@agent-cards/sdk 0.21.0 → 0.23.0

package/dist/payrails.generated.js

@@ -0,0 +1,596 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 2bf5a6f966e390caa86efaa4be753222abb5606a8689cc8cfa42c2466c65ded9
+// src/json-path.js
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/rsa-pkcs1v15.js
+var RsaPkcs1v15Error = class extends Error {
+    constructor(reason) {
+        super("RSA PKCS#1 v1.5 encryption refused.");
+        this.name = "RsaPkcs1v15Error";
+        this.code = "rsa_pkcs1v15_refused";
+        this.reason = reason;
+    }
+};
+var refuse = (reason) => new RsaPkcs1v15Error(reason);
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+var MODULUS_BYTES = [128, 256, 384, 512];
+var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
+var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
+function parseRsaPublicKey(key) {
+    const spki = key && typeof key === "object" ? key.spki : void 0;
+    const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
+        throw refuse("key");
+    if (typeof pin !== "string" || !SHA256_HEX.test(pin))
+        throw refuse("key");
+    let binary;
+    try {
+        binary = atob(spki);
+    }
+    catch {
+        throw refuse("key");
+    }
+    if (btoa(binary) !== spki)
+        throw refuse("key");
+    const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    if (sha256Hex(der) !== pin)
+        throw refuse("key");
+    const outer = readElement(der, 0, 48);
+    if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
+        throw refuse("key");
+    if (!RSA_ALGORITHM.every((byte, i) => der[outer.start + i] === byte))
+        throw refuse("key");
+    const bits = readElement(der, outer.start + RSA_ALGORITHM.length, 3);
+    if (bits.end !== outer.end || bits.start === bits.end || der[bits.start] !== 0)
+        throw refuse("key");
+    const rsa = readElement(der, bits.start + 1, 48);
+    if (rsa.end !== bits.end)
+        throw refuse("key");
+    const modulus = readPositiveInteger(der, rsa.start);
+    const exponent = readPositiveInteger(der, modulus.end);
+    if (exponent.end !== rsa.end)
+        throw refuse("key");
+    const n = modulus.bytes;
+    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+        throw refuse("key");
+    const e = exponent.bytes;
+    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+        throw refuse("key");
+    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+}
+function readElement(der, at, tag) {
+    if (at + 2 > der.length || der[at] !== tag)
+        throw refuse("key");
+    let length = der[at + 1];
+    let start = at + 2;
+    if (length & 128) {
+        const count = length & 127;
+        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+            throw refuse("key");
+        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        if (length < 128)
+            throw refuse("key");
+        start += count;
+    }
+    if (start + length > der.length)
+        throw refuse("key");
+    return { start, end: start + length };
+}
+function readPositiveInteger(der, at) {
+    const { start, end } = readElement(der, at, 2);
+    if (end === start || der[start] & 128)
+        throw refuse("key");
+    if (der[start] === 0 && (end - start === 1 || !(der[start + 1] & 128)))
+        throw refuse("key");
+    return { bytes: der.subarray(der[start] === 0 ? start + 1 : start, end), end };
+}
+function toBigInt(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++)
+        hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex}`);
+}
+// src/payrails.js
+var PAYRAILS_PSP = "payrails";
+var PAYRAILS_CAPABILITY = "payrails_device_encrypt";
+var PAYRAILS_OPERATION = "payrails.device_encrypted_card";
+var PAYRAILS_SAVE_PATH = "/public/payment/instruments";
+var PAYRAILS_SAVE_HOSTS = Object.freeze(["api-pub.payrails.io", "api-pub.staging.payrails.io", "sandbox-api-pub.staging.payrails.io"]);
+var PAYRAILS_JWE_HEADER = '{"alg":"RSA-OAEP-256","enc":"A256CBC-HS512"}';
+var PAYRAILS_JWE_HEADER_B64 = "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIn0";
+var PAYRAILS_KEY_BITS = Object.freeze([2048, 3072, 4096]);
+var PAYRAILS_FUTURE_USAGES = Object.freeze(["CardOnFile", "UnscheduledCardOnFile"]);
+var PAYRAILS_CARD_ON_FILE_CONSENTED = Object.freeze([]);
+var PAYRAILS_SESSION_MIN_SECONDS = 180;
+var NOT_THE_SAVE = "Refusing to pay: this is not the Payrails card save the checkout sends.";
+var KEY = "Refusing to pay: the Payrails session key does not match this checkout. Reload the checkout.";
+var ACCOUNT = "Refusing to pay: Agentcard has not reviewed the Payrails account behind this checkout.";
+var PAYRAILS_REFUSALS = Object.freeze({
+    payrails_request_malformed: NOT_THE_SAVE,
+    payrails_not_card_save: NOT_THE_SAVE,
+    payrails_jwe_malformed: NOT_THE_SAVE,
+    payrails_future_usage_refused: "Refusing to pay: this Payrails save asks to keep the card for a use the Vault cannot approve yet. Nothing was sent.",
+    payrails_card_on_file_consent_required: "Refusing to pay: this Payrails save would keep the card on file without your consent. Nothing was sent.",
+    payrails_key_invalid: KEY,
+    payrails_key_mismatch: KEY,
+    payrails_token_invalid: ACCOUNT,
+    payrails_workspace_unpinned: ACCOUNT,
+    payrails_workspace_mismatch: ACCOUNT,
+    payrails_session_expiring: "Refusing to pay: this Payrails session expires before it can be approved. Reload the checkout."
