@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/merchant-session.generated.js

@@ -0,0 +1,919 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 622844dcc82d0276b966b1c6e6714d2cc6c3cbb0f854caeba0f92c0bfb041e1b
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+var MAX_PATH_STEPS = 16;
+function isJsonPath(path) {
+    return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+// src/merchant-amount.js
+var ZERO_DECIMAL = /* @__PURE__ */ new Set(["BIF", "CLP", "DJF", "GNF", "ISK", "JPY", "KMF", "KRW", "PYG", "RWF", "UGX", "VND", "VUV", "XAF", "XOF", "XPF"]);
+var THREE_DECIMAL = /* @__PURE__ */ new Set(["BHD", "IQD", "JOD", "KWD", "LYD", "OMR", "TND"]);
+var minorDigits = (currency) => ZERO_DECIMAL.has(currency) ? 0 : THREE_DECIMAL.has(currency) ? 3 : 2;
+function minorFromDecimalText(text, digits, places) {
+    const m = /^(\d{1,13})(?:\.(\d+))?$/.exec(text);
+    if (!m)
+        return null;
+    const fraction = m[2] ?? "";
+    if (fraction.length > places || /[^0]/.test(fraction.slice(digits)))
+        return null;
+    const minor = Number(m[1]) * 10 ** digits + Number((fraction + "0".repeat(digits)).slice(0, digits) || "0");
+    return Number.isSafeInteger(minor) ? minor : null;
+}
+function totalMinor(value, format, unit, currency) {
+    const digits = minorDigits(currency);
+    if (format === "decimal2")
+        return typeof value === "string" && digits === 2 && /^\d{1,13}\.\d{2}$/.test(value) ? minorFromDecimalText(value, 2, 2) : null;
+    if (format === "decimal")
+        return typeof value === "string" ? minorFromDecimalText(value, digits, 4) : null;
+    if (format !== "number" || typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        return null;
+    if (unit === "minor")
+        return Number.isSafeInteger(value) ? value : null;
+    const text = String(value);
+    return /e/i.test(text) ? null : minorFromDecimalText(text, digits, 17);
+}
+var INPUT_TAG = /<input\b([^<>]*)>/gi;
+var ATTRIBUTE = /([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+var withoutComments = (html) => html.replace(/<!--[\s\S]*?-->/g, "");
+function inputValues(html, id) {
+    const values = [];
+    for (const tag of withoutComments(html).matchAll(INPUT_TAG)) {
+        const attributes = /* @__PURE__ */ new Map();
+        for (const attribute of tag[1].matchAll(ATTRIBUTE)) {
+            const name = attribute[1].toLowerCase();
+            if (!attributes.has(name))
+                attributes.set(name, attribute[2] ?? attribute[3] ?? attribute[4] ?? "");
+        }
+        if (attributes.get("id") === id)
+            values.push(attributes.has("value") ? attributes.get("value") : null);
+    }
+    return values;
+}
+// src/merchant-session-documents.js
+var DUNELM_CHECKOUT_VIEW = "query CheckoutView {\n  viewer {\n    __typename\n    checkoutProvisionalOrder {\n      __typename\n      ...ProvisionalOrder\n      customer {\n        __typename\n        emailAddress\n        addresses {\n          __typename\n          home {\n            ...Address\n            __typename\n          }\n          billing {\n            ...Address\n            __typename\n          }\n          pudoLocation {\n            ...Address\n            __typename\n          }\n        }\n      }\n    }\n  }\n}\n\nfragment CheckoutOrderline on CheckoutOrderline {\n  skuCode\n  quantity\n  unitPrice\n  totalPrice\n  unitDiscount\n  onOrBy\n  delivered\n  elapsed\n  customerPromiseDate\n  carrier\n  labels\n  quote {\n    __typename\n    quoteId\n  }\n  store {\n    __typename\n    sapSiteId\n    name\n    uri\n    streetAddress\n    localArea\n    city\n    county\n    postcode\n    country\n    phone\n    staticMapUrl\n    ccCheckInType\n    location {\n      __typename\n      lat\n      lon\n    }\n    tillTimes\n    openingHours {\n      __typename\n      day\n      open\n      close\n    }\n    facilities {\n      __typename\n      facilityIcon\n      facility\n    }\n    seoText {\n      __typename\n      facility\n      facilityIcon\n      type\n      text\n      spans {\n        __typename\n        start\n        end\n        type\n      }\n    }\n  }\n  skuDetails {\n    __typename\n    name\n    imageUrl\n    skuDefiningValues\n    productName\n  }\n  customProduct\n  customProperties {\n    madeToMeasure {\n      widthInCentimeters\n      lengthInCentimeters\n      totalMeterage\n      midRailInCentimeters\n      splitTiltInCentimeters\n      handleHolePositionInMillimeters\n      display {\n        width\n        length\n        unitOfMeasure\n        midRailUnitOfMeasure\n        splitTiltUnitOfMeasure\n        handleHolePositionUnitOfMeasure\n        options {\n          recess\n          controlSide\n          chainColour\n          rollDirection\n          bracketType\n          controlType\n          stackSide\n          bottomWeightType\n          eyeletColour\n          dressSide\n          singlePair\n          frame\n          frameSides\n          frameDepthInMillimeters\n          hardwareColour\n          louvreSize\n          numberOfPanels\n          panelConfiguration\n          midRail\n          midRailPosition\n          tPostConfiguration\n          splitTilt\n          splitTiltMeasure\n          handleHole\n          handleHolePosition\n          tiltControlSide\n          __typename\n        }\n        __typename\n      }\n      options {\n        recess\n        controlSide\n        chainColour\n        rollDirection\n        bracketType\n        controlType\n        stackSide\n        bottomWeightType\n        