@agent-cards/sdk 0.21.0 → 0.22.0

package/dist/creditguard.generated.js

@@ -0,0 +1,662 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 83caafdf10afb4617e5eb3a896d3a1ba4b5c098747495658529c5d13798051cc
+// src/creditguard.js
+var CREDITGUARD_PPS_HOSTS = Object.freeze(["pps.creditguard.co.il", "pps2.creditguard.co.il", "ppsuat.creditguard.co.il"]);
+var CREDITGUARD_SANDBOX_HOST = "ppsuat.creditguard.co.il";
+var CREDITGUARD_OPERATION = "creditguard.card_request";
+var CREDITGUARD_JWE_HEADER = "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ";
+var CREDITGUARD_RECAPTCHA_WINDOW_MS = 11e4;
+var CREDITGUARD_PAGE_WINDOW_MS = 6e5;
+var UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var PROCESS_PATH = new RegExp(`^/services/v1/txn/(${UUID})/process$`);
+var TXID = new RegExp(`^${UUID}$`);
+var PROCESS_ENDPOINT = /^\/services\/v1\/txn\/[^/]+\/process\/?$/i;
+var NUVEI_HOSTS = ["secure.safecharge.com", "ppp-test.safecharge.com"];
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,62}$/;
+function readCreditguardJson(body, limit = 65536, maxNodes = 1024) {
+    if (typeof body !== "string" || body === "" || body.length > limit)
+        return null;
+    let at = 0, nodes = 0;
+    const fail = () => {
+        throw new Error("invalid_creditguard_json");
+    };
+    const space = () => {
+        while (at < body.length && " 	\r\n".includes(body[at]))
+            at++;
+    };
+    const string = () => {
+        space();
+        const start = at;
+        if (body[at++] !== '"')
+            fail();
+        while (at < body.length) {
+            const char = body[at++];
+            if (char === "\\") {
+                at++;
+                continue;
+            }
+            if (char === '"')
+                return JSON.parse(body.slice(start, at));
+        }
+        return fail();
+    };
+    const value = (depth) => {
+        if (depth > 8 || ++nodes > maxNodes)
+            fail();
+        space();
+        const char = body[at];
+        if (char === '"')
+            return string();
+        if (char === "{") {
+            at++;
+            const result = /* @__PURE__ */ Object.create(null), seen = /* @__PURE__ */ new Set();
+            space();
+            if (body[at] === "}") {
+                at++;
+                return result;
+            }
+            for (;;) {
+                const key = string();
+                if (seen.has(key) || FORBIDDEN_KEYS.has(key))
+                    fail();
+                seen.add(key);
+                space();
+                if (body[at++] !== ":")
+                    fail();
+                result[key] = value(depth + 1);
+                space();
+                const next = body[at++];
+                if (next === "}")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        if (char === "[") {
+            at++;
+            const result = [];
+            space();
+            if (body[at] === "]") {
+                at++;
+                return result;
+            }
+            for (;;) {
+                result.push(value(depth + 1));
+                space();
+                const next = body[at++];
+                if (next === "]")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        for (const literal of ["true", "false", "null"]) {
+            if (body.startsWith(literal, at)) {
+                at += literal.length;
+                return JSON.parse(literal);
+            }
+        }
+        const number = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(body.slice(at, at + 32));
+        if (!number)
+            fail();
+        at += number[0].length;
+        const parsed = Number(number[0]);
+        if (!Number.isFinite(parsed))
+            fail();
