@agent-cards/sdk 0.23.21 → 0.23.22

package/dist/lifecycle.d.ts

@@ -159,6 +159,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private stripeContinuationChecks;
     /** The handoff in progress is WSPay's 3-D Secure step; see handedOff. */
     private wspayChallenge;
+    private heldBeforeHandoff;
     private stripeContinuedReason;
     private approvedPaymentMethod;
     private ownedShopOrderId;
@@ -191,7 +192,8 @@ export declare class CheckoutLifecycle implements CheckoutController {
     preparationFailed(error: CheckoutPreparationError): void;
     isBlocked(): boolean;
     /**
-     * An EBANX send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp). Until
+     * An EBANX or Payrexx send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp,
+     * payrexxFollowUp). Until
      * the returned function runs, once the send's answer reached the page or the send failed, reconcile() and
      * retryAfterMerchantFailure() throw, as they do while a card request is active: a confirm may still pay. The returned
      * function settles the send once, however often it runs.
@@ -200,7 +202,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     /** Whether a reconcile() is still waiting on the application's merchant resolver; pre-claim.ts claims no EBANX send then. */
     isReconciling(): boolean;
     /**
-     * Whether an EBANX send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
+     * Whether an EBANX or Payrexx send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
      * request meanwhile, as they do while an approval is outstanding: a confirm that may pay is never hidden behind
      * another payment's state.
      */
@@ -284,10 +286,13 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * paddle-vgs-pay.ts reasons), or the typed card that EBANX's 3-D Secure calls or
      * its hosted page's confirm send again after the token, when no approved token
      * request on this attachment covers that send or the cardholder's device did not
-     * send it (unsupported_ebanx_card_resend, ebanx.ts): once an approval exists the
+     * send it (unsupported_ebanx_card_resend, ebanx.ts), or the typed card Payrexx's card
+     * frame sends again for a 3-D Secure step when no approved card request on this
+     * attachment covers that send or the cardholder's device did not send it
+     * (unsupported_payrexx_card_resend, payrexx.ts): once an approval exists the
      * state keeps it, and only the hold changes.
      */
-    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | PaypalCardFormReason | 'unsupported_cybersource_secure_acceptance' | PaddleVgsPayRefusal | 'unsupported_ebanx_card_resend'): void;
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported' | GmoUnsupportedReason | 'microform_unsupported' | 'juspay_request_unsupported' | 'merchant_card_endpoint_not_enabled' | 'merchant_card_endpoint_resend_refused' | 'creditguard_three_d_secure' | 'unsupported_primer_sdk' | 'unsupported_primer_request' | PayrailsUnsupportedReason | ShijiStsUnsupportedReason | 'processor_card_page' | 'unsupported_paypal_hosted_fields' | PaypalCardFormReason | 'unsupported_cybersource_secure_acceptance' | PaddleVgsPayRefusal | 'unsupported_ebanx_card_resend' | 'unsupported_payrexx_card_resend'): void;
     /**
      * A card request that only a prepared checkout pays (an Adyen merchant
      * profile's, or a Fiserv card capture) arrived with no preparation on this

package/dist/lifecycle.js

@@ -57,6 +57,9 @@ export class CheckoutLifecycle {
     stripeContinuationChecks = 0;
     /** The handoff in progress is WSPay's 3-D Secure step; see handedOff. */
     wspayChallenge = false;
+    // Whether the attachment held when the handoff in progress began (prepareHandoff): a hold raised after that, while
+    // the answer was still landing, survives handedOff.
+    heldBeforeHandoff = false;
     // What the continuation that went through confirmed: a payment, or a card save.
     stripeContinuedReason = 'stripe_payment_continued';
     // The payment method a Stripe /v1/payment_methods approval returned: see approvedStripePaymentMethod.
@@ -120,7 +123,8 @@ export class CheckoutLifecycle {
     }
     isBlocked() { return this.held || this.cancelled; }
     /**
-     * An EBANX send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp). Until
+     * An EBANX or Payrexx send left for the cardholder's device under this attachment's approval (pre-claim.ts ebanxFollowUp,
+     * payrexxFollowUp). Until
      * the returned function runs, once the send's answer reached the page or the send failed, reconcile() and
      * retryAfterMerchantFailure() throw, as they do while a card request is active: a confirm may still pay. The returned
      * function settles the send once, however often it runs.