eyeletColour\n        dressSide\n        singlePair\n        frame\n        frameSides\n        frameDepthInMillimeters\n        hardwareColour\n        louvreSize\n        numberOfPanels\n        panelConfiguration\n        midRail\n        midRailPosition\n        tPostConfiguration\n        splitTilt\n        splitTiltMeasure\n        handleHole\n        handleHolePosition\n        tiltControlSide\n        __typename\n      }\n      __typename\n    }\n    fitting {\n      isSelected\n      durationInHours\n      numberOfWindows\n      __typename\n    }\n    __typename\n  }\n  __typename\n}\n\nfragment Address on Address {\n  id\n  addressCode\n  lastName\n  city\n  addressType\n  county\n  postcode\n  title\n  firstName\n  phoneNumber\n  countryCode\n  line1\n  line2\n  line3\n  __typename\n}\n\nfragment ProvisionalOrder on CheckoutProvisionalOrder {\n  provisionalOrderId\n  preferredDeliveryMethod\n  expiryDate\n  pup {\n    __typename\n    itemCount\n    lines {\n      ...CheckoutOrderline\n      __typename\n    }\n  }\n  cc {\n    __typename\n    itemCount\n    lines {\n      ...CheckoutOrderline\n      __typename\n    }\n    collections {\n      __typename\n      lines {\n        ...CheckoutOrderline\n        __typename\n      }\n    }\n  }\n  hd {\n    __typename\n    itemCount\n    lines {\n      ...CheckoutOrderline\n      __typename\n    }\n    deliveries {\n      type\n      onOrBy\n      date\n      fulfilmentType\n      deliveryCharge\n      isDeliveryCallRequired\n      groupId\n      otherOptions {\n        type\n        date\n        deliveryCharge\n        __typename\n      }\n      lines {\n        ...CheckoutOrderline\n        __typename\n      }\n      __typename\n    }\n    deliveryCharges {\n      type\n      charge\n      __typename\n    }\n  }\n  flags {\n    paymentRequired\n    isDeliveryFree\n    checkoutComplete\n    __typename\n  }\n  voucher {\n    __typename\n    basketDiscount\n    discountedDeliveryCharges {\n      discountedAmount\n      originalCharge\n      type\n      __typename\n    }\n    code\n    description\n  }\n  prices {\n    __typename\n    delivery\n    subtotal\n    orderLinesPayable\n    total\n  }\n  promises {\n    sku\n    available\n    promises {\n      ... on Delivery {\n        __typename\n      }\n      ... on HomeDelivery {\n        onOrBy\n        date\n        price\n        available\n        __typename\n      }\n      ... on Standard {\n        onOrBy\n        date\n        price\n        available\n        __typename\n      }\n      ... on NominatedDay {\n        onOrBy\n        date\n        price\n        available\n        __typename\n      }\n      ... on Express {\n        onOrBy\n        date\n        price\n        available\n        __typename\n      }\n      ... on ClickAndCollect {\n        available\n        stores {\n          sapSiteId\n          availability {\n            sku\n            quantity\n            stock\n            __typename\n          }\n          __typename\n        }\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n  __typename\n}\n";
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/merchant-session.js
+var MERCHANT_SESSION_MODE = "merchant_session";
+var MERCHANT_SESSION_USER_AGENT = "AgentcardMerchantRead/1.0 (+https://agentcard.sh)";
+var MERCHANT_SESSION_BOT_COOKIES = /* @__PURE__ */ deepFreeze(["cf_clearance", "__cf_bm", "_abck", "bm_sz", "ak_bmsc"]);
+var MERCHANT_SESSION_SIGN_IN_COOKIES = /* @__PURE__ */ deepFreeze([
+    "^auth0\\.[^.]+\\.is\\.authenticated$",
+    "^_legacy_auth0\\.[^.]+\\.is\\.authenticated$",
+    "^(?:__Secure-|__Host-)?(?:authjs|next-auth)\\.session-token(?:\\.\\d+)?$",
+    "^\\.ASPXAUTH$",
+    "^\\.AspNet\\.ApplicationCookie$",
+    "^\\.AspNetCore\\.Identity\\.Application$"
+]);
+var MERCHANT_SESSION_READ_LIMITS = /* @__PURE__ */ deepFreeze({ toMerchantBytes: 256 * 1024, toBrowserBytes: 1024 * 1024, durationMs: 6e4 });
+var MERCHANT_SESSION_RELAY_URL = "wss://merchant-session-relay.agentcard.sh/relay";
+var MERCHANT_SESSION_COOKIE_LIMITS = /* @__PURE__ */ deepFreeze({ captured: 96, kept: 64, nameBytes: 256, valueBytes: 4096, headerBytes: 16 * 1024 });
+var MAX_ANSWER_BYTES = 256 * 1024;
+var DOCUMENTS = /* @__PURE__ */ Object.freeze({ ee1e641857cf90bead052cc581ecacc56bf67fa625808f4f094a0a13e1ab8b93: DUNELM_CHECKOUT_VIEW });
+var HEADERS = (accept, language, extra = []) => [
+    ["accept", accept],
+    ["accept-encoding", "identity"],
+    ["accept-language", language],
+    ["cache-control", "no-cache"],
+    ...extra,
+    ["pragma", "no-cache"],
+    ["user-agent", MERCHANT_SESSION_USER_AGENT]
+];
+var MERCHANT_SESSION_PROFILES = /* @__PURE__ */ deepFreeze([
+    {
+        // Read Sep 29, 2026 in Felipe's agent Chrome (D15 A, evidence/dunelm): the legacy
+        // checkout (Unleash exp_checkout_mfe 'control') posts CheckoutView with variables {}
+        // to was.dunelm.com and reads the provisional order from the signed cookie-session
+        // was_session_2. The answer names prices in pounds (a JSON number) and no currency;
+        // Dunelm sells only in GBP. customerPromiseDate changes on every read, so the goods
+        // digest leaves it out. The page sends sas-use-cache: 1; this read omits it until the
+        // evidence shows what it does (DESIGN 7.1), and every answer seen was no-store and a
+        // miss at both Fastly tiers. The MFE variant (ProvisionalOrder by id, no cookies) is a
+        // different read: its session reads CheckoutView as null and is refused ('no_order').
