@agent-cards/sdk 0.20.0 → 0.22.0

package/dist/merchant-card-endpoints.generated.js

@@ -0,0 +1,1103 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 0149082f3796b4b5bbe843a6ab8e4f34f551de49e3edfc69ccf66d3cba1ba272
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+function sameKeyIgnoringCase(key, step) {
+    return !FORBIDDEN_KEYS.has(key) && (key.toLowerCase() === step.toLowerCase() || key.toUpperCase() === step.toUpperCase());
+}
+function valuesIgnoringCase(root, path) {
+    let nodes = [root];
+    for (const step of path) {
+        const next = [];
+        for (const node of nodes) {
+            if (typeof step === "number") {
+                if (Array.isArray(node) && Number.isSafeInteger(step) && step >= 0 && step < node.length)
+                    next.push(node[step]);
+            }
+            else if (isPlainObject(node)) {
+                for (const key of Object.keys(node))
+                    if (sameKeyIgnoringCase(key, step))
+                        next.push(node[key]);
+            }
+        }
+        nodes = next;
+    }
+    return nodes;
+}
+function describePath(path) {
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+}
+// src/url-template.js
+var PLACEHOLDER_VALUE = /^[A-Za-z0-9._~@+-]{1,256}$/;
+var placeholderValue = (value) => PLACEHOLDER_VALUE.test(value) && value !== "." && !value.includes("..");
+function pathPlaceholders(template, pathname) {
+    if (typeof template !== "string" || typeof pathname !== "string")
+        return null;
+    if (!template.startsWith("/") || !pathname.startsWith("/"))
+        return null;
+    const want = template.split("/");
+    const got = pathname.split("/");
+    if (want.length !== got.length)
+        return null;
+    const values = {};
+    for (const [i, segment] of want.entries()) {
+        if (segment.startsWith(":")) {
+            if (!placeholderValue(got[i]))
+                return null;
+            values[segment.slice(1)] = got[i];
+        }
+        else if (segment !== got[i]) {
+            return null;
+        }
+    }
+    return values;
+}
+function pathMatchesTemplate(template, pathname) {
+    return pathPlaceholders(template, pathname) !== null;
+}
+function queryPlaceholders(query, text) {
+    if (!query || typeof query !== "object" || Array.isArray(query))
+        return null;
+    const pairs = Object.entries(query);
+    if (pairs.length === 0)
+        return text === null ? {} : null;
+    if (typeof text !== "string")
+        return null;
+    const got = text.split("&");
+    if (got.length !== pairs.length)
+        return null;
+    const values = {};
+    for (const [i, [key, value]] of pairs.entries()) {
+        const mark = got[i].indexOf("=");
+        if (mark === -1 || got[i].slice(0, mark) !== key)
+            return null;
+        const written = got[i].slice(mark + 1);
+        if (typeof value !== "string")
+            return null;
+        if (value.startsWith(":")) {
+            if (!placeholderValue(written))
+                return null;
+            values[value.slice(1)] = written;
+        }
+        else if (written !== value) {
+            return null;
+        }
+    }
+    return values;
+}
+// src/substitution-primitives.js
+var SubstitutionError = class extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SubstitutionError";
+    }
+};
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/merchant-card-endpoint-profiles.js
+var MERCHANT_CARD_ENDPOINT_PSP = "merchant_card_endpoint";
+var MERCHANT_CARD_ENDPOINT_MODE = "card_endpoint";
+var BROWSER_HEADERS = /* @__PURE__ */ Object.freeze(["user-agent", "accept", "accept-language", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform"]);
+var MERCHANT_CARD_ENDPOINT_PROFILES = /* @__PURE__ */ deepFreeze([
+    {
+        id: "att_payment_info",
+        merchant: "AT&T",
+        status: "observe",
+        evidence: [
+            "att.com buy flow bundles (release/26.09.23.REL.COMMERCEUI), read Sep 25, 2026: with isUnifiedMfeEnabled on, Networker posts JSON with credentials: include to /msapi/checkoutexporch/v1/paymentInfo?cartId=<CHECKOUT_MFE_CART_ID>.",
+            "Headers: content-type application/json, appname and idpctx-appname onlinecart, X-CSRF-TOKEN from sessionStorage csrf-token.",
+            "Body: flat JSON with cardNumber, cvv, expDate (the month), expYear, name, zip, type, amount, cardSubType (the brand, derived from the PAN), and savedPaymentData, includeAutoPay, autoPayInfoList, leaseId, transactionId, statusCode on other flows.",
+            "The card-free order POST (/msapi/checkoutexporch/v1/post) carries the SMS PIN step-up."
+        ],
+        har: null,
+        checkout: "https://www.att.com",
+        endpoint: "https://www.att.com",
+        method: "POST",
+        path: "/msapi/checkoutexporch/v1/paymentInfo",
+        query: { cartId: ":cartId" },
+        encoding: "json",
+        session: {
+            cookies: true,
+            headers: [...BROWSER_HEADERS, "content-type", "x-csrf-token", "appname", "idpctx-appname"],
+            required: ["x-csrf-token", "appname"]
+        },
+        card: {
+            pan: { at: ["cardNumber"], format: "digits" },
+            cvv: { at: ["cvv"], format: "digits" },
+            exp_month: { at: ["expDate"], format: "as_typed" },
+            exp_year: { at: ["expYear"], format: "as_typed" },
+            brands: [{ at: ["cardSubType"], map: null }],
+            bins: null
+        },
+        requires: [{ at: ["type"], one_of: ["CREDIT", "DEBIT", "ANYCARD"] }],
+        refuse: [
+            { at: ["savedPaymentData"], when: "present" },
+            { at: ["autoPayInfoList"], when: "present" },
+            { at: ["leaseId"], when: "present" },
+            { at: ["transactionId"], when: "present" },
+            { at: ["statusCode"], when: "present" },
+            { at: ["includeAutoPay"], when: "true" }
+        ],
+        amount: { at: ["amount"], kind: "decimal_string" },
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie", "x-csrf-token"] },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        pending: [
+            "card.brands: the cardSubType value for each brand",
+            "card.exp_month and card.exp_year: how many digits expDate and expYear carry",
+            "whether cartId also rides in the body"
+        ]
+    },
+    {
+        id: "italo_booking_credit_card",
+        merchant: "Italo",
+        status: "observe",
+        evidence: [
+            "biglietti.italotreno.com public bundles (API client chunk 901970b7, payment step chunk 6297), read Sep 25, 2026: axios posts JSON, without withCredentials, to https://api-biglietti.italotreno.com/api/v1/booking/{bookingId}/payments/credit-card.",
+            "Headers: Content-Type application/json, Authorization Bearer <BIGSessionToken>, X-BIG-working-session-id.",
+            "Body: accountName, accountNumber (PAN, spaces stripped), CVV, expirationMonth (two-digit string), expirationYear (four-digit number), termsAndConditions true, StoreCreditCard (saves the card), creditCardId (saved cards), paymentMethodCode (VI, MC, AX, DC, JC, OT from payment.fns.cardType).",
+            "The answer carries validationMetadata.PaReq, a Nexi 3DS HTML snippet the page injects; the 3DS return and the commit are card-free."