+        return parsed;
+    };
+    try {
+        const parsed = value(0);
+        space();
+        return at === body.length && record(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function httpsUrl(url, maxLength = 512) {
+    if (typeof url !== "string" || url.length > maxLength)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return null;
+    return parsed;
+}
+function creditguardProcessTxId(url) {
+    if (typeof url !== "string" || url.includes("?") || url.includes("#"))
+        return null;
+    const parsed = httpsUrl(url);
+    if (!parsed || parsed.href !== url || !CREDITGUARD_PPS_HOSTS.includes(parsed.hostname))
+        return null;
+    return PROCESS_PATH.exec(parsed.pathname)?.[1] ?? null;
+}
+function isCreditguardProcessUrl(url, method = "POST") {
+    return method === "POST" && creditguardProcessTxId(url) !== null;
+}
+function isProcessEndpoint(url) {
+    const parsed = httpsUrl(url, 4096);
+    return !!parsed && CREDITGUARD_PPS_HOSTS.includes(parsed.hostname.toLowerCase()) && PROCESS_ENDPOINT.test(parsed.pathname);
+}
+function creditguardPreparationEnvironment(hostname) {
+    const host = typeof hostname === "string" ? hostname.toLowerCase() : "";
+    if (host === CREDITGUARD_SANDBOX_HOST)
+        return "sandbox";
+    return CREDITGUARD_PPS_HOSTS.includes(host) ? "production" : null;
+}
+function creditguardTransactionReadUrl(processUrl) {
+    const txId = creditguardProcessTxId(processUrl);
+    return txId === null ? null : `https://${new URL(processUrl).hostname}/services/v1/txn/${txId}`;
+}
+function creditguardPageProcessUrl(pageUrl) {
+    if (typeof pageUrl !== "string" || pageUrl.length > 2048 || pageUrl.includes("#"))
+        return null;
+    const page = httpsUrl(pageUrl, 2048);
+    if (!page || page.pathname !== "/")
+        return null;
+    const ids = page.searchParams.getAll("txId");
+    if (ids.length !== 1 || !TXID.test(ids[0]))
+        return null;
+    const processUrl = `https://${page.hostname}/services/v1/txn/${ids[0]}/process`;
+    return creditguardProcessTxId(processUrl) === ids[0] ? processUrl : null;
+}
+function isCreditguardPpsDocument(url) {
+    const parsed = httpsUrl(url, 4096);
+    return !!parsed && CREDITGUARD_PPS_HOSTS.includes(parsed.hostname.toLowerCase());
+}
+function creditguardNuveiRefusal(requestUrl, initiatorUrl) {
+    const request = httpsUrl(requestUrl, 4096);
+    if (!request || !NUVEI_HOSTS.includes(request.hostname.toLowerCase()))
+        return null;
+    return isCreditguardPpsDocument(initiatorUrl) ? "creditguard_three_d_secure" : null;
+}
+var CARD_KEYS = ["cardNumber", "expMonth", "expYear", "cvv"];
+var REFUSED_KEYS = Object.freeze({
+    cardId: "saved_card",
+    track2CardNo: "saved_card",
+    last4d: "saved_card",
+    enteredOTP: "otp",
+    googlePayToken: "wallet",
+    applePayToken: "wallet"
+});
+var JWE_MOVED_KEYS = ["cardNumber", "expMonth", "expYear", "track2CardNo", "cvv", "last4d", "personalId"];
+var USER_DATA_KEYS = Array.from({ length: 10 }, (_, index) => `userData${index + 1}`);
+var OTHER_KEYS = /* @__PURE__ */ new Set([
+    "personalId",
+    "expDateMMYY",
+    "txId",
+    "recaptchaValue",
+    "recaptchaV3Value",
+    "recaptchaChallenge",
+    "numberOfPayments",
+    "keepCCDetails",
+    "pendingGiftCards",
+    "useDcc",
+    "dccOption",
+    "isIframe",
+    "ppDomain",
+    "windowSize",
+    "jwePayload",
+    ...USER_DATA_KEYS
+]);
+var TOKEN = /^[A-Za-z0-9_.:+/=-]{1,8192}$/;
+var BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/;
+var absent = (value, key) => !owns(value, key) || value[key] === null;
+var optionalFlag = (value, key) => absent(value, key) || value[key] === false;
+function isCreditguardJweCompact(value) {
