@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/toast-seal.generated.d.ts

@@ -0,0 +1,37 @@
+declare var TOAST_SCHEME: string;
+declare var ToastError: {
+    new (reason: any): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+    };
+};
+declare function toastCardPlaintext(card: any, postalCode: any): string;
+declare function encryptToastCard(card: any, request: any, facilities?: {}): Promise<{
+    cardData: string;
+}>;
+declare function isToastCiphertextUnderKey(value: any): boolean;
+declare function toastKeyUsable(authorization: any): boolean;
+declare function toastSubstitutionsRefusal(template: any, substitutions: any): {
+    code: string;
+    message: any;
+} | null;
+declare function substituteToastCardData(url: any, body: any, fields: any): string;
+declare function toastAnswerOutcome(status: any, text: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { TOAST_SCHEME, ToastError, encryptToastCard, isToastCiphertextUnderKey, substituteToastCardData, toastAnswerOutcome, toastCardPlaintext, toastKeyUsable, toastSubstitutionsRefusal };

package/dist/toast-seal.generated.js

@@ -0,0 +1,625 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 76b8b2e66aaea554e1181148894062d1f998d5f7b75dc9ac626d420f22081d7e
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes2 = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes2)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/merchant-card-endpoint-keys.js
+var MerchantKeyError = class extends Error {
+    constructor(reason) {
+        super("Refusing to encrypt the card under the merchant's key.");
+        this.name = "MerchantKeyError";
+        this.code = "merchant_key_refused";
+        this.reason = reason;
+    }
+};
+var refuse = (reason) => new MerchantKeyError(reason);
+var MERCHANT_KEY_HASHES = /* @__PURE__ */ Object.freeze({ "SHA-1": 20, "SHA-256": 32, "SHA-512": 64 });
+var MERCHANT_KEY_JWE_ENCS = /* @__PURE__ */ Object.freeze({
+    "A256CBC-HS512": Object.freeze({ key: 64, iv: 16, tag: 32 }),
+    A256GCM: Object.freeze({ key: 32, iv: 12, tag: 16 })
+});
+var MERCHANT_KEY_SIZES = /* @__PURE__ */ Object.freeze([256, 384, 512]);
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+var MAX_ENCRYPTED_LENGTH = 4096;
+var isBytes = (value) => Object.prototype.toString.call(value) === "[object Uint8Array]";
+function encodeBase64(bytes, url = false) {
+    const alphabet = url ? BASE64URL_ALPHABET : BASE64_ALPHABET;
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const a = bytes[i];
+        const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        const triple = a << 16 | b << 8 | c;
+        out += alphabet[triple >> 18 & 63] + alphabet[triple >> 12 & 63];
+        if (i + 1 < bytes.length)
+            out += alphabet[triple >> 6 & 63];
+        else if (!url)
+            out += "=";
+        if (i + 2 < bytes.length)
+            out += alphabet[triple & 63];
+        else if (!url)
+            out += "=";
+    }
+    return out;
+}
+function decodeBase64(text, url = false) {
+    if (typeof text !== "string" || text.length === 0 || text.length > MAX_ENCRYPTED_LENGTH * 2)
+        return null;
+    const alphabet = url ? BASE64URL_ALPHABET : BASE64_ALPHABET;
+    const body = url ? text : text.replace(/={1,2}$/, "");
+    if (!url && text.length % 4 !== 0)
+        return null;
+    if (body.length % 4 === 1)
+        return null;
+    const out = new Uint8Array(Math.floor(body.length * 3 / 4));
+    let bits = 0;
+    let value = 0;
+    let at = 0;
+    for (let i = 0; i < body.length; i += 1) {
+        const digit = alphabet.indexOf(body[i]);
+        if (digit === -1)
+            return null;
