@agent-cards/sdk 0.21.0 → 0.22.0

package/dist/aci.d.ts

@@ -0,0 +1,173 @@
+type AciAt = {
+    checkoutId: string;
+    host: string;
+    environment: 'production' | 'sandbox';
+};
+/** What one request on an ACI checkout is (payment-core aci.js classifyAciRequest). */
+export type AciLeg = ({
+    leg: 'card' | 'absorb' | 'pass' | 'continuation';
+} & AciAt) | ({
+    leg: 'refuse';
+    code: string;
+} & AciAt);
+/** The processor id, as the registry and the API name it. */
+export declare const ACI_PSP = "aci";
+/** The dark-launch capability the API serves the ACI recognizer behind (payment-core definitions.js). */
+export declare const ACI_CAPABILITY = "aci_split_card.v1";
+/**
+ * How long a sibling leg (the page's CVC or expiry request) waits for its checkout's card-number
+ * request to begin an approval. The widget fires every leg on one Pay click, milliseconds apart,
+ * so a sibling that still has no card-number request after this is one this SDK will never answer
+ * (a one-click stored-card CVC form, or a card-number request refused before it paused).
+ */
+export declare const ACI_SIBLING_WAIT_MS = 5000;
+/** What the page's requests on one checkout are answered with: the card-number request's answer. */
+export interface AciAnswer {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+/** The SDK's verdict on the page's /payment submission. */
+export type AciPaymentVerdict = {
+    outcome: 'continue';
+    body: string;
+    stripped: boolean;
+    authorizationId: string | null;
+} | {
+    outcome: 'refuse';
+    code: string;
+};
+/** The /payment submission of a checkout whose card-number request was never answered here. */
+export declare const ACI_PAYMENT_UNAPPROVED = "aci_payment_unapproved";
+/** A second /payment submission on a checkout that already continued one. */
+export declare const ACI_PAYMENT_REPEATED = "aci_payment_repeated";
+/** A card-number request on a checkout whose card-number request is running or was answered here. */
+export declare const ACI_CHECKOUT_REUSED = "aci_checkout_reused";
+/**
+ * How many failed checkouts one attachment keeps. A failed checkout only makes its later CVC and
+ * expiry requests fail at once instead of after ACI_SIBLING_WAIT_MS, so the oldest are dropped past
+ * this; a running or answered checkout is never dropped, since it is what refuses a second
+ * card-number request or /payment on that checkout.
+ */
+export declare const ACI_FAILED_CHECKOUTS_KEPT = 16;
+/**
+ * ACI's paymentBrand for the card number a card-number request carried, or null. That number is
+ * the agent's placeholder, typed in the approved card's network (a Mastercard-range placeholder for
+ * an Agentcard-issued card), and ACI's widget names the brand of the /payment submission from the
+ * same digits. The SDK is never told the approved card's own network: the widget's brand for the
+ * approved request is the one /payment may carry. The cardholder's device judges the placeholder
+ * with this same payment-core rule and refuses to send a card of another brand, which ACI would
+ * otherwise hold on the checkout before refusing /payment (100.100.700).
+ */
+export declare function aciBrandOfCardLeg(body: string | null | undefined): string | null;
+/**
+ * The answer a paused card-number request gets, or null when the stored answer is not one to hand
+ * the page: a 2xx carrying exactly ACI's rebuilt success answer (payment-core sanitizeAciResponse,
+ * the allow-list the API stored it through), under JSON. The widget only waits for every leg to
+ * resolve, so nothing else ACI said is ever needed, and the same answer serves the sibling legs.
+ */
+export declare function aciCardLegAnswer(response: {
+    status: number;
+    body: string;
+}): AciAnswer | null;
+/**
+ * The URL with an ACI checkout id taken out of its path, or null for a URL that is not on one of
+ * ACI's hosts under /v1/checkouts/. The id is the checkout's only capability: once the card-number
+ * request carried the real card, anyone holding it can post /payment against that card for the
+ * rest of the checkout's 30 minutes, so it never rides on an event.
