlTemplateMatch({ path: p.path, query: p.query }, rawUrl);
+    if (!match)
+        return false;
+    const checkoutOrigin = opts?.checkoutOrigin;
+    return p.origins.some((pair) => pair.endpoint === match.origin && (checkoutOrigin === void 0 || pair.checkout === checkoutOrigin));
+}
+function reviewedProfileFor(profile) {
+    const id = trustedMerchantProfile(profile).id;
+    return MERCHANT_PROFILE_RECOGNIZERS.find((entry) => entry.id === id);
+}
+function merchantAmountFromResponses(profile, input) {
+    return readMerchantAmount(reviewedProfileFor(profile), input);
+}
+function merchantChargedFromResponses(profile, input) {
+    return readMerchantCharged(reviewedProfileFor(profile), input);
+}
+function merchantAmountStagesOf(profile, request, scope) {
+    return merchantAmountRequestStages(reviewedProfileFor(profile), request, scope);
+}
+function merchantAmountPending(profile, stage, card, request) {
+    return merchantExchangePending(reviewedProfileFor(profile), stage, card, request);
+}
+function merchantAmountExchanges(profile, stage, input) {
+    return selectMerchantExchanges(reviewedProfileFor(profile), stage, input);
+}
+// src/merchant-hosted-request.js
+function merchantTotalFromResponses(profileId, input) {
+    const read = merchantAmountFromResponses(profileId, input);
+    return read.ok ? { ...read, amount: { amount: read.amount.amountCents, currency: read.amount.currency } } : read;
+}
+function reviewedProfile(profileId) {
+    const profile = merchantProfileRecognizerById(profileId);
+    if (!profile)
+        throw new Error("Refusing to pay: unknown merchant profile.");
+    return profile;
+}
+function merchantProfileUrlRelation(profileId, rawUrl) {
+    const profile = reviewedProfile(profileId);
+    if (typeof rawUrl !== "string")
+        return null;
+    if (matchProfileEndpoint(profile.id, rawUrl, profile.method))
+        return "endpoint";
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.port || url.username || url.password)
+        return null;
+    if (!profile.origins.some((pair) => pair.endpoint === url.origin))
+        return null;
+    return pathMatchesTemplate(profile.path, url.pathname) ? "sibling" : null;
+}
+var JWE_AT = /ey[A-Za-z0-9_-]{1,126}\.[A-Za-z0-9_-]{342}\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{1,1024}\.[A-Za-z0-9_-]{22}/y;
+var LEGACY_BLOB = /adyenjs_0_1_\d{1,4}(?:\$|%24)/i;
+function textCarriesCiphertext(text) {
+    if (LEGACY_BLOB.test(text))
+        return true;
+    for (let at = text.indexOf("ey"); at !== -1; at = text.indexOf("ey", at + 1)) {
+        JWE_AT.lastIndex = at;
+        const match = JWE_AT.exec(text);
+        if (match && isAdyenJweCompact(match[0]))
+            return true;
+    }
+    return false;
+}
+function jsonStrings(root, out) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const value = stack.pop();
+        if (typeof value === "string")
+            out.push(value);
+        else if (Array.isArray(value))
+            for (const item of value)
+                stack.push(item);
+        else if (value !== null && typeof value === "object") {
+            for (const [key, child] of Object.entries(value)) {
+                out.push(key);
+                stack.push(child);
+            }
+        }
+    }
+}
+function decodedTexts(text) {
+    let parsed;
+    if (/^\s*[[{"]/.test(text)) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = void 0;
+        }
+    }
+    const out = [];
+    if (parsed !== void 0)
+        jsonStrings(parsed, out);
+    else if (/[%+]/.test(text)) {
+        for (const [name, value] of new URLSearchParams(text))
+            out.push(name, value);
+    }
+    return out.filter((decoded) => decoded !== text);
+}
+var DECODE_DEPTH = 6;
+function carriesAt(text, depth) {
+    if (textCarriesCiphertext(text))
+        return true;
+    const decoded = decodedTexts(text);
+    if (decoded.length === 0)
+        return false;
+    if (depth >= DECODE_DEPTH)
+        return true;
+    return decoded.some((inner) => carriesAt(inner, depth + 1));
+}
+function carriesAdyenCardCiphertext(body) {
+    if (typeof body !== "string" || body === "")
+        return false;
+    return carriesAt(body, 0);
+}