+    if (typeof value !== "string" || value.length > 4096)
+        return false;
+    const parts = value.split(".");
+    if (parts.length !== 5 || !parts.every((part) => BASE64URL_SEGMENT.test(part)))
+        return false;
+    const [header, key, iv, ciphertext, tag] = parts;
+    return header === CREDITGUARD_JWE_HEADER && key.length >= 342 && key.length <= 683 && iv.length === 16 && tag.length === 22 && ciphertext.length >= 2 && ciphertext.length <= 2048;
+}
+function creditguardPpDomainHost(ppDomain) {
+    if (ppDomain === "")
+        return "";
+    if (typeof ppDomain !== "string" || ppDomain.length > 400 || !/^[A-Za-z0-9+/]+={0,2}$/.test(ppDomain) || ppDomain.length % 4 !== 0)
+        return null;
+    let decoded;
+    try {
+        decoded = atob(ppDomain);
+    }
+    catch {
+        return null;
+    }
+    return HOSTNAME.test(decoded) ? decoded : null;
+}
+function installmentsRefusal(value) {
+    if (absent(value, "numberOfPayments"))
+        return null;
+    const count = value.numberOfPayments;
+    if (count === "" || count === 0 || count === "0")
+        return null;
+    return "installments";
+}
+function boundMerchantHost(options) {
+    if (!record(options) || !owns(options, "merchantHost") || options.merchantHost === void 0)
+        return void 0;
+    const host = typeof options.merchantHost === "string" ? options.merchantHost.toLowerCase() : "";
+    return HOSTNAME.test(host) ? host : null;
+}
+function cardFieldsRefusal(value) {
+    if (!CARD_KEYS.every((key) => owns(value, key)))
+        return "card_fields";
+    if (!digits(value.cardNumber, 12, 19) || !exact(/^(?:0[1-9]|1[0-2])$/, value.expMonth) || !exact(/^[0-9]{2}$/, value.expYear) || !digits(value.cvv, 3, 4))
+        return "card_fields";
+    if (owns(value, "expDateMMYY") && value.expDateMMYY !== `${value.expMonth}/${value.expYear}`)
+        return "card_fields";
+    return null;
+}
+function bodyRefusal(value, txId, options) {
+    const merchant = boundMerchantHost(options);
+    if (merchant === null)
+        return "pp_domain_unbound";
+    if (!record(value))
+        return "malformed_body";
+    for (const [key, reason] of Object.entries(REFUSED_KEYS))
+        if (owns(value, key))
+            return reason;
+    for (const key of Object.keys(value))
+        if (!CARD_KEYS.includes(key) && !OTHER_KEYS.has(key))
+            return "unexpected_field";
+    if (!optionalFlag(value, "keepCCDetails"))
+        return "keep_on_file";
+    if (!optionalFlag(value, "pendingGiftCards"))
+        return "gift_card";
+    if (!optionalFlag(value, "useDcc"))
+        return "dcc";
+    const installments = installmentsRefusal(value);
+    if (installments)
+        return installments;
+    if (!absent(value, "personalId") && value.personalId !== "")
+        return "personal_id";
+    if (owns(value, "txId") && (!exact(TXID, value.txId) || txId !== void 0 && value.txId !== txId))
+        return "txid_mismatch";
+    if (!absent(value, "ppDomain")) {
+        const host = creditguardPpDomainHost(value.ppDomain);
+        if (host === null)
+            return "pp_domain";
+        if (merchant !== void 0 && host !== merchant)
+            return "pp_domain";
+    }
+    else if (merchant !== void 0)
+        return "pp_domain";
+    if (!absent(value, "isIframe") && typeof value.isIframe !== "boolean")
+        return "malformed_body";
+    if (!absent(value, "windowSize") && !exact(/^[0-9]{1,5}x[0-9]{1,5}$/, value.windowSize))
+        return "malformed_body";
+    for (const key of ["recaptchaValue", "recaptchaV3Value"]) {
+        if (!absent(value, key) && value[key] !== "" && !exact(TOKEN, value[key]))
+            return "malformed_body";
+    }
