@agent-cards/sdk 0.20.0 → 0.22.0

package/dist/verifone.js

@@ -0,0 +1,119 @@
+/**
+ * Verifone eCommerce merchants, as the agent's browser sees them.
+ *
+ * A Verifone merchant (The Container Store) keeps its own card inputs and has
+ * verifone.js encrypt the card in the page under the merchant's own Verifone key,
+ * then posts the blob to ITS OWN server. No processor host is involved, so the
+ * processor registry can never recognize that request. Agentcard reviews each such
+ * merchant instead and pins its card request (a leg: endpoint, body rules and where
+ * the blob sits) and its key in a profile (payment-core verifone-profiles.js). This
+ * build carries those profiles as a generated projection (verifone.generated.ts) and
+ * arms one only when the API serves it (VaultClient.syncRegistry asks with the
+ * verifone_card_capture capability), which it does only for a company Agentcard
+ * turned Verifone on for. Every other company's checkout at a Verifone merchant is
+ * never paused, as before.
+ *
+ * A served profile's `status` keeps it dark: 'observe' pauses every request to the
+ * merchant's origin that carries a verifone.js blob, reports its shape (a hash of its
+ * key paths, never a value) and aborts it, so the agent's placeholder card never
+ * reaches the merchant and nothing is charged; 'enabled' lets a prepared checkout
+ * pay the reviewed leg. A profile is 'enabled' only when the API and this build both
+ * say so. The Container Store ships in 'observe', with no leg and no key reviewed.
+ */
+import * as generated from './verifone.generated.js';
+import { sha256Hex as sharedSha256Hex } from './adyen-merchant-hosted.generated.js';
+import { SubstitutionError } from './substitutions.generated.js';
+const sha256Hex = sharedSha256Hex;
+const core = generated;
+const BUILT = core.VERIFONE_PROFILE_RECOGNIZERS;
+/** Whether an entry the API served is a Verifone profile (`{ verifone_profile }`), never a recognizer. */
+export function isVerifoneProfileEntry(entry) {
+    return !!entry && typeof entry === 'object' && !Array.isArray(entry) && 'verifone_profile' in entry;
+}
+/**
+ * The profiles this client arms: only the ones the API served, each once, in this
+ * build's order. A served entry is `{ verifone_profile: <the profile's wire
+ * projection> }`, and the first one that names a profile with exactly this build's
+ * rules (origins, legs, body rules, key subkey: everything but `status`) and a status
+ * this build knows decides it: 'enabled' only when both that entry and this build say
+ * so. A profile the API did not serve, or served with other rules, is not armed.
+ */
+export function armServedVerifoneProfiles(entries = []) {
+    const decided = new Map();
+    for (const entry of entries) {
+        if (!isVerifoneProfileEntry(entry))
+            continue;
+        const served = entry.verifone_profile;
+        if (!served || typeof served !== 'object' || Array.isArray(served))
+            continue;
+        const id = served.id;
+        const status = served.status;
+        const built = typeof id === 'string' ? BUILT.find((profile) => profile.id === id) : undefined;
+        if (!built || decided.has(built.id) || (status !== 'observe' && status !== 'enabled') || !core.verifoneProfileRulesMatch(built.id, served))
+            continue;
+        decided.set(built.id, status === 'enabled' && built.status === 'enabled' ? 'enabled' : 'observe');
+    }
+    return BUILT.filter((built) => decided.has(built.id))
+        .map((built) => Object.freeze({ id: built.id, merchant: built.merchant, environment: built.environment, status: decided.get(built.id) }));
+}
+/** The armed profile whose endpoint origin a URL is on, or null. */
+export function verifoneProfileFor(profiles, url) {
+    if (typeof url !== 'string')
+        return null;
+    let origin;
+    try {
+        origin = new URL(url).origin;
+    }
+    catch {
+        return null;
+    }
+    return profiles.find((profile) => core.verifoneProfileUrlGlobs(profile.id).some((glob) => glob === `${origin}/*`)) ?? null;
+}
