@agent-cards/sdk 0.23.20 → 0.23.22

package/dist/paddle-tokenex.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c9116965f8802329701f18adf6519c9111857dfc4329e4f59d7666de150fb5a4
+// artifact-sha256: 4289a22922e08251b579e9aadc396c8cff5d1a95b99ce35dd9a4618b43a33db5
 // src/sha256.js
 var K = /* @__PURE__ */ new Uint32Array([
     1116352408,
@@ -153,6 +153,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin2 = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
@@ -188,9 +191,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function rsaesPkcs1v15Encrypt(key, message, random) {
     const { n, e, size } = parseRsaPublicKey(key);

package/dist/paygent.generated.d.ts

@@ -0,0 +1,60 @@
+declare var PAYGENT_PSP: string;
+declare var PAYGENT_CAPABILITY: string;
+declare var PAYGENT_OPERATION: string;
+declare var PAYGENT_TOKEN_HOSTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare var PAYGENT_TOKEN_PATH: string;
+declare var PAYGENT_CONTENT_TYPE: string;
+declare var PAYGENT_BODY_KEYS: readonly string[];
+declare var PAYGENT_REFUSAL_CODES: readonly string[];
+declare function paygentEnvironment(url: any): "production" | "sandbox" | null;
+declare function isPaygentTokenUrl(url: any): boolean;
+declare function paygentBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function paygentRequestVerdict(url: any, body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function paygentRequestRefusal(request: any): any;
+declare function paygentMerchantId(body: any): string | null;
+declare function paygentBodyMerchant(body: any): {
+    merchantId: string;
+    tokenKey: string;
+} | null;
+declare function paygentPreparationUrl(environment: any): string;
+declare var PAYGENT_MERCHANT_PINS: readonly any[];
+declare function paygentMerchantPin(merchantOrigin: any, merchant: any, pins?: readonly any[]): any;
+declare function paygentMerchantRefusal(environment: any, merchantOrigin: any, merchant: any, facts?: {}, pins?: readonly any[]): "unsupported_environment" | "paygent_merchant_unreviewed" | "paygent_currency_mismatch" | "paygent_merchant_mismatch" | null;
+declare function isPreparedPaygentRequest(url: any, method: any, body: any, environment: any, headers: any, binding?: {}, pins?: readonly any[]): boolean;
+declare function injectPaygentCard(body: any, card: any): {
+    body: string;
+    where: any[];
+};
+declare var PAYGENT_ANSWER_REFUSAL_CODES: readonly string[];
+declare function paygentAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    reason: string | undefined;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    code?: undefined;
+    reason?: undefined;
+};
+declare function paygentRefusalCode(text: any): any;
+declare function paygentRefusalMessage(code: any): any;
+export { PAYGENT_ANSWER_REFUSAL_CODES, PAYGENT_BODY_KEYS, PAYGENT_CAPABILITY, PAYGENT_CONTENT_TYPE, PAYGENT_MERCHANT_PINS, PAYGENT_OPERATION, PAYGENT_PSP, PAYGENT_REFUSAL_CODES, PAYGENT_TOKEN_HOSTS, PAYGENT_TOKEN_PATH, injectPaygentCard, isPaygentTokenUrl, isPreparedPaygentRequest, paygentAnswerOutcome, paygentBodyMerchant, paygentBodyVerdict, paygentEnvironment, paygentMerchantId, paygentMerchantPin, paygentMerchantRefusal, paygentPreparationUrl, paygentRefusalCode, paygentRefusalMessage, paygentRequestRefusal, paygentRequestVerdict };

package/dist/paygent.generated.js

@@ -0,0 +1,425 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 32d9a3f112e2704eacabb2954570a746bef5547c8fd865a4db14b2bd0cd1d936
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_CAPABILITY = "paygent_token";
+var PAYGENT_OPERATION = "paygent.card_request";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_TOKEN_PATH = "/n/token/request";
+var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+var PAYGENT_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "merchant_id",
+    "token_generate_key",
+    "card_number",
+    "card_expire_year",
+    "card_expire_month",
+    "card_cvc",
+    "card_name"
+]);
+var PAYGENT_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "paygent_url_refused",
+    "paygent_headers_refused",
+    "paygent_cvc_only",
+    "paygent_key_environment",
+    "paygent_body_unsupported"
+]);
+var BODY_LIMIT = 2048;
+var URL_LIMIT = 128;
+var MERCHANT_ID = /^[0-9]{5,6}$/;
+var LIVE_KEY = /^live_[A-Za-z0-9]{24}$/;
+var SANDBOX_KEY = /^(?!live_)[a-z]{1,8}_[A-Za-z0-9]{24}$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var YEAR = /^[0-9]{2}$/;
+var MONTH = /^(?:0?[1-9]|1[0-2])$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var HOLDER = /^[A-Za-z][A-Za-z .'-]{0,44}$/;
+var PAGE_HOLDER = /^(?:[A-Za-z][A-Za-z .'-]{0,44})?$/;