+});
+function payrailsRefusalMessage(code) {
+    return typeof code === "string" && Object.prototype.hasOwnProperty.call(PAYRAILS_REFUSALS, code) ? PAYRAILS_REFUSALS[code] : NOT_THE_SAVE;
+}
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var sameKeys = (value, keys) => {
+    const actual = Object.keys(value);
+    return actual.length === keys.length && actual.every((key, i) => key === keys[i]);
+};
+var plainText = (value, max) => typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var BODY_LIMIT = 16384;
+var B64URL = /^[A-Za-z0-9_-]+$/;
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(text, max) {
+    if (typeof text !== "string" || text.length === 0 || text.length > max || !B64URL.test(text) || text.length % 4 === 1)
+        return null;
+    const padded = text.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - text.length % 4) % 4);
+    let binary;
+    try {
+        binary = atob(padded);
+    }
+    catch {
+        return null;
+    }
+    const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    return base64UrlEncode(bytes) === text ? bytes : null;
+}
+function isPayrailsSaveUrl(url, { exact: exact2 = false } = {}) {
+    if (typeof url !== "string" || url.length > 2048)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return false;
+    if (!PAYRAILS_SAVE_HOSTS.includes(parsed.hostname) || parsed.pathname !== PAYRAILS_SAVE_PATH)
+        return false;
+    return !exact2 || parsed.search === "" && parsed.hash === "" && !/[?#]/.test(url);
+}
+function payrailsJweParts(jwe) {
+    if (typeof jwe !== "string" || jwe.length > 8192)
+        return null;
+    const parts = jwe.split(".");
+    if (parts.length !== 5 || parts[0] !== PAYRAILS_JWE_HEADER_B64)
+        return null;
+    const wrappedKey = base64UrlDecode(parts[1], 700);
+    const iv = base64UrlDecode(parts[2], 22);
+    const ciphertext = base64UrlDecode(parts[3], 5462);
+    const tag = base64UrlDecode(parts[4], 43);
+    if (!wrappedKey || !PAYRAILS_KEY_BITS.includes(wrappedKey.length * 8))
+        return null;
+    if (!iv || iv.length !== 16 || !tag || tag.length !== 32)
+        return null;
+    if (!ciphertext || ciphertext.length === 0 || ciphertext.length % 16 !== 0 || ciphertext.length > 4096)
+        return null;
+    return { wrappedKey, iv, ciphertext, tag };
+}
+var SAVE_KEYS = Object.freeze(["holderReference", "paymentMethod", "storeInstrument", "futureUsage", "data"]);
+var DATA_KEYS = Object.freeze(["encryptedData", "vaultProviderConfigId"]);
+var refusal = (code) => ({ code });
+function readSaveBody(body) {
+    if (typeof body !== "string" || body.length === 0 || body.length > BODY_LIMIT)
+        return refusal("payrails_request_malformed");
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return refusal("payrails_request_malformed");
+    }
+    if (!record(parsed) || !roundTrips(parsed, body))
+        return refusal("payrails_request_malformed");
+    const data = parsed.data;
+    if (parsed.paymentMethod !== "card" || !record(data) || !owns(data, "encryptedData"))
+        return refusal("payrails_not_card_save");
+    if (!sameKeys(parsed, SAVE_KEYS) || !sameKeys(data, DATA_KEYS))
+        return refusal("payrails_request_malformed");
+    if (!plainText(parsed.holderReference, 256) || typeof parsed.storeInstrument !== "boolean")
+        return refusal("payrails_request_malformed");
+    if (typeof data.vaultProviderConfigId !== "string" || !UUID.test(data.vaultProviderConfigId))
+        return refusal("payrails_request_malformed");
+    if (!PAYRAILS_FUTURE_USAGES.includes(parsed.futureUsage))
+        return refusal("payrails_future_usage_refused");
+    const jwe = payrailsJweParts(data.encryptedData);
+    if (!jwe)
+        return refusal("payrails_jwe_malformed");
+    return {