+        profile: "dunelm_was_graphql",
+        merchant: "Dunelm",
+        status: "observe",
+        mode: MERCHANT_SESSION_MODE,
+        binding: { level: "detected", evidence: [] },
+        guestOnly: true,
+        endpoint: "https://was.dunelm.com",
+        cookies: { drop: [] },
+        signIn: { cookies: [] },
+        read: {
+            method: "POST",
+            path: "/graphql",
+            query: {},
+            headers: HEADERS("*/*", "en-GB", [["content-type", "application/json"]]),
+            body: {
+                operationName: "CheckoutView",
+                documentSha256: "ee1e641857cf90bead052cc581ecacc56bf67fa625808f4f094a0a13e1ab8b93",
+                bodySha256: "e9f68a4fcb0dba9caf9649a9b1d72b95539efc09339106c59d7ffd5998994d57"
+            },
+            format: "json",
+            at: ["data", "viewer", "checkoutProvisionalOrder"],
+            // One Click & Collect line read 29,969 bytes, mostly the store's seoText.
+            maxAnswerBytes: 128 * 1024,
+            refuseCacheHit: true
+        },
+        total: { path: ["prices", "total"], format: "number", unit: "major", currency: "GBP" },
+        // false means nothing is left for a card; a GraphQL error result is not a total,
+        // even beside partial data; a completed checkout is not the one being paid.
+        requires: [{ path: ["flags", "paymentRequired"], equals: true }],
+        refuse: [{ path: ["errors"], when: "present", root: true }, { path: ["flags", "checkoutComplete"], when: "true" }],
+        cartId: ["provisionalOrderId"],
+        expiry: ["expiryDate"],
+        snapshot: [
+            ["provisionalOrderId"],
+            ["prices", "total"],
+            ["prices", "subtotal"],
+            ["prices", "orderLinesPayable"],
+            ["prices", "delivery"],
+            ["voucher", "basketDiscount"],
+            ["flags", "paymentRequired"],
+            ["expiryDate"]
+        ],
+        digests: {
+            goods: {
+                lists: [["pup", "lines"], ["cc", "lines"], ["cc", "collections", "*", "lines"], ["hd", "lines"], ["hd", "deliveries", "*", "lines"]],
+                fields: [["skuCode"], ["quantity"], ["unitPrice"], ["totalPrice"], ["unitDiscount"], ["carrier"], ["store", "sapSiteId"], ["customProduct"]]
+            },
+            destination: [
+                ["preferredDeliveryMethod"],
+                ["cc", "lines", "*", "store", "sapSiteId"],
+                ["cc", "collections", "*", "lines", "*", "store", "sapSiteId"],
+                ["hd", "deliveries", "*", "type"],
+                ["customer", "addresses", "home"],
+                ["customer", "addresses", "pudoLocation"]
+            ],
+            recipient: [["customer", "emailAddress"], ["customer", "addresses", "billing"]]
+        },
+        relay: { toMerchantBytes: 64 * 1024, toBrowserBytes: 320 * 1024, durationMs: 3e4 }
+    },
+    {
+        // Read Sep 29, 2026 in Felipe's agent Chrome (D15 A, evidence/cinemark): the guest
+        // checkout document GET /checkout renders the cart into #checkout_v2 with exactly one
+        // hidden input#CartSummary_TotalWithServiceFee (dollars as decimal text), next to
+        // eight anti-forgery tokens and six Umbraco route tokens that change on every render,
+        // which the goods digest never reads (it reads the container's text, not attribute
+        // values). The page's own XHR reload (GET /Checkout with X-Requested-With) did not
+        // run in that session, so the observed document is the pinned read. Cloudflare issued
+        // cf_clearance to Chrome silently; this read never sends it. __cflb (load-balancer
+        // affinity, not a bot score) stays in the session beside ASP.NET_SessionId, which
+        // holds the cart. An inline script must declare isAuthenticated false (the page's own
+        // adyenOptions does), and the page must write it true nowhere (D22).
+        profile: "cinemark_initiate",
+        merchant: "Cinemark",
+        status: "observe",
+        mode: MERCHANT_SESSION_MODE,
+        binding: { level: "detected", evidence: [] },
+        guestOnly: true,
+        endpoint: "https://www.cinemark.com",
+        cookies: { drop: [] },
+        signIn: { cookies: [] },
+        read: {
+            method: "GET",
+            path: "/checkout",
+            query: {},
+            headers: HEADERS("text/html", "en-US"),
+            body: null,
+            format: "html",
+            container: "checkout_v2",
+            // The document read 210,933 bytes decoded; the TLS runtime stops at 256 KiB.
+            maxAnswerBytes: 256 * 1024,
+            refuseCacheHit: true
+        },
+        total: { input: "CartSummary_TotalWithServiceFee", format: "decimal", unit: "major", currency: "USD" },
+        guest: { scriptFlag: "isAuthenticated" },
+        // The theater the tickets are for; Kount's device session id when the page renders
+        // one (none on Sep 29: risk data now comes from Adyen's own data collection).