+        value = value << 6 | digit;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out[at++] = value >> bits & 255;
+            value &= (1 << bits) - 1;
+        }
+    }
+    return encodeBase64(out, url) === text ? out : null;
+}
+function readElement(der, at, tag) {
+    if (at + 2 > der.length || der[at] !== tag)
+        throw refuse("key");
+    let length = der[at + 1];
+    let start = at + 2;
+    if (length & 128) {
+        const count = length & 127;
+        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+            throw refuse("key");
+        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        if (length < 128)
+            throw refuse("key");
+        start += count;
+    }
+    if (start + length > der.length)
+        throw refuse("key");
+    return { start, end: start + length };
+}
+function readPositiveInteger(der, at) {
+    const { start, end } = readElement(der, at, 2);
+    if (end === start || der[start] & 128)
+        throw refuse("key");
+    if (der[start] === 0 && (end - start === 1 || !(der[start + 1] & 128)))
+        throw refuse("key");
+    return { bytes: der.subarray(der[start] === 0 ? start + 1 : start, end), end };
+}
+function toBigInt(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i += 1)
+        hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex || "0"}`);
+}
+function toBytes(value, size) {
+    const hex = value.toString(16).padStart(size * 2, "0");
+    if (hex.length !== size * 2)
+        throw refuse("text");
+    const out = new Uint8Array(size);
+    for (let i = 0; i < size; i += 1)
+        out[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function modPow(base, exponent, modulus) {
+    let result = 1n;
+    let square = base % modulus;
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = result * square % modulus;
+        square = square * square % modulus;
+    }
+    return result;
+}
+function parseMerchantKey(key) {
+    const spki = key && typeof key === "object" ? key.spki : void 0;
+    const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    if (typeof spki !== "string" || spki.length > 1024 || typeof pin !== "string" || !SHA256_HEX.test(pin))
+        throw refuse("key");
+    const der = decodeBase64(spki);
+    if (!der || sha256Hex(der) !== pin)
+        throw refuse("key");
+    const outer = readElement(der, 0, 48);
+    if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
+        throw refuse("key");
+    if (!RSA_ALGORITHM.every((byte, i) => der[outer.start + i] === byte))
+        throw refuse("key");
+    const bits = readElement(der, outer.start + RSA_ALGORITHM.length, 3);
+    if (bits.end !== outer.end || bits.start === bits.end || der[bits.start] !== 0)
+        throw refuse("key");
+    const rsa = readElement(der, bits.start + 1, 48);
+    if (rsa.end !== bits.end)
+        throw refuse("key");
+    const modulus = readPositiveInteger(der, rsa.start);
+    const exponent = readPositiveInteger(der, modulus.end);
+    if (exponent.end !== rsa.end)
+        throw refuse("key");
+    const n = modulus.bytes;
+    if (!MERCHANT_KEY_SIZES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+        throw refuse("key");
+    const e = exponent.bytes;
+    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+        throw refuse("key");
+    return Object.freeze({ n: toBigInt(n), size: n.length });
+}
+function subtleOf(crypto) {
+    if (!crypto || !crypto.subtle || typeof crypto.getRandomValues !== "function")
+        throw refuse("crypto");
+    return crypto.subtle;
+}
+async function digest(subtle, hash, bytes) {
+    try {
+        return new Uint8Array(await subtle.digest(hash, bytes));
+    }
+    catch {
+        throw refuse("crypto");
+    }
+}