+        value: Object.freeze({
+            holderReference: parsed.holderReference,
+            storeInstrument: parsed.storeInstrument,
+            futureUsage: parsed.futureUsage,
+            encryptedData: data.encryptedData,
+            vaultProviderConfigId: data.vaultProviderConfigId,
+            wrappedKeyBytes: jwe.wrappedKey.length
+        })
+    };
+}
+function payrailsTemplateRefusal(body) {
+    return readSaveBody(body).code ?? null;
+}
+function parsePayrailsSave(body) {
+    return readSaveBody(body).value ?? null;
+}
+function payrailsKeepsCardFor(save) {
+    if (!record(save))
+        return null;
+    if (save.storeInstrument === true)
+        return save.futureUsage;
+    return save.futureUsage === "CardOnFile" ? null : save.futureUsage;
+}
+function payrailsCardOnFileRefusal(body) {
+    const save = readSaveBody(body);
+    if (save.code)
+        return save.code;
+    const usage = payrailsKeepsCardFor(save.value);
+    return usage === null || PAYRAILS_CARD_ON_FILE_CONSENTED.includes(usage) ? null : "payrails_card_on_file_consent_required";
+}
+function classifyPayrailsRequest(url, method, body) {
+    if (method !== "POST" || !isPayrailsSaveUrl(url))
+        return null;
+    if (typeof body !== "string" || body === "")
+        return "continue";
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return "continue";
+    }
+    const data = record(parsed) ? parsed.data : null;
+    const value = record(data) && owns(data, "encryptedData") ? data.encryptedData : void 0;
+    return typeof value === "string" && value !== "" || typeof value === "number" ? "card" : "continue";
+}
+function payrailsAuthorizeCarriesCard(url, method, body) {
+    if (method !== "POST" || typeof url !== "string" || typeof body !== "string" || body.length > 262144)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (!/(?:^|\.)payrails\.io$/.test(parsed.hostname))
+        return false;
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    const composition = record(value) ? value.paymentComposition : null;
+    return Array.isArray(composition) && composition.some((part) => record(part) && record(part.paymentInstrumentData) && typeof part.paymentInstrumentData.encryptedData === "string" && part.paymentInstrumentData.encryptedData !== "");
+}
+function payrailsSessionKeyBytes(spki) {
+    if (typeof spki !== "string" || spki.length === 0 || spki.length > 1024)
+        return null;
+    try {
+        const der = Uint8Array.from(atob(spki), (c) => c.charCodeAt(0));
+        const { size } = parseRsaPublicKey({ spki, sha256: sha256Hex(der) });
+        return PAYRAILS_KEY_BITS.includes(size * 8) ? size : null;
+    }
+    catch {
+        return null;
+    }
+}
+function payrailsSessionKeyRefusal(spki, body) {
+    const save = readSaveBody(body);
+    if (save.code)
+        return save.code;
+    const size = payrailsSessionKeyBytes(spki);
+    if (size === null)
+        return "payrails_key_invalid";
+    return size === save.value.wrappedKeyBytes ? null : "payrails_key_mismatch";
+}
+var TOKEN_LIMIT = 8192;
+var CLAIM_NAME = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;
+function payrailsTokenClaims(authorization) {
+    if (typeof authorization !== "string" || !authorization.startsWith("Bearer ") || authorization.length > TOKEN_LIMIT + 7)
+        return null;
+    const parts = authorization.slice(7).split(".");
+    if (parts.length !== 3 || parts[2] === "")
+        return null;
+    const decoded = [];
+    for (const part of parts.slice(0, 2)) {
+        const bytes = base64UrlDecode(part, TOKEN_LIMIT);
+        let value;
+        try {
+            value = bytes && JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        }
+        catch {
+            return null;
+        }