@@ -136,7 +140,7 @@ export class CheckoutLifecycle {
     /** Whether a reconcile() is still waiting on the application's merchant resolver; pre-claim.ts claims no EBANX send then. */
     isReconciling() { return this.reconciliation !== null; }
     /**
-     * Whether an EBANX send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
+     * Whether an EBANX or Payrexx send this attachment claimed is still out (followUpStarted). Both adapters refuse a new card
      * request meanwhile, as they do while an approval is outstanding: a confirm that may pay is never hidden behind
      * another payment's state.
      */
@@ -283,7 +287,10 @@ export class CheckoutLifecycle {
      * paddle-vgs-pay.ts reasons), or the typed card that EBANX's 3-D Secure calls or
      * its hosted page's confirm send again after the token, when no approved token
      * request on this attachment covers that send or the cardholder's device did not
-     * send it (unsupported_ebanx_card_resend, ebanx.ts): once an approval exists the
+     * send it (unsupported_ebanx_card_resend, ebanx.ts), or the typed card Payrexx's card
+     * frame sends again for a 3-D Secure step when no approved card request on this
+     * attachment covers that send or the cardholder's device did not send it
+     * (unsupported_payrexx_card_resend, payrexx.ts): once an approval exists the
      * state keeps it, and only the hold changes.
      */
     unsupported(reason = 'unrecognized_payment_endpoint') {
@@ -305,6 +312,7 @@ export class CheckoutLifecycle {
         this.set({ ...this.state, status: 'failed', reason: 'preparation_required' });
     }
     prepareHandoff(replay, requestUrl) {
+        this.heldBeforeHandoff = this.held;
         this.wspayChallenge = isWspayChallenge(requestUrl, replay);
         this.handoffs.push(requestUrl);
         if (replay.mode === 'token' && replay.executionMode === 'autopilot' && replay.shopOrderId) {
@@ -422,10 +430,14 @@ export class CheckoutLifecycle {
             return;
         }
         const mismatch = (!replay.mode || replay.mode === 'token') && replay.amountVerified === false;
+        // A hold raised while the answer was still landing stands: the page may send its first follow-up the moment the
+        // answer lands, and an EBANX or Payrexx send that fails then stops the approval's follow-ups for good
+        // (pre-claim.ts), so a new card request must not reopen the checkout under an approval that cannot finish.
+        const heldDuringHandoff = this.held && !this.heldBeforeHandoff;
         // A card endpoint answer means the merchant already holds the card: its page's own
         // retry, or a step-up that sends the card again, is refused until the application
         // reconciles the order, exactly as for a hosted form the device submitted.
