@agent-cards/sdk 0.23.19 → 0.23.21

package/dist/comgate.js

@@ -0,0 +1,80 @@
+/**
+ * ComGate's payment gateway (pay1 to pay4.comgate.cz, where most Czech and Slovak e-shops send the buyer), as this
+ * SDK reads it.
+ *
+ * The merchant's server creates the payment at ComGate and sends the buyer's browser to the gateway link ComGate
+ * answered with, https://payN.comgate.cz/init?id=<transaction id>, by a redirect or by setting the page's or a
+ * frame's location. That GET carries no card and nothing but the payment's id, and it is the one request a build
+ * that declares ComGate's capability pauses for ComGate (hosted-entry.ts): the cardholder's device then makes the
+ * gateway's own calls for that payment over the end-to-end TLS relay (payment-core processors/comgate.js). Only the
+ * link exactly as ComGate writes it is the entry; any other parameter would be handed on to the gateway's own
+ * route, which these rules never see.
+ *
+ * COMGATE_GATEWAY_HOSTS is payment-core's COMGATE_GATEWAY_HOSTS, and isComgateEntryUrl is payment-core's rule of
+ * the same name; hosted-entry.test.mjs pins both to payment-core on every case payment-core's own tests list.
+ */
+export const COMGATE_PSP = 'comgate';
+/** The dark-launch capability the API serves ComGate's recognizer behind (payment-core definitions.js). */
+export const COMGATE_CAPABILITY = 'comgate_hosted_payment_page';
+/** The four gateway hosts ComGate's create answer names, each a host of its own entry. */
+export const COMGATE_GATEWAY_HOSTS = Object.freeze(['pay1.comgate.cz', 'pay2.comgate.cz', 'pay3.comgate.cz', 'pay4.comgate.cz']);
+const COMGATE_ENTRY_PATH = '/init';
+// The id the gateway's router takes: three groups of four letters or digits.
+const TRANS_ID = /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/;
+/**
+ * The hosts that take a card, or part of one, for ComGate: the gateway's API (payments.comgate.cz behind pay1 and pay2,
+ * payments-gcp.comgate.cz behind pay3 and pay4), where the gateway posts the card (/client/instructions/card-process,
+ * check-card) and ComGate's Web Checkout SDK posts its own (/checkout/provider/*, /checkout/card/check-card), and the
+ * card frames' hosts (sec.comgate.cz, sec-gcp.comgate.cz), which post the card's first digits to their /bin-checker.
+ * The card is already encrypted in ComGate's frame by then, so no body rule could see it: once ComGate is served, this
+ * build fails every request to these hosts but a GET, so the card the agent typed never reaches ComGate.
+ */
+export const COMGATE_CARD_HOSTS = Object.freeze(['payments.comgate.cz', 'payments-gcp.comgate.cz', 'sec.comgate.cz', 'sec-gcp.comgate.cz']);
+/** The Fetch.enable globs attachToCdp arms for the card hosts, only while ComGate is served (cdp.ts). */
+export const COMGATE_CARD_PATTERNS = Object.freeze(COMGATE_CARD_HOSTS.map((host) => `*${host}*`));
+// A gateway link, as ComGate writes one: the registry reads ComGate as served when it takes this as a GET entry.
+const COMGATE_SAMPLE_ENTRY = 'https://pay1.comgate.cz/init?id=AAAA-BBBB-CCCC';
+/** Whether this URL is on one of ComGate's card hosts (https, no credentials, any port, a trailing dot or not). */
+export function isComgateCardHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === 'https:' && !parsed.username && !parsed.password
+        && COMGATE_CARD_HOSTS.includes(parsed.hostname.toLowerCase().replace(/\.$/, ''));
+}
+/** Whether this build's registry serves ComGate's entry: a company Agentcard turned ComGate on for, on a build that declares it. */
+export function servesComgate(vault) {
+    return typeof vault?.isCardRequest === 'function' && vault.isCardRequest(COMGATE_SAMPLE_ENTRY, 'GET');
+}
+/**
+ * Whether an adapter must hand this request to the pre-claim gates: it is on one of ComGate's card hosts and this
+ * build's registry serves ComGate. attachToPlaywright's route predicate asks this, as attachToCdp arms the hosts.
