@agent-cards/checkout 0.19.0 → 0.21.0

package/dist/fiserv.generated.js

@@ -1,830 +0,0 @@
-// @ts-nocheck
-// Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: abb8663c9be443f4f09ced0b06df7e3997cfbc7cae7bea1a1c341af1cea93524
-// src/fiserv-environment.js
-var FISERV_CARD_CAPTURE_ENDPOINTS = /* @__PURE__ */ Object.freeze({
-    production: "https://connect.fiservapis.com/ch/payments-vas/v1/card-capture",
-    sandbox: "https://connect-cert.fiservapis.com/ch/payments-vas/v1/card-capture"
-});
-function fiservEnvironment(url) {
-    if (url === FISERV_CARD_CAPTURE_ENDPOINTS.production)
-        return "production";
-    if (url === FISERV_CARD_CAPTURE_ENDPOINTS.sandbox)
-        return "sandbox";
-    return void 0;
-}
-function isFiservCardCaptureUrl(url) {
-    return fiservEnvironment(url) !== void 0;
-}
-var FISERV_SIMULATOR_PANS = /* @__PURE__ */ Object.freeze([
-    // Approval: any total under 5,000.
-    "4012001928706700",
-    "5500007287297385",
-    "341111227713933",
-    "6011114305944707",
-    // Security code responses.
-    "4012001472472642",
-    "5500008286090219",
-    "341111880552552",
-    "6011111273436666",
-    // Address verification responses.
-    "4012008565774776",
-    "5500002389250960",
-    "341111565369561",
-    "6011116171399338"
-]);
-// src/fiserv-envelope.js
-var KEY_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-var BASE64_VALUE = /* @__PURE__ */ (() => {
-    const table = /* @__PURE__ */ new Map();
-    for (let i = 0; i < BASE64_ALPHABET.length; i++)
-        table.set(BASE64_ALPHABET[i], i);
-    return table;
-})();
-var FISERV_ENVELOPE_CONSTANTS = Object.freeze({ aesTagLength: 128, encryptionType: "AES-GCM", encryptionTarget: "MANUAL" });
-function encodeBase64(bytes) {
-    let out = "";
-    for (let i = 0; i < bytes.length; i += 3) {
-        const a = bytes[i], b = i + 1 < bytes.length ? bytes[i + 1] : 0, c = i + 2 < bytes.length ? bytes[i + 2] : 0;
-        const triple = a << 16 | b << 8 | c;
-        out += BASE64_ALPHABET[triple >> 18 & 63] + BASE64_ALPHABET[triple >> 12 & 63] + (i + 1 < bytes.length ? BASE64_ALPHABET[triple >> 6 & 63] : "=") + (i + 2 < bytes.length ? BASE64_ALPHABET[triple & 63] : "=");
-    }
-    return out;
-}
-function decodeBase64(text2) {
-    if (typeof text2 !== "string" || text2.length === 0 || text2.length % 4 !== 0 || text2.length > 65536)
-        return null;
-    const padding = text2.endsWith("==") ? 2 : text2.endsWith("=") ? 1 : 0;
-    const body = text2.length - padding;
-    const out = new Uint8Array(text2.length / 4 * 3 - padding);
-    let at = 0;
-    for (let i = 0; i < text2.length; i += 4) {
-        const quad = [0, 0, 0, 0];
-        for (let j = 0; j < 4; j++) {
-            const index = i + j;
-            if (index >= body) {
-                quad[j] = 0;
-                continue;
-            }
-            const value = BASE64_VALUE.get(text2[index]);
-            if (value === void 0)
-                return null;
-            quad[j] = value;
-        }
-        const triple = quad[0] << 18 | quad[1] << 12 | quad[2] << 6 | quad[3];
-        if (at < out.length)
-            out[at++] = triple >> 16 & 255;
-        if (at < out.length)
-            out[at++] = triple >> 8 & 255;
-        if (at < out.length)
-            out[at++] = triple & 255;
-    }
-    return encodeBase64(out) === text2 ? out : null;
-}
-var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
-function fiservCaptureSource(card) {
-    const number = card && (typeof card.number === "string" || typeof card.number === "number") ? String(card.number).replace(/[ -]/g, "") : "";
-    const month = card && (typeof card.month === "string" || typeof card.month === "number") ? String(card.month) : "";
-    const year = card && (typeof card.year === "string" || typeof card.year === "number") ? String(card.year) : "";
-    const cvc = card && (typeof card.cvc === "string" || typeof card.cvc === "number") ? String(card.cvc) : "";
-    if (!digits(number, 12, 19) || !digits(month, 1, 2) || Number(month) < 1 || Number(month) > 12 || !(digits(year, 2, 2) || digits(year, 4, 4)) || !digits(cvc, 3, 4)) {
-        throw new Error("Could not fill the card fields for Fiserv. Nothing was sent.");
-    }
-    return {
-        sourceType: "PaymentCard",
-        card: {
-            cardData: number,
-            expirationMonth: month.padStart(2, "0"),