+        ],
+        har: null,
+        checkout: "https://biglietti.italotreno.com",
+        endpoint: "https://api-biglietti.italotreno.com",
+        method: "POST",
+        path: "/api/v1/booking/:bookingId/payments/credit-card",
+        query: {},
+        encoding: "json",
+        session: {
+            cookies: false,
+            headers: [...BROWSER_HEADERS, "content-type", "authorization", "x-big-working-session-id"],
+            required: ["authorization", "x-big-working-session-id"]
+        },
+        card: {
+            pan: { at: ["accountNumber"], format: "digits" },
+            cvv: { at: ["CVV"], format: "digits" },
+            exp_month: { at: ["expirationMonth"], format: "mm" },
+            exp_year: { at: ["expirationYear"], format: "yyyy_int" },
+            brands: [{ at: ["paymentMethodCode"], map: { visa: "VI", mastercard: "MC" } }],
+            bins: null
+        },
+        requires: [{ at: ["termsAndConditions"], equals: true }],
+        refuse: [
+            { at: ["StoreCreditCard"], when: "true" },
+            { at: ["creditCardId"], when: "present" }
+        ],
+        amount: null,
+        currency: "EUR",
+        response: { headers: ["content-type"] },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        pending: [
+            "whether the validationMetadata.PaReq answer carries the card number",
+            "whether expire is sent absent or as null"
+        ]
+    },
+    {
+        id: "universal_orlando_guest_checkout",
+        merchant: "Universal Orlando Resort",
+        status: "observe",
+        evidence: [
+            "www.universalorlando.com/web-store bundle (main-YEGFGVHU.js payCard and buildPaymentUrl), read Sep 25, 2026: Angular HttpClient posts JSON, without withCredentials, to https://secure-api.universalparks.com/instances/{instance-id}/commerce-checkout for a guest checkout.",
+            "Headers: Authorization Bearer, X-IBM-Client-ID, WCToken, WCTrustedToken, x-instance-id, x-resort-area-code, x-source-Id, X-UNIWebService-ApiKey, -AppVersion, -Device, -Platform, Akamai-BM-Telemetry.",
+            "Body: order_id, currency_code USD, amount (a string), number, cvv, expiration {month, year} as integers, save_to_wallet, cardinal-3d-secure {reference_id, jwt, window_size}, billing and contact fields.",
+            "A Cardinal challenge answers 400 CARDINAL_3DS_MORE_INFO_REQUIRED and re-posts the card with the Cardinal jwt, which the refuse rules stop."
+        ],
+        har: null,
+        checkout: "https://www.universalorlando.com",
+        endpoint: "https://secure-api.universalparks.com",
+        method: "POST",
+        path: "/instances/:instanceId/commerce-checkout",
+        query: {},
+        encoding: "json",
+        session: {
+            cookies: false,
+            headers: [
+                ...BROWSER_HEADERS,
+                "content-type",
+                "authorization",
+                "x-ibm-client-id",
+                "wctoken",
+                "wctrustedtoken",
+                "x-instance-id",
+                "x-resort-area-code",
+                "x-source-id",
+                "x-uniwebservice-apikey",
+                "x-uniwebservice-appversion",
+                "x-uniwebservice-device",
+                "x-uniwebservice-platform",
+                "akamai-bm-telemetry"
+            ],
+            required: ["authorization", "x-ibm-client-id", "wctoken", "wctrustedtoken"]
+        },
+        card: {
+            pan: { at: ["number"], format: "digits" },
+            cvv: { at: ["cvv"], format: "digits" },
+            exp_month: { at: ["expiration", "month"], format: "m_int" },
+            exp_year: { at: ["expiration", "year"], format: "yyyy_int" },
+            brands: [],
+            bins: null
+        },
+        requires: [
+            { at: ["currency_code"], equals: "USD" },
+            { at: ["order_id"], present: true }
+        ],
+        refuse: [
+            { at: ["save_to_wallet"], when: "true" },
+            { at: ["cardinal-3d-secure", "jwt"], when: "nonempty" },
+            { at: ["cardinal-3d-secure", "reference_id"], when: "nonempty" }
+        ],
+        amount: { at: ["amount"], kind: "decimal_string" },
+        currency: { at: ["currency_code"] },
+        response: { headers: ["content-type"] },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "at_request",
+        pending: ["how long a captured akamai-bm-telemetry header stays accepted"]
+    },
+    {
+        id: "target_optical_pi_add",
+        merchant: "Target Optical",
+        status: "observe",
+        evidence: [
+            "www.targetoptical.com HCL Commerce storefront scripts (CheckoutPayments.populateProtocolData, wc.service.invoke over $.ajax), read Sep 25, 2026: a same-origin form POST to /AjaxOrderChangeServicePIAddTO with X-Requested-With XMLHttpRequest and the WCS and Akamai cookies.",
+            "Body: storeId, catalogId, langId, payMethodId (brand code), piAmount (order total), billing_address_id, account (the PAN), cc_cvc, expire_month, expire_year, cc_brand, cc_nameoncard, requesttype ajax, authToken (WCS anti-CSRF), forterToken; saveCreditCard=on or creditCardToUse for a saved card.",
+            "The card is checked or authorized at this step; the later PIUpdate, OrderPrepare and SubmitOrder calls are card-free."
