@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/twoc2p.generated.js

@@ -0,0 +1,1149 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 3c735198962459f0b06c7fbbdfa58de91ab1f76adeec6fa17b4e1a8d33e4b8c3
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text2) {
+    const out = [];
+    for (const char of text2) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/rsa-pkcs1v15.js
+var RsaPkcs1v15Error = class extends Error {
+    constructor(reason) {
+        super("RSA PKCS#1 v1.5 encryption refused.");
+        this.name = "RsaPkcs1v15Error";
+        this.code = "rsa_pkcs1v15_refused";
+        this.reason = reason;
+    }
+};
+var refuse = (reason) => new RsaPkcs1v15Error(reason);
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+var MODULUS_BYTES = [128, 256, 384, 512];
+var MIN_PADDING = 8;
+var MAX_DRAWS = 16;
+var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
+var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
+function parseRsaPublicKey(key) {
+    const spki = key && typeof key === "object" ? key.spki : void 0;
+    const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
+    if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
+        throw refuse("key");
+    if (typeof pin !== "string" || !SHA256_HEX.test(pin))
+        throw refuse("key");
+    let binary;
+    try {
+        binary = atob(spki);
+    }
+    catch {
+        throw refuse("key");
+    }
+    if (btoa(binary) !== spki)
+        throw refuse("key");
+    const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    if (sha256Hex(der) !== pin)
+        throw refuse("key");
+    const outer = readElement(der, 0, 48);
+    if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
+        throw refuse("key");
+    if (!RSA_ALGORITHM.every((byte, i) => der[outer.start + i] === byte))
+        throw refuse("key");
+    const bits = readElement(der, outer.start + RSA_ALGORITHM.length, 3);
+    if (bits.end !== outer.end || bits.start === bits.end || der[bits.start] !== 0)
+        throw refuse("key");
+    const rsa = readElement(der, bits.start + 1, 48);
+    if (rsa.end !== bits.end)
+        throw refuse("key");
+    const modulus = readPositiveInteger(der, rsa.start);
+    const exponent = readPositiveInteger(der, modulus.end);
+    if (exponent.end !== rsa.end)
+        throw refuse("key");
+    const n = modulus.bytes;
+    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+        throw refuse("key");
+    const e = exponent.bytes;
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
+        throw refuse("key");
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
+}
+function rsaesPkcs1v15Encrypt(key, message, random) {
+    const { n, e, size } = parseRsaPublicKey(key);
+    if (typedArrayName.call(message) !== "Uint8Array")
+        throw refuse("message");
+    let bytes;
+    try {
+        bytes = new Uint8Array(message);
+    }
+    catch {
+        throw refuse("message");
+    }
+    const em = new Uint8Array(size);
+    try {
+        if (bytes.length > size - MIN_PADDING - 3)
+            throw refuse("message");
+        em[1] = 2;
+        fillNonZero(em.subarray(2, size - bytes.length - 1), random);
+        em.set(bytes, size - bytes.length);
+        return toBytes(modPow(toBigInt(em), e, n), size);
+    }
+    finally {
+        em.fill(0);
+        bytes.fill(0);
+    }
+}
+function readElement(der, at, tag) {
+    if (at + 2 > der.length || der[at] !== tag)
+        throw refuse("key");
+    let length = der[at + 1];
+    let start = at + 2;
+    if (length & 128) {
+        const count = length & 127;
+        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+            throw refuse("key");
+        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        if (length < 128)
+            throw refuse("key");
+        start += count;
+    }
+    if (start + length > der.length)
+        throw refuse("key");
+    return { start, end: start + length };
+}
+function readPositiveInteger(der, at) {
+    const { start, end } = readElement(der, at, 2);
+    if (end === start || der[start] & 128)
+        throw refuse("key");
+    if (der[start] === 0 && (end - start === 1 || !(der[start + 1] & 128)))
+        throw refuse("key");
+    return { bytes: der.subarray(der[start] === 0 ? start + 1 : start, end), end };
+}
+function fillNonZero(target, random) {
+    if (!random || typeof random.getRandomValues !== "function")
+        throw refuse("random");
+    const draw = new Uint8Array(target.length);
+    let filled = 0;
+    try {
+        for (let round = 0; round < MAX_DRAWS && filled < target.length; round++) {
+            draw.fill(0);
+            random.getRandomValues(draw);
+            for (let i = 0; i < draw.length && filled < target.length; i++)
+                if (draw[i] !== 0)
+                    target[filled++] = draw[i];
+        }
+    }
+    catch {
+        throw refuse("random");
+    }
+    finally {
+        draw.fill(0);
+    }
+    if (filled < target.length)
+        throw refuse("random");
+}
+function toBigInt(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++)
+        hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex}`);
+}
+function toBytes(value, size) {
+    const hex = value.toString(16).padStart(size * 2, "0");
+    const out = new Uint8Array(size);
+    for (let i = 0; i < size; i++)
+        out[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function modPow(base, exponent, modulus) {