+ */
+export declare function redactAciCheckoutId(raw: string): string | null;
+/** How long the persistent-context engine probe (a CDP session opening) may take before it counts as no. */
+export declare const ACI_ENGINE_PROBE_MS = 5000;
+/**
+ * Whether a Playwright page's browser sends the body the SDK replaced on a navigation. Removing the
+ * placeholder expiry from a classic-mode /payment needs it, because the widget's form posts
+ * /payment as its hidden iframe's navigation. The SDK's ACI browser test shows it on Chromium in
+ * both adapters (design gate G3), and CI installs only Chromium; a local WebKit 26.5 run sent the
+ * replaced body too, but nothing keeps that true, so every engine but Chromium is refused rather
+ * than trusted with the placeholder expiry. The engine is the page's browser type, or, for a
+ * persistent context that names no browser, whether a CDP session opens on the page, which only
+ * Chromium allows.
+ */
+export declare function playwrightReplacesNavigationBody(page: any, probeMs?: number): Promise<boolean>;
+/**
+ * One attachment's ACI state, keyed by checkout (host and checkout id). Every sibling and every
+ * /payment submission is matched against a card-number request this attachment itself paused and
+ * answered, never taken on the page's word. Inert (classify returns null) until the registry serves
+ * ACI, which a client reaches only by syncing with the capability, so a build or an API that never
+ * served it leaves every ACI request exactly as before.
+ */
+export declare class AciGate {
+    private readonly vault;
+    private readonly siblingWaitMs;
+    private readonly groups;
+    /** Siblings that arrived before their checkout's card-number request began, by checkout. */
+    private readonly early;
+    /** The checkout whose card-number request's approval is running. */
+    private current;
+    constructor(vault: {
+        recognizesProcessor?: (psp: string) => boolean;
+    } | undefined, siblingWaitMs?: number);
+    private served;
+    /** What this request is, when the registry serves ACI and it is a POST to an ACI checkout; null leaves it to the other gates. */
+    classify(url: string, method: string, body: string | null | undefined): AciLeg | null;
+    /**
+     * Playwright's route predicate sees only the URL. The card-number, CVC, expiry and holder
+     * requests share the recognizer's URL; /payment and /registration do not, so they are routed
+     * here, and the rest of ACI's traffic (the widget script, /bins, /v1/collect) never is.
+     */
+    matches(url: string): boolean;
+    /**
+     * The card-number request of a checkout began its approval; its siblings wait for the outcome.
+     * False, with nothing changed, for a checkout whose card-number request is still running or was
+     * answered here: its group keeps its answer and its one /payment, so a second approval can never
+     * reopen that checkout for another /payment. The pre-claim gate refuses such a request first
+     * (reused, aci_checkout_reused), before it claims a preparation; the adapters fail it here too.
+     * A refused begin leaves the running approval it found running. A checkout whose card-number
+     * request failed begins again.
+     */
+    begin(url: string, method: string, body: string | null | undefined, merchantOrigin: string | undefined): boolean;
+    /** Whether this checkout's card-number request is running or was answered here: another one is refused. */
+    reused(leg: {
+        host: string;
+        checkoutId: string;
+    }): boolean;
+    private live;
+    /** Drops the oldest failed checkouts past ACI_FAILED_CHECKOUTS_KEPT; running and answered ones stay. */
+    private prune;
+    /** The card-number request's answer reached the page; its siblings get the same answer. */
+    answered(url: string, answer: AciAnswer, authorizationId: string | null): void;
+    /** The card-number request's approval ended, answered or not; unanswered siblings fail. */
+    end(): void;
+    /**
+     * A request on this checkout was refused before any card-number request began (a card-number
+     * request that asks ACI to keep the card, a leg the widget never sends): the siblings waiting for
+     * one fail now, and so does every later sibling until a card-number request begins. A running or
+     * answered card-number request keeps its siblings.
+     */
+    refused(leg: {
+        host: string;
+        checkoutId: string;
+    }): void;
+    /**
+     * A sibling leg (the page's CVC or expiry request): the answer to hand it, once its checkout's
+     * card-number request was answered, or null when that request failed, never began within
+     * siblingWaitMs, or cannot be answered here. Never resolves to anything the page did not get.