+        ],
+        har: null,
+        checkout: "https://www.targetoptical.com",
+        endpoint: "https://www.targetoptical.com",
+        method: "POST",
+        path: "/AjaxOrderChangeServicePIAddTO",
+        query: {},
+        encoding: "form",
+        session: {
+            cookies: true,
+            headers: [...BROWSER_HEADERS, "content-type", "x-requested-with"],
+            required: ["x-requested-with"]
+        },
+        card: {
+            pan: { at: "account", format: "digits" },
+            cvv: { at: "cc_cvc", format: "digits" },
+            exp_month: { at: "expire_month", format: "as_typed" },
+            exp_year: { at: "expire_year", format: "as_typed" },
+            brands: [{ at: "cc_brand", map: null }, { at: "payMethodId", map: null }],
+            bins: null
+        },
+        requires: [
+            { at: "requesttype", equals: "ajax" },
+            { at: "authToken", present: true },
+            { at: "piAmount", present: true }
+        ],
+        refuse: [
+            { at: "saveCreditCard", when: "present" },
+            { at: "creditCardToUse", when: "present" }
+        ],
+        amount: { at: "piAmount", kind: "decimal_string" },
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"] },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "deferred",
+        pending: [
+            "card.brands: the cc_brand and payMethodId values for each brand",
+            "card.exp_month and card.exp_year: how many digits expire_month and expire_year carry",
+            "whether the visible account1_1 field is also sent"
+        ]
+    },
+    {
+        id: "opus_signup_payment",
+        merchant: "Opus Virtual Offices",
+        status: "observe",
+        evidence: [
+            "www.opusvirtualoffices.com signup payment step, read Sep 25, 2026: fetch posts new FormData(form#checkout-form) as multipart/form-data with the browser boundary and credentials: include to /api/signup/process/payment/; the only set header is Accept application/json.",
+            "Card fields: ccname, ccnumber (digits), expdatem (01 to 12), expdatey (four digits), ccv, CreditCardType (1 Visa, 2 Mastercard, 3 Discover, 4 Amex; the page takes Mastercard for 51 to 55 only).",
+            "Order fields: uid (the signup id from step 1), prepaymny (the term, from the page radio buttons in payment chunk 0wj2kykjptexg: 1 monthly, or 3, 6 or 11 months prepaid), payment_option CreditCard or Wire; no amount (the server prices the uid and the term).",
+            "The page also sets signedcompany, bcphone and bstate, and copies utm_* cookies and visitor_id (as opusrc) into the form.",
+            "The subscription renews to the card on file, which a single-use card declines."
+        ],
+        har: null,
+        checkout: "https://www.opusvirtualoffices.com",
+        endpoint: "https://www.opusvirtualoffices.com",
+        method: "POST",
+        path: "/api/signup/process/payment/",
+        query: {},
+        encoding: "multipart",
+        session: {
+            cookies: true,
+            headers: [...BROWSER_HEADERS, "content-type"],
+            required: []
+        },
+        card: {
+            pan: { at: "ccnumber", format: "digits" },
+            cvv: { at: "ccv", format: "digits" },
+            exp_month: { at: "expdatem", format: "mm" },
+            exp_year: { at: "expdatey", format: "yyyy" },
+            brands: [{ at: "CreditCardType", map: { visa: "1", mastercard: "2" } }],
+            bins: { mastercard: ["51", "52", "53", "54", "55"] }
+        },
+        requires: [
+            { at: "payment_option", equals: "CreditCard" },
+            { at: "uid", present: true },
+            { at: "prepaymny", one_of: ["1", "3", "6", "11"] }
+        ],
+        refuse: [],
+        amount: null,
+        currency: "USD",
+        response: { headers: ["content-type", "set-cookie"] },
+        bootstrap: "/robots.txt",
+        timeout_ms: 3e4,
+        charge_timing: "recurring",
+        pending: [
+            "the amount each prepaymny term charges, so the approval can show what the chosen term costs",
+            "a renewal policy: each renewal charges the card on file with no approval of its own"
+        ]
+    }
+]);
+function wireProjection(profiles) {
+    return deepFreeze(profiles.map(({ evidence, bootstrap, timeout_ms, ...profile }) => ({ ...profile })));
+}
+function clientProjection(profiles) {
+    return deepFreeze(profiles.map(({ evidence, ...profile }) => ({ ...profile })));
+}
+var MERCHANT_CARD_ENDPOINT_RECOGNIZERS = /* @__PURE__ */ wireProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
+var MERCHANT_CARD_ENDPOINT_CLIENT_TABLE = /* @__PURE__ */ clientProjection(MERCHANT_CARD_ENDPOINT_PROFILES);
+function merchantCardEndpointById(id) {
+    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((entry) => entry.id === id) ?? null : null;
+}
+function trustedMerchantCardEndpoint(idOrEntry) {
+    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
+    if (!profile)
+        throw new Error("Refusing to pay: unknown merchant card endpoint.");
+    return profile;
+}
+function merchantCardEndpointRecognizerById(id) {
+    return typeof id === "string" ? MERCHANT_CARD_ENDPOINT_RECOGNIZERS.find((entry) => entry.id === id) ?? null : null;
+}
+function merchantCardEndpointLive(idOrEntry) {
+    const profile = merchantCardEndpointById(typeof idOrEntry === "string" ? idOrEntry : idOrEntry?.id);
+    return !!profile && profile.status === "enabled" && profile.pending.length === 0 && typeof profile.har === "string" && profile.har !== "" && profile.charge_timing !== "recurring";
+}
+// src/merchant-card-endpoints.js
+var MERCHANT_CARD_ENDPOINT_LIMITS = /* @__PURE__ */ Object.freeze({
+    bodyBytes: 128 * 1024,
+    answerBytes: 256 * 1024,
+    urlLength: 8192,
+    headerValueBytes: 8 * 1024,
+    headerBytes: 32 * 1024,
+    cookies: 64
+});
+var NEVER_FROM_CAPTURE = /^(?:cookie|cookie2|set-cookie|origin|referer|host|content-length|transfer-encoding|connection|keep-alive|upgrade|te|trailer|expect|proxy-.*|:.*)$/;
+var PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
+var COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,256}$/;
+var COOKIE_VALUE = /^(?:[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*|"[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*")$/;
+var BOUNDARY = /^[A-Za-z0-9'()+_,\-./:=?]{1,70}$/;
+var BUNDLE_MEMBERS = /* @__PURE__ */ new Set(["url", "page_origin", "headers", "cookies", "referer", "body"]);
+function utf8Length(text) {