+    let result = 1n;
+    let square = base % modulus;
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = result * square % modulus;
+        square = square * square % modulus;
+    }
+    return result;
+}
+// src/twoc2p-secure-pay.js
+var TWOC2P_PASSPHRASE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-+=_";
+var PASSPHRASE_LENGTH = 8;
+var UNBIASED_BELOW = 228;
+var MAX_DRAWS2 = 16;
+var SALTED = /* @__PURE__ */ Object.freeze([83, 97, 108, 116, 101, 100, 95, 95]);
+var MAX_PLAINTEXT = 47;
+var TwoC2pSecurePayError = class extends Error {
+    constructor(code) {
+        super(code === "twoc2p_card_unsupported" ? "Refusing to encrypt: this card cannot be written in 2C2P's card format." : code === "twoc2p_key_unavailable" ? "Refusing to encrypt: no reviewed 2C2P key is pinned for this payment." : "Refusing to encrypt: this device cannot produce 2C2P's card field.");
+        this.name = "TwoC2pSecurePayError";
+        this.code = code;
+    }
+};
+var MD5_SHIFTS = /* @__PURE__ */ Object.freeze([7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21]);
+var MD5_K = /* @__PURE__ */ Object.freeze([
+    3614090360,
+    3905402710,
+    606105819,
+    3250441966,
+    4118548399,
+    1200080426,
+    2821735955,
+    4249261313,
+    1770035416,
+    2336552879,
+    4294925233,
+    2304563134,
+    1804603682,
+    4254626195,
+    2792965006,
+    1236535329,
+    4129170786,
+    3225465664,
+    643717713,
+    3921069994,
+    3593408605,
+    38016083,
+    3634488961,
+    3889429448,
+    568446438,
+    3275163606,
+    4107603335,
+    1163531501,
+    2850285829,
+    4243563512,
+    1735328473,
+    2368359562,
+    4294588738,
+    2272392833,
+    1839030562,
+    4259657740,
+    2763975236,
+    1272893353,
+    4139469664,
+    3200236656,
+    681279174,
+    3936430074,
+    3572445317,
+    76029189,
+    3654602809,
+    3873151461,
+    530742520,
+    3299628645,
+    4096336452,
+    1126891415,
+    2878612391,
+    4237533241,
+    1700485571,
+    2399980690,
+    4293915773,
+    2240044497,
+    1873313359,
+    4264355552,
+    2734768916,
+    1309151649,
+    4149444226,
+    3174756917,
+    718787259,
+    3951481745
+]);
+function twoC2pMd5(message) {
+    const length = message.length;
+    const padded = new Uint8Array((length + 8 >>> 6) + 1 << 6);
+    padded.set(message);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, length * 8 >>> 0, true);
+    view.setUint32(padded.length - 4, Math.floor(length / 536870912), true);
+    let a0 = 1732584193, b0 = 4023233417, c0 = 2562383102, d0 = 271733878;
+    try {
+        for (let offset = 0; offset < padded.length; offset += 64) {
+            let a = a0, b = b0, c = c0, d = d0;
+            for (let i = 0; i < 64; i++) {
+                const round = i >>> 4;
+                const f = round === 0 ? b & c | ~b & d : round === 1 ? d & b | ~d & c : round === 2 ? b ^ c ^ d : c ^ (b | ~d);
+                const g = round === 0 ? i : round === 1 ? 5 * i + 1 & 15 : round === 2 ? 3 * i + 5 & 15 : 7 * i & 15;
+                const sum = f + a + MD5_K[i] + view.getUint32(offset + g * 4, true) | 0;
+                const shift = MD5_SHIFTS[round << 2 | i & 3];
+                a = d;
+                d = c;
+                c = b;
+                b = b + (sum << shift | sum >>> 32 - shift) | 0;
+            }
+            a0 = a0 + a | 0;
+            b0 = b0 + b | 0;
+            c0 = c0 + c | 0;
+            d0 = d0 + d | 0;
+        }
+    }
+    finally {
+        padded.fill(0);
+    }
+    const out = new Uint8Array(16);
+    const words = new DataView(out.buffer);
+    words.setUint32(0, a0 >>> 0, true);
+    words.setUint32(4, b0 >>> 0, true);
+    words.setUint32(8, c0 >>> 0, true);
+    words.setUint32(12, d0 >>> 0, true);
+    return out;
+}
+function evpBytesToKey(password, salt) {
+    const seed = new Uint8Array(password.length + salt.length);
+    seed.set(password);
+    seed.set(salt, password.length);
+    const blocks = [];
+    let previous = new Uint8Array(0);
+    try {
+        for (let round = 0; round < 3; round++) {
+            const input = new Uint8Array(previous.length + seed.length);
+            input.set(previous);
+            input.set(seed, previous.length);
+            previous = twoC2pMd5(input);
+            input.fill(0);
+            blocks.push(previous);
+        }
+        const material = new Uint8Array(48);
+        blocks.forEach((block, at) => material.set(block, at * 16));
+        return { key: material.slice(0, 32), iv: material.slice(32, 48), material };
+    }
+    finally {
+        seed.fill(0);
+        for (const block of blocks)
+            block.fill(0);
+    }
+}
+var usable = (facilities) => {
+    const crypto = facilities && facilities.crypto ? facilities.crypto : globalThis.crypto;
+    if (!crypto || typeof crypto.getRandomValues !== "function" || !crypto.subtle)
+        throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+    return crypto;
+};
+function base64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return btoa(binary);
+}
+async function twoC2pSaltedAes(plaintext, passphrase, salt, facilities = {}) {
+    const crypto = usable(facilities);
+    const text2 = new TextEncoder().encode(plaintext);
+    const password = new TextEncoder().encode(passphrase);
+    if (!(salt instanceof Uint8Array) || salt.length !== 8 || text2.length === 0 || text2.length > MAX_PLAINTEXT) {
+        text2.fill(0);