+async function mgf1(subtle, hash, seed, length) {
+    const out = new Uint8Array(length);
+    const input = new Uint8Array(seed.length + 4);
+    input.set(seed);
+    try {
+        for (let counter = 0, filled = 0; filled < length; counter += 1) {
+            input[seed.length] = counter >>> 24 & 255;
+            input[seed.length + 1] = counter >>> 16 & 255;
+            input[seed.length + 2] = counter >>> 8 & 255;
+            input[seed.length + 3] = counter & 255;
+            const block = await digest(subtle, hash, input);
+            out.set(block.subarray(0, Math.min(block.length, length - filled)), filled);
+            filled += block.length;
+            block.fill(0);
+        }
+        return out;
+    }
+    finally {
+        input.fill(0);
+    }
+}
+function randomBytes(crypto, length) {
+    const out = new Uint8Array(length);
+    try {
+        crypto.getRandomValues(out);
+    }
+    catch {
+        throw refuse("random");
+    }
+    return out;
+}
+async function rsaOaepEncrypt(key, message, { hash, mgf1: maskHash }, crypto, seed) {
+    const subtle = subtleOf(crypto);
+    const { n, size } = parseMerchantKey(key);
+    const hLen = MERCHANT_KEY_HASHES[hash];
+    if (!hLen || !MERCHANT_KEY_HASHES[maskHash])
+        throw refuse("key");
+    if (!isBytes(message) || message.length > size - 2 * hLen - 2)
+        throw refuse("text");
+    const db = new Uint8Array(size - hLen - 1);
+    const em = new Uint8Array(size);
+    let seedBytes = null;
+    let dbMask = null;
+    let seedMask = null;
+    try {
+        db.set(await digest(subtle, hash, new Uint8Array(0)));
+        db[db.length - message.length - 1] = 1;
+        db.set(message, db.length - message.length);
+        if (seed !== void 0) {
+            if (!isBytes(seed) || seed.length !== hLen)
+                throw refuse("random");
+            seedBytes = Uint8Array.from(seed);
+        }
+        else {
+            seedBytes = randomBytes(crypto, hLen);
+        }
+        dbMask = await mgf1(subtle, maskHash, seedBytes, db.length);
+        for (let i = 0; i < db.length; i += 1)
+            db[i] ^= dbMask[i];
+        seedMask = await mgf1(subtle, maskHash, db, hLen);
+        for (let i = 0; i < hLen; i += 1)
+            seedBytes[i] ^= seedMask[i];
+        em.set(seedBytes, 1);
+        em.set(db, 1 + hLen);
+        return toBytes(modPow(toBigInt(em), 65537n, n), size);
+    }
+    finally {
+        db.fill(0);
+        em.fill(0);
+        if (seedBytes)
+            seedBytes.fill(0);
+        if (dbMask)
+            dbMask.fill(0);
+        if (seedMask)
+            seedMask.fill(0);
+    }
+}
+// src/substitution-primitives.js
+var SubstitutionError = class extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SubstitutionError";
+    }
+};
+// src/toast.js
+var TOAST_PSP = "toast";
+var TOAST_PAYMENT_METHODS_URL = "https://payments.toasttab.com/v1/payment-methods";
+var TOAST_KEY_ID = "RSA-OAEP-SHA1::bacb4887-8314-4c23-98fc-d5ef7bc99e94_oo-legacy-browsers";
+var TOAST_KEY = /* @__PURE__ */ Object.freeze({
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkq50dXdz/fQOwYUswZRXgh5Vghs1tcJZCv2goNsC5BO3dXC/EiejcApaE/fKVMespzDNSLsQHXrWHegpE2piyeBwMzpTbHrCG3v6MnG6Nu+9dBYxPS4T9cNMsf0V/iCPiiaTXib6r8IfOjVZTTas2nKGZEtiDfYJIS3bJ/f30SMP4dAFILvzXGALeqleB/psQ8AFc/qUZf7VZpRnoGtKoo8wD253xTmDdaiKqr09bcJZxhTWsCB9aYouqdbl6y9/5Lu+MtyBkj7LI05g5QqDSfVax0sp/Fe7RY5SYxwlR4GlMonwtbvFTMKsr6dZ1uLuNjHA/6dm+112Uqn/AxrKGwIDAQAB",
+    sha256: "5475b78c9577b1258615286307547aba18c52faa6fd7d60ad0cfcb996e21ad0e"
+});
+var TOAST_CIPHERTEXT_BYTES = 256;
+var TOAST_SUBSTITUTION = /* @__PURE__ */ Object.freeze({ at: "card", fields: Object.freeze(["cardData"]) });