+    let bytes = 0;
+    for (let i = 0; i < text.length; i += 1) {
+        const unit = text.charCodeAt(i);
+        if (unit < 128)
+            bytes += 1;
+        else if (unit < 2048)
+            bytes += 2;
+        else if (unit >= 55296 && unit <= 56319 && i + 1 < text.length) {
+            bytes += 4;
+            i += 1;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}
+function cardBrand(number) {
+    if (number.startsWith("4"))
+        return "visa";
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "mastercard";
+    if (/^3[47]/.test(number))
+        return "amex";
+    if (/^(?:6011|65|64[4-9])/.test(number))
+        return "discover";
+    return null;
+}
+function cardFacts(card) {
+    if (!isPlainObject(card))
+        throw new SubstitutionError("the card is missing");
+    const number = typeof card.number === "string" ? card.number : "";
+    if (!/^\d{12,19}$/.test(number))
+        throw new SubstitutionError("the card number is not 12 to 19 digits");
+    const cvc = typeof card.cvc === "string" ? card.cvc : "";
+    if (!/^\d{3,4}$/.test(cvc))
+        throw new SubstitutionError("the card security code is not 3 or 4 digits");
+    const monthText = typeof card.month === "number" || typeof card.month === "string" ? String(card.month) : "";
+    if (!/^\d{1,2}$/.test(monthText) || Number(monthText) < 1 || Number(monthText) > 12)
+        throw new SubstitutionError("the card expiry month is not 1 to 12");
+    const yearText = typeof card.year === "number" || typeof card.year === "string" ? String(card.year) : "";
+    if (!/^(?:\d{2}|\d{4})$/.test(yearText))
+        throw new SubstitutionError("the card expiry year is not 2 or 4 digits");
+    const year = yearText.length === 2 ? 2e3 + Number(yearText) : Number(yearText);
+    return { number, cvc, month: Number(monthText), year, brand: cardBrand(number) };
+}
+var digitForms = (digit) => `(?:${digit}|\\\\u003${digit}|%3${digit}|&#0*${48 + Number(digit)};|&#x0*3${digit};)`;
+var SEPARATOR = String.raw `(?:\\(?:[/\\"bfnrt]|u(?:00(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])|0[1-9a-f][0-9a-f]{2}|[1-9a-f][0-9a-f]{3}))` + String.raw `|%(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])` + String.raw `|&(?:#0*(?:[0-9]|[1-3][0-9]|4[0-7]|5[89]|6[0-4]|9[1-6]|12[3-9]|1[3-9][0-9]|[2-9][0-9]{2}|[1-9][0-9]{3,6})|#x0*(?:[0-9a-f]|[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f]|[1-9a-f][0-9a-f]{2,5})|[a-z][a-z0-9]{1,31});` + String.raw `|[^0-9A-Za-z\\%&]|%(?![0-9a-f]{2})|&(?!#?x?[0-9a-z]+;))`;
+function digitRun(digits) {
+    return new RegExp([...digits].map(digitForms).join(`${SEPARATOR}*`), "gi");
+}
+function countRuns(text, digits) {
+    return (text.match(digitRun(digits)) ?? []).length;
+}
+var CODE_KEY = /(?:cvv2?|cvc2?|cvn|csc|cid|ccv|security[\s_-]?code|card[\s_-]?code|verification[\s_-]?(?:code|value))(?:["']|%22|\\")?\s*(?::|=|%3[aAdD])\s*(?:["']|%22|\\")?\s*(\d{3,4})(?!\d)/gi;
+var CODE_NAME = /(?:cvv2?|cvc2?|cvn|csc|cid(?![a-z])|ccv|security[\s_-]?code|card[\s_-]?code|verification[\s_-]?(?:code|value))/gi;
+var CODE_WINDOW = 96;
+function codeRun(cvc) {
+    return new RegExp(`(?:^|[^0-9])${[...cvc].map(digitForms).join("")}(?![0-9])`, "i");
+}
+function codeNearKey(text, code) {
+    for (const key of text.matchAll(CODE_NAME)) {
+        const from = Math.max(0, key.index - CODE_WINDOW);
+        const to = Math.min(text.length, key.index + key[0].length + CODE_WINDOW);
+        let near = text.slice(from, to);
+        if (from > 0 && /[0-9]/.test(text[from - 1]))
+            near = near.replace(/^[0-9]+/, "");
+        if (to < text.length && /[0-9]/.test(text[to]))
+            near = near.replace(/[0-9]+$/, "");
+        if (code.test(near))
+            return true;
+        for (const [run] of near.replace(BASE64_ESCAPE, unescapeBase64).matchAll(CODE_BASE64_RUN)) {
+            for (let skip = 0; skip < 4; skip += 1)
+                if (code.test(base64Bytes(run, skip).replace(/\0/g, "")))
+                    return true;
+        }
+    }
+    return false;
+}
+function onlyOnce(variants, name) {
+    if (variants === 0)
+        return `${name} is missing`;
+    if (variants > 1)
+        return `${name} appears more than once`;
+    return null;
+}
+function multipartBoundary(contentType) {
+    const match = typeof contentType === "string" ? /^multipart\/form-data;\s*boundary=(?:"([^"]*)"|([^\s;"]*))$/i.exec(contentType) : null;
+    const boundary = match ? match[1] ?? match[2] : null;
+    return boundary && BOUNDARY.test(boundary) ? boundary : null;
+}
+function contentTypeRefusal(p, contentType) {
+    if (typeof contentType !== "string")
+        return `the card request to ${p.merchant} names no content type`;
+    const ok = p.encoding === "json" ? /^application\/json(?:;\s*charset=utf-8)?$/i.test(contentType) : p.encoding === "form" ? /^application\/x-www-form-urlencoded(?:;\s*charset=utf-8)?$/i.test(contentType) : multipartBoundary(contentType) !== null;
+    return ok ? null : `the card request to ${p.merchant} is not sent as ${p.encoding}`;
+}
+function forbiddenKeyIn(value, depth = 0) {
+    if (depth > 64)
+        return true;
+    if (Array.isArray(value))
+        return value.some((item) => forbiddenKeyIn(item, depth + 1));
+    if (isPlainObject(value))
+        return Object.keys(value).some((key) => FORBIDDEN_KEYS.has(key) || forbiddenKeyIn(value[key], depth + 1));
+    return false;
+}
+function parseForm(body) {
+    const fields = [];
+    if (body === "")
+        return { fields };
+    let offset = 0;
+    for (const pair of body.split("&")) {
+        const mark = pair.indexOf("=");
+        if (mark <= 0)
+            return { refusal: "the paused form body has a field with no name or no value" };
+        try {
+            fields.push({
+                name: decodeURIComponent(pair.slice(0, mark).replace(/\+/g, " ")),
+                value: decodeURIComponent(pair.slice(mark + 1).replace(/\+/g, " ")),
+                start: offset + mark + 1,
+                end: offset + pair.length
+            });
+        }
+        catch {
+            return { refusal: "the paused form body is not valid form encoding" };
+        }
+        offset += pair.length + 1;
+    }
+    return { fields };
+}
+function parseMultipart(body, boundary) {
+    const CRLF = "\r\n";
+    const dash = `--${boundary}`;
+    const delimiter = `${CRLF}${dash}`;
+    if (!body.startsWith(`${dash}${CRLF}`))
+        return { refusal: "the paused multipart body does not open with its declared boundary" };
+    const fields = [];