+        password.fill(0);
+        throw new TwoC2pSecurePayError("twoc2p_card_unsupported");
+    }
+    const { key, iv, material } = evpBytesToKey(password, salt);
+    try {
+        const aes = await crypto.subtle.importKey("raw", key, { name: "AES-CBC" }, false, ["encrypt"]);
+        const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-CBC", iv }, aes, text2));
+        const out = new Uint8Array(16 + sealed.length);
+        out.set(SALTED);
+        out.set(salt, 8);
+        out.set(sealed, 16);
+        return base64(out);
+    }
+    finally {
+        text2.fill(0);
+        password.fill(0);
+        key.fill(0);
+        iv.fill(0);
+        material.fill(0);
+    }
+}
+function drawPassphrase(random) {
+    const draw = new Uint8Array(PASSPHRASE_LENGTH * 2);
+    let out = "";
+    try {
+        for (let round = 0; round < MAX_DRAWS2 && out.length < PASSPHRASE_LENGTH; round++) {
+            draw.fill(255);
+            random.getRandomValues(draw);
+            for (let i = 0; i < draw.length && out.length < PASSPHRASE_LENGTH; i++) {
+                if (draw[i] < UNBIASED_BELOW)
+                    out += TWOC2P_PASSPHRASE_ALPHABET[draw[i] % TWOC2P_PASSPHRASE_ALPHABET.length];
+            }
+        }
+    }
+    catch {
+        throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+    }
+    finally {
+        draw.fill(0);
+    }
+    if (out.length < PASSPHRASE_LENGTH)
+        throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+    return out;
+}
+function cardPlaintext(card) {
+    if (!card || typeof card !== "object")
+        throw new TwoC2pSecurePayError("twoc2p_card_unsupported");
+    const number = String(card.number ?? "").replace(/[\s-]/g, "");
+    const month = Number(card.month);
+    const rawYear = String(card.year ?? "");
+    const year = /^[0-9]{2}$/.test(rawYear) ? 2e3 + Number(rawYear) : /^[0-9]{4}$/.test(rawYear) ? Number(rawYear) : NaN;
+    const cvc = String(card.cvc ?? "");
+    if (!/^[0-9]{12,19}$/.test(number) || !Number.isInteger(month) || month < 1 || month > 12 || !(year >= 2e3 && year <= 2099) || !/^[0-9]{3,4}$/.test(cvc))
+        throw new TwoC2pSecurePayError("twoc2p_card_unsupported");
+    return `${number};${String(month).padStart(2, "0")};${year};${cvc};;`;
+}
+async function buildTwoC2pSecurePayToken(card, key, facilities = {}) {
+    let size;
+    try {
+        size = parseRsaPublicKey(key).size;
+    }
+    catch {
+        throw new TwoC2pSecurePayError("twoc2p_key_unavailable");
+    }
+    const crypto = usable(facilities);
+    const plaintext = cardPlaintext(card);
+    const passphrase = drawPassphrase(crypto);
+    const message = new TextEncoder().encode(passphrase);
+    let block = null;
+    try {
+        for (let round = 0; round < MAX_DRAWS2 && block === null; round++) {
+            let sealed;
+            try {
+                sealed = rsaesPkcs1v15Encrypt(key, message, crypto);
+            }
+            catch {
+                throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+            }
+            if (sealed[0] !== 0)
+                block = sealed;
+        }
+    }
+    finally {
+        message.fill(0);
+    }
+    if (block === null || block.length !== size)
+        throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+    const salt = new Uint8Array(8);
+    try {
+        crypto.getRandomValues(salt);
+    }
+    catch {
+        throw new TwoC2pSecurePayError("twoc2p_crypto_unavailable");
+    }
+    const rsa = base64(block);
+    const aes = await twoC2pSaltedAes(plaintext, passphrase, salt, { crypto });
+    salt.fill(0);
+    return `${rsa.length.toString(16).padStart(4, "0")}${rsa}${aes}`;
+}
+var B64 = /^[A-Za-z0-9+/]+={0,2}$/;
+var FIELD_LIMIT = 1024;
+function decodeCanonical(text2) {
+    if (typeof text2 !== "string" || text2.length === 0 || text2.length % 4 !== 0 || !B64.test(text2))
+        return null;
+    let binary;
+    try {
+        binary = atob(text2);
+    }
+    catch {
+        return null;
+    }
+    if (btoa(binary) !== text2)
+        return null;
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function twoC2pSecurePayParts(value) {
+    if (typeof value !== "string" || value.length > FIELD_LIMIT || !/^[0-9a-f]{4}/.test(value))
+        return null;
+    const length = parseInt(value.slice(0, 4), 16);
+    if (length < 4 || 4 + length >= value.length)
+        return null;
+    const rsaText = value.slice(4, 4 + length);
+    const rsa = decodeCanonical(rsaText);
+    const cipher = decodeCanonical(value.slice(4 + length));
+    if (!rsa || !cipher || cipher.length < 32 || cipher.length > 80 || cipher.length % 16 !== 0)
+        return null;
+    if (!SALTED.every((byte, at) => cipher[at] === byte))
+        return null;
+    return { rsaText, rsa, salt: cipher.slice(8, 16), blocks: (cipher.length - 16) / 16 };
+}
+function isTwoC2pPageField(value, keyBytes) {
+    const parts = twoC2pSecurePayParts(value);
+    if (!parts || !Number.isInteger(keyBytes) || keyBytes < 128)
+        return false;
+    const expected = Math.ceil(keyBytes / 3) * 4;
+    return parts.rsaText.length === expected && (parts.rsa.length === keyBytes || parts.rsa.length === keyBytes - 1);
+}
+function isTwoC2pDeviceField(value, key) {
+    let parsed;
+    try {
+        parsed = parseRsaPublicKey(key);
+    }
+    catch {
+        return false;
+    }
+    const parts = twoC2pSecurePayParts(value);