+     */
+    hold(leg: {
+        host: string;
+        checkoutId: string;
+    }): Promise<AciAnswer | null>;
+    /**
+     * The page's /payment submission: continue it with the body to send, or refuse it. It continues
+     * only as a frame navigation (the widget's form posting into its hidden iframe; a script's fetch
+     * of the same URL is not the widget's and is refused before it can take the reservation), only
+     * for a checkout whose card-number request this attachment answered, only once, and only as
+     * payment-core's judge admits it for that card's brand and the merchant the cardholder approved.
+     * The reservation is taken before the answer, so two submissions can never both continue.
+     */
+    payment(url: string, method: string, body: string | null | undefined, request: {
+        navigation: boolean;
+    }): AciPaymentVerdict;
+}
+export {};

package/dist/aci.generated.d.ts

@@ -0,0 +1,87 @@
+declare var ACI_HOSTS: readonly string[];
+declare var ACI_TEST_HOSTS: readonly string[];
+declare var ACI_TEST_PANS: readonly string[];
+declare var ACI_CARD_ON_FILE_REFUSED: string;
+declare var ACI_UNSUPPORTED_REQUEST: string;
+declare var ACI_BRAND_MISMATCH: string;
+declare var ACI_RESULT_URL_REFUSED: string;
+declare var ACI_EXPIRY_UNSTRIPPABLE: string;
+declare var ACI_CARD_FIELD: string;
+declare var ACI_ABSORBED_FIELDS: readonly string[];
+declare var ACI_PASSED_FIELDS: readonly string[];
+declare var ACI_SIBLING_KEYS: readonly string[];
+declare var ACI_REMOVED_ON_CONTINUATION: readonly string[];
+declare function aciEndpoint(url: any): {
+    kind: string;
+    host: string;
+    checkoutId: string;
+    environment: string | undefined;
+} | null;
+declare function aciHostEnvironment(hostname: any): "production" | "sandbox" | undefined;
+declare function aciEnvironment(url: any): string | undefined;
+declare function readAciForm(body: any, limit?: number): {
+    key: string;
+    value: string;
+    raw: string;
+}[] | null;
+declare function isAciCardOnFileKey(key: any): boolean;
+declare function classifyAciRequest(request: any): {
+    checkoutId: string;
+    host: string;
+    environment: string | undefined;
+    leg: string;
+    code: any;
+} | {
+    checkoutId: string;
+    host: string;
+    environment: string | undefined;
+    leg: string;
+} | null;
+declare function isAciCardRequest(request: any): boolean;
+declare function isPreparedAciRequest(request: any, environment: any): boolean;
+declare function injectAciCard(templateBody: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function aciBrandForNetwork(network: any): any;
+declare function aciCardBrand(number: any): "VISA" | "MASTER" | "AMEX" | null;
+declare function aciBrandOfCardLeg(body: any): "VISA" | "MASTER" | "AMEX" | null;
+declare function aciPlaceholderBrandRefusal(templateBody: any, card: any): string | null;
+declare function prepareAciContinuation(request: any, context: any): {
+    checkoutId: string;
+    host: string;
+    environment: string | undefined;
+    outcome: string;
+    code: any;
+} | {
+    outcome: string;
+    code: string;
+} | {
+    checkoutId: string;
+    host: string;
+    environment: string | undefined;
+    outcome: string;
+    body: string;
+    stripped: boolean;
+    code?: undefined;
+};
+declare var ACI_CHECKOUT_UPDATED: string;
+declare function aciFacts(text: any): {
+    resultCode: any;
+    refusalCode: any;
+};
+declare function aciResponseOutcome(status: any, text: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+} | {
+    outcome: string;
+    reason?: undefined;
+    code?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+};
+declare function sanitizeAciResponse(text: any): string;
+export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };

package/dist/aci.generated.js

@@ -0,0 +1,306 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: b5b6d696111cb2906b73f99dc9ed21cbf51580bd0799183694ed5147c8a10e66