+        if (!record(value))
+            return null;
+        decoded.push(value);
+    }
+    if (!base64UrlDecode(parts[2], TOKEN_LIMIT))
+        return null;
+    const [header, payload] = decoded;
+    if (typeof header.alg !== "string" || header.alg === "" || header.alg.toLowerCase() === "none")
+        return null;
+    const claims = {};
+    for (const [name, value] of Object.entries(payload)) {
+        if (CLAIM_NAME.test(name) && (typeof value === "number" || typeof value === "boolean" || typeof value === "string" && value.length <= 256))
+            claims[name] = value;
+    }
+    if (owns(payload, "exp") && !(Number.isSafeInteger(payload.exp) && payload.exp > 0))
+        return null;
+    return Object.freeze({ claims: Object.freeze(claims), exp: owns(payload, "exp") ? payload.exp : null });
+}
+function payrailsWorkspacePinRefusal(authorization, pin, now = Math.floor(Date.now() / 1e3)) {
+    if (!record(pin) || !CLAIM_NAME.test(pin.claim) || !plainText(pin.value, 256))
+        return "payrails_workspace_unpinned";
+    const token = payrailsTokenClaims(authorization);
+    if (!token)
+        return "payrails_token_invalid";
+    if (!owns(token.claims, pin.claim) || token.claims[pin.claim] !== pin.value)
+        return "payrails_workspace_mismatch";
+    if (token.exp !== null && !(Number.isFinite(now) && token.exp - now >= PAYRAILS_SESSION_MIN_SECONDS))
+        return "payrails_session_expiring";
+    return null;
+}
+var ANSWER_LIMIT = 65536;
+var IDENTIFIER = /^[A-Za-z0-9_.:-]{1,64}$/;
+var INSTRUMENT_ID = /^[A-Za-z0-9_-]{1,64}$/;
+var INSTRUMENT_STATUS = /^[a-z][a-z_]{0,31}$/;
+var PAYRAILS_USABLE_STATUSES = Object.freeze(["created", "enabled"]);
+var PAYRAILS_UNUSABLE_STATUSES = Object.freeze(["invalid", "disabled", "deleted"]);
+var PAYRAILS_SERVED_CARD_FACTS = Object.freeze(["bin", "binLookup", "holderName", "network", "suffix", "expiryMonth", "expiryYear", "fingerprint"]);
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var bin6 = (value) => exact(/^[0-9]{6,8}$/, value) ? value.slice(0, 6) : void 0;
+var label = (value, max) => plainText(value, max) ? value : void 0;
+var pick = (value, pattern) => exact(pattern, value) ? value : void 0;
+var compact = (object) => Object.fromEntries(Object.entries(object).filter(([, value]) => value !== void 0));
+var nonEmpty = (object) => Object.keys(object).length ? object : void 0;
+function readJson(text) {
+    if (typeof text !== "string" || text.length === 0 || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function readInstrument(text) {
+    const value = readJson(text);
+    if (!record(value) || !exact(INSTRUMENT_ID, value.id) || value.paymentMethod !== "card" || !exact(INSTRUMENT_STATUS, value.status))
+        return null;
+    if (!record(value.data) || !exact(/^[0-9]{4}$/, value.data.suffix))
+        return null;
+    return value;
+}
+function payrailsFacts(text) {
+    const value = readJson(text);
+    const first = record(value) && Array.isArray(value.errors) ? value.errors[0] : void 0;
+    const code = record(first) ? first.code : void 0;
+    return { refusalCode: exact(IDENTIFIER, code) ? code : null };
+}
+function sanitizePayrailsResponse(text) {
+    const value = readInstrument(text);
+    if (!value)
+        throw new Error("Refusing to record: the Payrails answer is not a card instrument.");
+    const data = value.data;
+    const served = new Set(PAYRAILS_SERVED_CARD_FACTS);
+    const lookup = served.has("binLookup") && record(data.binLookup) ? data.binLookup : null;
+    const country = lookup && record(lookup.issuerCountry) ? lookup.issuerCountry : null;
+    const card = compact({
+        bin: served.has("bin") ? bin6(data.bin) : void 0,
+        binLookup: lookup ? nonEmpty(compact({