+var CONTENT_TYPE = /^text\/plain; ?charset=utf-8$/i;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paygentEnvironment(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.pathname !== PAYGENT_TOKEN_PATH)
+        return null;
+    if (PAYGENT_TOKEN_HOSTS.production.includes(parsed.hostname))
+        return "production";
+    if (PAYGENT_TOKEN_HOSTS.sandbox.includes(parsed.hostname))
+        return "sandbox";
+    return null;
+}
+function isPaygentTokenUrl(url) {
+    return paygentEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a pair");
+            return [chunk.slice(0, eq), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+var CVC_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_id", "token_generate_key", "card_cvc", "cvc_only_flg"]);
+var sameKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function judgeBody(body) {
+    const pairs = readBody(body);
+    if (pairs === null)
+        return { code: "paygent_body_unsupported", pairs: null };
+    if (sameKeys(pairs, CVC_ONLY_KEYS))
+        return { code: "paygent_cvc_only", pairs: null };
+    if (!sameKeys(pairs, PAYGENT_BODY_KEYS))
+        return { code: "paygent_body_unsupported", pairs: null };
+    const value = Object.fromEntries(pairs);
+    if (!MERCHANT_ID.test(value.merchant_id) || !(LIVE_KEY.test(value.token_generate_key) || SANDBOX_KEY.test(value.token_generate_key)) || !NUMBER.test(value.card_number) || !YEAR.test(value.card_expire_year) || !MONTH.test(value.card_expire_month) || !SECURITY_CODE.test(value.card_cvc) || !PAGE_HOLDER.test(value.card_name)) {
+        return { code: "paygent_body_unsupported", pairs: null };
+    }
+    return { code: null, pairs };
+}
+function paygentBodyVerdict(body) {
+    const { code } = judgeBody(body);
+    return code === null ? CARD : refuse(code);
+}
+function paygentRequestVerdict(url, body) {
+    const environment = paygentEnvironment(url);
+    if (environment === null)
+        return refuse("paygent_url_refused");
+    const { code, pairs } = judgeBody(body);
+    if (code !== null)
+        return refuse(code);
+    const key = pairs[1][1];
+    return (environment === "production" ? LIVE_KEY : SANDBOX_KEY).test(key) ? CARD : refuse("paygent_key_environment");
+}
+function paygentRequestRefusal(request) {
+    if (!record(request) || request.method !== "POST" || !isPaygentTokenUrl(request.url))
+        return "paygent_url_refused";
+    const headers = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(record(request.headers) ? request.headers : {})) {
+        const lower = name.toLowerCase();
+        if (headers.has(lower) || typeof value !== "string")
+            return "paygent_headers_refused";
+        headers.set(lower, value);
+    }
+    const contentType = headers.get("content-type");
+    if (contentType === void 0 || !CONTENT_TYPE.test(contentType))
+        return "paygent_headers_refused";
+    const verdict = paygentRequestVerdict(request.url, request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function paygentMerchantId(body) {
+    const { code, pairs } = judgeBody(body);
+    return code === null ? pairs[0][1] : null;
+}
+function paygentBodyMerchant(body) {
+    const { code, pairs } = judgeBody(body);
+    return code === null ? { merchantId: pairs[0][1], tokenKey: pairs[1][1] } : null;
+}
+function paygentPreparationUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_preparation_environment");
+    return `https://${PAYGENT_TOKEN_HOSTS[environment][0]}${PAYGENT_TOKEN_PATH}`;
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var PAYGENT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({
+        id: "fundex_tcs_eng",
+        merchant: "Tokyo Chinese School",
+        merchantId: "60362",
+        keySha256: "6073dee112b1e4089025d1c1f3c4cfad818c314a81943ffa55b839cb2df51018",
+        origins: ["https://fundexapp.jp"],
+        currency: "jpy"
+    })
+]);
+function paygentMerchantPin(merchantOrigin, merchant, pins = PAYGENT_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || typeof merchant !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin) && entry.merchant === merchant) ?? null;
+}
+function paygentMerchantRefusal(environment, merchantOrigin, merchant, facts = {}, pins = PAYGENT_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    const found = paygentMerchantPin(merchantOrigin, merchant, pins);
+    if (!found)
+        return "paygent_merchant_unreviewed";
+    const given = record(facts) ? facts : {};
+    if (given.currency !== void 0 && given.currency !== found.currency)
+        return "paygent_currency_mismatch";
+    if (given.merchantId !== void 0 && given.merchantId !== found.merchantId)
+        return "paygent_merchant_mismatch";