+    let position = dash.length + CRLF.length;
+    for (;;) {
+        const headerEnd = body.indexOf(`${CRLF}${CRLF}`, position);
+        if (headerEnd === -1)
+            return { refusal: "a part of the paused multipart body has no header end" };
+        const start = headerEnd + 4;
+        const end = body.indexOf(delimiter, start);
+        if (end === -1)
+            return { refusal: "a part of the paused multipart body is not closed by its boundary" };
+        let name = null;
+        for (const line of body.slice(position, headerEnd).split(CRLF)) {
+            const colon = line.indexOf(":");
+            const header = colon > 0 ? line.slice(0, colon).trim().toLowerCase() : "";
+            const value = colon > 0 ? line.slice(colon + 1).trim() : "";
+            if (header === "content-disposition" && name === null) {
+                const disposition = /^form-data; name="([^"\\\r\n]*)"$/.exec(value);
+                if (!disposition)
+                    return { refusal: "a part of the paused multipart body is not a plain form field" };
+                name = disposition[1];
+            }
+            else if (header !== "content-type" || !/^text\/plain(?:;\s*charset=utf-8)?$/i.test(value)) {
+                return { refusal: "a part of the paused multipart body is not a text field" };
+            }
+        }
+        if (name === null)
+            return { refusal: "a part of the paused multipart body names no field" };
+        fields.push({ name, value: body.slice(start, end), start, end });
+        position = end + delimiter.length;
+        if (body.startsWith("--", position)) {
+            const rest = body.slice(position + 2);
+            return rest === "" || rest === CRLF ? { fields } : { refusal: "the paused multipart body carries bytes after its closing boundary" };
+        }
+        if (!body.startsWith(CRLF, position))
+            return { refusal: "a boundary in the paused multipart body is not followed by a line break" };
+        position += CRLF.length;
+    }
+}
+function sameName(name, wanted) {
+    return !FORBIDDEN_KEYS.has(name) && (name.toLowerCase() === wanted.toLowerCase() || name.toUpperCase() === wanted.toUpperCase());
+}
+function jsonReader(parsed) {
+    return { parsed, exact: (at) => jsonAt(parsed, at), variants: (at) => valuesIgnoringCase(parsed, at), label: describePath };
+}
+function fieldReader(fields) {
+    return {
+        fields,
+        exact: (at) => {
+            const hits = fields.filter((field) => field.name === at);
+            return hits.length === 1 ? { found: true, value: hits[0].value, field: hits[0] } : { found: false };
+        },
+        variants: (at) => fields.filter((field) => sameName(field.name, at)).map((field) => field.value),
+        label: (at) => at
+    };
+}
+function readBody(p, body, contentType) {
+    if (typeof body !== "string")
+        return { refusal: "the paused body is not text" };
+    if (utf8Length(body) > MERCHANT_CARD_ENDPOINT_LIMITS.bodyBytes)
+        return { refusal: "the paused body is larger than a card request may be" };
+    const typeRefusal = contentTypeRefusal(p, contentType);
+    if (typeRefusal)
+        return { refusal: typeRefusal };
+    if (p.encoding === "json") {
+        let parsed2;
+        try {
+            parsed2 = JSON.parse(body);
+        }
+        catch {
+            return { refusal: "the paused body is not JSON" };
+        }
+        if (!isPlainObject(parsed2))
+            return { refusal: "the paused body is not a JSON object" };
+        if (!roundTrips(parsed2, body))
+            return { refusal: "the paused body does not round-trip through JSON, so its rules cannot be read" };
+        if (forbiddenKeyIn(parsed2))
+            return { refusal: "the paused body names a prototype key" };
+        return { reader: jsonReader(parsed2) };
+    }
+    const parsed = p.encoding === "form" ? parseForm(body) : parseMultipart(body, multipartBoundary(contentType));
+    if (parsed.refusal)
+        return parsed;
+    if (parsed.fields.some((field) => FORBIDDEN_KEYS.has(field.name)))
+        return { refusal: "the paused body names a prototype key" };
+    return { reader: fieldReader(parsed.fields) };
+}
+var SLOT_NAMES = /* @__PURE__ */ Object.freeze({
+    pan: "the card number",
+    cvv: "the security code",
+    exp_month: "the expiry month",
+    exp_year: "the expiry year",
+    brand: "the card network code"
+});
+function cardSlots(p) {
+    return [
+        ["pan", p.card.pan],
+        ["cvv", p.card.cvv],
+        ["exp_month", p.card.exp_month],
+        ["exp_year", p.card.exp_year],
+        ...p.card.brands.map((brand) => ["brand", brand])
+    ];
+}
+function placeholderFits(slot, spec, value) {
+    const text = typeof value === "string";
+    const int = Number.isInteger(value);
+    switch (slot) {
+        case "pan":
+            return text && /^\d{12,19}$/.test(value);
+        case "cvv":
+            return text && /^\d{3,4}$/.test(value);
+        case "exp_month":
+            if (spec.format === "mm")
+                return text && /^(?:0[1-9]|1[0-2])$/.test(value);
+            if (spec.format === "m_int")
+                return int && value >= 1 && value <= 12;
+            return spec.format === "as_typed" && (text && /^(?:0?[1-9]|1[0-2])$/.test(value) || int && value >= 1 && value <= 12);
+        case "exp_year":
+            if (spec.format === "yyyy")
+                return text && /^\d{4}$/.test(value);
+            if (spec.format === "yyyy_int")
+                return int && value >= 1e3 && value <= 9999;
+            return spec.format === "as_typed" && (text && /^(?:\d{2}|\d{4})$/.test(value) || int && (value >= 0 && value <= 99 || value >= 1e3 && value <= 9999));
+        case "brand":
+            return spec.map ? Object.values(spec.map).includes(value) : text && value !== "";
+        default:
+            return false;
+    }
+}
+function isNothing(value) {
+    return value === null || value === "" || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0;
+}
+function rulesRefusal(p, reader, body) {
+    const request = `the paused body is not ${p.merchant}'s card request`;
+    for (const [slot, spec] of cardSlots(p)) {
+        const label = reader.label(spec.at);
+        const once = onlyOnce(reader.variants(spec.at).length, label);
+        if (once)
+            return `${request}: ${once}`;
+        const at = reader.exact(spec.at);
+        if (!at.found)
+            return `${request}: ${label} is not spelled as reviewed`;