+        scriptValues: ["theaterId"],
+        kountInput: "KountSessionId",
+        relay: { toMerchantBytes: 64 * 1024, toBrowserBytes: 576 * 1024, durationMs: 3e4 }
+    }
+]);
+function merchantSessionProfile(id) {
+    return typeof id === "string" ? MERCHANT_SESSION_PROFILES.find((block) => block.profile === id) ?? null : null;
+}
+function required(id) {
+    const block = merchantSessionProfile(id);
+    if (!block)
+        throw new Error("Refusing to read: unknown merchant-session profile.");
+    const refusal = merchantSessionProfileRefusal(block);
+    if (refusal)
+        throw new Error(`Refusing to read: the ${block.profile} session block fails review (${refusal}).`);
+    return block;
+}
+function merchantSessionHosts() {
+    return [...new Set(MERCHANT_SESSION_PROFILES.map((block) => new URL(block.endpoint).hostname))].sort();
+}
+var JSON_MEMBERS = [
+    "profile",
+    "merchant",
+    "status",
+    "mode",
+    "binding",
+    "guestOnly",
+    "endpoint",
+    "cookies",
+    "signIn",
+    "read",
+    "total",
+    "requires",
+    "refuse",
+    "cartId",
+    "expiry",
+    "snapshot",
+    "digests",
+    "relay"
+];
+var HTML_MEMBERS = [
+    "profile",
+    "merchant",
+    "status",
+    "mode",
+    "binding",
+    "guestOnly",
+    "endpoint",
+    "cookies",
+    "signIn",
+    "read",
+    "total",
+    "guest",
+    "scriptValues",
+    "kountInput",
+    "relay"
+];
+var READ_MEMBERS = {
+    json: ["method", "path", "query", "headers", "body", "format", "at", "maxAnswerBytes", "refuseCacheHit"],
+    html: ["method", "path", "query", "headers", "body", "format", "container", "maxAnswerBytes", "refuseCacheHit"]
+};
+var READ_HEADERS = /* @__PURE__ */ new Set(["accept", "accept-encoding", "accept-language", "cache-control", "content-type", "pragma", "user-agent", "x-requested-with"]);
+var MUST = { "accept-encoding": "identity", "cache-control": "no-cache", pragma: "no-cache", "user-agent": MERCHANT_SESSION_USER_AGENT };
+var TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,256}$/;
+var ELEMENT_ID = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+var SCRIPT_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+var exactly = (value, members) => isPlainObject(value) && Object.keys(value).length === members.length && members.every((m) => Object.hasOwn(value, m));
+var isWildPath = (path) => Array.isArray(path) && path.length > 0 && isJsonPath(path.map((step) => step === "*" ? 0 : step));
+var compiles = (source) => {
+    try {
+        new RegExp(source);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+var bounded = (value, max) => Number.isSafeInteger(value) && value >= 1 && value <= max;
+function headersRefusal(read) {
+    const headers = read.headers;
+    if (!Array.isArray(headers) || headers.length === 0 || headers.length > 12)
+        return "read.headers is not a list of at most 12 pairs";
+    const seen = /* @__PURE__ */ new Map();
+    for (const pair of headers) {
+        if (!Array.isArray(pair) || pair.length !== 2 || typeof pair[0] !== "string" || typeof pair[1] !== "string")
+            return "a read header is not a [name, value] pair";
+        const [name, value] = pair;
+        if (!READ_HEADERS.has(name))
+            return `read header ${name} is not one a read may pin`;
+        if (seen.has(name))
+            return `read header ${name} is pinned twice`;
+        if (!/^[\x20-\x7e]{1,256}$/.test(value))
+            return `read header ${name} has no printable value`;
+        seen.set(name, value);
+    }
+    for (const [name, value] of Object.entries(MUST)) {
+        if (seen.get(name) !== value)
+            return `read header ${name} must be ${value}`;
+    }
+    if (read.method === "POST" ? seen.get("content-type") !== "application/json" : seen.has("content-type")) {
+        return "a POST read pins content-type application/json, and a GET read pins none";
+    }
+    return null;
+}
+function bodyRefusal(read) {
+    if (read.method === "GET")
+        return read.body === null ? null : "a GET read has no body";
+    const body = read.body;
+    if (!exactly(body, ["operationName", "documentSha256", "bodySha256"]) || typeof body.operationName !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(body.operationName))
+        return "read.body is not {operationName, documentSha256, bodySha256}";
+    const document = Object.hasOwn(DOCUMENTS, body.documentSha256) ? DOCUMENTS[body.documentSha256] : null;
+    if (!document || sha256Hex(document) !== body.documentSha256)
+        return "read.body names no pinned document";
+    if (!new RegExp(`^query ${body.operationName}\\b`).test(document))
+        return "the pinned document is not a query named by operationName";
+    if (sha256Hex(readBody(read)) !== body.bodySha256)
+        return "the pinned body does not hash to bodySha256";
+    return null;
+}
+function digestsRefusal(digests) {
+    if (!exactly(digests, ["goods", "destination", "recipient"]))
+        return "digests is not {goods, destination, recipient}";
+    const goods = digests.goods;
+    if (!exactly(goods, ["lists", "fields"]) || !Array.isArray(goods.lists) || !goods.lists.every(isWildPath) || !Array.isArray(goods.fields) || !goods.fields.every(isWildPath))
+        return "digests.goods is not {lists, fields} of paths";
+    for (const name of ["destination", "recipient"]) {
+        if (!Array.isArray(digests[name]) || !digests[name].every(isWildPath))
+            return `digests.${name} is not a list of paths`;
+    }
+    return null;
+}
+function merchantSessionProfileRefusal(block) {
+    if (!isPlainObject(block) || !isPlainObject(block.read))
+        return "the block is not an object with a read";
+    const format = block.read.format;
+    if (format !== "json" && format !== "html")
+        return "read.format is neither json nor html";
+    if (!exactly(block, format === "json" ? JSON_MEMBERS : HTML_MEMBERS))
+        return `the block's members are not the ${format} block's`;
+    if (typeof block.profile !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(block.profile))
+        return "profile is not a profile id";
+    if (typeof block.merchant !== "string" || !block.merchant)
+        return "merchant is not named";
+    if (block.status !== "observe")
+        return "status is not observe: no session block reads for a payment yet";
+    if (block.mode !== MERCHANT_SESSION_MODE)
+        return `mode is not ${MERCHANT_SESSION_MODE}`;
+    const binding = block.binding;
+    if (!exactly(binding, ["level", "evidence"]) || !Array.isArray(binding.evidence))
+        return "binding is not {level, evidence}";
+    if (binding.level === "prevented") {
+        if (!binding.evidence.some((entry) => isPlainObject(entry) && ["merchant_statement", "merchant_documentation"].includes(entry.kind))) {
+            return "binding prevented needs a merchant statement or documentation";
+        }
+    }
+    else if (binding.level !== "detected")
+        return "binding.level is neither detected nor prevented";
+    if (binding.evidence.some((entry) => !isPlainObject(entry) || entry.kind === "har"))
+        return "binding evidence of kind har never proves a binding";
+    if (block.guestOnly !== true)
+        return "guestOnly is not true";
+    let origin;
+    try {
+        origin = new URL(block.endpoint);
+    }
+    catch {
+        return "endpoint is not a URL";
+    }
+    if (origin.protocol !== "https:" || origin.origin !== block.endpoint || origin.port)
+        return "endpoint is not an exact https origin";
+    if (!exactly(block.cookies, ["drop"]) || !Array.isArray(block.cookies.drop) || !block.cookies.drop.every((name) => TOKEN.test(name))) {
+        return "cookies is not {drop} of cookie names";
+    }
+    if (!exactly(block.signIn, ["cookies"]) || !Array.isArray(block.signIn.cookies) || !block.signIn.cookies.every((source) => typeof source === "string" && source.length > 0 && compiles(source))) {
+        return "signIn is not {cookies} of patterns";
+    }
+    const read = block.read;
+    if (!exactly(read, READ_MEMBERS[format]))
+        return `read's members are not the ${format} read's`;
+    if (read.method !== "GET" && read.method !== "POST")
+        return "read.method is neither GET nor POST";
+    if (typeof read.path !== "string" || !/^\/[A-Za-z0-9._~/-]{0,255}$/.test(read.path) || read.path.split("/").some((segment) => segment === "." || segment === ".."))