+/** The Fetch.enable globs that pause every request to every armed profile's endpoint origins. */
+export function verifoneProfileUrlPatterns(profiles) {
+    return [...new Set(profiles.flatMap((profile) => core.verifoneProfileUrlGlobs(profile.id)))];
+}
+/** The verdict payment-core gives a request at an armed profile: pause (its reviewed leg), abort (a blob it cannot pay, with the reason) or pass. */
+export function classifyVerifoneProfileRequest(profile, url, method, body) {
+    return core.classifyVerifoneRequest(profile.id, url, method, body);
+}
+/** The URL an event names for a request at an armed profile: its origin and, for a leg, the leg's path template; never a query or an id. */
+export function verifoneTemplatedUrl(profileId, url) {
+    return core.verifoneProfileTemplatedUrl(profileId, url);
+}
+/** The endpoint a Verifone preparation pays from a checkout page: the profile's leg URL, or null. */
+export function verifoneProfileEndpointFor(profileId, checkoutOrigin) {
+    return core.verifoneProfileEndpointFor(profileId, checkoutOrigin);
+}
+/** Whether a paused request is the one a Verifone preparation for this profile consents to. */
+export function isPreparedVerifoneRequest(url, method, body, profileId) {
+    return core.isPreparedVerifoneRequest(url, method, body, profileId);
+}
+/** Whether an approval's substitution is exactly a Verifone blob for this profile. */
+export function isVerifoneSubstitution(sub, profileId) {
+    if (!sub || typeof sub !== 'object' || Array.isArray(sub))
+        return false;
+    const value = sub;
+    return Object.keys(value).sort().join(',') === 'blob,encoding,kind,profile' && value.encoding === 'json' && value.kind === 'verifone'
+        && value.profile === profileId && core.isVerifoneBlob(value.blob);
+}
+/**
+ * The continuation of a Verifone approval: the live paused body with the device's blob in place
+ * of the page's placeholder blob. The API keeps no merchant body, so the live body must first
+ * hash to the one the API checked when the authorization was created (`bodySha256`); a page that
+ * rewrote its body while the cardholder decided is refused rather than paid. payment-core's
+ * substituteVerifoneBlob then reads the leg's rules on the live body again, writes only the blob,
+ * and refuses a profile that is not enabled or a blob under any other key. Throws
+ * SubstitutionError; nothing leaves the browser when it does.
+ */
+export function substituteVerifoneBody(request, replay) {
+    if (typeof request.body !== 'string' || sha256Hex(request.body) !== replay.bodySha256) {
+        throw new SubstitutionError('the paused body is not the one Agentcard checked when this checkout was created');
+    }
+    try {
+        return core.substituteVerifoneBlob(request, replay.substitutions);
+    }
+    catch (error) {
+        throw new SubstitutionError(error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/voice-types.d.ts

@@ -592,6 +592,27 @@ export interface AppVoiceKeyDescription {
     proof_version: 1;
     lang?: Language;
     device_label?: string;
+    /**
+     * The phone's hardware key, attested for this app voice key (WP199): `VoiceHost` 1.9.8 puts it on the description it
+     * hands your `register` when the phone attested one, and `voice.appKeys.register` sends it on as `hardware`. Absent
+     * from a phone that registered a software key.
+     */
+    hardware?: HardwareAttestation;
+}
+/**
+ * The hardware key the phone binds to its app voice key at registration (WP199): the key's id, the platform's
+ * attestation of it (Android's certificate chain as base64url DER, one string a certificate, or iOS App Attest's
+ * attestation object as one base64url string), the challenge the attestation answers (`SHA-256(credential_id + "." +
+ * public_key)`, as the phone computed it; Agentcard recomputes and compares), and on iOS the App ID the build runs
+ * under (`<team id>.<bundle id>`), which Agentcard checks the attestation's `rpIdHash` against. Opaque to the SDK: it
+ * is sent as `hardware` on the registration and Agentcard checks it.