-            expirationYear: year.length === 2 ? "20" + year : year,
-            securityCode: cvc
-        }
-    };
-}
-function aesKeyBytes(crypto) {
-    const key = new Uint8Array(32);
-    const pool = new Uint8Array(64);
-    let filled = 0;
-    while (filled < key.length) {
-        crypto.getRandomValues(pool);
-        for (let i = 0; i < pool.length && filled < key.length; i++) {
-            if (pool[i] < 248)
-                key[filled++] = KEY_ALPHABET.charCodeAt(pool[i] % 62);
-        }
-    }
-    pool.fill(0);
-    return key;
-}
-var isBytes = (value) => Object.prototype.toString.call(value) === "[object Uint8Array]";
-function isExponent65537(exponent) {
-    return isBytes(exponent) && exponent.length === 3 && exponent[0] === 1 && exponent[1] === 0 && exponent[2] === 1;
-}
-async function sealFiservEnvelope(keyId, spki, source, crypto) {
-    if (typeof keyId !== "string" || !keyId)
-        throw new Error("Refusing to encrypt: the Fiserv key has no id.");
-    if (!isBytes(spki))
-        throw new Error("Refusing to encrypt: the Fiserv key is malformed.");
-    if (!crypto?.subtle || typeof crypto.getRandomValues !== "function")
-        throw new Error("Processor cryptography is unavailable.");
-    let rsa;
-    try {
-        rsa = await crypto.subtle.importKey("spki", spki, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
-    }
-    catch {
-        throw new Error("Refusing to encrypt: the Fiserv key is malformed.");
-    }
-    const algorithm = (
-    /** @type {RsaHashedKeyAlgorithm} */
-    rsa.algorithm);
-    if (algorithm.modulusLength !== 2048 || !isExponent65537(algorithm.publicExponent)) {
-        throw new Error("Refusing to encrypt: unexpected Fiserv key size.");
-    }
-    const keyBytes = aesKeyBytes(crypto);
-    const plaintext = new TextEncoder().encode(JSON.stringify(source));
-    try {
-        const encryptedKey = new Uint8Array(await crypto.subtle.encrypt({ name: "RSA-OAEP" }, rsa, keyBytes));
-        const aes = await crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["encrypt"]);
-        keyBytes.fill(0);
-        const iv = crypto.getRandomValues(new Uint8Array(12));
-        const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, tagLength: 128 }, aes, plaintext));
-        return {
-            keyId,
-            encryptedKey: encodeBase64(encryptedKey),
-            encryptionBlock: encodeBase64(sealed),
-            aesIv: encodeBase64(iv),
-            aesTagLength: FISERV_ENVELOPE_CONSTANTS.aesTagLength,
-            encryptionType: FISERV_ENVELOPE_CONSTANTS.encryptionType,
-            encryptionTarget: FISERV_ENVELOPE_CONSTANTS.encryptionTarget
-        };
-    }
-    finally {
-        keyBytes.fill(0);
-        plaintext.fill(0);
-    }
-}
-// src/deep-freeze.js
-function deepFreeze(value) {
-    if (value && typeof value === "object" && !Object.isFrozen(value)) {
-        for (const child of Object.values(value))
-            deepFreeze(child);
-        Object.freeze(value);
-    }
-    return value;
-}
-// src/sha256.js
-var K = /* @__PURE__ */ new Uint32Array([
-    1116352408,
-    1899447441,
-    3049323471,
-    3921009573,
-    961987163,
-    1508970993,
-    2453635748,
-    2870763221,
-    3624381080,
-    310598401,
-    607225278,
-    1426881987,
-    1925078388,
-    2162078206,
-    2614888103,
-    3248222580,
-    3835390401,
-    4022224774,
-    264347078,
-    604807628,
-    770255983,
-    1249150122,
-    1555081692,
-    1996064986,
-    2554220882,
-    2821834349,
-    2952996808,
-    3210313671,
-    3336571891,
-    3584528711,
-    113926993,
-    338241895,
-    666307205,
-    773529912,
-    1294757372,
-    1396182291,
-    1695183700,
-    1986661051,
-    2177026350,
-    2456956037,
-    2730485921,
-    2820302411,
-    3259730800,
-    3345764771,
-    3516065817,
-    3600352804,
-    4094571909,
-    275423344,
-    430227734,
-    506948616,
-    659060556,
-    883997877,
-    958139571,
-    1322822218,
-    1537002063,
-    1747873779,
-    1955562222,
-    2024104815,
-    2227730452,
-    2361852424,
-    2428436474,
-    2756734187,
-    3204031479,
-    3329325298
-]);
-var rotr = (x, n) => x >>> n | x << 32 - n;
-function utf8(text2) {
-    const out = [];
-    for (const char of text2) {
-        let cp = char.codePointAt(0);
-        if (cp >= 55296 && cp <= 57343)
-            cp = 65533;
-        if (cp < 128)
-            out.push(cp);