+        return "read.path is not a plain path";
+    if (!isPlainObject(read.query) || Object.keys(read.query).length > 0)
+        return "read.query is not {}";
+    const headers = headersRefusal(read);
+    if (headers)
+        return headers;
+    const body = bodyRefusal(read);
+    if (body)
+        return body;
+    if (!bounded(read.maxAnswerBytes, MAX_ANSWER_BYTES))
+        return `read.maxAnswerBytes is not 1 to ${MAX_ANSWER_BYTES}`;
+    if (read.refuseCacheHit !== true)
+        return "read.refuseCacheHit is not true";
+    const total = block.total;
+    if (!isPlainObject(total) || !["major", "minor"].includes(total.unit) || typeof total.currency !== "string" || !/^[A-Z]{3}$/.test(total.currency)) {
+        return "total names no unit and currency";
+    }
+    if (format === "json") {
+        if (read.method !== "POST" || !isJsonPath(read.at))
+            return "a json read is a POST with an at path";
+        if (!exactly(total, ["path", "format", "unit", "currency"]) || !isJsonPath(total.path) || !["number", "decimal", "decimal2"].includes(total.format)) {
+            return "total is not {path, format, unit, currency}";
+        }
+        if (!Array.isArray(block.requires) || !block.requires.every((rule) => exactly(rule, ["path", "equals"]) && isJsonPath(rule.path))) {
+            return "requires is not a list of {path, equals}";
+        }
+        if (!Array.isArray(block.refuse) || !block.refuse.every((rule) => isPlainObject(rule) && isJsonPath(rule.path) && ["present", "true"].includes(rule.when) && (rule.root === void 0 || rule.root === true)))
+            return "refuse is not a list of {path, when, root?}";
+        if (!isJsonPath(block.cartId) || !(block.expiry === null || isJsonPath(block.expiry)))
+            return "cartId or expiry is not a path";
+        if (!Array.isArray(block.snapshot) || block.snapshot.length === 0 || !block.snapshot.every(isJsonPath))
+            return "snapshot is not a list of paths";
+        const digests = digestsRefusal(block.digests);
+        if (digests)
+            return digests;
+    }
+    else {
+        if (read.method !== "GET" || typeof read.container !== "string" || !ELEMENT_ID.test(read.container))
+            return "an html read is a GET with a container id";
+        if (!exactly(total, ["input", "format", "unit", "currency"]) || !ELEMENT_ID.test(total.input) || total.format !== "decimal") {
+            return "total is not {input, format decimal, unit, currency}";
+        }
+        if (!exactly(block.guest, ["scriptFlag"]) || !SCRIPT_NAME.test(block.guest.scriptFlag))
+            return "guest is not {scriptFlag}";
+        if (!Array.isArray(block.scriptValues) || !block.scriptValues.every((name) => SCRIPT_NAME.test(name)))
+            return "scriptValues is not a list of names";
+        if (!(block.kountInput === null || ELEMENT_ID.test(block.kountInput)))
+            return "kountInput is not an element id";
+    }
+    if (total.format !== "number" && total.unit !== "major")
+        return "a decimal total is in major units";
+    if (total.format === "decimal2" && totalMinor("1.00", "decimal2", "major", total.currency) === null) {
+        return `a decimal2 total needs a currency with two decimals, which ${total.currency} does not have`;
+    }
+    const relay = block.relay;
+    if (!exactly(relay, ["toMerchantBytes", "toBrowserBytes", "durationMs"]) || !bounded(relay.toMerchantBytes, MERCHANT_SESSION_READ_LIMITS.toMerchantBytes) || !bounded(relay.toBrowserBytes, MERCHANT_SESSION_READ_LIMITS.toBrowserBytes) || !bounded(relay.durationMs, MERCHANT_SESSION_READ_LIMITS.durationMs))
+        return "relay does not fit the relay's read grant ceilings";
+    if (relay.toBrowserBytes < read.maxAnswerBytes + 32 * 1024)
+        return "relay.toBrowserBytes leaves no room for one whole answer";
+    return null;
+}
+var COOKIE_VALUE = /^(?:[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*|"[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*")$/;
+var byteLength = (text) => {
+    let n = 0;
+    for (const char of text) {
+        const cp = char.codePointAt(0);
+        n += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+    }
+    return n;
+};
+var refused = (code, reason) => ({ ok: false, code, reason });
+function merchantSessionCookies(id, cookies) {
+    const block = merchantSessionProfile(id);
+    if (!block)
+        return refused("unknown_profile", "no reviewed merchant-session block has this id");
+    if (!Array.isArray(cookies) || cookies.length > MERCHANT_SESSION_COOKIE_LIMITS.captured) {
+        return refused("invalid_session", `the session is not a list of at most ${MERCHANT_SESSION_COOKIE_LIMITS.captured} cookies`);
+    }
+    const signIn = [...MERCHANT_SESSION_SIGN_IN_COOKIES, ...block.signIn.cookies].map((source) => new RegExp(source));
+    const drop = /* @__PURE__ */ new Set([...MERCHANT_SESSION_BOT_COOKIES, ...block.cookies.drop]);
+    const kept = [];
+    const dropped = [];
+    const names = /* @__PURE__ */ new Set();
+    for (const cookie of cookies) {
+        if (!exactly(cookie, ["name", "value"]) || typeof cookie.name !== "string" || typeof cookie.value !== "string" || !TOKEN.test(cookie.name) || byteLength(cookie.name) > MERCHANT_SESSION_COOKIE_LIMITS.nameBytes || !COOKIE_VALUE.test(cookie.value) || byteLength(cookie.value) > MERCHANT_SESSION_COOKIE_LIMITS.valueBytes) {