+ */
+export interface HardwareAttestation {
+    platform: 'android' | 'ios';
+    key_id: string;
+    attestation: string[] | string;
+    challenge: string;
+    app_id?: string;
 }
 /** The registered app voice key, with the phone's scoped credential (one hour; register again for a fresh one). */
 export interface RegisteredAppVoiceKey {
@@ -610,6 +631,12 @@ export interface RegisteredAppVoiceKey {
         token_type: 'Bearer';
         expires_in: number;
     };
+    /** Whether Agentcard verified a hardware key bound to this app voice key (WP199); absent from an API from before it. */
+    hardware_proven?: boolean;
+    /** Where the proven hardware key lives: Android StrongBox or TEE, or Apple's Secure Enclave. */
+    hardware_level?: 'strongbox' | 'tee' | 'secure_enclave';
+    /** Which hardware key is proven, by its id, so the phone compares it with the key it holds (WP199). Present only when proven. */
+    hardware_key_id?: string;
 }
 /** `voice.appKeys.revoke`: the key is revoked and nothing else is. */
 export interface RevokedAppVoiceKey {

package/dist/voice.d.ts

@@ -14,7 +14,7 @@ import { ApiModule, type ApiTransport } from './api-module.js';
 import { type StreamFormat, type StreamHandle, type ChannelKind } from './voice-stream.generated.js';
 import { type PkceCrypto } from './voice-pkce.js';
 import type { Language, LanguageInfo } from './languages.js';
-import { type Action, type ActionState, type AppVoiceKeyDescription, type ApprovalPosture, type Authorization, type AuthorizationResult, type Cancelled, type CancelReason, type Connected, type ConnectInput, type ConnectResult, type CreateAuthorizationInput, type Done, type Exchanged, type ExchangeInput, type HostApprovalBundle, type Person, type Proposed, type RegisteredAppVoiceKey, type RevokedAppVoiceKey, type Revoked, type SessionState, type VaultSessionStep, type VoiceChallenge, type VoiceResetInput } from './voice-types.js';
+import { type Action, type ActionState, type AppVoiceKeyDescription, type ApprovalPosture, type Authorization, type AuthorizationResult, type Cancelled, type CancelReason, type Connected, type ConnectInput, type ConnectResult, type CreateAuthorizationInput, type Done, type Exchanged, type ExchangeInput, type HardwareAttestation, type HostApprovalBundle, type Person, type Proposed, type RegisteredAppVoiceKey, type RevokedAppVoiceKey, type Revoked, type SessionState, type VaultSessionStep, type VoiceChallenge, type VoiceResetInput } from './voice-types.js';
 export { stripePaymentIntentConfirm, type MintedIntent } from './requests.js';
 /**
  * The voice half of the client's options: named once, per business, when the
@@ -290,9 +290,14 @@ export declare class VoiceModule extends ApiModule {
          * the phone and nothing else. `user_id` is the person the connect exchange returned; required. 404
          * `connection_not_found` when the person never connected through this client; 409 `credential_exists`
          * when the credential id already names a different key. The same key again answers with a fresh credential.
+         * `hardware` (WP199), when the phone minted a hardware key for this app voice key, is its attestation as the
+         * phone handed it over: on the key itself (`key.hardware`, where `VoiceHost` 1.9.8 puts it, so a server that
+         * forwards the key as it came needs no change) or in `opts.hardware`, which wins when both are given. It is sent
+         * on as is, and the answer's `hardware_proven` and `hardware_level` say what Agentcard made of it.
          */
         register: (key: AppVoiceKeyDescription, opts: {
             user_id: string;
+            hardware?: HardwareAttestation;
         }) => Promise<RegisteredAppVoiceKey>;
         /** Revokes one app voice key of the person `user_id` names; the person's other keys, the card and the connection stay. Idempotent. */
         revoke: (keyId: string, opts: {

package/dist/voice.js

@@ -657,6 +657,10 @@ export class VoiceModule extends ApiModule {
          * the phone and nothing else. `user_id` is the person the connect exchange returned; required. 404
          * `connection_not_found` when the person never connected through this client; 409 `credential_exists`
          * when the credential id already names a different key. The same key again answers with a fresh credential.
+         * `hardware` (WP199), when the phone minted a hardware key for this app voice key, is its attestation as the
+         * phone handed it over: on the key itself (`key.hardware`, where `VoiceHost` 1.9.8 puts it, so a server that
+         * forwards the key as it came needs no change) or in `opts.hardware`, which wins when both are given. It is sent
+         * on as is, and the answer's `hardware_proven` and `hardware_level` say what Agentcard made of it.