+ */
+export function isArmedComgateUrl(vault, url) {
+    return isComgateCardHost(url) && servesComgate(vault);
+}
+/**
+ * Whether a URL is ComGate's gateway link exactly as ComGate's create answer writes it: https, one of the four
+ * gateway hosts in lowercase, the default port, no credentials or fragment, the path /init, and a query of the one
+ * `id` parameter holding a transaction id. A string that parses to another spelling is not it.
+ */
+export function isComgateEntryUrl(raw) {
+    if (typeof raw !== 'string' || raw.length > 256)
+        return false;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.href !== raw || url.protocol !== 'https:' || url.port || url.username || url.password || url.hash)
+        return false;
+    if (!COMGATE_GATEWAY_HOSTS.includes(url.hostname) || url.pathname !== COMGATE_ENTRY_PATH)
+        return false;
+    return url.search.startsWith('?id=') && TRANS_ID.test(url.search.slice(4));
+}

package/dist/cybersource-secure-acceptance.generated.d.ts

@@ -38,7 +38,7 @@ declare function isPreparedSecureAcceptanceRequest(url: any, method: any, body:
 declare function secureAcceptanceMerchantEntry(profileId: any, merchantOrigin: any, entries?: any): any;
 declare function secureAcceptanceMerchantRefusal(environment: any, profileId: any, merchantOrigin: any, accessKey: any, entries?: any): "unsupported_environment" | "invalid_profile_id" | "secure_acceptance_merchant_unreviewed" | "secure_acceptance_merchant_pending" | "secure_acceptance_access_key_unreviewed" | "secure_acceptance_merchant_observe" | null;
 declare function secureAcceptanceCardType(number: any): "001" | "002" | "003" | "004" | null;
-declare function secureAcceptanceCardRefusal(environment: any, card: any): "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "invalid_card_number" | "live_host_refuses_documented_test_card" | "card_network_unsupported" | "invalid_expiry" | "invalid_cvn" | null;
+declare function secureAcceptanceCardRefusal(environment: any, card: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | "card_network_unsupported" | "invalid_expiry" | "invalid_cvn" | null;
 declare function isSecureAcceptanceDeviceRequest(templateBody: any, deviceBody: any, environment: any): boolean;
 declare function secureAcceptanceDeviceRequest(request: any, card: any, options: any): {
     url: any;

package/dist/eprotect.generated.d.ts

@@ -81,7 +81,7 @@ declare function eprotectMerchantPin(paypageId: any, merchantOrigin: any, pins?:
 declare function eprotectMerchantRefusal(environment: any, paypageId: any, merchantOrigin: any, pins?: any): "invalid_paypage_id" | "unsupported_environment" | "eprotect_merchant_unreviewed" | null;
 declare function defaultRandom(bytes: any): void;
 declare function eprotectEncrypt(text: any, key: any, random?: typeof defaultRandom): string;
-declare function eprotectCardRefusal(environment: any, cardNumber: any): "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "invalid_card_number" | "live_host_refuses_documented_test_card" | null;
+declare function eprotectCardRefusal(environment: any, cardNumber: any): "invalid_card_number" | "unsupported_environment" | "sandbox_host_requires_documented_test_card" | "live_host_refuses_documented_test_card" | null;
 declare function eprotectDeviceRequest(templateUrl: any, card: any, sessionKey: any, random?: typeof defaultRandom): {
     url: string;
     method: string;

package/dist/gmo.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 8149714daf5515a2fd3ec90d5aa0c7eb58a66d5ce79c3e3f0ba81c29d2946dc3
+// artifact-sha256: a65199bcbf0b67546130fb4f2c12ba72c8f51a2ff5b4e3054e2bfcc29b06f95d
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/dist/hipay.generated.d.ts

@@ -0,0 +1,56 @@
+declare var HIPAY_PSP: string;