+    if (!absent(value, "recaptchaChallenge") && typeof value.recaptchaChallenge !== "boolean" && !exact(TOKEN, value.recaptchaChallenge))
+        return "malformed_body";
+    if (!absent(value, "dccOption") && typeof value.dccOption !== "boolean" && !exact(/^[A-Za-z0-9_-]{1,32}$/, value.dccOption))
+        return "malformed_body";
+    for (const key of USER_DATA_KEYS) {
+        if (!absent(value, key) && !text(value[key], 2048) && !Number.isSafeInteger(value[key]))
+            return "malformed_body";
+    }
+    if (owns(value, "jwePayload")) {
+        if (typeof value.jwePayload !== "string" || !isCreditguardJweCompact(value.jwePayload))
+            return "jwe_fallback";
+        if (JWE_MOVED_KEYS.some((key) => owns(value, key)) || owns(value, "expDateMMYY"))
+            return "jwe_fallback";
+        return record(options) && options.jwe === true ? null : "jwe_unsupported";
+    }
+    return cardFieldsRefusal(value);
+}
+function creditguardBodyRefusal(body, txId, options) {
+    return bodyRefusal(readCreditguardJson(body), txId, options);
+}
+function classifyCreditguardRequest(url, method, body, options) {
+    if (!isProcessEndpoint(url))
+        return null;
+    if (method !== "POST")
+        return "unsupported";
+    const txId = creditguardProcessTxId(url);
+    if (txId === null)
+        return "unsupported";
+    return creditguardBodyRefusal(typeof body === "string" ? body : "", txId, options) === null ? "card" : "unsupported";
+}
+var CONTENT_TYPE = /^application\/json(?:;\s*charset=utf-8)?$/i;
+var ACCEPT_RANGES = /* @__PURE__ */ new Set(["application/json", "text/plain", "*/*"]);
+function headersRefusal(headers) {
+    if (headers === void 0)
+        return null;
+    if (!record(headers))
+        return "headers";
+    const seen = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (seen.has(lower) || typeof value !== "string")
+            return "headers";
+        seen.set(lower, value);
+    }
+    if (seen.has("content-type") && !exact(CONTENT_TYPE, seen.get("content-type")))
+        return "headers";
+    if (seen.has("accept")) {
+        if (!text(seen.get("accept"), 1024))
+            return "headers";
+        const ranges = seen.get("accept").split(",").map((range) => range.trim().toLowerCase());
+        if (!ranges.includes("application/json") || !ranges.every((range) => ACCEPT_RANGES.has(range)))
+            return "headers";
+    }
+    return null;
+}
+function creditguardProcessRefusal(request, options) {
+    if (!record(request) || request.method !== "POST")
+        return "not_process_request";
+    const txId = creditguardProcessTxId(request.url);
+    if (txId === null)
+        return "not_process_request";
+    return headersRefusal(request.headers) ?? creditguardBodyRefusal(request.body, txId, options);
+}
+function isCreditguardProcessRequest(request, options) {
+    return creditguardProcessRefusal(request, options) === null;
+}
+function creditguardReplayRefusal(request, options) {
+    return creditguardProcessRefusal(request, options) ?? (boundMerchantHost(options) === void 0 ? "pp_domain_unbound" : null);
+}
+function creditguardRefusalMessage(reason) {
+    const code = typeof reason === "string" && /^[a-z_]{1,40}$/.test(reason) ? reason : "unsupported";
+    return `Refusing to pay: this CreditGuard request is not the reviewed card payment (${code}). Nothing was sent.`;
+}
+var FILL_REFUSAL = "Could not fill the card fields for CreditGuard. Nothing was sent.";
+function cardParts(card) {
+    const month = card && (Number.isInteger(card.month) || digits(card.month, 1, 2)) ? Number(card.month) : NaN;
+    const year = card && (Number.isInteger(card.year) || digits(card.year, 2, 4)) ? Number(card.year) : NaN;