+        if (!placeholderFits(slot, spec, at.value))
+            return `${request}: ${label} is not ${SLOT_NAMES[slot]} in the reviewed form`;
+    }
+    if (countRuns(body, reader.exact(p.card.pan.at).value) !== 1) {
+        return `${request}: the card number appears outside ${reader.label(p.card.pan.at)}`;
+    }
+    for (const rule of p.requires) {
+        const label = reader.label(rule.at);
+        const variants = reader.variants(rule.at);
+        const at = reader.exact(rule.at);
+        const holds = (value) => "equals" in rule ? value === rule.equals : "one_of" in rule ? rule.one_of.includes(value) : !isNothing(value);
+        if (!at.found || variants.length !== 1 || !holds(at.value))
+            return `${request}: ${label} is not what the review requires`;
+    }
+    for (const rule of p.refuse) {
+        const values = reader.variants(rule.at);
+        const fires = rule.when === "present" ? values.length > 0 : rule.when === "nonempty" ? values.some((value) => !isNothing(value)) : p.encoding === "json" ? values.some((value) => value !== false && value !== null) : values.some((value) => value !== "" && value !== "false");
+        if (fires)
+            return `the paused body asks ${p.merchant} for more than this purchase: ${reader.label(rule.at)}`;
+    }
+    if (p.amount) {
+        const label = reader.label(p.amount.at);
+        const at = reader.exact(p.amount.at);
+        const fits = p.amount.kind === "decimal_string" ? typeof at.value === "string" && /^\d{1,9}(?:\.\d{1,2})?$/.test(at.value) : p.encoding === "json" ? Number.isSafeInteger(at.value) && at.value >= 0 : typeof at.value === "string" && /^\d{1,12}$/.test(at.value);
+        if (!at.found || reader.variants(p.amount.at).length !== 1 || !fits)
+            return `${request}: the amount at ${label} is not a ${p.amount.kind.replace("_", " ")}`;
+    }
+    if (isPlainObject(p.currency)) {
+        const at = reader.exact(p.currency.at);
+        if (!at.found || reader.variants(p.currency.at).length !== 1 || typeof at.value !== "string" || !/^[A-Z]{3}$/.test(at.value)) {
+            return `${request}: ${reader.label(p.currency.at)} is not a currency code`;
+        }
+    }
+    return null;
+}
+function merchantCardEndpointBodyRefusal(profile, body, contentType) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const read = readBody(p, body, contentType);
+    return read.refusal ?? rulesRefusal(p, read.reader, body);
+}
+var TWO_DECIMAL_CURRENCIES = /* @__PURE__ */ new Set(["usd", "eur", "gbp", "cad", "aud"]);
+function merchantCardEndpointAmount(profile, body, contentType) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const read = readBody(p, body, contentType);
+    const refusal = read.refusal ?? rulesRefusal(p, read.reader, body);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    const currency = (typeof p.currency === "string" ? p.currency : read.reader.exact(p.currency.at).value).toLowerCase();
+    if (!p.amount)
+        return { amountCents: null, currency };
+    const value = read.reader.exact(p.amount.at).value;
+    if (p.amount.kind === "minor_int")
+        return { amountCents: Number(value), currency };
+    if (!TWO_DECIMAL_CURRENCIES.has(currency))
+        throw new Error(`Refusing to pay: ${p.merchant}'s amount is in a currency this build does not read.`);
+    const [whole, fraction = ""] = value.split(".");
+    return { amountCents: Number(whole) * 100 + Number(fraction.padEnd(2, "0")), currency };
+}
+function endpointMatches(p, rawUrl, method, opts) {
+    if (typeof rawUrl !== "string" || rawUrl.length > MERCHANT_CARD_ENDPOINT_LIMITS.urlLength)
+        return false;
+    if (typeof method !== "string" || method.toUpperCase() !== p.method)
+        return false;
+    if (rawUrl.includes("#"))
+        return false;
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== rawUrl || url.protocol !== "https:" || url.port || url.username || url.password)
+        return false;
+    if (url.origin !== p.endpoint)
+        return false;
+    if (opts?.checkoutOrigin !== void 0 && opts.checkoutOrigin !== p.checkout)
+        return false;
+    if (!pathMatchesTemplate(p.path, url.pathname))
+        return false;
+    const mark = rawUrl.indexOf("?");
+    return queryPlaceholders(p.query, mark === -1 ? null : rawUrl.slice(mark + 1)) !== null;
+}
+function merchantCardEndpointMatches(profile, rawUrl, method, opts) {
+    return endpointMatches(trustedMerchantCardEndpoint(profile), rawUrl, method, opts);
+}
+function matchMerchantCardEndpoint(rawUrl, method, opts) {
+    return MERCHANT_CARD_ENDPOINT_CLIENT_TABLE.find((p) => endpointMatches(p, rawUrl, method, opts)) ?? null;
+}
+function assertMerchantCardEndpoint(authorization) {
+    if (!isPlainObject(authorization))
+        throw new Error("Refusing to pay: malformed payment endpoint.");
+    if (authorization.mode !== MERCHANT_CARD_ENDPOINT_MODE || authorization.psp !== MERCHANT_CARD_ENDPOINT_PSP) {
+        throw new Error("Refusing to pay: this payment is not a reviewed merchant's own card request.");
+    }
+    const named = authorization.merchant_card_endpoint;
+    if (!isPlainObject(named) || typeof named.profile !== "string")
+        throw new Error("Refusing to pay: this payment names no merchant Agentcard reviewed.");
+    const profile = trustedMerchantCardEndpoint(named.profile);
+    let url;
+    try {
+        url = new URL(authorization.url);
+    }
+    catch {
+        throw new Error("Refusing to pay: malformed payment endpoint.");
+    }
+    const method = authorization.method === void 0 ? "POST" : authorization.method;
+    if (!endpointMatches(profile, authorization.url, method)) {
+        throw new Error(`Refusing to pay: ${url.hostname} is not ${profile.merchant}'s reviewed card endpoint.`);
+    }
+    if (named.endpoint_host !== void 0 && named.endpoint_host !== url.hostname) {
+        throw new Error(`Refusing to pay: this payment names a different host from ${url.hostname}, the one it pays.`);
+    }
+    if (named.page_origin !== profile.checkout) {
+        throw new Error(`Refusing to pay: this payment was not started on ${profile.merchant}'s checkout page.`);
+    }
+    if (!merchantCardEndpointLive(profile))
+        throw new Error(`Refusing to pay: Agentcard has not turned on payments to ${profile.merchant} yet.`);
+    return Object.assign(url, { profile });
+}
+function refererKept(p, referer) {
+    if (typeof referer !== "string" || referer.length > MERCHANT_CARD_ENDPOINT_LIMITS.headerValueBytes || !PRINTABLE_ASCII.test(referer) || referer.includes("#"))