+declare var HIPAY_CAPABILITY: string;
+declare var HIPAY_OPERATION: string;
+declare var HIPAY_VAULT_HOSTS: Readonly<{
+    "secure2-vault.hipay-tpp.com": "production";
+    "stage-secure2-vault.hipay-tpp.com": "sandbox";
+}>;
+declare var HIPAY_TOKEN_URLS: Readonly<{
+    production: "https://secure2-vault.hipay-tpp.com/rest/v2/token";
+    sandbox: "https://stage-secure2-vault.hipay-tpp.com/rest/v2/token";
+}>;
+declare var HIPAY_UPDATE_PATH: string;
+declare var HIPAY_REFUSAL_CODES: readonly string[];
+declare function hipayTokenEnvironment(url: any): "production" | "sandbox" | null;
+declare function isHipayTokenUrl(url: any): boolean;
+declare function hipayBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function hipayNumberOnlyRequest(url: any, method: any, body: any): boolean;
+declare function hipayUsernameEnvironment(username: any): "production" | "sandbox" | null;
+declare function hipayUsername(headers: any): string | null;
+declare function hipayRequestRefusal(request: any): any;
+declare function isPreparedHipayRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare function hipayPinOriginUsable(origin: any): boolean;
+declare var HIPAY_MERCHANT_PINS: readonly any[];
+declare function hipayOriginPin(merchantOrigin: any, pins?: readonly any[]): any;
+declare function hipayPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly any[]): "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayMerchantPin(merchantOrigin: any, username: any, pins?: readonly any[]): any;
+declare function hipayMerchantRefusal(environment: any, merchantOrigin: any, username: any, pins?: readonly any[]): "hipay_headers_refused" | "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayRefusalMessage(code: any): any;
+declare function injectHipayCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isHipayDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function hipayRefusalCode(text: any): string | null;
+declare function hipayAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { HIPAY_CAPABILITY, HIPAY_MERCHANT_PINS, HIPAY_OPERATION, HIPAY_PSP, HIPAY_REFUSAL_CODES, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayAnswerOutcome, hipayBodyVerdict, hipayMerchantPin, hipayMerchantRefusal, hipayNumberOnlyRequest, hipayOriginPin, hipayPinOriginUsable, hipayPreparationRefusal, hipayRefusalCode, hipayRefusalMessage, hipayRequestRefusal, hipayTokenEnvironment, hipayUsername, hipayUsernameEnvironment, injectHipayCard, isHipayDeviceRequest, isHipayTokenUrl, isPreparedHipayRequest };

package/dist/hipay.generated.js

@@ -0,0 +1,392 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: e8cb1ddfc6c8937f5126197b90d8261da8b07c9c68df1decb261052e8a2fabc1
+// src/hipay.js
+var HIPAY_PSP = "hipay";
+var HIPAY_CAPABILITY = "hipay_vault_token";
+var HIPAY_OPERATION = "hipay.card_request";
+var HIPAY_VAULT_HOSTS = /* @__PURE__ */ Object.freeze({ "secure2-vault.hipay-tpp.com": "production", "stage-secure2-vault.hipay-tpp.com": "sandbox" });
+var HIPAY_TOKEN_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://secure2-vault.hipay-tpp.com/rest/v2/token",
+    sandbox: "https://stage-secure2-vault.hipay-tpp.com/rest/v2/token"
+});
+var HIPAY_UPDATE_PATH = "/rest/v2/token/update";
+var HIPAY_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "hipay_url_refused",
+    "hipay_headers_refused",
+    "hipay_number_only",
+    "hipay_keeps_card",
+    "hipay_body_unsupported"
+]);
+var BODY_LIMIT = 2048;
+var HOSTED_KEYS = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number", "card_holder", "cvc"]);
+var HOSTED_KEYS_NO_HOLDER = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number", "cvc"]);
+var DIRECT_KEYS = /* @__PURE__ */ Object.freeze(["card_expiry_month", "card_expiry_year", "card_number", "card_holder", "cvc", "multi_use"]);