-        else if (cp < 2048)
-            out.push(192 | cp >> 6, 128 | cp & 63);
-        else if (cp < 65536)
-            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
-        else
-            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
-    }
-    return Uint8Array.from(out);
-}
-function sha256Hex(input) {
-    const isBytes2 = Object.prototype.toString.call(input) === "[object Uint8Array]";
-    if (typeof input !== "string" && !isBytes2)
-        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
-    const bytes = typeof input === "string" ? utf8(input) : input;
-    const length = bytes.length;
-    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
-    padded.set(bytes);
-    padded[length] = 128;
-    const view = new DataView(padded.buffer);
-    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
-    view.setUint32(padded.length - 4, length << 3 >>> 0);
-    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
-    const W = new Uint32Array(64);
-    for (let offset = 0; offset < padded.length; offset += 64) {
-        for (let t = 0; t < 16; t++)
-            W[t] = view.getUint32(offset + t * 4);
-        for (let t = 16; t < 64; t++) {
-            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
-            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
-            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
-        }
-        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
-        for (let t = 0; t < 64; t++) {
-            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
-            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
-            h = g;
-            g = f;
-            f = e;
-            e = d + t1 >>> 0;
-            d = c;
-            c = b;
-            b = a;
-            a = t1 + t2 >>> 0;
-        }
-        H[0] += a;
-        H[1] += b;
-        H[2] += c;
-        H[3] += d;
-        H[4] += e;
-        H[5] += f;
-        H[6] += g;
-        H[7] += h;
-    }
-    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
-}
-// src/fiserv-keys.js
-var ISO_UTC = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?Z$/;
-function fiservTimestampMs(text2) {
-    const match = typeof text2 === "string" ? ISO_UTC.exec(text2) : null;
-    if (!match || match[0] !== text2)
-        return NaN;
-    const [year, month, day, hour, minute, second] = match.slice(1, 7).map(Number);
-    const millis = Number(`${match[7] ?? ""}000`.slice(0, 3));
-    const value = Date.UTC(year, month - 1, day, hour, minute, second, millis);
-    const date = new Date(value);
-    return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day && hour <= 23 && minute <= 59 && second <= 59 ? value : NaN;
-}
-var pin = (entry) => ({ ...entry, validFromMs: fiservTimestampMs(entry.validFrom), validToMs: fiservTimestampMs(entry.validTo) });
-var FISERV_KEY_PINS = /* @__PURE__ */ deepFreeze([
-    pin({
-        id: "homedepot_orangepay",
-        merchant: "Home Depot",
-        environment: "production",
-        // Empty until a card-free dry run records the merchantId Home Depot's
-        // capture carries, so this key encrypts no card yet. env.js names
-        // merchantId TZOPBKED, but that is what OrangePay sends its own authenticate
-        // call and may not be the Commerce Hub id in the capture body, and the
-        // payment step has never been observed.
-        merchantIds: [],
-        keyId: "d51d5faeb0261f664c99aac27cd131db",
-        spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArobUom7fqw1aWE03z0OFQhnwzXPmh/rw0GxxEEdDsV07ysH/xtEAggNO46sWeWh8UEBat/mleL6wart8XEDkP1z67mSBhvu9Y3MqrbTMilxkb7NxdsMW26ukYx7Q9QGq+llTuapwBhLeU3uVsu0keUcs1kqc32fisCMv6hd7Nvh9niVp6dxPpqWnlmrB3PqQI/Y9wIOKlLtQ8n/1b5V3UJUjEXgJlDBzBn13ATj3vrl2aJxey6A99DL75md8RBF/rd2x/OxPKHkqWQWbRIgd++dtjxLVUYe5vRnq8OtqvrWdY0SCRoG61PgHqIPvoaokovJNi8utp95WuCww5jX8MQIDAQAB",
-        spkiSha256: "49c3ac40078bfb4d5a08ebf1f6009d0b4b25b9cac58a4046fe64f1fa917a0e84",
-        validFrom: "2025-12-20T09:00:00.980742211Z",
-        validTo: "2027-12-20T09:00:00.980742211Z",
-        status: "ACTIVE",
-        published: "https://orangepay-ecommerce.hdpayments.homedepot.com/rsaKey.js"
-    }),
-    pin({
-        id: "agentcard_sandbox",
-        merchant: "Agentcard sandbox",
-        environment: "sandbox",
-        // The sandbox merchant the key was generated under, which every Wave 0
-        // capture named.