+            return refused("invalid_session", "a session cookie is not an RFC 6265 name and value within the limits");
+        }
+        if (names.has(cookie.name))
+            return refused("invalid_session", `the session names cookie ${cookie.name} twice`);
+        names.add(cookie.name);
+        if (signIn.some((pattern) => pattern.test(cookie.name))) {
+            return refused("signed_in", `the session carries ${cookie.name}, which marks a signed-in account: phase 1 reads guest checkouts only`);
+        }
+        if (drop.has(cookie.name))
+            dropped.push(cookie.name);
+        else
+            kept.push({ name: cookie.name, value: cookie.value });
+    }
+    if (kept.length === 0)
+        return refused("no_session", "no cookie is left to name the cart");
+    if (kept.length > MERCHANT_SESSION_COOKIE_LIMITS.kept)
+        return refused("invalid_session", `more than ${MERCHANT_SESSION_COOKIE_LIMITS.kept} cookies are left to send`);
+    const header = kept.map(({ name, value }) => `${name}=${value}`).join("; ");
+    if (byteLength(header) > MERCHANT_SESSION_COOKIE_LIMITS.headerBytes)
+        return refused("invalid_session", "the Cookie header would pass 16 KiB");
+    return { ok: true, cookies: kept, dropped: dropped.sort(), header };
+}
+function readBody(read) {
+    return JSON.stringify({ operationName: read.body.operationName, variables: {}, query: DOCUMENTS[read.body.documentSha256] });
+}
+function merchantSessionRead(id, session) {
+    const block = required(id);
+    const kept = merchantSessionCookies(block.profile, isPlainObject(session) ? session.cookies : void 0);
+    if (!kept.ok)
+        throw Object.assign(new Error(`Refusing to read: ${kept.reason}.`), { code: kept.code });
+    const read = block.read;
+    return deepFreeze({
+        method: read.method,
+        url: `${block.endpoint}${read.path}`,
+        headers: [...read.headers.map(([name, value]) => [name, value]), ["cookie", kept.header]],
+        body: read.method === "POST" ? readBody(read) : null
+    });
+}
+function headerPairs(headers) {
+    if (!Array.isArray(headers) || headers.length > 256)
+        return null;
+    const pairs = [];
+    for (const pair of headers) {
+        if (!Array.isArray(pair) || pair.length !== 2 || typeof pair[0] !== "string" || typeof pair[1] !== "string")
+            return null;
+        pairs.push([pair[0].toLowerCase(), pair[1]]);
+    }
+    return pairs;
+}
+var valuesOf = (pairs, name) => pairs.filter(([n]) => n === name).map(([, v]) => v);
+function cacheHit(pairs) {
+    if (valuesOf(pairs, "age").some((value) => !/^\s*0+\s*$/.test(value)))
+        return true;
+    if (valuesOf(pairs, "x-cache").some((value) => /\bHIT\b/i.test(value)))
+        return true;
+    if (valuesOf(pairs, "x-cache-hits").some((value) => value.split(",").some((part) => !/^\s*0*\s*$/.test(part))))
+        return true;
+    return valuesOf(pairs, "cf-cache-status").some((value) => /^\s*(?:HIT|STALE|UPDATING|REVALIDATED)\s*$/i.test(value));
+}
+var CACHE_FACT_HEADERS = ["age", "cache-control", "cf-cache-status", "x-cache", "x-cache-hits"];
+var CHALLENGE_STATUSES = /* @__PURE__ */ new Set([403, 406, 429, 503]);
+var CACHE_FACT_VALUES = 4;
+var MERCHANT_SESSION_CACHE_FACT_CHARS = CACHE_FACT_VALUES * 64 + (CACHE_FACT_VALUES - 1) * " | ".length + " | more".length;
+function merchantSessionAnswerFacts(response) {
+    const pairs = isPlainObject(response) ? headerPairs(response.headers) : null;
+    const status = isPlainObject(response) && Number.isSafeInteger(response.status) ? response.status : null;
+    if (!pairs || status === null)
+        return { status, challenge: null, headerNames: [], cache: {} };
+    const body = typeof response.bodyText === "string" ? response.bodyText : "";
+    const names = new Set(pairs.map(([name]) => name));
+    let challenge = null;
+    if (names.has("cf-mitigated"))
+        challenge = "cloudflare";
+    else if (status !== 200) {
+        if (body.includes("/cdn-cgi/challenge-platform/h/") || /<title>\s*Just a moment\.\.\.\s*<\/title>/i.test(body))
+            challenge = "cloudflare";
+        else if (body.includes("/_sec/cp_challenge/"))
+            challenge = "akamai";
+        else if (names.has("x-datadome") || names.has("x-dd-b"))
+            challenge = "datadome";
+        else if (CHALLENGE_STATUSES.has(status))
+            challenge = "unknown";
+    }
+    const cache = {};
+    for (const name of CACHE_FACT_HEADERS) {
+        const values = valuesOf(pairs, name);
+        if (values.length) {
+            const kept = values.slice(0, CACHE_FACT_VALUES).map((value) => /^[A-Za-z0-9 ,=._/-]{0,64}$/.test(value) ? value : "other");
+            cache[name] = [...kept, ...values.length > CACHE_FACT_VALUES ? ["more"] : []].join(" | ");
+        }
+    }
+    const headerNames = [...names].filter((name) => /^[a-z0-9-]{1,64}$/.test(name)).sort().slice(0, 64);
+    return { status, challenge, headerNames, cache };
+}
+function valuesAtPath(root, path) {
+    let nodes = [root];
+    for (const step of path) {
+        const next = [];
+        for (const node of nodes) {
+            if (step === "*") {
+                if (Array.isArray(node))
+                    next.push(...node);
+                continue;
+            }
+            const at = jsonAt(node, [step]);
+            if (at.found)