+var DIRECT_KEYS_NO_HOLDER = /* @__PURE__ */ Object.freeze(["card_expiry_month", "card_expiry_year", "card_number", "cvc", "multi_use"]);
+var CARD_SHAPES = /* @__PURE__ */ Object.freeze([HOSTED_KEYS, HOSTED_KEYS_NO_HOLDER, DIRECT_KEYS, DIRECT_KEYS_NO_HOLDER]);
+var NUMBER_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number"]);
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var YEAR = /^20[0-9]{2}$/;
+var TEXT_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var JSON_TYPE = /^application\/json(?:\s*;\s*charset=utf-8)?$/i;
+var BASIC = /^Basic ([A-Za-z0-9+/]{4,512}={0,2})$/;
+var PRODUCTION_USERNAME = /^[0-9]{6,12}\.(?:secure-gateway|api)\.hipay-tpp\.com$/;
+var SANDBOX_USERNAME = /^[0-9]{6,12}\.stage-secure-gateway\.hipay-tpp\.com$/;
+var PASSWORD = /^[\x21-\x7e]{8,128}$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function hipayTokenEnvironment(url) {
+    if (url === HIPAY_TOKEN_URLS.production)
+        return "production";
+    if (url === HIPAY_TOKEN_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isHipayTokenUrl(url) {
+    return hipayTokenEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function hipayBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse("hipay_body_unsupported");
+    if (sameKeys(value, NUMBER_ONLY_KEYS))
+        return refuse("hipay_number_only");
+    if (!CARD_SHAPES.some((keys) => sameKeys(value, keys)))
+        return refuse("hipay_body_unsupported");
+    if (typeof value.card_number !== "string" || !CARD_NUMBER.test(value.card_number) || typeof value.cvc !== "string" || !SECURITY_CODE.test(value.cvc) || typeof value.card_expiry_month !== "string" || !MONTH.test(value.card_expiry_month) || typeof value.card_expiry_year !== "string" || !YEAR.test(value.card_expiry_year) || "card_holder" in value && !plainText(value.card_holder)) {
+        return refuse("hipay_body_unsupported");
+    }
+    if (value.multi_use === 1)
+        return refuse("hipay_keeps_card");
+    return value.multi_use === 0 ? CARD : refuse("hipay_body_unsupported");
+}
+function hipayNumberOnlyRequest(url, method, body) {
+    if (typeof method !== "string" || method.toUpperCase() !== "POST" || !isHipayTokenUrl(url))
+        return false;
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return false;
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    return record(value) && !(typeof value.cvc === "string" && SECURITY_CODE.test(value.cvc));
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function base64Text(input) {
+    if (input.length % 4 !== 0)
+        return null;
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    const stripped = input.replace(/={1,2}$/, "");
+    if (stripped.includes("="))
+        return null;
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const character of stripped) {
+        const sextet = alphabet.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits & 255);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+function hipayUsernameEnvironment(username) {
+    if (typeof username !== "string")
+        return null;
+    if (PRODUCTION_USERNAME.test(username))
+        return "production";
+    return SANDBOX_USERNAME.test(username) ? "sandbox" : null;
+}
+function hipayUsername(headers) {
+    if (!record(headers))
+        return null;
+    const authorization = headerValue(headers, "authorization");
+    const basic = authorization === null ? null : BASIC.exec(authorization);
+    const text = basic ? base64Text(basic[1]) : null;
+    const colon = text === null ? -1 : text.indexOf(":");
+    if (colon <= 0)
+        return null;
+    const username = text.slice(0, colon);
+    return hipayUsernameEnvironment(username) !== null && PASSWORD.test(text.slice(colon + 1)) ? username : null;
+}