+var BODY_LIMIT = 8192;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze(["type", "card", "sessionSecret", "usage", "setupFutureUsage", "billingDetails"]);
+var CARD_KEYS = /* @__PURE__ */ Object.freeze(["keyId", "cardData"]);
+var WALLETS = /* @__PURE__ */ Object.freeze(["APPLE_PAY", "GOOGLE_PAY"]);
+var SESSION_SECRET = /^[\x21-\x7e]{1,1024}$/;
+var POSTAL_CODE = /^[A-Za-z0-9 -]{0,16}$/;
+var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var failed = (code) => (
+/** @type {ToastBodyReadJs} */
+Object.freeze({ ok: false, code }));
+function isWalletBody(parsed) {
+    const card = parsed.card;
+    const rootOk = sameKeys(parsed, ["type", "card", "sessionSecret"]) || sameKeys(parsed, ["type", "card", "sessionSecret", "billingDetails"]) && record(parsed.billingDetails);
+    return rootOk && WALLETS.includes(parsed.type) && record(card) && sameKeys(card, ["keyId", "cardData", "wallet"]) && card.keyId === null && typeof card.cardData === "string" && record(card.wallet) && sameKeys(card.wallet, ["type"]) && card.wallet.type === parsed.type && typeof parsed.sessionSecret === "string";
+}
+function isToastPaymentMethodsUrl(url) {
+    return url === TOAST_PAYMENT_METHODS_URL;
+}
+function isToastCiphertext(value) {
+    return typeof value === "string" && CIPHERTEXT_B64.test(value);
+}
+function readToastBody(body) {
+    const malformed = failed("toast_body_malformed");
+    if (typeof body !== "string" || body.length > BODY_LIMIT)
+        return malformed;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return malformed;
+    }
+    if (!record(parsed) || JSON.stringify(parsed) !== body)
+        return malformed;
+    if (isWalletBody(parsed))
+        return (
+        /** @type {ToastBodyReadJs} */
+        Object.freeze({ ok: false, wallet: true }));
+    const card = parsed.card;
+    if (!sameKeys(parsed, ROOT_KEYS) || parsed.type !== "CARD" || !record(card) || !sameKeys(card, CARD_KEYS))
+        return malformed;
+    if (typeof card.keyId !== "string")
+        return malformed;
+    if (card.keyId !== TOAST_KEY_ID)
+        return failed("toast_foreign_key");
+    if (!isToastCiphertext(card.cardData))
+        return malformed;
+    if (typeof parsed.sessionSecret !== "string" || !SESSION_SECRET.test(parsed.sessionSecret))
+        return malformed;
+    if (parsed.usage !== null || parsed.setupFutureUsage !== null)
+        return failed("toast_keeps_card");
+    const billing = parsed.billingDetails;
+    if (!record(billing) || !sameKeys(billing, ["postalCode"]) || typeof billing.postalCode !== "string" || !POSTAL_CODE.test(billing.postalCode))
+        return malformed;
+    const read = { ok: true, sessionSecret: parsed.sessionSecret, postalCode: billing.postalCode, cardData: card.cardData };
+    return Object.freeze(read);
+}
+function toastRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST" || !isToastPaymentMethodsUrl(request.url))
+        return "toast_url_refused";
+    const read = readToastBody(request.body);
+    return read.ok ? null : read.code ?? "toast_body_malformed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    toast_url_refused: "Refusing to pay: this Toast card request does not go to the address Toast's card form sends cards to. Nothing was sent.",
+    toast_foreign_key: "Refusing to pay: this Toast card request is encrypted under a key Agentcard has not reviewed. Nothing was sent.",
+    toast_keeps_card: "Refusing to pay: this Toast checkout asks to keep the card for later payments, and Agentcard pays only a one-time guest checkout here. Nothing was sent.",
+    toast_body_malformed: "Refusing to pay: this is not the card request of Toast's card form. Nothing was sent."