-        merchantIds: ["100008000003683"],
-        keyId: "77eba5e58f007456ce2c35527bec2877",
-        spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqbsaa0wpsHUuNIAr5LVYAbID77PB4d0qYnaIsTFGa0JZMIj/egbfdkl4DCaEhV3dzRDMivr+EB5643Xut00lT+SoPonc0Hps+Z5ejcVIZrtIvx/kSxJEqYK70HZHxJewh6P5qFUb+2ZPLSWQQpMqNMpDQhlISt3XtnO1JWmTvCUrjs4PKyVbexIq7+Di36HzwAnatSRP+mfgBnRsXnFmF/oOZKijsCYswqfomIom8eb9kpU1mVuSCPXmxivPOXPdFARFGd23PhdHpLhx0E7OIXpm2xEDmizeit56KVrP4PUHT08tZ4x26cSj7Po1oFpJ4XtsjSrXxmJCdE/LQFIZUwIDAQAB",
-        spkiSha256: "7a62942573e251eeffa856ce6f307d8684aad39eec43e9eb48badb450619296a",
-        validFrom: "2026-09-25T22:33:01.658638461Z",
-        validTo: "2026-12-24T22:33:01.658638461Z",
-        status: "ACTIVE",
-        published: null
-    })
-]);
-function fiservKeyPin(keyId, environment) {
-    if (typeof keyId !== "string" || environment !== "production" && environment !== "sandbox")
-        return null;
-    return FISERV_KEY_PINS.find((entry) => entry.keyId === keyId && entry.environment === environment) ?? null;
-}
-function isFiservPinnedKeyId(keyId) {
-    return typeof keyId === "string" && FISERV_KEY_PINS.some((entry) => entry.keyId === keyId);
-}
-function fiservKeyRefusal(keyId, environment, nowMs) {
-    const entry = fiservKeyPin(keyId, environment);
-    if (!entry)
-        return "fiserv_key_unpinned";
-    if (entry.status !== "ACTIVE")
-        return "fiserv_key_inactive";
-    if (!Number.isSafeInteger(nowMs) || nowMs < entry.validFromMs || nowMs >= entry.validToMs)
-        return "fiserv_key_outside_validity";
-    return null;
-}
-function fiservPinServesMerchant(entry, merchantId) {
-    return !!entry && Array.isArray(entry.merchantIds) && typeof merchantId === "string" && entry.merchantIds.includes(merchantId);
-}
-function pinnedSpki(entry) {
-    const der = entry && typeof entry.spki === "string" ? decodeBase64(entry.spki) : null;
-    return der && sha256Hex(der) === entry.spkiSha256 ? der : null;
-}
-var PUBLISHED_SCRIPT = /^const rsaKey = (\{[\s\S]{1,4096}\});\s*window\.rsaKey = rsaKey;\s*$/;
-var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
-function parseFiservPublishedKey(text2) {
-    if (typeof text2 !== "string" || text2.length > 8192)
-        return null;
-    const script = PUBLISHED_SCRIPT.exec(text2);
-    let value;
-    try {
-        value = JSON.parse(script ? script[1] : text2);
-    }
-    catch {
-        return null;
-    }
-    const key = record(value) ? value.asymmetricKeyDetails : null;
-    const symmetric = record(value) ? value.symmetricKeyDetails : null;
-    if (!record(key) || !record(symmetric))
-        return null;
-    for (const name of ["keyId", "encryptionType", "encodedPublicKey", "validFrom", "validTo", "status"]) {
-        if (!own(key, name) || typeof key[name] !== "string")
-            return null;
-    }
-    return {
-        keyId: key.keyId,
-        encryptionType: key.encryptionType,
-        modulus: key.modulus,
-        encodedPublicKey: key.encodedPublicKey,
-        validFrom: key.validFrom,
-        validTo: key.validTo,
-        status: key.status,
-        symmetric: { encryptionType: symmetric.encryptionType, modulus: symmetric.modulus }
-    };
-}
-function fiservPublishedKeyRefusal(text2, keyId, environment, nowMs) {
-    const entry = fiservKeyPin(keyId, environment);
-    if (!entry)
-        return "fiserv_key_unpinned";
-    const published = parseFiservPublishedKey(text2);
-    if (!published)
-        return "fiserv_published_key_unreadable";
-    if (published.keyId !== entry.keyId)
-        return "fiserv_published_key_rotated";
-    const der = decodeBase64(published.encodedPublicKey);
-    if (!der || sha256Hex(der) !== entry.spkiSha256)
-        return "fiserv_published_key_mismatch";
-    if (published.encryptionType !== "RSA" || published.modulus !== 2048 || published.symmetric.encryptionType !== "AES-GCM" || published.symmetric.modulus !== 256)
-        return "fiserv_published_key_mismatch";
-    if (published.status !== "ACTIVE")
-        return "fiserv_key_inactive";
-    if (published.validFrom !== entry.validFrom || published.validTo !== entry.validTo)
-        return "fiserv_published_key_mismatch";
-    return fiservKeyRefusal(keyId, environment, nowMs);
-}
-// src/json-path.js
-function isPlainObject(v) {
-    return !!v && typeof v === "object" && !Array.isArray(v);
-}
-function roundTrips(parsed, body) {
-    try {
-        return JSON.stringify(parsed) === body;
-    }
-    catch {
-        return false;
-    }
-}
-// src/fiserv-response.js
-var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
-var own2 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var ENUM = /^[A-Z][A-Z_]{0,31}$/;