+function hipayRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "hipay_url_refused";
+    const environment = hipayTokenEnvironment(request.url);
+    if (environment === null)
+        return "hipay_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const username = hipayUsername(headers);
+    if (contentType === null || !JSON_TYPE.test(contentType.trim()) || username === null || hipayUsernameEnvironment(username) !== environment) {
+        return "hipay_headers_refused";
+    }
+    const verdict = hipayBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedHipayRequest(url, method, body, environment, headers) {
+    return (environment === "production" || environment === "sandbox") && hipayTokenEnvironment(url) === environment && hipayRequestRefusal({ url, method, headers, body }) === null;
+}
+var PIN_ORIGIN = /^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/;
+var HIPAY_DOMAIN = /(?:^|\.)(?:hipay\.com|hipay-tpp\.com|hipaywallet\.com|hipay-pos-platform\.com|hipaycomprafacil\.com)$/;
+function hipayPinOriginUsable(origin) {
+    const host = typeof origin === "string" ? PIN_ORIGIN.exec(origin) : null;
+    return !!host && !HIPAY_DOMAIN.test(host[1]);
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]), usernames: Object.freeze([...fields.usernames]) });
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
+]);
+var usablePin = (entry) => !!entry && Array.isArray(entry.origins) && Array.isArray(entry.usernames) && entry.origins.length > 0 && entry.usernames.length > 0 && entry.origins.every(hipayPinOriginUsable) && entry.usernames.every((name) => hipayUsernameEnvironment(name) === "production");
+function hipayOriginPin(merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || !Array.isArray(pins) || !hipayPinOriginUsable(merchantOrigin))
+        return null;
+    const found = pins.filter((entry) => usablePin(entry) && entry.origins.includes(merchantOrigin));
+    return found.length === 1 ? found[0] : null;
+}
+function hipayPreparationRefusal(environment, merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    return hipayOriginPin(merchantOrigin, pins) ? null : "hipay_merchant_unreviewed";
+}
+function hipayMerchantPin(merchantOrigin, username, pins = HIPAY_MERCHANT_PINS) {
+    if (typeof username !== "string" || hipayUsernameEnvironment(username) !== "production")
+        return null;
+    const found = hipayOriginPin(merchantOrigin, pins);
+    return found && found.usernames.includes(username) ? found : null;
+}
+function hipayMerchantRefusal(environment, merchantOrigin, username, pins = HIPAY_MERCHANT_PINS) {
+    if (environment !== "production" && environment !== "sandbox")
+        return "unsupported_environment";
+    if (hipayUsernameEnvironment(username) !== environment)
+        return "hipay_headers_refused";
+    if (environment === "sandbox")
+        return null;
+    return hipayMerchantPin(merchantOrigin, username, pins) ? null : "hipay_merchant_unreviewed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    hipay_url_refused: "Refusing to pay: this HiPay card request does not go to HiPay's card vault exactly as HiPay's card form sends it. Nothing was sent.",
+    hipay_headers_refused: "Refusing to pay: this HiPay card request does not carry the checkout's own headers. Nothing was sent.",
+    hipay_number_only: "Refusing to pay: this is not the card request of HiPay's card form. Nothing was sent.",
+    hipay_keeps_card: "This payment asks the payment processor to keep your card for later charges, and you cannot agree to that on this page yet.",
+    hipay_body_unsupported: "Refusing to pay: this is not the card request of HiPay's card form. Nothing was sent.",
+    hipay_merchant_unreviewed: "This payment goes to a merchant account Agentcard has not reviewed."