          */
         register: async (key, opts) => {
             this.posture();
@@ -666,7 +670,8 @@ export class VoiceModule extends ApiModule {
             if (!key || typeof key.credential_id !== 'string' || typeof key.public_key !== 'string')
                 throw new AgentcardError('invalid_app_key', 'The app voice key needs credential_id and public_key, as VoiceHost describes it.');
             await this.t.languages.check(key.lang);
-            const body = { credential_id: key.credential_id, public_key: key.public_key, kind: 'app_voice_key', alg: 'ES256', proof_version: 1, ...(key.lang ? { lang: key.lang } : {}), ...(key.device_label ? { device_label: key.device_label } : {}) };
+            const hardware = opts.hardware ?? key.hardware;
+            const body = { credential_id: key.credential_id, public_key: key.public_key, kind: 'app_voice_key', alg: 'ES256', proof_version: 1, ...(key.lang ? { lang: key.lang } : {}), ...(key.device_label ? { device_label: key.device_label } : {}), ...(hardware ? { hardware } : {}) };
             const reg = await this.request(`/api/v2/vault_users/${encodeURIComponent(user)}/app_voice_keys`, { method: 'POST', body });
             if (!reg || !reg.credential || typeof reg.credential.token !== 'string')
                 throw new AgentcardError('register_failed', 'Agentcard registered the key without a scoped credential.');

package/dist/wspay.d.ts

@@ -0,0 +1,41 @@
+import type { ReplayResponse } from './client.js';
+export declare const WSPAY_PSP = "wspay";
+/** The dark-launch capability the API serves the wspay recognizer behind. */
+export declare const WSPAY_CAPABILITY = "wspay_confirm";
+/**
+ * Why the SDK refuses a WSPay request before anything is claimed, created or prompted:
+ *   - `unsupported_wspay_payment_method`: not the card frame's new-card confirm. That covers a
+ *     saved_card or temp_card_id body (no new card to fill), a card-shaped object the page
+ *     built into the transaction, another URL shape on the host, or headers the frame does not
+ *     send. The cardholder's device could never fill it.
+ *   - `wspay_keep_on_file_unsupported`: a sound confirm that asks WSPay to keep the card on file
+ *     (tokenize_pan true), so the merchant could charge it later without another approval. Only
+ *     the cardholder can agree to that, and no approval asks them yet.
+ * The API refuses the same requests at create (invalid_wspay_request and
+ * wspay_keep_on_file_unsupported), so a refusal here only saves the round trip.
+ */
+export type WspayRefusalReason = 'unsupported_wspay_payment_method' | 'wspay_keep_on_file_unsupported';
+/** True when the URL's host is one of WSPay's two Components hosts. */
+export declare function isWspayHost(url: string): boolean;
+/**
+ * The pause decision for a POST the registry recognized on a WSPay host. Null when it is the
+ * card frame's confirm of a new card for a one-time payment, which pauses for approval;
+ * otherwise the reason it is refused. It judges the whole request (the exact URL, the frame's
+ * content type, Accept and WP3-v2-Client authorization, and a body of the frame's own keys
+ * bound to the URL's client_secret) with payment-core's wspayConfirmRefusal, the check the API
+ * runs at create. It never passes keep-on-file consent: that waits for an approval that asks
+ * the cardholder.
+ */
+export declare function wspayRefusal(request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string | null;
+}): WspayRefusalReason | null;
+/**
+ * Whether an approved answer handed to a WSPay confirm is WSPay's 3-D Secure step: HTTP 200 with
+ * status `action_required`, which is how the API stores it (payment-core sanitizeWspayResponse,
+ * with no payment_result). The card frame then runs the bank's challenge in the agent's browser,
+ * and nothing is charged until the cardholder completes it there. The adapters read it after the
+ * handoff to report `requires_user_action` with reason `3ds` (lifecycle.ts).