-var PROCESSING_IDS = Object.freeze({
-    transactionTimestamp: /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/,
-    apiTraceId: /^[A-Za-z0-9-]{1,64}$/,
-    clientRequestId: /^[A-Za-z0-9-]{1,64}$/,
-    transactionId: /^[A-Za-z0-9-]{1,64}$/
-});
-function readObject(text2) {
-    if (typeof text2 !== "string" || text2.length > 65536)
-        return null;
-    try {
-        const value = JSON.parse(text2);
-        return isPlainObject(value) ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
-function sanitizeFiservCaptureResponse(text2) {
-    const value = readObject(text2);
-    const gateway = value && isPlainObject(value.gatewayResponse) ? value.gatewayResponse : null;
-    if (!gateway || gateway.transactionType !== "CARD_CAPTURE" || gateway.transactionState !== "CAPTURED") {
-        throw new Error("Invalid Fiserv card-capture response.");
-    }
-    const safe = { transactionType: "CARD_CAPTURE", transactionState: "CAPTURED" };
-    if (exact(ENUM, gateway.transactionOrigin))
-        safe.transactionOrigin = gateway.transactionOrigin;
-    const details = gateway.transactionProcessingDetails;
-    if (isPlainObject(details)) {
-        const ids = {};
-        for (const [name, pattern] of Object.entries(PROCESSING_IDS))
-            if (exact(pattern, details[name]))
-                ids[name] = details[name];
-        if (Object.keys(ids).length)
-            safe.transactionProcessingDetails = ids;
-    }
-    return JSON.stringify({ gatewayResponse: safe });
-}
-function fiservCaptureCardMismatch(text2, card) {
-    const value = readObject(text2);
-    const reported = value && isPlainObject(value.source) && isPlainObject(value.source.card) ? value.source.card : null;
-    if (!reported)
-        return false;
-    const number = String(card?.number ?? "").replace(/[ -]/g, "");
-    if (own2(reported, "last4") && (typeof reported.last4 !== "string" || reported.last4 !== number.slice(-4)))
-        return true;
-    if (own2(reported, "expirationMonth") && Number(reported.expirationMonth) !== Number(card?.month))
-        return true;
-    if (own2(reported, "expirationYear") && Number(reported.expirationYear) % 100 !== Number(card?.year) % 100)
-        return true;
-    return false;
-}
-function fiservErrorIdentifiers(text2) {
-    const value = readObject(text2);
-    const first = value && Array.isArray(value.error) ? value.error.slice(0, 8).find(isPlainObject) : null;
-    const identifier = (item) => exact(/^[A-Za-z0-9_.:-]{1,64}$/, item) ? item : null;
-    return { code: first ? identifier(first.code) : null, type: first ? identifier(first.type) : null };
-}
-// src/fiserv.js
-var own3 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-var onlyKeys = (value, allowed) => isPlainObject(value) && Object.keys(value).every((key) => allowed.includes(key));
-var exact2 = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
-var text = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-var decodedLength = (value, min, max) => {
-    const bytes = decodeBase64(value);
-    return !!bytes && bytes.length >= min && bytes.length <= max;
-};
-var IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var KEY_ID = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
-var BODY_LIMIT = 65536;
-var TOP_LEVEL = ["source", "merchantDetails", "transactionDetails", "billingAddress"];
-var ENVELOPE = ["keyId", "encryptedKey", "encryptionBlock", "aesIv", "aesTagLength", "encryptionType", "encryptionTarget"];
-var NAME_FIELDS = ["firstName", "middleName", "lastName"];
-var ADDRESS_FIELDS = [
-    "street",
-    "houseNumberOrName",
-    "recipientNameOrAddress",
-    "city",
-    "stateOrProvince",
-    "postalCode",
-    "country",
-    "county",
-    "addressHistory"
-];
-var PHONE_FIELDS = ["countryCode", "phoneNumber"];
-function readCaptureBody(body) {
-    if (typeof body !== "string" || body.length === 0 || body.length > BODY_LIMIT)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(body);
-    }
-    catch {
-        return null;
-    }
-    return isPlainObject(parsed) && roundTrips(parsed, body) ? parsed : null;
-}
-function envelopeOk(value) {
-    return onlyKeys(value, ENVELOPE) && ENVELOPE.every((key) => own3(value, key)) && exact2(KEY_ID, value.keyId) && decodedLength(value.encryptedKey, 128, 512) && decodedLength(value.encryptionBlock, 17, 4096) && decodedLength(value.aesIv, 12, 12) && value.aesTagLength === FISERV_ENVELOPE_CONSTANTS.aesTagLength && value.encryptionType === FISERV_ENVELOPE_CONSTANTS.encryptionType && value.encryptionTarget === FISERV_ENVELOPE_CONSTANTS.encryptionTarget;
-}
-function merchantOk(value) {