+});
+function hipayRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.hipay_body_unsupported;
+}
+var WHERE = /* @__PURE__ */ Object.freeze(["card_number", "cvc", "card_expiry_month", "card_expiry_year"]);
+function frameCard(card) {
+    if (!card)
+        return null;
+    const number = String(card.number).replace(/[ -]/g, "");
+    const cvc = String(card.cvc);
+    const month = Number(card.month);
+    const rawYear = Number(card.year);
+    const year = Number.isInteger(rawYear) && rawYear >= 0 && rawYear <= 99 ? 2e3 + rawYear : rawYear;
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvc) || !Number.isInteger(month) || month < 1 || month > 12 || !Number.isInteger(year) || !YEAR.test(String(year)))
+        return null;
+    return { card_number: number, cvc, card_expiry_month: String(month).padStart(2, "0"), card_expiry_year: String(year) };
+}
+function written(body, values) {
+    const value = JSON.parse(body);
+    for (const key of WHERE)
+        value[key] = values[key];
+    return JSON.stringify(value);
+}
+function injectHipayCard(body, card) {
+    const verdict = hipayBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(hipayRefusalMessage(verdict.code));
+    const values = frameCard(card);
+    if (!values)
+        throw new Error("Could not fill the card fields for HiPay. Nothing was sent.");
+    return { body: written(body, values), where: [...WHERE] };
+}
+function isHipayDeviceRequest(templateBody, deviceBody) {
+    if (hipayBodyVerdict(templateBody).verdict !== "card" || hipayBodyVerdict(deviceBody).verdict !== "card")
+        return false;
+    const device = JSON.parse(deviceBody);
+    return written(templateBody, device) === deviceBody && device.card_number !== JSON.parse(templateBody).card_number;
+}
+var ANSWER_LIMIT = 16384;
+var TOKEN = /^[A-Za-z0-9_-]{16,128}$/;
+var LONG_DIGIT_RUN = /[0-9]{13,}/;
+var DIGEST_TOKEN = /^[0-9a-f]{64}$/;
+var PAN = /^([0-9]{6})[xX*]{2,9}([0-9]{4})$/;
+var REQUEST_ID = /^[0-9]{1,11}$/;
+var REQUEST_ID_MAX = 99999999999;
+var CARD_ID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var WORD = /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/;
+var COUNTRY = /^[A-Z]{2}$/;
+var VAULT_CODE = /^[0-9]{1,7}$/;
+var ECHO_WINDOW = 7;
+var HIDDEN_FLOOR = 5;
+var SEPARATORS = /[ ._-]/g;
+var WORD_DIGITS = 2;
+var word = (value) => typeof value === "string" && WORD.test(value) && (value.match(/[0-9]/g) ?? []).length <= WORD_DIGITS;
+var ANSWER_KEYS = /* @__PURE__ */ Object.freeze([
+    "token",
+    "request_id",
+    "card_id",
+    "multi_use",
+    "brand",
+    "pan",
+    "card_holder",
+    "card_expiry_month",
+    "card_expiry_year",
+    "issuer",
+    "country",
+    "domestic_network",
+    "card_type",
+    "card_category",
+    "forbidden_issuer_country"
+]);
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function vaultCode(answer) {
+    const code = answer ? answer.code : void 0;
+    const text = typeof code === "number" && Number.isInteger(code) && code >= 0 ? String(code) : typeof code === "string" ? code : null;
+    return text !== null && VAULT_CODE.test(text) ? text : null;
+}
+function hipayRefusalCode(text) {
+    const code = vaultCode(readAnswer(text));
+    return code === null ? null : `hipay_${code}`;
+}
+var KEPT = /* @__PURE__ */ Object.freeze({
+    token: (value) => typeof value === "string" && TOKEN.test(value) && (DIGEST_TOKEN.test(value) || !LONG_DIGIT_RUN.test(value)),
+    request_id: (value) => typeof value === "string" && REQUEST_ID.test(value) || Number.isInteger(value) && value >= 0 && value <= REQUEST_ID_MAX,
+    card_id: (value) => typeof value === "string" && CARD_ID.test(value) && !LONG_DIGIT_RUN.test(value),
+    multi_use: (value) => value === 0 || value === false,
+    brand: word,
+    pan: (value) => typeof value === "string" && PAN.test(value),
+    card_holder: plainText,
+    card_expiry_month: (value) => typeof value === "string" && MONTH.test(value),
+    card_expiry_year: (value) => typeof value === "string" && YEAR.test(value),