+    if (!card || !digits(card.number, 12, 19) || !digits(card.cvc, 3, 4) || !(month >= 1 && month <= 12) || !(year >= 0 && year <= 99 || year >= 2e3 && year <= 2099))
+        throw new Error(FILL_REFUSAL);
+    return { number: card.number, month: String(month).padStart(2, "0"), year: String(year % 100).padStart(2, "0"), cvc: card.cvc };
+}
+function injectCreditguardCard(body, card, options) {
+    const value = readCreditguardJson(body);
+    const reason = bodyRefusal(value, void 0, options);
+    if (reason !== null)
+        throw new Error(creditguardRefusalMessage(reason));
+    if (owns(value, "jwePayload"))
+        throw new Error(creditguardRefusalMessage("jwe_unsupported"));
+    const parts = cardParts(card);
+    value.cardNumber = parts.number;
+    value.expMonth = parts.month;
+    value.expYear = parts.year;
+    value.cvv = parts.cvc;
+    const where = ["cardNumber", "expMonth", "expYear", "cvv"];
+    if (owns(value, "expDateMMYY")) {
+        value.expDateMMYY = `${parts.month}/${parts.year}`;
+        where.push("expDateMMYY");
+    }
+    return { body: JSON.stringify(value), where };
+}
+var b64url = (bytes) => {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+function fromB64url(value) {
+    if (typeof value !== "string" || !BASE64URL_SEGMENT.test(value) || value.length % 4 === 1)
+        return null;
+    try {
+        const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4));
+        return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+var stripLeadingZeros = (bytes) => {
+    let start = 0;
+    while (start < bytes.length - 1 && bytes[start] === 0)
+        start++;
+    return bytes.slice(start);
+};
+function parseCreditguardJwePublicKey(key) {
+    let value = key;
+    if (typeof value === "string") {
+        if (value.length > 8192)
+            return null;
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!record(value) || owns(value, "kty") && value.kty !== "RSA")
+        return null;
+    let modulus = null;
+    if (typeof value.n === "string" && value.n.length <= 2048 && /^(?:[0-9a-fA-F]{2}:)+[0-9a-fA-F]{2}$/.test(value.n)) {
+        modulus = Uint8Array.from(value.n.split(":"), (pair) => parseInt(pair, 16));
+    }
+    else
+        modulus = fromB64url(value.n);
+    if (!modulus)
+        return null;
+    modulus = stripLeadingZeros(modulus);
+    const bits = modulus.length === 0 || modulus[0] === 0 ? 0 : (modulus.length - 1) * 8 + (32 - Math.clz32(modulus[0]));
+    let exponent = null;
+    if (typeof value.e === "number")
+        exponent = value.e === 65537 ? new Uint8Array([1, 0, 1]) : null;
+    else {
+        const bytes = fromB64url(value.e);
+        exponent = bytes && stripLeadingZeros(bytes).join(",") === "1,0,1" ? new Uint8Array([1, 0, 1]) : null;
+    }
+    if (!exponent || bits < 2048 || bits > 4096)
+        return null;
+    return { kty: "RSA", n: b64url(modulus), e: b64url(exponent), bits };
+}
+async function encryptCreditguardJwe(plaintext, publicKey, facilities = {}) {
+    const crypto = facilities.crypto ?? globalThis.crypto;
+    if (!crypto?.subtle || typeof crypto.getRandomValues !== "function")
+        throw new Error("Processor cryptography is unavailable.");
+    const jwk = parseCreditguardJwePublicKey(publicKey);
+    if (!jwk || typeof plaintext !== "string")
+        throw new Error("Refusing to encrypt: the CreditGuard key is malformed.");
+    const key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e, ext: true }, { name: "RSA-OAEP", hash: "SHA-1" }, false, ["encrypt"]);
+    const cek = crypto.getRandomValues(new Uint8Array(32));
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const encryptedKey = new Uint8Array(await crypto.subtle.encrypt({ name: "RSA-OAEP" }, key, cek));