+var PASS = /* @__PURE__ */ Object.freeze({ verdict: "pass" });
+var PAUSE = /* @__PURE__ */ Object.freeze({ verdict: "pause" });
+var abort = (reason) => Object.freeze({ verdict: "abort", reason });
+function holderRefusal(profile, parsed) {
+    const holder = jsonAt(parsed, profile.holder);
+    if (!holder.found || !isPlainObject(holder.value)) {
+        return `the paused body carries no card object where ${profile.merchant}'s card request holds it`;
+    }
+    const values = Object.values(profile.fields).map((name) => Object.prototype.hasOwnProperty.call(holder.value, name) ? holder.value[name] : void 0);
+    if (!values.every((value) => typeof value === "string" && isAdyenJweCompact(value))) {
+        return `the paused body does not carry the four encrypted card fields ${profile.merchant}'s card request holds a new card in`;
+    }
+    if (new Set(values).size !== values.length)
+        return "two encrypted card fields in the paused body are the same";
+    const type = holder.value.type;
+    if (type !== void 0 && type !== "scheme")
+        return "the paused body pays with something other than a card";
+    return null;
+}
+function amountRefusal(profile, parsed) {
+    const priced = isPlainObject(profile.amountSource);
+    if (!Array.isArray(profile.amount)) {
+        return priced ? null : `${profile.merchant}'s card request names no amount, so it cannot be checked against the amount the cardholder approves`;
+    }
+    const at = jsonAt(parsed, profile.amount);
+    if (!at.found) {
+        return priced ? null : `the paused body names no amount where ${profile.merchant}'s card request holds it, so it cannot be checked against the amount the cardholder approves`;
+    }
+    const amount = at.value;
+    const value = isPlainObject(amount) ? amount.value : void 0;
+    const currency = isPlainObject(amount) ? amount.currency : void 0;
+    const valueOk = typeof value === "number" ? Number.isSafeInteger(value) && value >= 0 : typeof value === "string" && /^\d{1,15}$/.test(value.trim());
+    const currencyOk = typeof currency === "string" && /^[A-Za-z]{3}$/.test(currency.trim());
+    return valueOk && currencyOk ? null : `the amount where ${profile.merchant}'s card request holds it is not the {value, currency} Agentcard reviewed, so it cannot be checked`;
+}
+function classifyMerchantBody(profileId, body) {
+    const profile = reviewedProfile(profileId);
+    if (!carriesAdyenCardCiphertext(body))
+        return PASS;
+    const refusal = merchantBodyRefusal(profile.id, body);
+    if (refusal)
+        return abort(refusal);
+    const parsed = JSON.parse(body);
+    const card = holderRefusal(profile, parsed) ?? amountRefusal(profile, parsed);
+    return card ? abort(card) : PAUSE;
+}
+function classifyMerchantRequest(profileId, rawUrl, method, body) {
+    const profile = reviewedProfile(profileId);
+    const relation = merchantProfileUrlRelation(profile.id, rawUrl);
+    if (!relation || !carriesAdyenCardCiphertext(body))
+        return PASS;
+    if (relation === "sibling") {
+        return abort(`the paused request sends a card to ${profile.merchant} somewhere other than the card request Agentcard reviewed`);
+    }
+    if (typeof method !== "string" || method.toUpperCase() !== profile.method) {
+        return abort(`the paused request sends a card to ${profile.merchant} as ${String(method).toUpperCase()}, not as the ${profile.method} Agentcard reviewed`);
+    }
+    return classifyMerchantBody(profile.id, body);
+}
+function declaredUrlRelation(endpoint, rawUrl) {
+    if (typeof endpoint !== "string" || typeof rawUrl !== "string")
+        return null;
+    if (rawUrl === endpoint)
+        return "endpoint";
+    let want;
+    let got;
+    try {
+        want = new URL(endpoint);
+        got = new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+    return got.origin === want.origin && got.pathname === want.pathname ? "sibling" : null;
+}
+function classifyDeclaredMerchantRequest(profileId, endpoint, rawUrl, method, body) {
+    const profile = reviewedProfile(profileId);
+    const relation = declaredUrlRelation(endpoint, rawUrl);
+    if (!relation || !carriesAdyenCardCiphertext(body))
+        return PASS;