-    return onlyKeys(value, ["merchantId", "terminalId"]) && own3(value, "merchantId") && exact2(IDENTIFIER, value.merchantId) && (!own3(value, "terminalId") || exact2(IDENTIFIER, value.terminalId));
-}
-var CAPTCHA_MODES = ["ALWAYS_CHALLENGE", "SOMETIMES_CHALLENGE", "INVISIBLE"];
-function transactionDetailsOk(value) {
-    if (!onlyKeys(value, ["deviceFingerprint"]))
-        return false;
-    if (!own3(value, "deviceFingerprint"))
-        return true;
-    const list = value.deviceFingerprint;
-    return Array.isArray(list) && list.length === 1 && list.every((entry) => onlyKeys(entry, ["provider", "dataCapture"]) && entry.provider === "HCAPTCHA" && onlyKeys(entry.dataCapture, ["dataEventId", "rawData"]) && CAPTCHA_MODES.includes(entry.dataCapture.dataEventId) && text(entry.dataCapture.rawData, 1, 32768));
-}
-function billingOk(value) {
-    if (!onlyKeys(value, [...NAME_FIELDS, "address", "phone"]))
-        return false;
-    if (NAME_FIELDS.some((key) => own3(value, key) && !text(value[key], 0, 256)))
-        return false;
-    if (own3(value, "address") && !(onlyKeys(value.address, ADDRESS_FIELDS) && Object.values(value.address).every((field) => text(field, 0, 256))))
-        return false;
-    return !own3(value, "phone") || onlyKeys(value.phone, PHONE_FIELDS) && Object.values(value.phone).every((field) => text(field, 0, 32));
-}
-function captureBodyRefusal(value) {
-    if (!onlyKeys(value, TOP_LEVEL))
-        return "fiserv_body_member_not_allowed";
-    const source = value.source;
-    if (!onlyKeys(source, ["sourceType", "encryptionData"]) || source.sourceType !== "PaymentCard" || !own3(source, "encryptionData")) {
-        return "fiserv_source_not_encrypted_card";
-    }
-    if (!envelopeOk(source.encryptionData))
-        return "fiserv_envelope_invalid";
-    if (!merchantOk(value.merchantDetails))
-        return "fiserv_merchant_invalid";
-    if (own3(value, "transactionDetails") && !transactionDetailsOk(value.transactionDetails))
-        return "fiserv_transaction_details_invalid";
-    if (own3(value, "billingAddress") && !billingOk(value.billingAddress))
-        return "fiserv_billing_address_invalid";
-    return null;
-}
-var FRAME_HEADERS = [
-    "content-type",
-    "authorization",
-    "api-key",
-    "client-request-id",
-    "timestamp",
-    "auth-token-type",
-    "x-integration",
-    "x-integration-version",
-    "x-integration-merchant-id",
-    "x-integration-terminal-id",
-    "x-integration-origin"
-];
-var BROWSER_HEADERS = [
-    "accept",
-    "accept-language",
-    "accept-encoding",
-    "content-length",
-    "origin",
-    "referer",
-    "user-agent",
-    "host",
-    "connection",
-    "cache-control",
-    "pragma",
-    "priority",
-    "dnt",
-    "sec-gpc",
-    "sec-fetch-dest",
-    "sec-fetch-mode",
-    "sec-fetch-site",
-    "sec-fetch-user"
-];
-var HEADER_VALUES = Object.freeze({
-    authorization: /^Bearer [A-Za-z0-9._~+/=-]{1,4096}$/,
-    "api-key": /^[A-Za-z0-9._~+/=-]{1,256}$/,
-    "client-request-id": /^[A-Za-z0-9-]{1,64}$/,
-    timestamp: /^[0-9]{1,16}$/,
-    "x-integration": /^[\x21-\x7e][\x20-\x7e]{0,127}$/,
-    "x-integration-version": /^[\x21-\x7e][\x20-\x7e]{0,63}$/
-});
-function httpsOrigin(value) {
-    try {
-        const url = new URL(value);
-        return url.protocol === "https:" && (value === url.origin || value === `${url.origin}/`);
-    }
-    catch {
-        return false;
-    }
-}
-function headerRefusal(headers, body) {
-    if (!isPlainObject(headers))
-        return "fiserv_headers_invalid";
-    const seen = /* @__PURE__ */ new Map();
-    let bytes = 0;
-    for (const [name, value] of Object.entries(headers)) {
-        const lower = name.toLowerCase();
-        if (seen.size >= 64 || seen.has(lower) || !exact2(/^[A-Za-z0-9-]{1,64}$/, name) || !text(value, 0, 8192) || (bytes += name.length + value.length) > 32768)
-            return "fiserv_headers_invalid";
-        if (!FRAME_HEADERS.includes(lower) && !BROWSER_HEADERS.includes(lower) && !exact2(/^sec-ch-ua(?:-[a-z0-9-]+)?$/, lower)) {
-            return "fiserv_header_not_allowed";
-        }
-        seen.set(lower, value);
-    }
-    if (!exact2(/^application\/json(?:;\s*charset=utf-8)?$/i, seen.get("content-type")))
-        return "fiserv_content_type_invalid";
-    if (seen.get("auth-token-type") !== "AccessToken")
-        return "fiserv_auth_token_type_invalid";
-    if (seen.get("x-integration-merchant-id") !== body.merchantDetails.merchantId)
-        return "fiserv_merchant_header_mismatch";
-    if (seen.get("x-integration-terminal-id") !== body.merchantDetails.terminalId)
-        return "fiserv_terminal_header_mismatch";
-    for (const [name, pattern] of Object.entries(HEADER_VALUES)) {