+// src/aci.js
+var ACI_HOSTS = Object.freeze(["eu-prod.oppwa.com", "oppwa.com", "eu-test.oppwa.com", "test.oppwa.com"]);
+var ACI_TEST_HOSTS = Object.freeze(["eu-test.oppwa.com", "test.oppwa.com"]);
+var ACI_TEST_PANS = Object.freeze([
+    "4200000000000000",
+    "4711100000000000",
+    "5454545454545454",
+    "5212345678901234",
+    "377777777777770",
+    "375987000000005"
+]);
+var ACI_CARD_ON_FILE_REFUSED = "aci_card_on_file_refused";
+var ACI_UNSUPPORTED_REQUEST = "aci_unsupported_request";
+var ACI_BRAND_MISMATCH = "aci_brand_mismatch";
+var ACI_RESULT_URL_REFUSED = "aci_result_url_refused";
+var ACI_EXPIRY_UNSTRIPPABLE = "aci_expiry_unstrippable";
+var ACI_CARD_FIELD = "card.number";
+var ACI_ABSORBED_FIELDS = Object.freeze(["card.cvv", "card.expiryMonth", "card.expiryYear"]);
+var ACI_PASSED_FIELDS = Object.freeze(["card.holder"]);
+var ACI_SIBLING_KEYS = Object.freeze(["customParameters[SHOPPER_EndToEndIdentity]"]);
+var ACI_REMOVED_ON_CONTINUATION = Object.freeze(["card.expiryMonth", "card.expiryYear"]);
+var END_TO_END = ACI_SIBLING_KEYS[0];
+var CHECKOUT_ID = /^[0-9A-F]{32}\.[a-z0-9]{1,16}-vm-tx[0-9]{1,3}$/i;
+var ENDPOINT_PATH = /^\/v1\/checkouts\/([^/]+?)(\/payment|\/registration)?$/;
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var PAN = /^[0-9]{12,19}$/;
+var CVV = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var YEAR = /^(?:19|20)[0-9]{2}$/;
+var HEX64 = /^[0-9a-f]{64}$/i;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function aciEndpoint(url) {
+    if (typeof url !== "string" || url.length > 512 || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !ACI_HOSTS.includes(parsed.hostname))
+        return null;
+    const path = ENDPOINT_PATH.exec(parsed.pathname);
+    if (!path || !exact(CHECKOUT_ID, path[1]))
+        return null;
+    const kind = path[2] === "/payment" ? "payment" : path[2] === "/registration" ? "registration" : "leg";
+    return { kind, host: parsed.hostname, checkoutId: path[1], environment: aciHostEnvironment(parsed.hostname) };
+}
+function aciHostEnvironment(hostname) {
+    if (ACI_TEST_HOSTS.includes(hostname))
+        return "sandbox";
+    return ACI_HOSTS.includes(hostname) ? "production" : void 0;
+}
+function aciEnvironment(url) {
+    const endpoint = aciEndpoint(url);
+    return endpoint && endpoint.kind === "leg" ? endpoint.environment : void 0;
+}
+function readAciForm(body, limit = 8192) {
+    if (typeof body !== "string" || body === "" || body.length > limit)
+        return null;
+    const pairs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const raw of body.split("&")) {
+        const eq = raw.indexOf("=");
+        if (eq <= 0 || pairs.length >= 64)
+            return null;
+        let key, value;
+        try {
+            key = decodeURIComponent(raw.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(raw.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return null;
+        }
+        if (!key || key.length > 128 || CONTROL.test(key) || CONTROL.test(value) || value.length > 2048 || seen.has(key))
+            return null;
+        seen.add(key);
+        pairs.push({ key, value, raw });
+    }
+    return pairs;
+}
+function isAciCardOnFileKey(key) {
+    return typeof key === "string" && (key === "createRegistration" || key === "registrationId" || key === "recurringType" || key.startsWith("registrations[") || key.startsWith("registrations.") || key.startsWith("standingInstruction."));
+}
+function validField(key, value) {
+    switch (key) {
+        case "card.number":
+            return exact(PAN, value);
+        case "card.cvv":
+            return exact(CVV, value);
+        case "card.expiryMonth":
+            return exact(MONTH, value);
+        case "card.expiryYear":
+            return exact(YEAR, value);
+        // ACI takes 3 to 128 characters; the merchant may allow an empty holder.