-        this.held = !!this.options.requireMerchantResult || replay.mode === 'hosted_form' || replay.mode === 'card_endpoint' || mismatch || this.unboundStripeToken;
+        this.held = heldDuringHandoff || !!this.options.requireMerchantResult || replay.mode === 'hosted_form' || replay.mode === 'card_endpoint' || mismatch || this.unboundStripeToken;
         if (mismatch)
             this.stripeTokenPrepared = false;
         this.set({ status: 'awaiting_merchant', authorizationId: replay.authorizationId, mode: replay.mode ?? 'token',

package/dist/paygent.generated.d.ts

@@ -0,0 +1,60 @@
+declare var PAYGENT_PSP: string;
+declare var PAYGENT_CAPABILITY: string;
+declare var PAYGENT_OPERATION: string;
+declare var PAYGENT_TOKEN_HOSTS: Readonly<{
+    production: readonly string[];
+    sandbox: readonly string[];
+}>;
+declare var PAYGENT_TOKEN_PATH: string;
+declare var PAYGENT_CONTENT_TYPE: string;
+declare var PAYGENT_BODY_KEYS: readonly string[];
+declare var PAYGENT_REFUSAL_CODES: readonly string[];
+declare function paygentEnvironment(url: any): "production" | "sandbox" | null;
+declare function isPaygentTokenUrl(url: any): boolean;
+declare function paygentBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function paygentRequestVerdict(url: any, body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function paygentRequestRefusal(request: any): any;
+declare function paygentMerchantId(body: any): string | null;
+declare function paygentBodyMerchant(body: any): {
+    merchantId: string;
+    tokenKey: string;
+} | null;
+declare function paygentPreparationUrl(environment: any): string;
+declare var PAYGENT_MERCHANT_PINS: readonly any[];
+declare function paygentMerchantPin(merchantOrigin: any, merchant: any, pins?: readonly any[]): any;
+declare function paygentMerchantRefusal(environment: any, merchantOrigin: any, merchant: any, facts?: {}, pins?: readonly any[]): "unsupported_environment" | "paygent_merchant_unreviewed" | "paygent_currency_mismatch" | "paygent_merchant_mismatch" | null;
+declare function isPreparedPaygentRequest(url: any, method: any, body: any, environment: any, headers: any, binding?: {}, pins?: readonly any[]): boolean;
+declare function injectPaygentCard(body: any, card: any): {
+    body: string;
+    where: any[];
+};
+declare var PAYGENT_ANSWER_REFUSAL_CODES: readonly string[];
+declare function paygentAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    reason: string | undefined;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    code?: undefined;
+    reason?: undefined;
+};
+declare function paygentRefusalCode(text: any): any;
+declare function paygentRefusalMessage(code: any): any;
+export { PAYGENT_ANSWER_REFUSAL_CODES, PAYGENT_BODY_KEYS, PAYGENT_CAPABILITY, PAYGENT_CONTENT_TYPE, PAYGENT_MERCHANT_PINS, PAYGENT_OPERATION, PAYGENT_PSP, PAYGENT_REFUSAL_CODES, PAYGENT_TOKEN_HOSTS, PAYGENT_TOKEN_PATH, injectPaygentCard, isPaygentTokenUrl, isPreparedPaygentRequest, paygentAnswerOutcome, paygentBodyMerchant, paygentBodyVerdict, paygentEnvironment, paygentMerchantId, paygentMerchantPin, paygentMerchantRefusal, paygentPreparationUrl, paygentRefusalCode, paygentRefusalMessage, paygentRequestRefusal, paygentRequestVerdict };

package/dist/paygent.generated.js

@@ -0,0 +1,425 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 32d9a3f112e2704eacabb2954570a746bef5547c8fd865a4db14b2bd0cd1d936
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/paygent.js
+var PAYGENT_PSP = "paygent";
+var PAYGENT_CAPABILITY = "paygent_token";
+var PAYGENT_OPERATION = "paygent.card_request";
+var PAYGENT_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: Object.freeze(["token.paygent.co.jp"]),
+    sandbox: Object.freeze(["sandbox.paygent.co.jp"])
+});
+var PAYGENT_TOKEN_PATH = "/n/token/request";
+var PAYGENT_CONTENT_TYPE = "text/plain;charset=UTF-8";
+var PAYGENT_BODY_KEYS = /* @__PURE__ */ Object.freeze([
+    "merchant_id",
+    "token_generate_key",
+    "card_number",
+    "card_expire_year",
+    "card_expire_month",
+    "card_cvc",
+    "card_name"
+]);
+var PAYGENT_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "paygent_url_refused",