+ */
+export declare function isWspayChallenge(requestUrl: string, replay: ReplayResponse): boolean;

package/dist/wspay.generated.d.ts

@@ -0,0 +1,41 @@
+declare var WSPAY_CONFIRM_HOSTS: readonly string[];
+declare var WSPAY_TEST_HOST: string;
+declare function wspayConfirmClientSecret(url: any): string | null;
+declare function isWspayConfirmUrl(url: any, method?: string): boolean;
+declare function isWspayNewCardBody(body: any, clientSecret: any, options: any): boolean;
+declare function classifyWspayRequest(url: any, method: any, body: any, options: any): "card" | "unsupported" | null;
+declare function isWspayConfirmRequest(request: any, options: any): any;
+declare function wspayStoredCredentialRequested(body: any): boolean | null;
+declare function wspayConfirmRefusal(request: any, options: any): "unsupported" | "keep_on_file" | null;
+declare function wspayRefusalMessage(reason: any): string;
+declare function injectWspayCard(body: any, card: any, options: any): {
+    body: string;
+    where: string[];
+};
+declare function wspayResponseOutcome(status: any, text2: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    pending?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    pending?: undefined;
+} | {
+    outcome: string;
+    reason?: undefined;
+    code?: undefined;
+    pending?: undefined;
+} | {
+    outcome: string;
+    pending: string;
+    reason?: undefined;
+    code?: undefined;
+};
+declare function sanitizeWspayResponse(text2: any, options: any): string;
+declare function wspayFacts(status: any, text2: any): {
+    outcome: string;
+    refusalCode: any;
+};
+export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };

package/dist/wspay.generated.js

@@ -0,0 +1,370 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 560fa6d54ff04e65a21dc08d3046495f67499274b35c83053f8b25370f13a17a
+// src/wspay.js
+var WSPAY_CONFIRM_HOSTS = Object.freeze(["proxy.wspay.biz", "proxy-test.wspay.biz"]);
+var WSPAY_TEST_HOST = "proxy-test.wspay.biz";
+var CONFIRM_PATH = /^\/v2\/payment\/([A-Za-z0-9_-]{1,128})\/confirm$/;
+var AUTHORIZATION = /^WP3-v2-Client [A-Za-z0-9_-]{1,256}$/;
+var CONTENT_TYPE = /^application\/json(?:;\s*charset=utf-8)?$/i;
+var ACCEPT_RANGES = /* @__PURE__ */ new Set(["application/json", "text/plain", "*/*"]);
+var TRANSACTION_TEXT = [
+    "ch_address",
+    "ch_city",
+    "ch_country",
+    "ch_zip",
+    "language",
+    "ch_email",
+    "ch_full_name",
+    "ch_phone",
+    "order_info",
+    "custom_params"
+];
+var TRANSACTION_KEYS = [...TRANSACTION_TEXT, "number_of_installments", "meta"];
+var META_KEYS = ["integration_type", "library_version", "library"];
+var CARD_DATA_KEYS = ["pan", "expiration_date", "cvv", "tokenize_pan"];
+var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this WSPay payment would keep the card on file without your consent. Nothing was sent.";
+var UNSUPPORTED_REFUSAL = "Refusing to pay: unsupported WSPay card payment request.";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var keysWithin = (value, allowed) => record(value) && Object.keys(value).every((key) => allowed.includes(key));
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var yymm = (value) => digits(value, 4, 4) && Number(value.slice(2)) >= 1 && Number(value.slice(2)) <= 12;
+function frameCardNumber(number) {
+    const mask = /^3[47]/.test(number) ? [4, 6, 5] : /^3[0689]/.test(number) ? [4, 6, 4] : [4, 4, 4, 4, 3];
+    const parts = [];
+    let at = 0;
+    for (const size of mask) {
+        if (at >= number.length)
+            break;
+        parts.push(number.slice(at, at + size));
+        at += size;
+    }
+    return at >= number.length ? parts.join(" ") : null;
+}
+var cardNumberField = (value) => {
+    if (typeof value !== "string")
+        return false;
+    const number = value.replace(/ /g, "");
+    return digits(number, 12, 19) && (value === number || value === frameCardNumber(number));
+};
+function readJson(body, limit = 65536) {
+    if (typeof body !== "string" || !body || body.length > limit)
+        return null;
+    let at = 0, nodes = 0;
+    const fail = () => {
+        throw new Error("invalid_wspay_json");
+    };
+    const space = () => {
+        while (" 	\r\n".includes(body[at] ?? "\0"))
+            at++;
+    };
+    const string = () => {
+        space();
+        const start = at;
+        if (body[at++] !== '"')
+            fail();
+        while (at < body.length) {
+            const char = body[at++];
+            if (char === "\\") {
+                at++;
+                continue;
+            }