+    const aes = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM" }, false, ["encrypt"]);
+    cek.fill(0);
+    const bytes = new TextEncoder().encode(plaintext);
+    const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(CREDITGUARD_JWE_HEADER), tagLength: 128 }, aes, bytes));
+    bytes.fill(0);
+    return [
+        CREDITGUARD_JWE_HEADER,
+        b64url(encryptedKey),
+        b64url(iv),
+        b64url(sealed.subarray(0, sealed.length - 16)),
+        b64url(sealed.subarray(sealed.length - 16))
+    ].join(".");
+}
+async function injectCreditguardJweCard(body, card, publicKey, facilities) {
+    const value = readCreditguardJson(body);
+    const reason = bodyRefusal(value, void 0, { jwe: true });
+    if (reason !== null)
+        throw new Error(creditguardRefusalMessage(reason));
+    if (!owns(value, "jwePayload"))
+        throw new Error(creditguardRefusalMessage("jwe_fallback"));
+    const parts = cardParts(card);
+    value.jwePayload = await encryptCreditguardJwe(JSON.stringify({
+        cardNumber: parts.number,
+        expYear: parts.year,
+        expMonth: parts.month,
+        cvv: parts.cvc
+    }), publicKey, facilities);
+    return { body: JSON.stringify(value), where: ["jwePayload"] };
+}
+var INPUT_NAMES = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+var flag = (value) => value === true;
+var inputFlag = (value) => value === void 0 || typeof value === "boolean";
+function parseCreditguardTransaction(body, txId) {
+    const value = readCreditguardJson(body, 65536, 8192);
+    const trx = value && value.transactionData;
+    if (!record(trx) || typeof txId !== "string" || trx.txId !== txId || !exact(TXID, txId))
+        return null;
+    if (!Number.isSafeInteger(trx.amount) || trx.amount <= 0 || !exact(/^[A-Z]{3}$/, trx.currency) || trx.envType !== "prod" && trx.envType !== "test")
+        return null;
+    const count = (key, max) => Number.isSafeInteger(trx[key]) && trx[key] >= 0 && trx[key] <= max ? trx[key] : null;
+    const ui = record(value.uiCustomData) ? value.uiCustomData : {};
+    const inputData = record(value.formConfig) && Array.isArray(value.formConfig.inputData) ? value.formConfig.inputData : [];
+    const inputs = inputData.length <= 32 && inputData.every((input) => record(input) && exact(INPUT_NAMES, input.inputName) && inputFlag(input.required) && inputFlag(input.visible)) ? inputData.map((input) => ({ inputName: input.inputName, required: input.required === true, visible: input.visible === true })) : null;
+    let jwePublicKey = "absent";
+    if (owns(trx, "jwePublicKey") && trx.jwePublicKey !== null && trx.jwePublicKey !== "") {
+        jwePublicKey = parseCreditguardJwePublicKey(trx.jwePublicKey) ?? "malformed";
+    }
+    return {
+        txId,
+        amount: trx.amount,
+        currency: trx.currency,
+        envType: trx.envType,
+        mid: exact(/^[0-9]{1,12}$/, trx.mid) ? trx.mid : null,
+        transactionType: exact(/^[A-Za-z]{1,32}$/, trx.transactionType) ? trx.transactionType : null,
+        creditType: record(trx.creditTypeData) && exact(/^[A-Za-z]{1,32}$/, trx.creditTypeData.type) ? trx.creditTypeData.type : null,
+        numberOfPayments: count("numberOfPayments", 99),
+        remainingSubmitRetries: count("remainingSubmitRetries", 99),
+        threeDS: flag(trx.CG3DSV2),
+        threeDSProvider: exact(/^[a-z]{2}$/, trx.cg3DSProvider) ? trx.cg3DSProvider : null,
+        otpActive: flag(trx.otpActive),
+        dccActive: flag(trx.dccActive),
+        recaptcha: ["googleRecaptchaKey", "googleRecaptchaV3Key"].some((key) => typeof trx[key] === "string" && trx[key] !== ""),
+        jwePublicKey,