+    issuer: plainText,
+    country: (value) => typeof value === "string" && COUNTRY.test(value),
+    domestic_network: word,
+    card_type: word,
+    card_category: word,
+    forbidden_issuer_country: (value) => typeof value === "boolean"
+});
+function tokenAnswer(answer) {
+    if (!answer || typeof answer.token !== "string" || typeof answer.pan !== "string")
+        return null;
+    const out = {};
+    for (const key of ANSWER_KEYS) {
+        if (answer[key] === void 0 || answer[key] === null)
+            continue;
+        if (!KEPT[key](answer[key]))
+            return null;
+        out[key] = answer[key];
+    }
+    return out;
+}
+function hipayAnswerOutcome(status, text, card) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "hipay_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: hipayRefusalCode(text) ?? `http_${status}` };
+    if (status !== 200 && status !== 201)
+        return { outcome: "unknown", reason: "hipay_unconfirmed" };
+    const answer = readAnswer(text);
+    if (answer && typeof answer.token !== "string" && vaultCode(answer) !== null)
+        return { outcome: "refused", code: `hipay_${vaultCode(answer)}` };
+    const token = tokenAnswer(answer);
+    if (token === null)
+        return { outcome: "unknown", reason: "hipay_unsafe_response" };
+    if (card) {
+        const sent = frameCard(card);
+        if (!sent)
+            return { outcome: "unknown", reason: "hipay_unsafe_response" };
+        const hidden = sent.card_number.slice(6, -4);
+        const holdsHidden = (key, value) => hidden.length >= HIDDEN_FLOOR && key !== "card_expiry_month" && key !== "card_expiry_year" && String(value).replace(SEPARATORS, "").includes(hidden);
+        if (ANSWER_KEYS.some((key) => key !== "pan" && token[key] !== void 0 && (echoesCard(token[key], sent.card_number) || holdsHidden(key, token[key])))) {
+            return { outcome: "unknown", reason: "hipay_unsafe_response" };
+        }
+        const pan = PAN.exec(token.pan);
+        const brand = brandNetwork(token.brand);
+        const network = cardNetwork(sent.card_number);
+        if (!pan || pan[1] !== sent.card_number.slice(0, 6) || pan[2] !== sent.card_number.slice(-4) || token.card_expiry_month !== void 0 && token.card_expiry_month !== sent.card_expiry_month || token.card_expiry_year !== void 0 && token.card_expiry_year !== sent.card_expiry_year || brand !== null && network !== null && brand !== network) {
+            return { outcome: "unknown", reason: "hipay_token_mismatch" };
+        }
+    }
+    return { outcome: "approved", body: JSON.stringify(token) };
+}
+function echoesCard(value, number) {
+    const digits = String(value).replace(/[^0-9]/g, "");
+    if (digits.length < ECHO_WINDOW)
+        return false;
+    for (let at = 0; at + ECHO_WINDOW <= number.length; at += 1) {
+        if (digits.includes(number.slice(at, at + ECHO_WINDOW)))
+            return true;
+    }
+    return false;
+}
+function cardNetwork(number) {
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (number.startsWith("4"))
+        return "VISA";
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "MASTERCARD";
+    return two === 34 || two === 37 ? "AMEX" : null;
+}
+function brandNetwork(brand) {
+    const name = typeof brand === "string" ? brand.toUpperCase().replace(/[^A-Z]/g, "") : "";
+    if (name === "VISA")
+        return "VISA";
+    if (name === "MASTERCARD")
+        return "MASTERCARD";
+    return name === "AMERICANEXPRESS" || name === "AMEX" ? "AMEX" : null;
+}
+export { HIPAY_CAPABILITY, HIPAY_MERCHANT_PINS, HIPAY_OPERATION, HIPAY_PSP, HIPAY_REFUSAL_CODES, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayAnswerOutcome, hipayBodyVerdict, hipayMerchantPin, hipayMerchantRefusal, hipayNumberOnlyRequest, hipayOriginPin, hipayPinOriginUsable, hipayPreparationRefusal, hipayRefusalCode, hipayRefusalMessage, hipayRequestRefusal, hipayTokenEnvironment, hipayUsername, hipayUsernameEnvironment, injectHipayCard, isHipayDeviceRequest, isHipayTokenUrl, isPreparedHipayRequest };