+    "paygent_headers_refused",
+    "paygent_cvc_only",
+    "paygent_key_environment",
+    "paygent_body_unsupported"
+]);
+var BODY_LIMIT = 2048;
+var URL_LIMIT = 128;
+var MERCHANT_ID = /^[0-9]{5,6}$/;
+var LIVE_KEY = /^live_[A-Za-z0-9]{24}$/;
+var SANDBOX_KEY = /^(?!live_)[a-z]{1,8}_[A-Za-z0-9]{24}$/;
+var NUMBER = /^[0-9]{12,19}$/;
+var YEAR = /^[0-9]{2}$/;
+var MONTH = /^(?:0?[1-9]|1[0-2])$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var HOLDER = /^[A-Za-z][A-Za-z .'-]{0,44}$/;
+var PAGE_HOLDER = /^(?:[A-Za-z][A-Za-z .'-]{0,44})?$/;
+var CONTENT_TYPE = /^text\/plain; ?charset=utf-8$/i;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function paygentEnvironment(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.pathname !== PAYGENT_TOKEN_PATH)
+        return null;
+    if (PAYGENT_TOKEN_HOSTS.production.includes(parsed.hostname))
+        return "production";
+    if (PAYGENT_TOKEN_HOSTS.sandbox.includes(parsed.hostname))
+        return "sandbox";
+    return null;
+}
+function isPaygentTokenUrl(url) {
+    return paygentEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    try {
+        const pairs = body.split("&").map((chunk) => {
+            const eq = chunk.indexOf("=");
+            if (eq <= 0)
+                throw new URIError("not a pair");
+            return [chunk.slice(0, eq), decodeURIComponent(chunk.slice(eq + 1))];
+        });
+        return pairs.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&") === body ? pairs : null;
+    }
+    catch {
+        return null;
+    }
+}
+var CVC_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["merchant_id", "token_generate_key", "card_cvc", "cvc_only_flg"]);
+var sameKeys = (pairs, keys) => pairs.length === keys.length && pairs.every(([key], at) => key === keys[at]);
+function judgeBody(body) {
+    const pairs = readBody(body);
+    if (pairs === null)
+        return { code: "paygent_body_unsupported", pairs: null };
+    if (sameKeys(pairs, CVC_ONLY_KEYS))
+        return { code: "paygent_cvc_only", pairs: null };
+    if (!sameKeys(pairs, PAYGENT_BODY_KEYS))
+        return { code: "paygent_body_unsupported", pairs: null };
+    const value = Object.fromEntries(pairs);
+    if (!MERCHANT_ID.test(value.merchant_id) || !(LIVE_KEY.test(value.token_generate_key) || SANDBOX_KEY.test(value.token_generate_key)) || !NUMBER.test(value.card_number) || !YEAR.test(value.card_expire_year) || !MONTH.test(value.card_expire_month) || !SECURITY_CODE.test(value.card_cvc) || !PAGE_HOLDER.test(value.card_name)) {
+        return { code: "paygent_body_unsupported", pairs: null };
+    }
+    return { code: null, pairs };
+}
+function paygentBodyVerdict(body) {
+    const { code } = judgeBody(body);
+    return code === null ? CARD : refuse(code);
+}
+function paygentRequestVerdict(url, body) {
+    const environment = paygentEnvironment(url);
+    if (environment === null)
+        return refuse("paygent_url_refused");
+    const { code, pairs } = judgeBody(body);
+    if (code !== null)
+        return refuse(code);
+    const key = pairs[1][1];
+    return (environment === "production" ? LIVE_KEY : SANDBOX_KEY).test(key) ? CARD : refuse("paygent_key_environment");
+}
+function paygentRequestRefusal(request) {
+    if (!record(request) || request.method !== "POST" || !isPaygentTokenUrl(request.url))
+        return "paygent_url_refused";
+    const headers = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(record(request.headers) ? request.headers : {})) {
+        const lower = name.toLowerCase();
+        if (headers.has(lower) || typeof value !== "string")
+            return "paygent_headers_refused";
+        headers.set(lower, value);
+    }
+    const contentType = headers.get("content-type");
+    if (contentType === void 0 || !CONTENT_TYPE.test(contentType))
+        return "paygent_headers_refused";
+    const verdict = paygentRequestVerdict(request.url, request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function paygentMerchantId(body) {
+    const { code, pairs } = judgeBody(body);
+    return code === null ? pairs[0][1] : null;
+}
+function paygentBodyMerchant(body) {