+        personalIdAlwaysEnabled: flag(ui.personalIdAlwaysEnabled),
+        inputs
+    };
+}
+var CARD_INPUTS = /* @__PURE__ */ new Set(["cardNumber", "expMonth", "expYear", "expDateMMYY", "cvv"]);
+var PAGE_INPUTS = /* @__PURE__ */ new Set([...CARD_INPUTS, "personalId", "numberOfPayments", "keepCCDetails"]);
+function formInputsRefusal(inputs) {
+    if (!Array.isArray(inputs))
+        return "form_inputs";
+    for (const input of inputs) {
+        if (CARD_INPUTS.has(input.inputName) && !input.visible)
+            return "card_field_hidden";
+        if (input.inputName === "keepCCDetails" && input.required)
+            return "keep_on_file";
+        if (!PAGE_INPUTS.has(input.inputName) && (input.required || input.visible))
+            return "form_inputs";
+    }
+    return null;
+}
+function creditguardTransactionRefusal(txn, expectation) {
+    if (!record(txn) || !record(expectation))
+        return "transaction_unreadable";
+    if (txn.threeDS)
+        return "three_d_secure";
+    if (txn.otpActive)
+        return "otp";
+    if (txn.dccActive)
+        return "dcc";
+    if (txn.transactionType !== "Debit")
+        return "transaction_type";
+    if (txn.creditType !== "RegularCredit" || txn.numberOfPayments === null || txn.numberOfPayments > 0)
+        return "installments";
+    if (txn.personalIdAlwaysEnabled)
+        return "personal_id";
+    const form = formInputsRefusal(txn.inputs);
+    if (form)
+        return form;
+    if (txn.remainingSubmitRetries === null || txn.remainingSubmitRetries === 0)
+        return "no_retries_left";
+    const environment = creditguardPreparationEnvironment(expectation.hostname);
+    if (environment === null || environment === "sandbox" !== (txn.envType === "test") || typeof expectation.sandbox !== "boolean" || expectation.sandbox !== (environment === "sandbox"))
+        return "environment_mismatch";
+    if (txn.jwePublicKey === "malformed")
+        return "jwe_public_key_malformed";
+    if (txn.jwePublicKey !== "absent" && expectation.jwe !== true)
+        return "jwe_unsupported";
+    if (!Number.isSafeInteger(expectation.amount) || expectation.amount !== txn.amount)
+        return "amount_mismatch";
+    if (typeof expectation.currency !== "string" || expectation.currency.toUpperCase() !== txn.currency)
+        return "currency_mismatch";
+    return null;
+}
+function creditguardSendWindowRefusal(timing) {
+    if (!record(timing) || !Number.isFinite(timing.now))
+        return "timing_unknown";
+    if (!Number.isFinite(timing.readAt) || timing.now - timing.readAt > CREDITGUARD_PAGE_WINDOW_MS)
+        return "page_expired";
+    if (timing.recaptcha === true && (!Number.isFinite(timing.pausedAt) || timing.now - timing.pausedAt > CREDITGUARD_RECAPTCHA_WINDOW_MS))
+        return "recaptcha_expired";
+    return null;
+}
+var ERROR_CODE = /^-?[0-9]{1,4}$/;
+var CREDITGUARD_REFUSAL_CODES = Object.freeze(["681", "682", "683", "687", "689"]);
+function landingUrl(value) {
+    if (typeof value !== "string" || value.length > 4096 || /[\s\u0000-\u001f\u007f]/.test(value))
+        return false;
+    return httpsUrl(value, 4096) !== null;
+}
+var retries = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 99;
+function creditguardResponseOutcome(status, body, options) {
+    const clientError = Number.isInteger(status) && status >= 400 && status < 500;
+    if (status !== 200 && !clientError)
+        return { outcome: "unknown", reason: "creditguard_status_unconfirmed" };
+    const value = readCreditguardJson(body);
+    if (!value)
+        return { outcome: "unknown", reason: "creditguard_unreadable" };
+    if (!exact(ERROR_CODE, value.errorCode))
+        return { outcome: "unknown", reason: "creditguard_unexpected_response" };