+    if (given.tokenKey !== void 0 && (typeof given.tokenKey !== "string" || typeof found.keySha256 !== "string" || sha256Hex(given.tokenKey) !== found.keySha256))
+        return "paygent_merchant_mismatch";
+    return null;
+}
+function isPreparedPaygentRequest(url, method, body, environment, headers, binding = {}, pins = PAYGENT_MERCHANT_PINS) {
+    if (environment !== "production" && environment !== "sandbox" || paygentEnvironment(url) !== environment || paygentRequestRefusal({ url, method, headers, body }) !== null)
+        return false;
+    const given = record(binding) ? binding : {};
+    const facts = paygentBodyMerchant(body);
+    return facts !== null && paygentMerchantRefusal(environment, given.merchantOrigin, given.merchant, facts, pins) === null;
+}
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var whole = (value, min, max) => {
+    if (Number.isSafeInteger(value) && value >= 0)
+        return value;
+    return digits(value, min, max) ? Number(value) : NaN;
+};
+var cardYear = (year) => year >= 0 && year <= 99 || year >= 2e3 && year <= 2099;
+var AMEX = /^3[47]/;
+var FILL_REFUSAL = "Could not fill the card fields for Paygent. Nothing was sent.";
+function injectPaygentCard(body, card) {
+    const { code, pairs } = judgeBody(body);
+    if (code !== null)
+        throw new Error(paygentRefusalMessage(code));
+    const month = card ? whole(card.month, 1, 2) : NaN;
+    const year = card ? whole(card.year, 2, 4) : NaN;
+    if (!card || !digits(card.number, 12, 19) || !(month >= 1 && month <= 12) || !cardYear(year) || !digits(card.cvc, AMEX.test(card.number) ? 4 : 3, AMEX.test(card.number) ? 4 : 3)) {
+        throw new Error(FILL_REFUSAL);
+    }
+    const written = {
+        card_number: card.number,
+        card_expire_year: String(year % 100).padStart(2, "0"),
+        card_expire_month: String(month).padStart(2, "0"),
+        card_cvc: card.cvc
+    };
+    if (pairs[6][1] !== "" && typeof card.name === "string" && HOLDER.test(card.name))
+        written.card_name = card.name;
+    const where = [];
+    const filled = pairs.map(([key, value]) => {
+        if (!Object.prototype.hasOwnProperty.call(written, key))
+            return `${key}=${encodeURIComponent(value)}`;
+        where.push(key);
+        return `${key}=${encodeURIComponent(written[key])}`;
+    });
+    return { body: filled.join("&"), where };
+}
+var PAYGENT_ANSWER_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "1100",
+    "1200",
+    "1300",
+    "1301",
+    "1400",
+    "1401",
+    "1500",
+    "1501",
+    "1502",
+    "1600",
+    "1601",
+    "1700"
+]);
+var ANSWER_LIMIT = 4096;
+var TOKEN = /^[A-Za-z0-9+/=_.-]{8,256}$/;
+var MASKED = /^(?=.{12,19}$)[0-9]{0,6}[*Xx]{2,}[0-9]{4}$/;
+var VALID_UNTIL = /^[0-9][0-9 :/.T-]{7,31}$/;
+var FINGERPRINT = /^[A-Za-z0-9+/=_.-]{1,256}$/;
+var TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["token", "masked_card_number", "valid_until", "fingerprint"]);
+var HC = /^[A-Za-z0-9+/=_.-]{1,256}$/;
+function readAnswer(status, text) {
+    if (status !== 200)
+        return { kind: "unknown", reason: status >= 500 ? "server_error" : "paygent_answer_status" };
+    if (typeof text !== "string" || text.length > ANSWER_LIMIT)
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    let answer;
+    try {
+        answer = JSON.parse(text);
+    }
+    catch {
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    }
+    if (!record(answer) || typeof answer.result !== "string")
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    if (answer.result !== "0000") {
+        return PAYGENT_ANSWER_REFUSAL_CODES.includes(answer.result) ? { kind: "refused", code: answer.result } : { kind: "unknown", reason: "paygent_answer_unknown_result" };
+    }
+    const card = answer.tokenizedCardObject;
+    if (!record(card) || typeof card.token !== "string" || !TOKEN.test(card.token) || typeof card.masked_card_number !== "string" || !MASKED.test(card.masked_card_number) || typeof card.valid_until !== "string" || !VALID_UNTIL.test(card.valid_until) || card.fingerprint !== void 0 && (typeof card.fingerprint !== "string" || !FINGERPRINT.test(card.fingerprint))) {
+        return { kind: "unknown", reason: "paygent_token_unconfirmed" };
+    }
+    if (answer.hc !== void 0 && (typeof answer.hc !== "string" || !HC.test(answer.hc))) {
+        return { kind: "unknown", reason: "paygent_token_unconfirmed" };
+    }
+    return { kind: "token", answer: card, hc: answer.hc };
+}
+var rebuild = (card, hc) => JSON.stringify({ result: "0000", tokenizedCardObject: Object.fromEntries(TOKEN_KEYS.filter((key) => card[key] !== void 0).map((key) => [key, card[key]])), ...hc !== void 0 ? { hc } : {} });