+        case "card.holder":
+            return typeof value === "string" && value.length <= 128;
+        case END_TO_END:
+            return exact(HEX64, value);
+        default:
+            return false;
+    }
+}
+function classifyAciRequest(request) {
+    if (!request || typeof request !== "object" || Array.isArray(request))
+        return null;
+    const endpoint = aciEndpoint(request.url);
+    if (!endpoint || request.method !== "POST")
+        return null;
+    const at = { checkoutId: endpoint.checkoutId, host: endpoint.host, environment: endpoint.environment };
+    const refuse = (code) => ({ leg: "refuse", code, ...at });
+    if (endpoint.kind === "registration")
+        return refuse(ACI_CARD_ON_FILE_REFUSED);
+    if (endpoint.kind === "payment")
+        return { leg: "continuation", ...at };
+    const pairs = readAciForm(request.body);
+    if (!pairs)
+        return refuse(ACI_UNSUPPORTED_REQUEST);
+    if (pairs.some(({ key }) => isAciCardOnFileKey(key)))
+        return refuse(ACI_CARD_ON_FILE_REFUSED);
+    if (!pairs.every(({ key, value }) => validField(key, value)))
+        return refuse(ACI_UNSUPPORTED_REQUEST);
+    const own = pairs.map(({ key }) => key).filter((key) => key !== END_TO_END);
+    const has = (key) => own.includes(key);
+    if (has("card.expiryMonth") !== has("card.expiryYear"))
+        return refuse(ACI_UNSUPPORTED_REQUEST);
+    if (has(ACI_CARD_FIELD)) {
+        return own.every((key) => key === ACI_CARD_FIELD || key === "card.cvv") ? { leg: "card", ...at } : refuse(ACI_UNSUPPORTED_REQUEST);
+    }
+    if (own.length && own.every((key) => ACI_ABSORBED_FIELDS.includes(key)))
+        return { leg: "absorb", ...at };
+    if (own.length && own.every((key) => ACI_PASSED_FIELDS.includes(key)))
+        return { leg: "pass", ...at };
+    return refuse(ACI_UNSUPPORTED_REQUEST);
+}
+function isAciCardRequest(request) {
+    return classifyAciRequest(request)?.leg === "card";
+}
+function isPreparedAciRequest(request, environment) {
+    const leg = classifyAciRequest(request);
+    return !!leg && leg.leg === "card" && (environment === "production" || environment === "sandbox") && leg.environment === environment;
+}
+function injectAciCard(templateBody, card) {
+    const pairs = readAciForm(templateBody);
+    const keys = pairs ? pairs.map(({ key }) => key) : [];
+    if (!pairs || !keys.includes(ACI_CARD_FIELD) || pairs.some(({ key }) => isAciCardOnFileKey(key)) || !keys.every((key) => key === ACI_CARD_FIELD || key === "card.cvv" || key === END_TO_END) || !pairs.every(({ key, value }) => validField(key, value))) {
+        throw new Error("Refusing to pay: unsupported ACI card request.");
+    }
+    const number = String(card && card.number);
+    const cvc = String(card && card.cvc);
+    const month = String(card && card.month).padStart(2, "0");
+    const rawYear = String(card && card.year);
+    const year = /^[0-9]{2}$/.test(rawYear) ? `20${rawYear}` : rawYear;
+    if (!exact(PAN, number) || !exact(CVV, cvc) || !exact(MONTH, month) || !exact(YEAR, year)) {
+        throw new Error("Could not fill the card fields for ACI. Nothing was sent.");
+    }
+    if (aciPlaceholderBrandRefusal(templateBody, { number })) {
+        throw new Error("Refusing to pay: this ACI payment names a card network that is not your card's. Nothing was sent.");
+    }