+    if (!absent(value, "enhancedAuthActive") && typeof value.enhancedAuthActive !== "boolean")
+        return { outcome: "unknown", reason: "creditguard_unexpected_response" };
+    if (value.enhancedAuthActive === true)
+        return { outcome: "unknown", reason: "creditguard_enhanced_auth" };
+    const bound = record(options) && typeof options.txId === "string" ? options.txId : null;
+    if (owns(value, "txId") && (!exact(TXID, value.txId) || bound !== null && value.txId !== bound))
+        return { outcome: "unknown", reason: "creditguard_txid_mismatch" };
+    if (value.errorCode !== "000") {
+        return CREDITGUARD_REFUSAL_CODES.includes(value.errorCode) ? { outcome: "refused", code: value.errorCode } : { outcome: "unknown", reason: "creditguard_not_approved" };
+    }
+    if (clientError)
+        return { outcome: "unknown", reason: "creditguard_status_unconfirmed" };
+    if (!landingUrl(value.url) || !absent(value, "remainingSubmitRetries") && !retries(value.remainingSubmitRetries) || !absent(value, "clientRedirectMethod") && !exact(/^(?:GET|POST)$/i, value.clientRedirectMethod) || !absent(value, "clientRedirectCharset") && !exact(/^[A-Za-z0-9._-]{1,32}$/, value.clientRedirectCharset)) {
+        return { outcome: "unknown", reason: "creditguard_unconfirmed" };
+    }
+    const number = record(options) && digits(options.cardNumber, 12, 19) ? options.cardNumber : null;
+    if (number !== null && (body.includes(number) || JSON.stringify(value).includes(number)))
+        return { outcome: "unknown", reason: "creditguard_card_echo" };
+    return { outcome: "approved" };
+}
+function sanitizeCreditguardResponse(body, options) {
+    if (creditguardResponseOutcome(200, body, options).outcome !== "approved")
+        throw new Error("Invalid CreditGuard payment response.");
+    const value = readCreditguardJson(body);
+    const safe = { errorCode: "000", url: value.url };
+    if (!absent(value, "remainingSubmitRetries"))
+        safe.remainingSubmitRetries = value.remainingSubmitRetries;
+    if (value.enhancedAuthActive === false)
+        safe.enhancedAuthActive = false;
+    if (!absent(value, "clientRedirectMethod"))
+        safe.clientRedirectMethod = value.clientRedirectMethod;
+    if (!absent(value, "clientRedirectCharset"))
+        safe.clientRedirectCharset = value.clientRedirectCharset;
+    if (owns(value, "txId"))
+        safe.txId = value.txId;
+    return JSON.stringify(safe);
+}
+function creditguardFacts(status, body) {
+    const verdict = creditguardResponseOutcome(status, body);
+    const value = readCreditguardJson(body);
+    return {
+        outcome: verdict.outcome,
+        errorCode: value && exact(ERROR_CODE, value.errorCode) ? value.errorCode : null,
+        refusalCode: verdict.outcome === "refused" ? verdict.code : null
+    };
+}
+export { CREDITGUARD_JWE_HEADER, CREDITGUARD_OPERATION, CREDITGUARD_PAGE_WINDOW_MS, CREDITGUARD_PPS_HOSTS, CREDITGUARD_RECAPTCHA_WINDOW_MS, CREDITGUARD_REFUSAL_CODES, CREDITGUARD_SANDBOX_HOST, classifyCreditguardRequest, creditguardBodyRefusal, creditguardFacts, creditguardNuveiRefusal, creditguardPageProcessUrl, creditguardPpDomainHost, creditguardPreparationEnvironment, creditguardProcessRefusal, creditguardProcessTxId, creditguardRefusalMessage, creditguardReplayRefusal, creditguardResponseOutcome, creditguardSendWindowRefusal, creditguardTransactionReadUrl, creditguardTransactionRefusal, encryptCreditguardJwe, injectCreditguardCard, injectCreditguardJweCard, isCreditguardJweCompact, isCreditguardPpsDocument, isCreditguardProcessRequest, isCreditguardProcessUrl, parseCreditguardJwePublicKey, parseCreditguardTransaction, readCreditguardJson, sanitizeCreditguardResponse };