+            if (char === '"')
+                return JSON.parse(body.slice(start, at));
+        }
+        return fail();
+    };
+    const value = (depth) => {
+        if (depth > 8 || ++nodes > 512)
+            fail();
+        space();
+        const char = body[at];
+        if (char === '"')
+            return string();
+        if (char === "{") {
+            at++;
+            const result = /* @__PURE__ */ Object.create(null), seen = /* @__PURE__ */ new Set();
+            space();
+            if (body[at] === "}") {
+                at++;
+                return result;
+            }
+            while (true) {
+                const key = string();
+                if (seen.has(key) || ["__proto__", "prototype", "constructor"].includes(key))
+                    fail();
+                seen.add(key);
+                space();
+                if (body[at++] !== ":")
+                    fail();
+                result[key] = value(depth + 1);
+                space();
+                const next = body[at++];
+                if (next === "}")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        if (char === "[") {
+            at++;
+            const result = [];
+            space();
+            if (body[at] === "]") {
+                at++;
+                return result;
+            }
+            while (true) {
+                result.push(value(depth + 1));
+                space();
+                const next = body[at++];
+                if (next === "]")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        for (const literal of ["true", "false", "null"]) {
+            if (body.startsWith(literal, at)) {
+                at += literal.length;
+                return JSON.parse(literal);
+            }
+        }
+        const number = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(body.slice(at, at + 32));
+        if (!number)
+            fail();
+        at += number[0].length;
+        const parsed = Number(number[0]);
+        if (!Number.isFinite(parsed))
+            fail();
+        return parsed;
+    };
+    try {
+        const parsed = value(0);
+        space();
+        return at === body.length && record(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function wspayConfirmClientSecret(url) {
+    if (typeof url !== "string" || url.length > 512 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.search || parsed.hash || !WSPAY_CONFIRM_HOSTS.includes(parsed.hostname))
+        return null;
+    return CONFIRM_PATH.exec(parsed.pathname)?.[1] ?? null;
+}
+function isWspayConfirmUrl(url, method = "POST") {
+    return method === "POST" && wspayConfirmClientSecret(url) !== null;
+}
+var PARES_REDIRECT = /^\/v2\/js\/3ds-pares-iframe\.html\?client_secret=([A-Za-z0-9_-]{1,128})&three_ds_controller=iframe$/;
+function confirmBody(body, clientSecret) {
+    const value = readJson(body);
+    if (!keysWithin(value, ["payment_method", "transaction", "pares_redirect_url"]) || !owns(value, "payment_method") || !owns(value, "transaction") || !owns(value, "pares_redirect_url"))
+        return null;
+    const pares = PARES_REDIRECT.exec(typeof value.pares_redirect_url === "string" ? value.pares_redirect_url : "");
+    if (!pares || pares[0] !== value.pares_redirect_url || clientSecret !== void 0 && pares[1] !== clientSecret)
+        return null;
+    const pm = value.payment_method, data = pm?.data;
+    if (!keysWithin(pm, ["type", "data"]) || pm.type !== "card" || !keysWithin(data, CARD_DATA_KEYS) || !CARD_DATA_KEYS.every((key) => owns(data, key)) || !cardNumberField(data.pan) || !yymm(data.expiration_date) || !digits(data.cvv, 3, 4) || typeof data.tokenize_pan !== "boolean")
+        return null;
+    const trx = value.transaction;
+    if (!keysWithin(trx, TRANSACTION_KEYS) || !owns(trx, "meta") || TRANSACTION_TEXT.some((key) => owns(trx, key) && !text(trx[key], key === "custom_params" ? 2048 : 256)))
+        return null;
+    const installments = trx.number_of_installments;
+    if (owns(trx, "number_of_installments") && !(Number.isSafeInteger(installments) && installments >= 1 && installments <= 99) && !(digits(installments, 1, 2) && Number(installments) >= 1))
+        return null;
+    if (!keysWithin(trx.meta, META_KEYS) || !META_KEYS.every((key) => owns(trx.meta, key)) || META_KEYS.some((key) => !exact(/^[A-Za-z0-9][A-Za-z0-9._ -]{0,63}$/, trx.meta[key])))
+        return null;
+    return value;
+}
+var payable = (value, options) => value.payment_method.data.tokenize_pan === false || record(options) && options.keepOnFile === true;