+    if (relation === "sibling")
+        return abort("the paused request sends a card somewhere other than the endpoint this test checkout declared");
+    if (typeof method !== "string" || method.toUpperCase() !== profile.method) {
+        return abort(`the paused request sends a card as ${String(method).toUpperCase()}, not as the ${profile.method} the declared checkout takes`);
+    }
+    return classifyMerchantBody(profile.id, body);
+}
+function declaredTemplatedUrl(endpoint) {
+    const url = new URL(endpoint);
+    return `${url.origin}${url.pathname}`;
+}
+function merchantProfileTemplatedUrl(profileId, rawUrl) {
+    const profile = reviewedProfile(profileId);
+    let origin = null;
+    try {
+        origin = new URL(rawUrl).origin;
+    }
+    catch {
+        origin = null;
+    }
+    const pair = profile.origins.find((candidate) => candidate.endpoint === origin) ?? profile.origins[0];
+    const query = Object.entries(profile.query).map(([key, value]) => `${key}=${value}`).join("&");
+    return `${pair.endpoint}${profile.path}${query ? `?${query}` : ""}`;
+}
+function keyPaths(root, out) {
+    const stack = [[root, ""]];
+    while (stack.length > 0) {
+        const [value, prefix] = stack.pop();
+        if (Array.isArray(value)) {
+            for (const item of value)
+                stack.push([item, `${prefix}[]`]);
+        }
+        else if (value === null || typeof value !== "object") {
+            if (prefix)
+                out.add(prefix);
+        }
+        else {
+            for (const [key, child] of Object.entries(value))
+                stack.push([child, prefix ? `${prefix}.${key}` : key]);
+        }
+    }
+}
+function merchantBodyKeyPathSha256(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    const paths = /* @__PURE__ */ new Set();
+    keyPaths(parsed, paths);
+    return sha256Hex([...paths].sort().join("\n"));
+}
+var globEscape = (text) => text.replace(/[*?\\]/g, (char) => `\\${char}`);
+function merchantProfileUrlGlobs(profileId) {
+    const profile = reviewedProfile(profileId);
+    const path = profile.path.split("/").map((segment) => segment.startsWith(":") ? "*" : globEscape(segment)).join("/");
+    return [...new Set(profile.origins.map((pair) => `${pair.endpoint}${path}*`))];
+}
+function declaredUrlGlobs(endpoint) {
+    const url = new URL(endpoint);
+    return [`${url.origin}${globEscape(url.pathname)}*`];
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (isPlainObject(value)) {
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+function merchantProfileRulesMatch(profileId, served) {
+    const profile = reviewedProfile(profileId);
+    if (!isPlainObject(served) || served.id !== profile.id)
+        return false;
+    const { status: _built, ...built } = profile;
+    const { status: _served, ...copy } = served;
+    try {
+        return canonical(copy) === canonical(built);
+    }
+    catch {
+        return false;
+    }
+}
+function merchantProfileEnvironment(profileId) {
+    return reviewedProfile(profileId).adyen.environment === "test" ? "sandbox" : "production";
+}
+function merchantProfileEndpointFor(profileId, checkoutOrigin) {
+    const profile = reviewedProfile(profileId);
+    const pair = profile.origins.find((candidate) => candidate.checkout === checkoutOrigin);
+    if (!pair || profile.path.split("/").some((segment) => segment.startsWith(":")))
+        return null;
+    const query = Object.entries(profile.query).map(([key, value]) => `${key}=${value}`).join("&");
+    return `${pair.endpoint}${profile.path}${query ? `?${query}` : ""}`;
+}
+export { MERCHANT_EXCHANGES_MAX, MERCHANT_PROFILE_RECOGNIZERS, carriesAdyenCardCiphertext, classifyDeclaredMerchantRequest, classifyMerchantBody, classifyMerchantRequest, declaredEndpointRefusal, declaredTemplatedUrl, declaredUrlGlobs, declaredUrlRelation, merchantAmountExchanges, merchantAmountFromResponses, merchantAmountPending, merchantAmountStagesOf, merchantBodyKeyPathSha256, merchantChargedFromResponses, merchantProfileEndpointFor, merchantProfileEnvironment, merchantProfileRulesMatch, merchantProfileTemplatedUrl, merchantProfileUrlGlobs, merchantProfileUrlRelation, merchantTotalFromResponses, sha256Hex };