+});
+function toastRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.toast_body_malformed;
+}
+// src/toast-seal.js
+var TOAST_SCHEME = "rsa-oaep-sha1-json";
+var MESSAGES = /* @__PURE__ */ Object.freeze({
+    unsupported: "Refusing to pay: this is not the card request of Toast's card form. Nothing was sent.",
+    card: "Could not encrypt this card for Toast. Nothing was sent."
+});
+var ToastError = class extends Error {
+    constructor(reason) {
+        const known = reason === "card" ? "card" : "unsupported";
+        super(MESSAGES[known]);
+        this.name = "ToastError";
+        this.code = "toast_refused";
+        this.reason = known;
+    }
+};
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var has = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var digitsOf = (value) => typeof value === "string" || typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? String(value) : null;
+var POSTAL_CODE2 = /^[A-Za-z0-9 -]{0,16}$/;
+function toastCardPlaintext(card, postalCode) {
+    if (!record2(card) || typeof postalCode !== "string" || !POSTAL_CODE2.test(postalCode))
+        throw new ToastError("card");
+    const number = digitsOf(card.number)?.replace(/\s/g, "") ?? "";
+    const month = digitsOf(card.month) ?? "";
+    const year = digitsOf(card.year) ?? "";
+    const cvv = digitsOf(card.cvc) ?? "";
+    if (!/^\d{12,19}$/.test(number) || !/^\d{1,2}$/.test(month) || !/^(?:\d{2}|\d{4})$/.test(year) || !/^\d{3,4}$/.test(cvv)) {
+        throw new ToastError("card");
+    }
+    if (Number(month) < 1 || Number(month) > 12)
+        throw new ToastError("card");
+    return JSON.stringify({ cardNumber: number, zipCode: postalCode, cvv, expMonth: month.padStart(2, "0"), expYear: year.slice(-2) });
+}
+async function encryptToastCard(card, request, facilities = {}) {
+    if (!record2(request) || toastRequestRefusal({ url: request.url, method: "POST", body: request.body }) !== null) {
+        throw new ToastError("unsupported");
+    }
+    const paused = readToastBody(request.body);
+    if (!paused.ok)
+        throw new ToastError("unsupported");
+    const text = new TextEncoder().encode(toastCardPlaintext(card, paused.postalCode));
+    try {
+        const sealed = await rsaOaepEncrypt(TOAST_KEY, text, { hash: "SHA-1", mgf1: "SHA-1" }, facilities.crypto ?? globalThis.crypto);
+        const cardData = encodeBase64(sealed);
+        if (!isToastCiphertext(cardData) || cardData === paused.cardData)
+            throw new ToastError("card");
+        return { cardData };
+    }
+    catch (error) {
+        if (error instanceof ToastError)
+            throw error;
+        throw new ToastError("card");
+    }
+    finally {
+        text.fill(0);
+    }
+}
+function isToastCiphertextUnderKey(value) {
+    if (!isToastCiphertext(value))
+        return false;
+    const bytes = decodeBase64(value);
+    if (!bytes || bytes.length !== TOAST_CIPHERTEXT_BYTES)
+        return false;
+    let c = 0n;
+    for (const byte of bytes)
+        c = c << 8n | BigInt(byte);
+    try {
+        return c > 1n && c < parseMerchantKey(TOAST_KEY).n;
+    }
+    catch {
+        return false;
+    }
+}
+function toastKeyUsable(authorization) {
+    if (!record2(authorization) || !record2(authorization.cse))
+        return false;
+    const cse = authorization.cse;
+    if (authorization.psp !== TOAST_PSP || cse.psp !== TOAST_PSP || cse.scheme !== TOAST_SCHEME)
+        return false;
+    if (cse.public_key != null || cse.client_key != null || has(cse, "merchant_hosted") || has(cse, "verifone"))
+        return false;
+    if (authorization.sandbox !== false || cse.environment !== "live")
+        return false;