+    if (!parts || parts.blocks < 2 || parts.blocks > 3 || parts.rsa.length !== parsed.size || parts.rsa[0] === 0)
+        return false;
+    if (value.slice(0, 4) !== parts.rsaText.length.toString(16).padStart(4, "0"))
+        return false;
+    let hex = "";
+    for (let i = 0; i < parts.rsa.length; i++)
+        hex += parts.rsa[i].toString(16).padStart(2, "0");
+    const c = BigInt(`0x${hex}`);
+    return c > 1n && c < parsed.n;
+}
+// src/twoc2p-keys.js
+var TWOC2P_KEYS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/1ljsxI+r6qQraTFrHfWNrV41vxumBF+4ILAG3WsN6HEBQU2wSUv/IyQmZkiys1ilOb+OOuQTH8OXMnqQg9E4epyePW3L7IeOieSbIIDeSX6UpTWmT/Fs7moWZkN8RpuCV0u87n3AY2tQbtcSqwEKi2sxzWLFwscoGn6N5yVIpQIDAQAB",
+        sha256: "bb8f27929ce140c6ef0ec9c4a20d7ca0b83376bc35a501985dc40d16669384fe",
+        script: Object.freeze({ url: "https://t.2c2p.com/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "4a745a37765a2e28e299d64f6ea5811aab27b176da61db6f840fa85d6a47e763" })
+    }),
+    sandbox: Object.freeze({
+        spki: "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKakJC+2MSZikKoPzlNqXvJCuWNLhejg3gMRePSetYNNgnhyqFwwAR7t7i/B2QFZoixSYc2/23cJz0jA5O+q+Cu3fycqKlf1L9966+X3B9nyHe2eKQZr8KrcS/8+sEKcd0pLATY4AleW1iktuN+2oghrDKuv+aDNztWcOy+PTofwIDAQAB",
+        sha256: "7f80c07f1d72db28ede10dae942940657c72dfa789836c9fdf283cba6feff2e6",
+        script: Object.freeze({ url: "https://demo2.2c2p.com/2C2PFrontEnd/SecurePayment/api/my2c2p.1.7.6.min.js", sha256: "435723d92bfefb00607a56851967e0b745d52b8d49443de5f0000f0583fde5cc" })
+    })
+});
+function twoC2pKey(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        return null;
+    return TWOC2P_KEYS[environment] ?? null;
+}
+function twoC2pKeyBytes(environment) {
+    const key = twoC2pKey(environment);
+    if (!key)
+        return null;
+    try {
+        return parseRsaPublicKey(key).size;
+    }
+    catch {
+        return null;
+    }
+}
+// src/adyen-jwe.js
+var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+function isAdyenJweCompact(s) {
+    if (typeof s !== "string" || s.length > 2048)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5)
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (!parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    if (encryptedKey.length !== 342 || iv.length !== 16 || tag.length !== 22)
+        return false;
+    if (ciphertext.length > 1024)
+        return false;
+    return isAdyenJweHeader(header);
+}
+function isAdyenJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > 128)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const obj = parsed;
+    const keys = Object.keys(obj).sort();
+    if (keys.join(",") !== "alg,enc,version")
+        return false;
+    return obj.alg === ADYEN_JWE_HEADER.alg && obj.enc === ADYEN_JWE_HEADER.enc && obj.version === ADYEN_JWE_HEADER.version;
+}
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+var MAX_PATH_STEPS = 16;
+function isJsonPath(path) {
+    return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+function sameSteps(a, b) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+}
+function pathsOverlap(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+function describePath(path) {
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+}
+// src/substitution-primitives.js
+var SubstitutionError = class extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SubstitutionError";
+    }
+};
+var SWAP_MEMBERS = /* @__PURE__ */ new Set(["path", "fields", "remove", "set"]);
+function checkedSet(set, path, names, remove) {
+    if (!Array.isArray(set))
+        throw new SubstitutionError("substitutions.set is not a list");
+    const entries = [...set].map((raw) => {
+        const entry = isPlainObject(raw) ? Object.fromEntries(Object.entries(raw)) : null;
+        if (!entry || Object.keys(entry).sort().join(",") !== "path,value")
+            throw new SubstitutionError("a set entry is not a {path, value}");
+        const at = Array.isArray(entry.path) ? [...entry.path] : entry.path;
+        if (!isJsonPath(at) || at.length === 0 || typeof at[at.length - 1] !== "string")
+            throw new SubstitutionError("refusing set path");
+        const value = entry.value;
+        if (value !== null && !["string", "boolean"].includes(typeof value) && !(typeof value === "number" && Number.isFinite(value))) {
+            throw new SubstitutionError(`the set value at ${describePath(at)} is not a string, number, boolean or null`);
+        }
+        const key = at[at.length - 1];
+        if (sameSteps(at.slice(0, -1), path) && (names.includes(key) || remove.includes(key))) {
+            throw new SubstitutionError(`the set entry at ${describePath(at)} writes over an encrypted field or a removed key`);
+        }
+        return { path: at, value };
+    });
+    for (const [i, a] of entries.entries()) {
+        for (const b of entries.slice(i + 1)) {
+            if (pathsOverlap(a.path, b.path))
+                throw new SubstitutionError(`two set entries write at ${describePath(a.path)}`);
+        }
+    }
+    return entries;
+}
+var ADYEN_JWE = /* @__PURE__ */ Object.freeze({ accepts: isAdyenJweCompact, label: "an Adyen JWE" });
+function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
+    if (!isPlainObject(spec))
+        throw new SubstitutionError("refusing a substitution that is not an object");
+    for (const member of Object.keys(spec)) {
+        if (!SWAP_MEMBERS.has(member))
+            throw new SubstitutionError(`unexpected substitution member ${member}`);