+function paygentAnswerOutcome(status, text, card) {
+    const read = readAnswer(status, text);
+    if (read.kind === "refused")
+        return { outcome: "refused", code: read.code };
+    if (read.kind !== "token")
+        return { outcome: "unknown", reason: read.reason };
+    if (card) {
+        const number = String(card.number);
+        const masked = read.answer.masked_card_number;
+        const inPlace = masked.length === number.length && [...masked].every((ch, at) => !/[0-9]/.test(ch) || ch === number[at]);
+        if (!inPlace || [...TOKEN_KEYS.map((key) => read.answer[key]), read.hc].some((value) => typeof value === "string" && value.includes(number))) {
+            return { outcome: "unknown", reason: "paygent_token_mismatch" };
+        }
+    }
+    return { outcome: "approved", body: rebuild(read.answer, read.hc) };
+}
+function paygentRefusalCode(text) {
+    const read = readAnswer(200, text);
+    return read.kind === "refused" ? read.code : null;
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    paygent_url_refused: "Refusing to pay: this Paygent card request does not go to Paygent's token address exactly as Paygent's script sends it. Nothing was sent.",
+    paygent_headers_refused: "Refusing to pay: this Paygent card request does not carry Paygent's own content type. Nothing was sent.",
+    paygent_cvc_only: "Refusing to pay: this Paygent request is for a card the merchant keeps on file, not a card from your Vault. Nothing was sent.",
+    paygent_key_environment: "Refusing to pay: this Paygent card request uses a test key on Paygent's live address, or a live key on its test address. Nothing was sent.",
+    paygent_body_unsupported: "Refusing to pay: this is not the card request of Paygent's token script. Nothing was sent."
+});
+function paygentRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.paygent_body_unsupported;
+}
+export { PAYGENT_ANSWER_REFUSAL_CODES, PAYGENT_BODY_KEYS, PAYGENT_CAPABILITY, PAYGENT_CONTENT_TYPE, PAYGENT_MERCHANT_PINS, PAYGENT_OPERATION, PAYGENT_PSP, PAYGENT_REFUSAL_CODES, PAYGENT_TOKEN_HOSTS, PAYGENT_TOKEN_PATH, injectPaygentCard, isPaygentTokenUrl, isPreparedPaygentRequest, paygentAnswerOutcome, paygentBodyMerchant, paygentBodyVerdict, paygentEnvironment, paygentMerchantId, paygentMerchantPin, paygentMerchantRefusal, paygentPreparationUrl, paygentRefusalCode, paygentRefusalMessage, paygentRequestRefusal, paygentRequestVerdict };

package/dist/payrails.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 38065a5bd834d5233979a0528fde4345378914e8e8b1a63e329bff0994572da5
+// artifact-sha256: 056fa54de953be9af775505906b2fba30def2787a217a12fe2ca2a50b8614649
 // src/json-path.js
 function roundTrips(parsed, body) {
     try {
@@ -160,6 +160,9 @@ var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStrin
 function parseRsaPublicKey(key) {
     const spki = key && typeof key === "object" ? key.spki : void 0;
     const pin = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
     if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
         throw refuse("key");
     if (typeof pin !== "string" || !SHA256_HEX.test(pin))
@@ -195,9 +198,10 @@ function parseRsaPublicKey(key) {
     if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
         throw refuse("key");
     const e = exponent.bytes;
-    if (e.length !== 3 || e[0] !== 1 || e[1] !== 0 || e[2] !== 1)
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
         throw refuse("key");
-    return Object.freeze({ n: toBigInt(n), e: 65537n, size: n.length });
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
 }
 function readElement(der, at, tag) {
     if (at + 2 > der.length || der[at] !== tag)

package/dist/payrexx.d.ts

@@ -0,0 +1,91 @@
+export declare const PAYREXX_PSP: "payrexx";
+/** The capability a build declares to be served Payrexx's recognizer (payment-core PAYREXX_CAPABILITY). */
+export declare const PAYREXX_CAPABILITY: "payrexx_card_frame";
+/** The reason a checkout reads when a 3-D Secure send of the placeholder card fails in the browser. */
+export declare const PAYREXX_RESEND_REASON: "unsupported_payrexx_card_resend";
+/** The 3-D Secure sends one approval covers, in the page's order (payment-core PAYREXX_FOLLOW_UP_KINDS). */
+export type PayrexxFollowUpKind = 'authentication' | 'post_authentication';
+/**
+ * Whether a request is a POST to Payrexx's card frame URL whose body sends the card again for a 3-D Secure step
+ * (payment-core payrexxBodyVerdict: payrexx_three_ds_resend). `readBody` is called only for a POST to the frame URL,
+ * and a reader that throws, or a body nobody could read, reads as no 3-D Secure send.