+    if (toastRequestRefusal({ url: authorization.url, method: "POST", body: authorization.postData }) !== null)
+        return false;
+    try {
+        return parseMerchantKey(TOAST_KEY).size === TOAST_CIPHERTEXT_BYTES;
+    }
+    catch {
+        return false;
+    }
+}
+function toastSubstitutionsRefusal(template, substitutions) {
+    const refuse2 = (message) => ({ code: "invalid_substitutions", message });
+    if (!record2(template) || toastRequestRefusal({ url: template.url, method: "POST", body: template.body }) !== null) {
+        return refuse2("This authorization is not a Toast card request.");
+    }
+    const keys = record2(substitutions) ? Object.keys(substitutions) : [];
+    if (keys.length !== 1 || keys[0] !== "cardData")
+        return refuse2("substitutions must carry exactly cardData.");
+    if (!isToastCiphertextUnderKey(substitutions.cardData))
+        return refuse2("substitutions.cardData is not a card sealed under the pinned Toast key.");
+    const paused = readToastBody(template.body);
+    if (!paused.ok || substitutions.cardData === paused.cardData) {
+        return refuse2("substitutions.cardData is the paused request's own card, not one the cardholder's device sealed.");
+    }
+    return null;
+}
+function substituteToastCardData(url, body, fields) {
+    const refusal = toastRequestRefusal({ url, method: "POST", body });
+    if (refusal !== null)
+        throw new SubstitutionError(toastRefusalMessage(refusal));
+    const paused = readToastBody(body);
+    if (!paused.ok)
+        throw new SubstitutionError(toastRefusalMessage("toast_body_malformed"));
+    const keys = record2(fields) ? Object.keys(fields) : [];
+    if (keys.length !== 1 || keys[0] !== "cardData")
+        throw new SubstitutionError("the substitution must carry exactly cardData");
+    const sealed = fields.cardData;
+    if (!isToastCiphertextUnderKey(sealed))
+        throw new SubstitutionError("substitution for cardData is not a card sealed under the pinned Toast key");
+    if (sealed === paused.cardData || body.includes(sealed))
+        throw new SubstitutionError("the sealed card in this substitution is already in the body");
+    const parsed = JSON.parse(body);
+    parsed.card.cardData = sealed;
+    const out = JSON.stringify(parsed);
+    const written = readToastBody(out);
+    if (!written.ok || written.cardData !== sealed || written.sessionSecret !== paused.sessionSecret || written.postalCode !== paused.postalCode || out.length !== body.length || out.replace(sealed, paused.cardData) !== body) {
+        throw new SubstitutionError("the substitution did not land at card.cardData");
+    }
+    return out;
+}
+var ANSWER_LIMIT = 65536;
+var METHOD_ID = /^[\x21-\x7e]{1,256}$/;
+function toastAnswerOutcome(status, text) {
+    if (!Number.isInteger(status) || status < 100 || status > 599)
+        return { outcome: "unknown", reason: "toast_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400)
+        return { outcome: "refused", code: `http_${status}` };
+    if (status < 200 || status >= 300 || typeof text !== "string" || text.length > ANSWER_LIMIT)
+        return { outcome: "unknown", reason: "toast_unconfirmed" };
+    let answer;
+    try {
+        answer = JSON.parse(text);
+    }
+    catch {
+        return { outcome: "unknown", reason: "toast_unconfirmed" };
+    }
+    if (!record2(answer) || typeof answer.id !== "string" || !METHOD_ID.test(answer.id) || !record2(answer.card)) {
+        return { outcome: "unknown", reason: "toast_unconfirmed" };
+    }
+    return { outcome: "approved", body: "{}" };
+}
+export { TOAST_SCHEME, ToastError, encryptToastCard, isToastCiphertextUnderKey, substituteToastCardData, toastAnswerOutcome, toastCardPlaintext, toastKeyUsable, toastSubstitutionsRefusal };