+    }
+    const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
+    const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
+    const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
+    if (!isJsonPath(path))
+        throw new SubstitutionError("refusing substitution path");
+    if (!fields || Object.keys(fields).length === 0)
+        throw new SubstitutionError("substitutions carry no fields");
+    const names = Object.keys(fields);
+    const values = names.map((name) => fields[name]);
+    for (const name of names) {
+        if (FORBIDDEN_KEYS.has(name))
+            throw new SubstitutionError(`refusing substitution field ${name}`);
+        if (!ciphertext.accepts(fields[name]))
+            throw new SubstitutionError(`substitution for ${name} is not ${ciphertext.label}`);
+    }
+    if (!Array.isArray(remove))
+        throw new SubstitutionError("substitutions.remove is not a list");
+    for (const key of remove) {
+        if (typeof key !== "string" || !key || FORBIDDEN_KEYS.has(key))
+            throw new SubstitutionError(`refusing removal of ${String(key)}`);
+        if (names.includes(key))
+            throw new SubstitutionError(`substitution field ${key} is also listed for removal`);
+    }
+    if (new Set(remove).size !== remove.length)
+        throw new SubstitutionError("substitutions.remove names a key twice");
+    const set = checkedSet(spec.set ?? [], path, names, remove);
+    if (typeof body !== "string")
+        throw new SubstitutionError("the paused body is not JSON");
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        throw new SubstitutionError("the paused body is not JSON");
+    }
+    if (!isPlainObject(parsed))
+        throw new SubstitutionError("the paused body is not a JSON object");
+    const holder = jsonAt(parsed, path);
+    if (!holder.found || !isPlainObject(holder.value))
+        throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
+    const swaps = /* @__PURE__ */ new Map();
+    for (const name of names) {
+        const dummy = Object.prototype.hasOwnProperty.call(holder.value, name) ? holder.value[name] : void 0;
+        if (typeof dummy !== "string")
+            throw new SubstitutionError(`the paused body has no string field ${name} at ${describePath(path)}`);
+        if (!ciphertext.accepts(dummy))
+            throw new SubstitutionError(`the paused field ${name} is not ${ciphertext.label}`);
+        if (swaps.has(dummy))
+            throw new SubstitutionError("two paused fields carry the same ciphertext");
+        swaps.set(dummy, fields[name]);
+    }
+    const dummies = [...swaps.keys()];
+    if (new Set(values).size !== values.length || values.some((value) => swaps.has(value))) {
+        throw new SubstitutionError("two ciphertexts in this substitution are the same");
+    }
+    const texts = [...dummies, ...values];
+    for (const a of texts)
+        for (const b of texts)
+            if (a !== b && b.includes(a))
+                throw new SubstitutionError("one ciphertext is part of another");
+    if ((remove.length > 0 || set.length > 0) && !roundTrips(parsed, body)) {
+        throw new SubstitutionError("the paused body does not round-trip through JSON, so it cannot be edited");
+    }
+    for (const entry of set) {
+        const parent = jsonAt(parsed, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value)) {
+            throw new SubstitutionError(`the paused body has no object at ${describePath(entry.path.slice(0, -1))} to write a value in`);
+        }
+        const key = entry.path[entry.path.length - 1];
+        const current = Object.prototype.hasOwnProperty.call(parent.value, key) ? parent.value[key] : void 0;
+        if (current !== null && typeof current === "object") {
+            throw new SubstitutionError(`refusing to write over the object at ${describePath(entry.path)}`);
+        }
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const pattern = new RegExp(dummies.map((text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g");
+    const swapped = body.replace(pattern, (text2) => {
+        seen.add(text2);
+        return swaps.get(text2);
+    });
+    if (seen.size !== dummies.length)
+        throw new SubstitutionError("a paused field is not written verbatim in the body");
+    let out;
+    try {
+        out = JSON.parse(swapped);
+    }
+    catch {
+        throw new SubstitutionError("the substituted body is not JSON");
+    }
+    const written = jsonAt(out, path);
+    if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
+    if (remove.length === 0 && set.length === 0)
+        return swapped;
+    for (const key of remove)
+        if (Object.prototype.hasOwnProperty.call(written.value, key))
+            delete written.value[key];
+    for (const entry of set) {
+        const parent = jsonAt(out, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value))
+            throw new SubstitutionError(`the set entry at ${describePath(entry.path)} did not land`);
+        parent.value[entry.path[entry.path.length - 1]] = entry.value;
+    }
+    return JSON.stringify(out);
+}
+// src/twoc2p.js
+var TWOC2P_PSP = "twoc2p";
+var TWOC2P_CAPABILITY = "twoc2p_secure_pay";
+var TWOC2P_OPERATION = "twoc2p.encrypted_card";
+var TWOC2P_SCHEME = "twoc2p-secure-pay";
+var TWOC2P_FIELD_AT = "payment.data";
+var TWOC2P_FIELD = "securePayToken";
+var TWOC2P_REVIEWED_BUILDS = /* @__PURE__ */ Object.freeze(["4.1", "4.2", "4.3", "4.4", "4.5"]);