+function isWspayNewCardBody(body, clientSecret, options) {
+    const value = confirmBody(body, clientSecret);
+    return value !== null && payable(value, options);
+}
+function classifyWspayRequest(url, method, body, options) {
+    if (method !== "POST")
+        return null;
+    const clientSecret = wspayConfirmClientSecret(url);
+    if (clientSecret === null)
+        return null;
+    return isWspayNewCardBody(typeof body === "string" ? body : "", clientSecret, options) ? "card" : "unsupported";
+}
+function isWspayConfirmRequest(request, options) {
+    if (!record(request) || request.method !== "POST" || !record(request.headers))
+        return false;
+    const clientSecret = wspayConfirmClientSecret(request.url);
+    if (clientSecret === null || !isWspayNewCardBody(request.body, clientSecret, options))
+        return false;
+    const headers = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(request.headers)) {
+        const lower = name.toLowerCase();
+        if (headers.has(lower) || typeof value !== "string")
+            return false;
+        headers.set(lower, value);
+    }
+    const reviewed = (name) => text(headers.get(name), 1024) ? headers.get(name) : null;
+    const accept = reviewed("accept");
+    const ranges = accept === null ? [] : accept.split(",").map((range) => range.trim().toLowerCase());
+    return exact(CONTENT_TYPE, reviewed("content-type")) && exact(AUTHORIZATION, reviewed("authorization")) && ranges.includes("application/json") && ranges.every((range) => ACCEPT_RANGES.has(range));
+}
+function wspayStoredCredentialRequested(body) {
+    const value = confirmBody(body);
+    return value === null ? null : value.payment_method.data.tokenize_pan === true;
+}
+function wspayConfirmRefusal(request, options) {
+    if (!isWspayConfirmRequest(request, { keepOnFile: true }))
+        return "unsupported";
+    return isWspayConfirmRequest(request, options) ? null : "keep_on_file";
+}
+function wspayRefusalMessage(reason) {
+    return reason === "keep_on_file" ? KEEP_ON_FILE_REFUSAL : UNSUPPORTED_REFUSAL;
+}
+function injectWspayCard(body, card, options) {
+    const value = confirmBody(body);
+    if (!value)
+        throw new Error(UNSUPPORTED_REFUSAL);
+    if (!payable(value, options))
+        throw new Error(KEEP_ON_FILE_REFUSAL);
+    const month = card && (Number.isInteger(card.month) || digits(card.month, 1, 2)) ? Number(card.month) : NaN;
+    const year = card && (Number.isInteger(card.year) || digits(card.year, 2, 4)) ? Number(card.year) : NaN;
+    if (!card || !digits(card.number, 12, 19) || !digits(card.cvc, 3, 4) || !(month >= 1 && month <= 12) || !(year >= 0 && year <= 99 || year >= 2e3 && year <= 2099)) {
+        throw new Error("Could not fill the card fields for WSPay. Nothing was sent.");
+    }
+    const data = value.payment_method.data;
+    data.pan = data.pan.includes(" ") ? frameCardNumber(card.number) ?? card.number : card.number;
+    data.expiration_date = String(year % 100).padStart(2, "0") + String(month).padStart(2, "0");
+    data.cvv = card.cvc;
+    return { body: JSON.stringify(value), where: ["pan", "expiration_date", "cvv"].map((key) => "payment_method.data." + key) };
+}
+var ENVELOPE_KEYS = ["id", "status", "client_secret", "payment_result", "action_required", "order", "errors"];
+var RESULT_KEYS = [
+    "status",
+    "currency",
+    "amount",
+    "order_number",
+    "pan_token",
+    "created_at",
+    "transaction_type",
+    "payment_method",
+    "errors",
+    "response_message",
+    "success_url",
+    "transaction_response"
+];
+var panLike = (value) => /(?:[0-9][ _.:-]*){12,}/.test(value);
+var opaqueId = (value, max = 128) => exact(new RegExp(`^[A-Za-z0-9_.:-]{1,${max}}$`), value) && !panLike(value);
+var isoTime = (value) => text(value, 40) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:?\d{2})?$/.test(value);
+function httpsUrl(value) {
+    if (!text(value, 2048) || panLike(value))
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && url.href === value;
+    }
+    catch {
+        return false;
+    }
+}
+var emptyErrors = (value) => value === void 0 || value === null || Array.isArray(value) && value.length === 0;
+function namesSecret(url, secret) {
+    if (url.includes(secret))
+        return true;
+    try {
+        return decodeURIComponent(url).includes(secret);
+    }
+    catch {
+        return true;
+    }
+}
+function approvedResult(result) {