+                next.push(at.value);
+        }
+        nodes = next;
+    }
+    return nodes;
+}
+var hashOf = (value) => sha256Hex(JSON.stringify(value));
+var pathKey = (path) => path.join(".");
+function jsonReading(block, text, now) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return refused("unreadable", "the answer is not JSON");
+    }
+    const order = jsonAt(parsed, block.read.at);
+    for (const rule of block.refuse) {
+        const at = jsonAt(rule.root ? parsed : order.found ? order.value : void 0, rule.path);
+        const fires = rule.when === "present" ? at.found : at.found && at.value !== false && at.value !== null;
+        if (fires)
+            return refused(rule.root ? "error_result" : "not_payable", `the answer carries ${pathKey(rule.path)}`);
+    }
+    if (!order.found || !isPlainObject(order.value))
+        return refused("no_order", "the answer names no order to pay");
+    const node = order.value;
+    for (const rule of block.requires) {
+        const at = jsonAt(node, rule.path);
+        if (!at.found || at.value !== rule.equals)
+            return refused("not_payable", `${pathKey(rule.path)} is not ${JSON.stringify(rule.equals)}`);
+    }
+    const total = jsonAt(node, block.total.path);
+    const minor = total.found ? totalMinor(total.value, block.total.format, block.total.unit, block.total.currency) : null;
+    if (minor === null || minor <= 0)
+        return refused("unreadable", "the total is not a whole positive amount in minor units");
+    const cart = jsonAt(node, block.cartId);
+    const cartId = cart.found && Number.isSafeInteger(cart.value) ? String(cart.value) : cart.found ? cart.value : null;
+    if (typeof cartId !== "string" || !/^[\x21-\x7e]{1,256}$/.test(cartId))
+        return refused("unreadable", "the answer names no cart id");
+    let expiresAt = null;
+    if (block.expiry) {
+        const expiry = jsonAt(node, block.expiry);
+        expiresAt = expiry.found && typeof expiry.value === "string" ? Date.parse(expiry.value) : NaN;
+        if (!Number.isFinite(expiresAt))
+            return refused("unreadable", "the answer names no expiry");
+        if (Number.isFinite(now) && expiresAt <= now)
+            return refused("expired", "the order expired before this read");
+    }
+    const snapshot = block.snapshot.map((path) => {
+        const at = jsonAt(node, path);
+        return [pathKey(path), at.found ? at.value : null];
+    });
+    const { goods, destination, recipient } = block.digests;
+    const lines = goods.lists.flatMap((list) => valuesAtPath(node, list)).flatMap((list) => Array.isArray(list) ? list : []).map((line) => goods.fields.map((field) => valuesAtPath(line, field)));
+    const collect = (paths) => paths.map((path) => [pathKey(path), valuesAtPath(node, path)]);
+    return {
+        ok: true,
+        profile: block.profile,
+        totalMinor: minor,
+        currency: block.total.currency,
+        cartId,
+        cartIdSha256: sha256Hex(cartId),
+        expiresAt,
+        snapshotSha256: hashOf(snapshot),
+        digests: { goods: hashOf(lines), destination: hashOf(collect(destination)), recipient: hashOf(collect(recipient)) },
+        kountSessionSha256: null
+    };
+}
+var NON_MARKUP = /<!--[\s\S]*?-->|<(script|style|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
+var START_TAG = /<([A-Za-z][A-Za-z0-9-]*)\b([^<>]*)>/g;
+var ID_ATTRIBUTE = /(?:^|\s)id\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/i;
+function containerOf(markup, id) {
+    const opens = [...markup.matchAll(START_TAG)].filter((tag) => {
+        const m = ID_ATTRIBUTE.exec(tag[2]);
+        return m && (m[1] ?? m[2] ?? m[3]) === id;
+    });
+    if (opens.length !== 1)
+        return { found: false, count: opens.length };
+    const [open] = opens;
+    const name = open[1].toLowerCase();
+    const tags = new RegExp(`<(/?)${name}\\b[^<>]*>`, "gi");
+    tags.lastIndex = open.index + open[0].length;
+    let depth = 1;
+    for (let tag = tags.exec(markup); tag; tag = tags.exec(markup)) {
+        depth += tag[1] ? -1 : 1;
+        if (depth === 0)
+            return { found: true, inner: markup.slice(open.index + open[0].length, tag.index) };
+    }
+    return { found: false, count: 1 };
+}
+function scriptValues(text, name, shape) {
+    const pattern = new RegExp(`(?:^|[^A-Za-z0-9_$.])${name.replace(/\$/g, "\\$")}['"]?\\s*(?::|=(?!=))\\s*(['"]?)(${shape})\\1(?![A-Za-z0-9_$])`, "g");
+    return [...text.matchAll(pattern)].map((m) => m[2]);
+}
+var COMMENT_OR_SCRIPT = /<!--[\s\S]*?-->|<script\b([^<>]*)>([\s\S]*?)<\/script\s*>/gi;
+var ATTRIBUTE2 = /([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+var JAVASCRIPT_TYPES = /* @__PURE__ */ new Set([
+    "application/ecmascript",
+    "application/javascript",
+    "application/x-ecmascript",
+    "application/x-javascript",
+    "text/ecmascript",
+    "text/javascript",
+    "text/javascript1.0",
+    "text/javascript1.1",
+    "text/javascript1.2",
+    "text/javascript1.3",
+    "text/javascript1.4",
+    "text/javascript1.5",
+    "text/jscript",
+    "text/livescript",
+    "text/x-ecmascript",
+    "text/x-javascript"
+]);
+function attributesOf(text) {
+    const attributes = /* @__PURE__ */ new Map();
+    for (const m of text.matchAll(ATTRIBUTE2)) {
+        const name = m[1].toLowerCase();
+        if (!attributes.has(name))