+var TWOC2P_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "twoc2p_url_refused",
+    "twoc2p_build_unreviewed",
+    "twoc2p_body_unsupported",
+    "twoc2p_channel_unsupported",
+    "twoc2p_field_unreviewed",
+    "twoc2p_keeps_card",
+    "twoc2p_stored_card",
+    "twoc2p_card_in_clear",
+    "twoc2p_installments",
+    "twoc2p_currency_conversion",
+    "twoc2p_loyalty_redemption"
+]);
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var refuse2 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var CONTINUE = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
+var PAYMENT_URL = /^https:\/\/(sandbox-)?pgwv4\.2c2p\.com\/payment\/(4\.[0-9]{1,2})\/Payment$/;
+function twoC2pPaymentTarget(url) {
+    const match = typeof url === "string" ? PAYMENT_URL.exec(url) : null;
+    if (!match)
+        return null;
+    return Object.freeze({ environment: match[1] ? "sandbox" : "production", version: match[2], reviewed: TWOC2P_REVIEWED_BUILDS.includes(match[2]) });
+}
+function twoC2pPaymentCarriesCard(body) {
+    if (typeof body !== "string")
+        return true;
+    try {
+        return JSON.stringify(JSON.parse(body)).includes(`"${TWOC2P_FIELD}"`);
+    }
+    catch {
+        return true;
+    }
+}
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["paymentToken", "clientIP", "locale", "responseReturnUrl", "clientID", "payment"]);
+var CODE_KEYS = /* @__PURE__ */ Object.freeze(["channelCode", "agentCode", "agentChannelCode"]);
+var DATA_KEYS = /* @__PURE__ */ Object.freeze([
+    "name",
+    "isIppChosen",
+    "cardDetails",
+    "loyaltyPoints",
+    "fxRateID",
+    "email",
+    "mobileNo",
+    "mobileNoPrefix",
+    "customerNote",
+    "paymentExpiry",
+    "securePayToken",
+    "cardTokenize",
+    "accountTokenization",
+    "token",
+    "customerToken",
+    "accountNo",
+    "installmentPeriod",
+    "interestType",
+    "payLaterPeriod",
+    "billingAddress1",
+    "billingAddress2",
+    "billingCity",
+    "billingState",
+    "billingCountryCode",
+    "billingPostalCode",
+    "riskInfo"
+]);
+var RISK_KEYS = /* @__PURE__ */ Object.freeze(["customer_id", "shipping_method", "deviceSessionId", "customData"]);
+var BODY_LIMIT = 16384;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var CARD_LIKE = /(?:[0-9][ _.:/-]*){12,}/;
+var PAYMENT_TOKEN = /^[A-Za-z0-9+/]{16,1000}={0,2}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var IP = /^[0-9A-Fa-f.:]{2,45}$/;
+var LOCALE = /^[A-Za-z]{2,3}(?:[-_][A-Za-z0-9]{2,8})?$/;
+var AGENT = /^[A-Za-z0-9_]{1,32}$/;
+var RISK_TOKEN = /^[\x21-\x7e]{1,512}$/;
+var RETURN_URL = /^https:\/\/((?:sandbox-)?pgw-ui\.2c2p\.com)\/payment\/4\.[0-9]{1,2}(?:\/|\/index\.html)?#\/(?:info|mobile\/process)\/([A-Za-z0-9+/]{16,1000}={0,2})?$/;
+var PAGE_HOSTS = /* @__PURE__ */ Object.freeze({ production: "pgw-ui.2c2p.com", sandbox: "sandbox-pgw-ui.2c2p.com" });
+var returnUrlTaken = (value, paymentToken, environment) => {
+    if (value === void 0)
+        return true;
+    const match = typeof value === "string" ? RETURN_URL.exec(value) : null;
+    return !!match && (match[2] === void 0 || match[2] === paymentToken) && (environment === void 0 || match[1] === PAGE_HOSTS[environment]);
+};
+var inOrder = (value, order) => {
+    let at = -1;
+    for (const key of Object.keys(value)) {
+        const next = order.indexOf(key);
+        if (next <= at)
+            return false;
+        at = next;
+    }
+    return true;
+};
+var text = (value, limit) => typeof value === "string" && value.length <= limit && !CONTROL.test(value) && !CARD_LIKE.test(value);
+var optionalText = (value, limit) => value === void 0 || text(value, limit);
+function twoC2pBodyVerdict(body, keyBytes = 128, environment = void 0) {
+    if (!twoC2pPaymentCarriesCard(body))
+        return CONTINUE;
+    if (typeof body !== "string" || body.length > BODY_LIMIT)
+        return refuse2("twoc2p_body_unsupported");
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return refuse2("twoc2p_body_unsupported");
+    }
+    if (!record(value) || JSON.stringify(value) !== body || !inOrder(value, ROOT_KEYS))
+        return refuse2("twoc2p_body_unsupported");
+    if (typeof value.paymentToken !== "string" || !PAYMENT_TOKEN.test(value.paymentToken) || value.clientIP !== void 0 && !(typeof value.clientIP === "string" && IP.test(value.clientIP)) || value.locale !== void 0 && !(typeof value.locale === "string" && LOCALE.test(value.locale)) || !returnUrlTaken(value.responseReturnUrl, value.paymentToken, environment) || value.clientID !== void 0 && !(typeof value.clientID === "string" && UUID.test(value.clientID)))
+        return refuse2("twoc2p_body_unsupported");
+    const payment = value.payment;
+    if (!record(payment) || Object.keys(payment).join(",") !== "code,data")
+        return refuse2("twoc2p_body_unsupported");
+    const code = payment.code;
+    const data = payment.data;
+    if (!record(code) || !record(data))
+        return refuse2("twoc2p_body_unsupported");
+    if (Object.prototype.hasOwnProperty.call(code, "subChannelCode"))
+        return refuse2("twoc2p_stored_card");
+    if (code.channelCode === "IPP" || code.channelCode === "LIPP")
+        return refuse2("twoc2p_installments");
+    if (!inOrder(code, CODE_KEYS) || code.channelCode === void 0)
+        return refuse2("twoc2p_body_unsupported");
+    if (code.channelCode !== "CC")
+        return refuse2("twoc2p_channel_unsupported");