+        return false;
+    let url;
+    try {
+        url = new URL(referer);
+    }
+    catch {
+        return false;
+    }
+    return url.href === referer && url.origin === p.checkout && !url.username && !url.password;
+}
+function lowerHeaders(headers) {
+    const out = /* @__PURE__ */ Object.create(null);
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (Object.prototype.hasOwnProperty.call(out, lower))
+            return null;
+        out[lower] = value;
+    }
+    return out;
+}
+function merchantCardEndpointSessionRefusal(profile, bundle) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const limits = MERCHANT_CARD_ENDPOINT_LIMITS;
+    if (!isPlainObject(bundle))
+        return "the session bundle is missing";
+    if (Object.keys(bundle).some((member) => !BUNDLE_MEMBERS.has(member)))
+        return "the session bundle carries a member it may not";
+    if (!endpointMatches(p, bundle.url, p.method))
+        return `the session bundle's URL is not ${p.merchant}'s reviewed card endpoint`;
+    if (bundle.page_origin !== p.checkout)
+        return `the card request was not paused on ${p.checkout}`;
+    const raw = bundle.headers === void 0 ? {} : bundle.headers;
+    const headers = isPlainObject(raw) ? lowerHeaders(raw) : null;
+    if (!headers)
+        return "the session headers are not one value per name";
+    let total = 0;
+    for (const [name, value] of Object.entries(headers)) {
+        if (NEVER_FROM_CAPTURE.test(name) || !p.session.headers.includes(name))
+            return `the session bundle carries a header outside ${p.merchant}'s reviewed list`;
+        if (typeof value !== "string" || !PRINTABLE_ASCII.test(value) || value.length > limits.headerValueBytes)
+            return `the session header ${name} is not printable text within the limit`;
+        total += name.length + value.length;
+    }
+    if (total > limits.headerBytes)
+        return "the session headers are larger than the limit";
+    for (const name of p.session.required) {
+        if (typeof headers[name] !== "string" || headers[name] === "")
+            return `the session bundle is missing ${name}`;
+    }
+    const cookies = bundle.cookies === void 0 ? [] : bundle.cookies;
+    if (!Array.isArray(cookies))
+        return "the session cookies are not a list";
+    if (!p.session.cookies && cookies.length > 0)
+        return `${p.merchant}'s card request carries no cookies`;
+    if (cookies.length > limits.cookies)
+        return "the session bundle carries more cookies than the limit";
+    let cookieBytes = 0;
+    for (const cookie of cookies) {
+        if (!isPlainObject(cookie) || Object.keys(cookie).sort().join(",") !== "name,value" || typeof cookie.name !== "string" || !COOKIE_NAME.test(cookie.name) || typeof cookie.value !== "string" || !COOKIE_VALUE.test(cookie.value))
+            return "a session cookie is not an RFC 6265 name and value";
+        if (cookie.name.length + cookie.value.length + 1 > limits.headerValueBytes)
+            return "a session cookie is larger than the limit";
+        cookieBytes += cookie.name.length + cookie.value.length + 3;
+    }
+    if (cookieBytes > limits.headerBytes)
+        return "the session cookies are larger than the limit";
+    if (bundle.referer !== void 0 && !refererKept(p, bundle.referer))
+        return `the session Referer is not a page on ${p.checkout}`;
+    return merchantCardEndpointBodyRefusal(p.id, bundle.body, headers["content-type"]);
+}
+function slotValue(slot, spec, placeholder, facts) {
+    if (slot === "pan")
+        return facts.number;
+    if (slot === "cvv")
+        return facts.cvc;
+    if (slot === "exp_month") {
+        const padded = String(facts.month).padStart(2, "0");
+        if (spec.format === "mm")
+            return padded;
+        if (spec.format === "m_int" || typeof placeholder === "number")
+            return facts.month;
+        return placeholder.length === 2 ? padded : String(facts.month);
+    }
+    if (spec.format === "yyyy")
+        return String(facts.year);
+    if (spec.format === "yyyy_int")
+        return facts.year;
+    if (typeof placeholder === "number")
+        return placeholder >= 1e3 ? facts.year : facts.year % 100;
+    return placeholder.length === 4 ? String(facts.year) : String(facts.year % 100).padStart(2, "0");
+}
+function writeJson(parsed, at, value) {
+    const parent = jsonAt(parsed, at.slice(0, -1));
+    const key = at[at.length - 1];
+    const owned = parent.found && (typeof key === "number" ? Array.isArray(parent.value) && key < parent.value.length : isPlainObject(parent.value) && !FORBIDDEN_KEYS.has(key) && Object.prototype.hasOwnProperty.call(parent.value, key));
+    if (!owned)
+        throw new SubstitutionError(`the paused body has no field at ${describePath(at)}`);
+    parent.value[key] = value;
+}
+function substituteMerchantCardEndpoint(body, contentType, profile, card) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const read = readBody(p, body, contentType);
+    const refusal = read.refusal ?? rulesRefusal(p, read.reader, body);
+    if (refusal)
+        throw new SubstitutionError(refusal);
+    const facts = cardFacts(card);
+    const typed = read.reader.exact(p.card.pan.at).value;
+    if (typed === facts.number)
+        throw new SubstitutionError("the paused body already carries the real card number");
+    const bins = p.card.bins && facts.brand && Object.prototype.hasOwnProperty.call(p.card.bins, facts.brand) ? p.card.bins[facts.brand] : null;
+    if (bins && !bins.some((prefix) => facts.number.startsWith(prefix)))
+        throw new SubstitutionError(`${p.merchant} does not take this card's number range`);
+    const writes = [];
+    for (const [slot, spec] of cardSlots(p)) {
+        const at = read.reader.exact(spec.at);
+        if (slot === "brand" && !spec.map)
+            continue;
+        let value;
+        if (slot === "brand") {
+            value = facts.brand && Object.prototype.hasOwnProperty.call(spec.map, facts.brand) ? spec.map[facts.brand] : void 0;
+            if (value === void 0)
+                throw new SubstitutionError(`${p.merchant} does not take this card's network`);
+        }
+        else {
+            value = slotValue(slot, spec, at.value, facts);
+        }
+        writes.push({ at: spec.at, found: at, value });
+    }
+    let out = body;
+    if (p.encoding === "json") {
+        for (const write of writes)
+            writeJson(read.reader.parsed, write.at, write.value);