-        if (seen.has(name) && !exact2(pattern, seen.get(name)))
-            return "fiserv_header_value_invalid";
-    }
-    if (seen.has("x-integration-origin") && !httpsOrigin(seen.get("x-integration-origin")))
-        return "fiserv_header_value_invalid";
-    return null;
-}
-function fiservCardCaptureRefusal(request) {
-    if (!isPlainObject(request))
-        return "fiserv_request_invalid";
-    if (!isFiservCardCaptureUrl(request.url))
-        return "fiserv_endpoint_invalid";
-    if (request.method !== "POST")
-        return "fiserv_method_invalid";
-    const body = readCaptureBody(request.body);
-    if (!body)
-        return "fiserv_body_invalid";
-    return captureBodyRefusal(body) ?? headerRefusal(request.headers, body);
-}
-function isFiservCardCaptureRequest(request) {
-    return fiservCardCaptureRefusal(request) === null;
-}
-var TOKEN_MEMBERS = ["walletType", "tokenData", "tokenSource"];
-var NON_CARD_CATEGORIES = ["GIFT", "EBT"];
-function isNonCardSource(source) {
-    if (!isPlainObject(source))
-        return false;
-    if (source.sourceType === "PaymentToken") {
-        return onlyKeys(source, ["sourceType", ...TOKEN_MEMBERS]) && own3(source, "tokenData") && TOKEN_MEMBERS.every((key) => !own3(source, key) || text(source[key], 1, 4096));
-    }
-    if (source.sourceType === "PaymentCheck") {
-        return onlyKeys(source, ["sourceType", "encryptionData"]) && envelopeOk(source.encryptionData);
-    }
-    return source.sourceType === "PaymentCard" && onlyKeys(source, ["sourceType", "encryptionData", "card"]) && envelopeOk(source.encryptionData) && onlyKeys(source.card, ["category", "subCategory"]) && NON_CARD_CATEGORIES.includes(source.card.category) && (!own3(source.card, "subCategory") || text(source.card.subCategory, 1, 64));
-}
-function isNonCardCapture(body) {
-    const parsed = readCaptureBody(body);
-    return parsed !== null && isNonCardSource(parsed.source);
-}
-function isFiservPausableBody(body) {
-    return !isNonCardCapture(body);
-}
-function fiservTemplateKeyId(body) {
-    const parsed = readCaptureBody(body);
-    return parsed && captureBodyRefusal(parsed) === null ? parsed.source.encryptionData.keyId : null;
-}
-function fiservCaptureMerchant(body) {
-    const parsed = readCaptureBody(body);
-    if (!parsed || captureBodyRefusal(parsed) !== null)
-        return null;
-    const merchant = parsed.merchantDetails;
-    return { merchantId: merchant.merchantId, terminalId: own3(merchant, "terminalId") ? merchant.terminalId : null };
-}
-function capturePin(capture) {
-    if (!isPlainObject(capture))
-        return { refusal: "fiserv_request_invalid" };
-    const environment = fiservEnvironment(capture.url);
-    if (!environment)
-        return { refusal: "fiserv_endpoint_invalid" };
-    const body = readCaptureBody(capture.body);
-    if (!body)
-        return { refusal: "fiserv_body_invalid" };
-    const refusal = captureBodyRefusal(body);
-    if (refusal)
-        return { refusal };
-    const pin2 = fiservKeyPin(body.source.encryptionData.keyId, environment);
-    if (!pin2)
-        return { refusal: "fiserv_key_unpinned" };
-    if (!fiservPinServesMerchant(pin2, body.merchantDetails.merchantId))
-        return { refusal: "fiserv_key_merchant_unlisted" };
-    return { pin: pin2, environment };
-}
-function fiservCapturePin(capture) {
-    return capturePin(capture).pin ?? null;
-}
-function fiservCaptureKeyRefusal(capture, nowMs) {
-    const found = capturePin(capture);
-    return found.refusal ?? fiservKeyRefusal(found.pin.keyId, found.environment, nowMs);
-}
-function fiservPreparationUrl(environment) {
-    if (environment !== "production" && environment !== "sandbox")
-        throw new Error("unsupported_preparation_environment");
-    return FISERV_CARD_CAPTURE_ENDPOINTS[environment];
-}
-function isPreparedFiservRequest(url, method, body, environment, headers) {
-    return (environment === "production" || environment === "sandbox") && fiservEnvironment(url) === environment && fiservCardCaptureRefusal({ url, method, body, headers }) === null && fiservCapturePin({ url, body }) !== null;
-}
-var digitsOf = (value) => typeof value === "string" || typeof value === "number" ? String(value).replace(/[ -]/g, "") : "";
-var KEY_REFUSALS = Object.freeze({
-    fiserv_key_unpinned: "Refusing to encrypt: Agentcard has not pinned this Fiserv key.",
-    fiserv_key_merchant_unlisted: "Refusing to encrypt: Agentcard has not pinned this Fiserv key for the merchant this payment names.",
-    fiserv_key_inactive: "Refusing to encrypt: this Fiserv key is no longer active.",
-    fiserv_key_outside_validity: "Refusing to encrypt: this Fiserv key is outside its validity window."