+    return keysWithin(result, RESULT_KEYS) && result.status === "approved" && emptyErrors(result.errors) && Number.isSafeInteger(result.amount) && result.amount >= 0 && exact(/^[A-Z]{3}$/, result.currency) && opaqueId(result.order_number, 64) && (!owns(result, "transaction_type") || ["authorize", "purchase"].includes(result.transaction_type));
+}
+function responseCode(result) {
+    const trx = record(result) ? result.transaction_response : null;
+    const code = record(trx) ? trx.response_code : null;
+    return exact(/^[0-9]{4}$/, code) ? code : null;
+}
+function wspayResponseOutcome(status, text2) {
+    if (status !== 200)
+        return { outcome: "unknown", reason: "wspay_status_unconfirmed" };
+    const value = readJson(text2);
+    if (!value)
+        return { outcome: "unknown", reason: "wspay_unreadable" };
+    if (!keysWithin(value, ENVELOPE_KEYS))
+        return { outcome: "unknown", reason: "wspay_unexpected_response" };
+    if (!emptyErrors(value.errors))
+        return { outcome: "unknown", reason: "wspay_processor_error" };
+    const result = value.payment_result;
+    if (value.status === "declined" || value.status === "approved" && record(result) && result.status === "declined") {
+        return { outcome: "refused", code: responseCode(result) ?? "declined" };
+    }
+    if (value.status === "approved" && approvedResult(result))
+        return { outcome: "approved" };
+    if (value.status === "action_required" && (result === null || result === void 0) && keysWithin(value.action_required, ["acs_url", "redirect_to"]) && httpsUrl(value.action_required.acs_url) && httpsUrl(value.action_required.redirect_to))
+        return { outcome: "approved", pending: "three_ds" };
+    return { outcome: "unknown", reason: "wspay_unconfirmed" };
+}
+function sanitizeWspayResponse(text2, options) {
+    const fail = () => {
+        throw new Error("Invalid WSPay payment response.");
+    };
+    const keepOnFile = record(options) && options.keepOnFile === true;
+    const clientSecret = record(options) && typeof options.clientSecret === "string" && options.clientSecret ? options.clientSecret : null;
+    if (wspayResponseOutcome(200, text2).outcome !== "approved")
+        return fail();
+    const value = readJson(text2);
+    if (value.status === "action_required") {
+        return JSON.stringify({
+            status: "action_required",
+            action_required: { acs_url: value.action_required.acs_url, redirect_to: value.action_required.redirect_to },
+            payment_result: null
+        });
+    }
+    const result = value.payment_result;
+    const safe = {
+        status: "approved",
+        currency: result.currency,
+        amount: result.amount,
+        order_number: result.order_number,
+        pan_token: null,
+        payment_method: null
+    };
+    if (isoTime(result.created_at))
+        safe.created_at = result.created_at;
+    if (owns(result, "transaction_type"))
+        safe.transaction_type = result.transaction_type;
+    if (httpsUrl(result.success_url) && clientSecret !== null && !namesSecret(result.success_url, clientSecret))
+        safe.success_url = result.success_url;
+    if (keepOnFile) {
+        if (result.pan_token !== null && result.pan_token !== void 0) {
+            if (!opaqueId(result.pan_token))
+                return fail();
+            safe.pan_token = result.pan_token;
+        }
+        const pm = result.payment_method, data = record(pm) ? pm.data : null;
+        if (pm !== null && pm !== void 0) {
+            if (!keysWithin(pm, ["type", "data"]) || pm.type !== "card" || !keysWithin(data, ["brand", "issuer", "masked", "expiration_date", "token"]) || !opaqueId(data.token) || owns(data, "brand") && !opaqueId(data.brand, 32) || owns(data, "issuer") && !opaqueId(data.issuer, 64) || owns(data, "expiration_date") && !yymm(data.expiration_date) || owns(data, "masked") && !exact(/^[0-9]{0,6}[-* xX]{4,16}[0-9]{4}$/, data.masked))
+                return fail();
+            safe.payment_method = { type: "card", data: { ...data } };
+        }
+    }
+    return JSON.stringify({ status: "approved", action_required: null, payment_result: safe });
+}
+function wspayFacts(status, text2) {
+    const verdict = wspayResponseOutcome(status, text2);
+    return { outcome: verdict.outcome, refusalCode: verdict.outcome === "refused" ? verdict.code : null };
+}
+export { WSPAY_CONFIRM_HOSTS, WSPAY_TEST_HOST, classifyWspayRequest, injectWspayCard, isWspayConfirmRequest, isWspayConfirmUrl, isWspayNewCardBody, sanitizeWspayResponse, wspayConfirmClientSecret, wspayConfirmRefusal, wspayFacts, wspayRefusalMessage, wspayResponseOutcome, wspayStoredCredentialRequested };