+            bin: bin6(lookup.bin),
+            network: label(lookup.network, 32),
+            issuer: label(lookup.issuer, 128),
+            issuerCountry: country ? nonEmpty(compact({ code: pick(country.code, /^[A-Z]{2}$/), name: label(country.name, 64), iso3: pick(country.iso3, /^[A-Z]{3}$/) })) : void 0,
+            type: label(lookup.type, 32)
+        })) : void 0,
+        holderName: served.has("holderName") ? label(data.holderName, 200) : void 0,
+        network: served.has("network") ? label(data.network, 32) : void 0,
+        suffix: data.suffix,
+        expiryMonth: served.has("expiryMonth") ? pick(data.expiryMonth, /^(?:0[1-9]|1[0-2])$/) : void 0,
+        expiryYear: served.has("expiryYear") ? pick(data.expiryYear, /^(?:[0-9]{2}|[0-9]{4})$/) : void 0
+    });
+    return JSON.stringify(compact({
+        id: value.id,
+        createdAt: pick(value.createdAt, /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?(?:Z|[+-][0-9]{2}:[0-9]{2})$/),
+        holderId: pick(value.holderId, INSTRUMENT_ID),
+        paymentMethod: "card",
+        status: value.status,
+        data: card,
+        fingerprint: served.has("fingerprint") ? pick(value.fingerprint, /^[A-Za-z0-9_+/=-]{1,128}$/) : void 0,
+        futureUsage: ["CardOnFile", "Subscription", "UnscheduledCardOnFile"].includes(value.futureUsage) ? value.futureUsage : void 0
+    }));
+}
+function instrumentMatchesCard(instrument, card) {
+    const number = String(card.number ?? "").replace(/\D/g, "");
+    const month = Number(card.month);
+    const year = Number(card.year);
+    const data = instrument.data;
+    return number.length >= 12 && data.suffix === number.slice(-4) && exact(/^(?:0[1-9]|1[0-2])$/, data.expiryMonth) && Number(data.expiryMonth) === month && exact(/^(?:[0-9]{2}|[0-9]{4})$/, data.expiryYear) && Number(data.expiryYear) % 100 === year % 100;
+}
+function payrailsResponseOutcome(status, text, { card } = {}) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "payrails_unconfirmed" };
+    if (status === 409 || status === 429)
+        return { outcome: "unknown", reason: "payrails_not_judged" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: payrailsFacts(text).refusalCode || `http_${status}` };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status !== 201)
+        return { outcome: "unknown", reason: "payrails_unconfirmed" };
+    const instrument = readInstrument(text);
+    if (!instrument)
+        return { outcome: "unknown", reason: "payrails_unsafe_response" };
+    if (PAYRAILS_UNUSABLE_STATUSES.includes(instrument.status))
+        return { outcome: "refused", code: `payrails_instrument_${instrument.status}` };
+    if (!PAYRAILS_USABLE_STATUSES.includes(instrument.status))
+        return { outcome: "unknown", reason: "payrails_instrument_unconfirmed" };
+    if (card && !instrumentMatchesCard(instrument, card))
+        return { outcome: "unknown", reason: "payrails_instrument_mismatch" };
+    return { outcome: "approved", body: sanitizePayrailsResponse(text) };
+}
+export { PAYRAILS_CAPABILITY, PAYRAILS_CARD_ON_FILE_CONSENTED, PAYRAILS_FUTURE_USAGES, PAYRAILS_JWE_HEADER, PAYRAILS_JWE_HEADER_B64, PAYRAILS_KEY_BITS, PAYRAILS_OPERATION, PAYRAILS_PSP, PAYRAILS_REFUSALS, PAYRAILS_SAVE_HOSTS, PAYRAILS_SAVE_PATH, PAYRAILS_SERVED_CARD_FACTS, PAYRAILS_SESSION_MIN_SECONDS, PAYRAILS_UNUSABLE_STATUSES, PAYRAILS_USABLE_STATUSES, base64UrlDecode, base64UrlEncode, classifyPayrailsRequest, isPayrailsSaveUrl, parsePayrailsSave, payrailsAuthorizeCarriesCard, payrailsCardOnFileRefusal, payrailsFacts, payrailsJweParts, payrailsKeepsCardFor, payrailsRefusalMessage, payrailsResponseOutcome, payrailsSessionKeyBytes, payrailsSessionKeyRefusal, payrailsTemplateRefusal, payrailsTokenClaims, payrailsWorkspacePinRefusal, sanitizePayrailsResponse };