+    const written = { "card.number": number, "card.cvv": cvc };
+    const out = pairs.map(({ key, raw }) => Object.prototype.hasOwnProperty.call(written, key) ? `${raw.slice(0, raw.indexOf("="))}=${written[key]}` : raw);
+    const where = ["card.number"];
+    if (keys.includes("card.cvv"))
+        where.push("card.cvv");
+    else {
+        out.push(`card.cvv=${cvc}`);
+        where.push("card.cvv");
+    }
+    out.push(`card.expiryMonth=${month}`, `card.expiryYear=${year}`);
+    where.push("card.expiryMonth", "card.expiryYear");
+    return { body: out.join("&"), where };
+}
+var ACI_BRANDS = Object.freeze({ visa: "VISA", mastercard: "MASTER", master: "MASTER", amex: "AMEX", american_express: "AMEX" });
+function aciBrandForNetwork(network) {
+    const key = typeof network === "string" ? network.trim().toLowerCase().replace(/[\s-]+/g, "_") : "";
+    return Object.prototype.hasOwnProperty.call(ACI_BRANDS, key) ? ACI_BRANDS[key] : null;
+}
+function aciCardBrand(number) {
+    if (!exact(PAN, number))
+        return null;
+    if (/^4/.test(number))
+        return "VISA";
+    if (/^(?:5[1-5]|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)/.test(number))
+        return "MASTER";
+    return /^3[47]/.test(number) ? "AMEX" : null;
+}
+function aciBrandOfCardLeg(body) {
+    const pairs = readAciForm(body);
+    return aciCardBrand(pairs?.find(({ key }) => key === ACI_CARD_FIELD)?.value);
+}
+function aciPlaceholderBrandRefusal(templateBody, card) {
+    const placeholder = aciBrandOfCardLeg(templateBody);
+    return placeholder && placeholder === aciCardBrand(String(card?.number ?? "")) ? null : ACI_BRAND_MISMATCH;
+}
+var CONTINUATION_KEYS = /* @__PURE__ */ new Set([
+    "paymentBrand",
+    "shopperResultUrl",
+    "shopOrigin",
+    "forceUtf8",
+    "card.holder",
+    "card.expiryMonth",
+    "card.expiryYear",
+    ...[
+        "acceptLanguage",
+        "challengeWindow",
+        "deviceId",
+        "javaEnabled",
+        "javascriptEnabled",
+        "language",
+        "screenColorDepth",
+        "screenHeight",
+        "screenWidth",
+        "timezone",
+        "userAgent"
+    ].map((name) => `customer.browser.${name}`),
+    "customer.browserFingerprint.id",
+    "risk.parameters[CS_SESSION_ID]"
+]);
+var SHOPPER_PARAMETER = /^customParameters\[SHOPPER_[A-Za-z0-9._]{1,56}\]$/;
+var continuationKey = (key) => CONTINUATION_KEYS.has(key) || exact(SHOPPER_PARAMETER, key);
+function onOrigin(value, origin) {
+    if (typeof value !== "string" || typeof origin !== "string")
+        return false;
+    let url, expected;
+    try {
+        url = new URL(value);
+        expected = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    return url.protocol === "https:" && !url.username && !url.password && expected.origin === origin && url.origin === origin;
+}
+function prepareAciContinuation(request, context) {
+    const { brand, merchantOrigin } = context || {};
+    const endpoint = request && typeof request === "object" ? aciEndpoint(request.url) : null;
+    if (!endpoint || endpoint.kind !== "payment" || request.method !== "POST")
+        return { outcome: "refuse", code: ACI_UNSUPPORTED_REQUEST };
+    const at = { checkoutId: endpoint.checkoutId, host: endpoint.host, environment: endpoint.environment };
+    const refuse = (code) => ({ outcome: "refuse", code, ...at });
+    const pairs = readAciForm(request.body, 16384);