+            attributes.set(name, m[2] ?? m[3] ?? m[4] ?? "");
+    }
+    return attributes;
+}
+function runsInline(attributes) {
+    if (attributes.has("src"))
+        return false;
+    const type = attributes.has("type") ? attributes.get("type") || "text/javascript" : attributes.get("language") ? `text/${attributes.get("language")}` : "text/javascript";
+    const typeString = type.replace(/^[\t\n\f\r ]+|[\t\n\f\r ]+$/g, "").toLowerCase();
+    if (typeString === "module")
+        return true;
+    return JAVASCRIPT_TYPES.has(typeString) && !attributes.has("nomodule");
+}
+function inlineScriptText(html) {
+    const texts = [];
+    for (const [, attributes, text] of html.matchAll(COMMENT_OR_SCRIPT)) {
+        if (text !== void 0 && runsInline(attributesOf(attributes)))
+            texts.push(text);
+    }
+    return texts.join("\n");
+}
+function htmlReading(block, html) {
+    const markup = html.replace(NON_MARKUP, "");
+    const container = containerOf(markup, block.read.container);
+    if (!container.found)
+        return refused(container.count > 1 ? "ambiguous" : "unreadable", `the page has ${container.count > 1 ? "more than one" : "no whole"} #${block.read.container}`);
+    const everywhere = inputValues(markup, block.total.input);
+    const inside = inputValues(container.inner, block.total.input);
+    if (everywhere.length > 1 || inside.length > 1)
+        return refused("ambiguous", `the page renders #${block.total.input} more than once`);
+    if (inside.length !== 1)
+        return refused("unreadable", `#${block.total.input} is not inside #${block.read.container}`);
+    const minor = totalMinor(inside[0], block.total.format, block.total.unit, block.total.currency);
+    if (minor === null || minor <= 0)
+        return refused("unreadable", "the total is not a whole positive amount in minor units");
+    const flag = block.guest.scriptFlag;
+    const flagValues = (text2) => scriptValues(text2, flag, "[Tt]rue|[Ff]alse|TRUE|FALSE").map((value) => value.toLowerCase());
+    if (flagValues(html).includes("true"))
+        return refused("signed_in", `the page says ${flag} is true: phase 1 reads guest checkouts only`);
+    if (!flagValues(inlineScriptText(html)).includes("false"))
+        return refused("unreadable", `no script on the page says ${flag} is false`);
+    const values = block.scriptValues.map((name) => [name, scriptValues(html, name, "\\d{1,9}")]);
+    const text = container.inner.replace(/<[^<>]*>/g, " ").replace(/\s+/g, " ").trim();
+    const kount = block.kountInput ? inputValues(markup, block.kountInput).filter((value) => typeof value === "string" && value) : [];
+    return {
+        ok: true,
+        profile: block.profile,
+        totalMinor: minor,
+        currency: block.total.currency,
+        cartId: null,
+        cartIdSha256: null,
+        expiresAt: null,
+        snapshotSha256: hashOf([["total", inside[0]], ...values]),
+        digests: { goods: sha256Hex(text), destination: hashOf(values), recipient: hashOf([]) },
+        kountSessionSha256: kount.length === 0 ? null : sha256Hex(kount.length === 1 ? kount[0] : JSON.stringify(kount))
+    };
+}
+function merchantSessionReading(id, response, { now } = {}) {
+    const block = required(id);
+    const pairs = isPlainObject(response) ? headerPairs(response.headers) : null;
+    if (!pairs || !Number.isSafeInteger(response.status) || typeof response.bodyText !== "string") {
+        return refused("unreadable", "the answer is not {status, headers, bodyText}");
+    }
+    const facts = merchantSessionAnswerFacts(response);
+    if (response.status >= 300 && response.status < 400)
+        return refused("redirect", "the merchant answered with a redirect");
+    if (facts.challenge && facts.challenge !== "unknown")
+        return refused("challenge", `${facts.challenge} challenged the read`);
+    if (response.status !== 200)
+        return refused(facts.challenge ? "challenge" : "status", `the merchant answered ${response.status}`);
+    if (block.read.refuseCacheHit && cacheHit(pairs))
+        return refused("cache_hit", "the answer came from a cache");
+    if (byteLength(response.bodyText) > block.read.maxAnswerBytes)
+        return refused("too_large", "the answer is larger than the block reads");
+    return block.read.format === "json" ? jsonReading(block, response.bodyText, now) : htmlReading(block, response.bodyText);
+}
+function sameMerchantSnapshot(a, b) {
+    if (!isPlainObject(a) || !isPlainObject(b) || a.ok !== true || b.ok !== true)
+        return false;
+    return a.profile === b.profile && a.totalMinor === b.totalMinor && a.currency === b.currency && a.cartId === b.cartId && a.expiresAt === b.expiresAt && a.snapshotSha256 === b.snapshotSha256 && isPlainObject(a.digests) && isPlainObject(b.digests) && ["goods", "destination", "recipient"].every((name) => typeof a.digests[name] === "string" && a.digests[name] === b.digests[name]);
+}
+export { MERCHANT_SESSION_BOT_COOKIES, MERCHANT_SESSION_CACHE_FACT_CHARS, MERCHANT_SESSION_COOKIE_LIMITS, MERCHANT_SESSION_MODE, MERCHANT_SESSION_PROFILES, MERCHANT_SESSION_READ_LIMITS, MERCHANT_SESSION_RELAY_URL, MERCHANT_SESSION_SIGN_IN_COOKIES, MERCHANT_SESSION_USER_AGENT, merchantSessionAnswerFacts, merchantSessionCookies, merchantSessionHosts, merchantSessionProfile, merchantSessionProfileRefusal, merchantSessionRead, merchantSessionReading, sameMerchantSnapshot };