+        out = JSON.stringify(read.reader.parsed);
+    }
+    else {
+        for (const write of [...writes].sort((a, b) => b.found.field.start - a.found.field.start)) {
+            const text = p.encoding === "form" ? encodeURIComponent(String(write.value)).replace(/%20/g, "+") : String(write.value);
+            out = out.slice(0, write.found.field.start) + text + out.slice(write.found.field.end);
+        }
+    }
+    if (countRuns(out, typed) !== 0)
+        throw new SubstitutionError("the typed card number would still reach the merchant");
+    if (countRuns(out, facts.number) !== 1)
+        throw new SubstitutionError("the card number would reach the merchant outside its field");
+    if (!merchantCardEndpointLive(p))
+        throw new SubstitutionError(`Agentcard has not turned on payments to ${p.merchant} yet`);
+    return out;
+}
+function merchantEndpointRequest(profile, bundle, card) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const refusal = merchantCardEndpointSessionRefusal(p.id, bundle);
+    if (refusal)
+        throw new Error(`Refusing to pay: ${refusal}.`);
+    const captured = lowerHeaders(bundle.headers ?? {});
+    const body = substituteMerchantCardEndpoint(bundle.body, captured["content-type"], p.id, card);
+    const headers = { "content-type": p.encoding === "form" ? "application/x-www-form-urlencoded; charset=UTF-8" : captured["content-type"] };
+    for (const [name, value] of Object.entries(captured))
+        if (name !== "content-type")
+            headers[name] = value;
+    const cookies = bundle.cookies ?? [];
+    if (p.session.cookies && cookies.length > 0)
+        headers.cookie = cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+    headers.origin = p.checkout;
+    if (bundle.referer !== void 0)
+        headers.referer = bundle.referer;
+    return { url: bundle.url, method: p.method, headers, body };
+}
+function headerPairs(headers) {
+    if (headers === void 0)
+        return [];
+    if (Array.isArray(headers)) {
+        return headers.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string") ? headers : null;
+    }
+    if (!isPlainObject(headers))
+        return null;
+    const pairs = [];
+    for (const [name, value] of Object.entries(headers)) {
+        for (const item of Array.isArray(value) ? value : [value]) {
+            if (typeof item !== "string")
+                return null;
+            pairs.push([name, item]);
+        }
+    }
+    return pairs;
+}
+function answerParts(response) {
+    const pairs = isPlainObject(response) ? headerPairs(response.headers) : null;
+    if (!pairs || !Number.isInteger(response.status) || response.status < 100 || response.status > 599 || typeof response.bodyText !== "string" || utf8Length(response.bodyText) > MERCHANT_CARD_ENDPOINT_LIMITS.answerBytes) {
+        throw new Error("Refusing to read: the merchant's answer is malformed.");
+    }
+    return pairs;
+}
+var BASE64_RUN = /[A-Za-z0-9+/_-]{8,}/g;
+var STREAM_RUN_LENGTH = 16;
+var CODE_BASE64_RUN = /[A-Za-z0-9+/_-]{4,}/g;
+var BASE64_ESCAPE = /\\\/|\\u002[bBfF]|%2[bBfF]|&#(?:43|47|x2[bBfF]);/g;
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var unescapeBase64 = (escape) => /43|[bB]/.test(escape) ? "+" : "/";
+function base64Bytes(run, skip) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (let i = skip; i < run.length; i += 1) {
+        const char = run[i];
+        value = value << 6 | (char === "-" ? 62 : char === "_" ? 63 : BASE64_ALPHABET.indexOf(char));
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+function compressedStream(bytes) {
+    const first = bytes.charCodeAt(0);
+    const second = bytes.charCodeAt(1);
+    return first === 31 && second === 139 || (first & 15) === 8 && first >> 4 <= 7 && (first << 8 | second) % 31 === 0;
+}
+function carriesCard(text, facts, pan, code, depth, seen) {
+    if (text.search(pan) !== -1)
+        return true;
+    for (const match of text.matchAll(CODE_KEY))
+        if (match[1] === facts.cvc)
+            return true;
+    if (codeNearKey(text, code))
+        return true;
+    if (depth === 0)
+        return false;
+    for (const [run] of text.replace(BASE64_ESCAPE, unescapeBase64).matchAll(BASE64_RUN)) {
+        for (let skip = 0; skip < 4; skip += 1) {
+            const bytes = base64Bytes(run, skip);
+            if (run.length >= STREAM_RUN_LENGTH && compressedStream(bytes))
+                seen.compressed = true;
+            if (carriesCard(bytes.replace(/\0/g, ""), facts, pan, code, depth - 1, seen))
+                return true;
+        }
+    }
+    return false;
+}
+function responseCardLeak(card, response) {
+    const facts = cardFacts(card);
+    const pan = digitRun(facts.number);
+    const code = codeRun(facts.cvc);
+    const seen = { compressed: false };
+    for (const text of [response.bodyText, ...answerParts(response).flat()]) {
+        if (carriesCard(text, facts, pan, code, 2, seen))
+            return "card_in_response";
+    }
+    return seen.compressed ? "unreadable_in_response" : null;
+}
+function merchantCardEndpointAnswer(profile, response, card) {
+    const p = trustedMerchantCardEndpoint(profile);
+    const pairs = answerParts(response);
+    const withheld = responseCardLeak(card, response);
+    if (withheld)
+        return { status: response.status, withheld, headers: {}, set_cookies: [], bodyText: null };
+    const headers = {};
+    const setCookies = [];
+    for (const [rawName, value] of pairs) {
+        const name = rawName.toLowerCase();
+        if (!p.response.headers.includes(name))
+            continue;
+        if (name === "set-cookie")
+            setCookies.push(value);
+        else
+            headers[name] = Object.prototype.hasOwnProperty.call(headers, name) ? `${headers[name]}, ${value}` : value;
+    }
+    return { status: response.status, headers, set_cookies: setCookies, bodyText: response.bodyText };
+}
+export { MERCHANT_CARD_ENDPOINT_CLIENT_TABLE, MERCHANT_CARD_ENDPOINT_LIMITS, MERCHANT_CARD_ENDPOINT_MODE, MERCHANT_CARD_ENDPOINT_PROFILES, MERCHANT_CARD_ENDPOINT_PSP, MERCHANT_CARD_ENDPOINT_RECOGNIZERS, SubstitutionError, assertMerchantCardEndpoint, matchMerchantCardEndpoint, merchantCardEndpointAmount, merchantCardEndpointAnswer, merchantCardEndpointBodyRefusal, merchantCardEndpointById, merchantCardEndpointLive, merchantCardEndpointMatches, merchantCardEndpointRecognizerById, merchantCardEndpointSessionRefusal, merchantEndpointRequest, responseCardLeak, substituteMerchantCardEndpoint, trustedMerchantCardEndpoint };