-});
-var CAPTURE_REFUSED = "Refusing to encrypt: unsupported Fiserv card capture request.";
-async function encryptFiservCard(card, capture, facilities) {
-    const found = capturePin(capture);
-    const refusal = found.refusal ?? fiservKeyRefusal(found.pin.keyId, found.environment, facilities?.nowMs);
-    if (refusal)
-        throw new Error(KEY_REFUSALS[refusal] ?? CAPTURE_REFUSED);
-    const { pin: pin2, environment } = found;
-    if (environment === "sandbox" && !FISERV_SIMULATOR_PANS.includes(digitsOf(card?.number))) {
-        throw new Error("Refusing to encrypt: the Fiserv sandbox key encrypts only Fiserv's documented test cards.");
-    }
-    const spki = pinnedSpki(pin2);
-    if (!spki)
-        throw new Error("Refusing to encrypt: the Fiserv key is malformed.");
-    return sealFiservEnvelope(pin2.keyId, spki, fiservCaptureSource(card), facilities.crypto);
-}
-var FISERV_SUBSTITUTION = Object.freeze({
-    at: "source.encryptionData",
-    fields: Object.freeze(["keyId", "encryptedKey", "encryptionBlock", "aesIv"])
-});
-function fiservSubstitutionFieldsRefusal(fields) {
-    if (!isPlainObject(fields))
-        return "fiserv_substitution_invalid";
-    const names = Object.keys(fields);
-    if (names.length !== FISERV_SUBSTITUTION.fields.length || !FISERV_SUBSTITUTION.fields.every((name) => own3(fields, name))) {
-        return "fiserv_substitution_fields_invalid";
-    }
-    if (!isFiservPinnedKeyId(fields.keyId))
-        return "fiserv_key_unpinned";
-    if (!decodedLength(fields.encryptedKey, 256, 256) || !decodedLength(fields.encryptionBlock, 17, 4096) || !decodedLength(fields.aesIv, 12, 12))
-        return "fiserv_substitution_fields_invalid";
-    return null;
-}
-function fiservApprovedEnvelopeRefusal(fields, context) {
-    const shape = fiservSubstitutionFieldsRefusal(fields);
-    if (shape)
-        return shape;
-    if (!isPlainObject(context) || typeof context.sandbox !== "boolean")
-        return "fiserv_approval_context_invalid";
-    const found = capturePin(context.template);
-    if (found.refusal)
-        return found.refusal;
-    if (found.environment === "sandbox" !== context.sandbox)
-        return "fiserv_environment_mismatch";
-    if (
-    /** @type {Record<string, unknown>} */
-    fields.keyId !== found.pin.keyId)
-        return "fiserv_key_mismatch";
-    return fiservKeyRefusal(found.pin.keyId, found.environment, context.nowMs);
-}
-function fiservSubstitutions(envelope) {
-    if (!isPlainObject(envelope) || envelope.aesTagLength !== FISERV_ENVELOPE_CONSTANTS.aesTagLength || envelope.encryptionType !== FISERV_ENVELOPE_CONSTANTS.encryptionType || envelope.encryptionTarget !== FISERV_ENVELOPE_CONSTANTS.encryptionTarget) {
-        throw new Error("Refusing the Fiserv envelope: it is not the Secure Data Capture form.");
-    }
-    const fields = Object.fromEntries(FISERV_SUBSTITUTION.fields.map((name) => [name, envelope[name]]));
-    const refusal = fiservSubstitutionFieldsRefusal(fields);
-    if (refusal)
-        throw new Error(`Refusing the Fiserv envelope: ${refusal}.`);
-    return { encoding: "json", at: FISERV_SUBSTITUTION.at, fields };
-}
-var SUBSTITUTION_MEMBERS = ["encoding", "at", "fields", "remove"];
-function substituteFiservEnvelope(body, sub) {
-    if (!isPlainObject(sub) || !onlyKeys(sub, SUBSTITUTION_MEMBERS) || sub.encoding !== "json" || sub.at !== FISERV_SUBSTITUTION.at || own3(sub, "remove") && !(Array.isArray(sub.remove) && sub.remove.length === 0)) {
-        throw new Error("Refusing to substitute: not a Fiserv envelope substitution.");
-    }
-    const fields = isPlainObject(sub.fields) ? Object.fromEntries(Object.entries(sub.fields)) : null;
-    const refusal = fiservSubstitutionFieldsRefusal(fields);
-    if (refusal)
-        throw new Error(`Refusing to substitute: ${refusal}.`);
-    const parsed = readCaptureBody(body);
-    const bodyRefusal = parsed ? captureBodyRefusal(parsed) : "fiserv_body_invalid";
-    if (bodyRefusal)
-        throw new Error(`Refusing to substitute: ${bodyRefusal}.`);
-    const envelope = parsed.source.encryptionData;
-    if (envelope.keyId !== fields.keyId)
-        throw new Error("Refusing to substitute: the envelope names another key than the paused capture.");
-    for (const name of FISERV_SUBSTITUTION.fields)
-        envelope[name] = fields[name];
-    return JSON.stringify(parsed);
-}
-export { FISERV_CARD_CAPTURE_ENDPOINTS, FISERV_ENVELOPE_CONSTANTS, FISERV_KEY_PINS, FISERV_SIMULATOR_PANS, FISERV_SUBSTITUTION, encryptFiservCard, fiservApprovedEnvelopeRefusal, fiservCaptureCardMismatch, fiservCaptureKeyRefusal, fiservCaptureMerchant, fiservCapturePin, fiservCardCaptureRefusal, fiservEnvironment, fiservErrorIdentifiers, fiservKeyPin, fiservKeyRefusal, fiservPreparationUrl, fiservPublishedKeyRefusal, fiservSubstitutionFieldsRefusal, fiservSubstitutions, fiservTemplateKeyId, fiservTimestampMs, isFiservCardCaptureRequest, isFiservCardCaptureUrl, isFiservPausableBody, isFiservPinnedKeyId, isPreparedFiservRequest, parseFiservPublishedKey, sanitizeFiservCaptureResponse, substituteFiservEnvelope };