+    if ([code.agentCode, code.agentChannelCode].some((part) => part !== void 0 && !(typeof part === "string" && AGENT.test(part))))
+        return refuse2("twoc2p_body_unsupported");
+    return dataVerdict(data, keyBytes, body);
+}
+function dataVerdict(data, keyBytes, body) {
+    if (data.cardTokenize !== void 0 || data.accountTokenization !== void 0)
+        return refuse2("twoc2p_keeps_card");
+    if (data.token !== void 0 || data.customerToken !== void 0)
+        return refuse2("twoc2p_stored_card");
+    if (data.accountNo !== void 0)
+        return refuse2("twoc2p_card_in_clear");
+    const details = data.cardDetails;
+    if (record(details) && (details.cardNo !== void 0 || details.accountNo !== void 0))
+        return refuse2("twoc2p_card_in_clear");
+    if (record(details) && Object.keys(details).some((key) => key !== "email"))
+        return refuse2("twoc2p_stored_card");
+    if (data.isIppChosen === true || data.installmentPeriod !== void 0 || data.interestType !== void 0 || data.payLaterPeriod !== void 0) {
+        return refuse2("twoc2p_installments");
+    }
+    if (data.fxRateID !== void 0)
+        return refuse2("twoc2p_currency_conversion");
+    if (data.loyaltyPoints !== void 0 && !(Array.isArray(data.loyaltyPoints) && data.loyaltyPoints.length === 0)) {
+        return refuse2("twoc2p_loyalty_redemption");
+    }
+    if (!inOrder(data, DATA_KEYS) || data.paymentExpiry !== void 0)
+        return refuse2("twoc2p_body_unsupported");
+    if (typeof data.securePayToken !== "string" || !isTwoC2pPageField(data.securePayToken, keyBytes))
+        return refuse2("twoc2p_field_unreviewed");
+    if (body.split(data.securePayToken).length !== 2)
+        return refuse2("twoc2p_body_unsupported");
+    if (data.isIppChosen !== void 0 && data.isIppChosen !== false)
+        return refuse2("twoc2p_body_unsupported");
+    if (details !== void 0 && !(record(details) && (details.email === void 0 || text(details.email, 254))))
+        return refuse2("twoc2p_body_unsupported");
+    if (!optionalText(data.name, 128) || !optionalText(data.email, 254) || !optionalText(data.customerNote, 255) || !(data.mobileNo === void 0 || typeof data.mobileNo === "string" && /^[0-9]{4,11}$/.test(data.mobileNo)) || !(data.mobileNoPrefix === void 0 || typeof data.mobileNoPrefix === "string" && /^\+?[0-9]{1,4}$/.test(data.mobileNoPrefix))) {
+        return refuse2("twoc2p_body_unsupported");
+    }
+    for (const key of ["billingAddress1", "billingAddress2", "billingCity", "billingState", "billingPostalCode"]) {
+        if (!optionalText(data[key], 128))
+            return refuse2("twoc2p_body_unsupported");
+    }
+    if (data.billingCountryCode !== void 0 && !(typeof data.billingCountryCode === "string" && /^[A-Za-z]{2}$/.test(data.billingCountryCode))) {
+        return refuse2("twoc2p_body_unsupported");
+    }
+    const risk = data.riskInfo;
+    if (risk !== void 0 && risk !== null && !(record(risk) && Object.keys(risk).join(",") === RISK_KEYS.join(",") && risk.customer_id === "" && risk.shipping_method === "" && typeof risk.deviceSessionId === "string" && RISK_TOKEN.test(risk.deviceSessionId) && record(risk.customData) && Object.keys(risk.customData).length === 0)) {
+        return refuse2("twoc2p_body_unsupported");
+    }
+    return CARD;
+}
+function twoC2pRequestRefusal(request, environment) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "twoc2p_url_refused";
+    const target = twoC2pPaymentTarget(request.url);
+    if (!target || environment !== void 0 && target.environment !== environment)
+        return "twoc2p_url_refused";
+    if (!target.reviewed)
+        return "twoc2p_build_unreviewed";
+    const keyBytes = twoC2pKeyBytes(target.environment);
+    if (keyBytes === null)
+        return "twoc2p_field_unreviewed";
+    const verdict = twoC2pBodyVerdict(request.body, keyBytes, target.environment);
+    return verdict.verdict === "card" ? null : verdict.verdict === "refuse" ? verdict.code : "twoc2p_body_unsupported";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    twoc2p_url_refused: "Refusing to pay: this request does not go to 2C2P's payment API exactly as 2C2P's payment page sends it. Nothing was sent.",
+    twoc2p_build_unreviewed: "Refusing to pay: this 2C2P payment page is a version Agentcard has not reviewed. Nothing was sent.",
+    twoc2p_body_unsupported: "Refusing to pay: this is not the card payment 2C2P's payment page sends. Nothing was sent.",
+    twoc2p_channel_unsupported: "Refusing to pay: this 2C2P payment is not a card payment Agentcard can make. Nothing was sent.",
+    twoc2p_field_unreviewed: "Refusing to pay: 2C2P's page encrypted the card in a way Agentcard has not reviewed. Nothing was sent.",
+    twoc2p_keeps_card: "Refusing to pay: this 2C2P payment would save the card for later payments. Nothing was sent.",
+    twoc2p_stored_card: "Refusing to pay: this 2C2P payment uses a card 2C2P saved, not the card you approve. Nothing was sent.",
+    twoc2p_card_in_clear: "Refusing to pay: this 2C2P payment carries a card number outside 2C2P's encrypted field. Nothing was sent.",
+    twoc2p_installments: "Refusing to pay: this 2C2P payment is an instalment plan. Nothing was sent.",
+    twoc2p_currency_conversion: "Refusing to pay: this 2C2P payment takes a currency conversion offer, which changes what is charged. Nothing was sent.",
+    twoc2p_loyalty_redemption: "Refusing to pay: this 2C2P payment redeems loyalty points. Nothing was sent."