+    if (!pairs)
+        return refuse(ACI_UNSUPPORTED_REQUEST);
+    if (pairs.some(({ key }) => isAciCardOnFileKey(key)))
+        return refuse(ACI_CARD_ON_FILE_REFUSED);
+    if (!pairs.every(({ key }) => continuationKey(key)))
+        return refuse(ACI_UNSUPPORTED_REQUEST);
+    const value = (key) => pairs.find((pair) => pair.key === key)?.value;
+    if (typeof brand !== "string" || !/^[A-Z]{2,16}$/.test(brand) || value("paymentBrand") !== brand)
+        return refuse(ACI_BRAND_MISMATCH);
+    if (!onOrigin(value("shopperResultUrl"), merchantOrigin))
+        return refuse(ACI_RESULT_URL_REFUSED);
+    const shopOrigin = value("shopOrigin");
+    if (shopOrigin !== void 0 && shopOrigin !== merchantOrigin)
+        return refuse(ACI_RESULT_URL_REFUSED);
+    const month = value("card.expiryMonth");
+    const year = value("card.expiryYear");
+    if (month === void 0 !== (year === void 0))
+        return refuse(ACI_EXPIRY_UNSTRIPPABLE);
+    const stripped = month !== void 0;
+    if (stripped && (!validField("card.expiryMonth", month) || !validField("card.expiryYear", year)))
+        return refuse(ACI_EXPIRY_UNSTRIPPABLE);
+    const body = pairs.filter(({ key }) => !ACI_REMOVED_ON_CONTINUATION.includes(key)).map(({ raw }) => raw).join("&");
+    return { outcome: "continue", body, stripped, ...at };
+}
+var ACI_CHECKOUT_UPDATED = "000.200.101";
+var RESULT_CODE = /^[0-9]{3}\.[0-9]{3}\.[0-9]{3}$/;
+var REFUSAL_FAMILY = /^(?:100|200|600|800)\./;
+function resultCode(text) {
+    if (typeof text !== "string" || text.length > 32768)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const result = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.result : null;
+    const code = result && typeof result === "object" && !Array.isArray(result) ? result.code : null;
+    return exact(RESULT_CODE, code) ? code : null;
+}
+function aciFacts(text) {
+    const code = resultCode(text);
+    return { resultCode: code, refusalCode: code && REFUSAL_FAMILY.test(code) ? code : null };
+}
+function aciResponseOutcome(status, text) {
+    const { resultCode: code, refusalCode } = aciFacts(text);
+    if (!(Number.isInteger(status) && status >= 200 && status < 300))
+        return { outcome: "unknown", reason: "aci_unconfirmed" };
+    if (code === ACI_CHECKOUT_UPDATED)
+        return { outcome: "approved" };
+    if (refusalCode)
+        return { outcome: "refused", code: refusalCode };
+    return { outcome: "unknown", reason: "aci_unconfirmed" };
+}
+function sanitizeAciResponse(text) {
+    if (resultCode(text) !== ACI_CHECKOUT_UPDATED)
+        throw new Error("Refusing to store an unconfirmed ACI answer.");
+    return JSON.stringify({ result: { code: ACI_CHECKOUT_UPDATED, description: "successfully updated checkout" } });
+}
+export { ACI_ABSORBED_FIELDS, ACI_BRAND_MISMATCH, ACI_CARD_FIELD, ACI_CARD_ON_FILE_REFUSED, ACI_CHECKOUT_UPDATED, ACI_EXPIRY_UNSTRIPPABLE, ACI_HOSTS, ACI_PASSED_FIELDS, ACI_REMOVED_ON_CONTINUATION, ACI_RESULT_URL_REFUSED, ACI_SIBLING_KEYS, ACI_TEST_HOSTS, ACI_TEST_PANS, ACI_UNSUPPORTED_REQUEST, aciBrandForNetwork, aciBrandOfCardLeg, aciCardBrand, aciEndpoint, aciEnvironment, aciFacts, aciHostEnvironment, aciPlaceholderBrandRefusal, aciResponseOutcome, classifyAciRequest, injectAciCard, isAciCardOnFileKey, isAciCardRequest, isPreparedAciRequest, prepareAciContinuation, readAciForm, sanitizeAciResponse };