+ */
+export declare function isPayrexxResend(url: string, method: string, readBody: () => string | null): boolean;
+/**
+ * A 3-D Secure send the cardholder's device did not answer with Payrexx's own answer. `reason` is the API's word for
+ * it: `not_picked_up` (no device started it in time: the Vault page was closed or asleep), `not_sent` (the device
+ * refused it before the card left), `no_answer`, `answer_withheld` (Payrexx's answer carried the card),
+ * `answer_refused`, `answer_late`, `response_expired`, or the API's refusal code when it did not take the send at all
+ * (`follow_up_refused`, `follow_up_not_covered`, `follow_up_window_closed`). `cardSent` says whether the card may
+ * have reached Payrexx: false only when the API confirmed it never left the device. Nothing in it names the request,
+ * the card or Payrexx's answer.
+ */
+export declare class PayrexxFollowUpError extends Error {
+    readonly reason: string;
+    readonly cardSent: boolean;
+    readonly authorizationId: string;
+    constructor(reason: string, cardSent: boolean, authorizationId: string);
+}
+/** A send this attachment claimed: the approval it goes under, its kind, the request to send, and how it ended. */
+export interface PayrexxFollowUpClaim {
+    readonly authorizationId: string;
+    readonly kind: PayrexxFollowUpKind;
+    readonly until: number;
+    readonly request: {
+        url: string;
+        method: 'POST';
+        headers: Record<string, string>;
+        body: string;
+    };
+    /** Record the answer the page received, or null when the send failed. */
+    settle(answer: {
+        status: number;
+        text: string;
+    } | null): void;
+}
+/**
+ * What one attachment keeps of its approved Payrexx card request: the request and Payrexx's answer as the page received
+ * them, until when the API said the approval covers sends after it, and the sends it claimed since, in order. Only a
+ * card request whose answer started 3-D Secure (payment-core payrexxAnswerOutcome: pending three_ds) and whose read
+ * named that window (`followUpsUntil`) is kept. Any later Payrexx card request handed over replaces it, a send the
+ * window has passed is never claimed, and once a send is refused or fails the attachment stops (stop()): nothing after
+ * it is claimed, a later approval included.
+ */
+export declare class PayrexxFollowUps {
+    private parent;
+    private sent;
+    private stopped;
+    /** After a refused or failed send: no later request on this attachment is claimed. */
+    stop(): void;
+    /**
+     * The approval the remembered card request went under, or null when none is remembered. The gate sends nothing
+     * unless the checkout's own state names this same approval.
+     */
+    get authorizationId(): string | null;
+    /**
+     * As the adapter hands an approved card request's answer to the page: before the answer lands, since the page may
+     * start 3-D Secure at once. Every Payrexx card request handed over clears what an earlier one left; only one whose
+     * answer started 3-D Secure, under a read that named the window, is kept.
+     */
+    remember(request: {
+        url: string;
+        body: string;
+    }, replay: {
+        mode?: string;
+        authorizationId: string;
+        status: number;
+        body: string;
+        followUpsUntil?: string;
+    }): void;
+    /**
+     * The claim for a paused 3-D Secure send the remembered approval covers, or null: no approval covers sends here, its
+     * window has passed, or payment-core's rule refuses the send against the sends already claimed. Synchronous, and it
+     * reserves the send, so two requests can never both be claimed as the next one.
+     */
+    claim(request: {
+        url: string;
+        method: string;
+        headers: Record<string, string>;
+        body: string | null;
+    }, now?: number): PayrexxFollowUpClaim | null;
+}