+});
+function twoC2pRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.twoc2p_body_unsupported;
+}
+async function encryptTwoC2pCard(card, environment, facilities = {}) {
+    const key = twoC2pKey(environment);
+    if (!key)
+        throw new TwoC2pSecurePayError("twoc2p_key_unavailable");
+    return buildTwoC2pSecurePayToken(card, key, facilities);
+}
+function twoC2pSubstitutionOf(value, environment) {
+    const key = twoC2pKey(environment);
+    if (!key || !record(value) || Object.keys(value).join(",") !== TWOC2P_FIELD)
+        return null;
+    return isTwoC2pDeviceField(value[TWOC2P_FIELD], key) ? value[TWOC2P_FIELD] : null;
+}
+function pausedField(url, body) {
+    const target = twoC2pPaymentTarget(url);
+    if (!target || !target.reviewed || twoC2pRequestRefusal({ method: "POST", url, body }) !== null)
+        return null;
+    const field = JSON.parse(body).payment.data.securePayToken;
+    return { target, field, copies: body.split(field).length - 1 };
+}
+function substituteTwoC2p(url, body, field) {
+    const paused = pausedField(url, body);
+    if (!paused)
+        throw new SubstitutionError("the paused request is not the card payment 2C2P's page sends");
+    if (paused.copies !== 1)
+        throw new SubstitutionError("the paused card field is written more than once");
+    const device = twoC2pSubstitutionOf({ [TWOC2P_FIELD]: field }, paused.target.environment);
+    if (device === null || device === paused.field)
+        throw new SubstitutionError("the substitution is not a new 2C2P card field in the shape the device writes");
+    const keyBytes = twoC2pKeyBytes(paused.target.environment);
+    const kind = Object.freeze({ accepts: (value) => isTwoC2pPageField(value, keyBytes), label: "a 2C2P card field in the library's format" });
+    const out = swapMerchantHostedFields(body, { path: ["payment", "data"], fields: { [TWOC2P_FIELD]: device } }, kind);
+    if (twoC2pRequestRefusal({ method: "POST", url, body: out }) !== null || JSON.parse(out).payment.data.securePayToken !== device) {
+        throw new SubstitutionError("the substitution did not land in the page's card payment");
+    }
+    return out;
+}
+function twoC2pSubstitutionsRefusal(template, substitution) {
+    const refuseWith = (message) => ({ code: "invalid_substitutions", message });
+    const paused = record(template) ? pausedField(template.url, template.body) : null;
+    if (!paused)
+        return refuseWith("This authorization is not the card payment 2C2P's page sends.");
+    const device = twoC2pSubstitutionOf(substitution, paused.target.environment);
+    if (device === null)
+        return refuseWith("substitutions must be exactly securePayToken, a 2C2P card field in the shape the device writes.");
+    if (device === paused.field)
+        return refuseWith("substitutions must be a new card field, not the one already in the paused request.");
+    return null;
+}
+function twoC2pKeyUsable(authorization) {
+    if (!record(authorization) || !record(authorization.cse))
+        return false;
+    const cse = authorization.cse;
+    if (cse.psp !== TWOC2P_PSP || cse.scheme !== TWOC2P_SCHEME)
+        return false;
+    if (cse.public_key != null || cse.client_key != null || Object.prototype.hasOwnProperty.call(cse, "merchant_hosted"))
+        return false;
+    const target = twoC2pPaymentTarget(authorization.url);
+    if (!target || !target.reviewed || cse.environment !== target.environment || authorization.sandbox !== (target.environment === "sandbox"))
+        return false;
+    return twoC2pKeyBytes(target.environment) !== null;
+}
+export { TWOC2P_CAPABILITY, TWOC2P_FIELD, TWOC2P_FIELD_AT, TWOC2P_OPERATION, TWOC2P_PSP, TWOC2P_REFUSAL_CODES, TWOC2P_REVIEWED_BUILDS, TWOC2P_SCHEME, encryptTwoC2pCard, substituteTwoC2p, twoC2pBodyVerdict, twoC2pKeyUsable, twoC2pPaymentCarriesCard, twoC2pPaymentTarget, twoC2pRefusalMessage, twoC2pRequestRefusal, twoC2pSubstitutionOf, twoC2pSubstitutionsRefusal };