+    const { code, pairs } = judgeBody(body);
+    return code === null ? { merchantId: pairs[0][1], tokenKey: pairs[1][1] } : null;
+}
+function paygentPreparationUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_preparation_environment");
+    return `https://${PAYGENT_TOKEN_HOSTS[environment][0]}${PAYGENT_TOKEN_PATH}`;
+}
+var pin = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fields.origins]) });
+var PAYGENT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({
+        id: "fundex_tcs_eng",
+        merchant: "Tokyo Chinese School",
+        merchantId: "60362",
+        keySha256: "6073dee112b1e4089025d1c1f3c4cfad818c314a81943ffa55b839cb2df51018",
+        origins: ["https://fundexapp.jp"],
+        currency: "jpy"
+    })
+]);
+function paygentMerchantPin(merchantOrigin, merchant, pins = PAYGENT_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || typeof merchant !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && entry.origins.includes(merchantOrigin) && entry.merchant === merchant) ?? null;
+}
+function paygentMerchantRefusal(environment, merchantOrigin, merchant, facts = {}, pins = PAYGENT_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    const found = paygentMerchantPin(merchantOrigin, merchant, pins);
+    if (!found)
+        return "paygent_merchant_unreviewed";
+    const given = record(facts) ? facts : {};
+    if (given.currency !== void 0 && given.currency !== found.currency)
+        return "paygent_currency_mismatch";
+    if (given.merchantId !== void 0 && given.merchantId !== found.merchantId)
+        return "paygent_merchant_mismatch";
+    if (given.tokenKey !== void 0 && (typeof given.tokenKey !== "string" || typeof found.keySha256 !== "string" || sha256Hex(given.tokenKey) !== found.keySha256))
+        return "paygent_merchant_mismatch";
+    return null;
+}
+function isPreparedPaygentRequest(url, method, body, environment, headers, binding = {}, pins = PAYGENT_MERCHANT_PINS) {
+    if (environment !== "production" && environment !== "sandbox" || paygentEnvironment(url) !== environment || paygentRequestRefusal({ url, method, headers, body }) !== null)
+        return false;
+    const given = record(binding) ? binding : {};
+    const facts = paygentBodyMerchant(body);
+    return facts !== null && paygentMerchantRefusal(environment, given.merchantOrigin, given.merchant, facts, pins) === null;
+}
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var whole = (value, min, max) => {
+    if (Number.isSafeInteger(value) && value >= 0)
+        return value;
+    return digits(value, min, max) ? Number(value) : NaN;
+};
+var cardYear = (year) => year >= 0 && year <= 99 || year >= 2e3 && year <= 2099;
+var AMEX = /^3[47]/;
+var FILL_REFUSAL = "Could not fill the card fields for Paygent. Nothing was sent.";
+function injectPaygentCard(body, card) {
+    const { code, pairs } = judgeBody(body);
+    if (code !== null)
+        throw new Error(paygentRefusalMessage(code));
+    const month = card ? whole(card.month, 1, 2) : NaN;
+    const year = card ? whole(card.year, 2, 4) : NaN;
+    if (!card || !digits(card.number, 12, 19) || !(month >= 1 && month <= 12) || !cardYear(year) || !digits(card.cvc, AMEX.test(card.number) ? 4 : 3, AMEX.test(card.number) ? 4 : 3)) {
+        throw new Error(FILL_REFUSAL);
+    }
+    const written = {
+        card_number: card.number,
+        card_expire_year: String(year % 100).padStart(2, "0"),
+        card_expire_month: String(month).padStart(2, "0"),
+        card_cvc: card.cvc
+    };
+    if (pairs[6][1] !== "" && typeof card.name === "string" && HOLDER.test(card.name))
+        written.card_name = card.name;
+    const where = [];
+    const filled = pairs.map(([key, value]) => {
+        if (!Object.prototype.hasOwnProperty.call(written, key))
+            return `${key}=${encodeURIComponent(value)}`;
+        where.push(key);
+        return `${key}=${encodeURIComponent(written[key])}`;
+    });
+    return { body: filled.join("&"), where };
+}
+var PAYGENT_ANSWER_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "1100",
+    "1200",
+    "1300",
+    "1301",
+    "1400",
+    "1401",
+    "1500",
+    "1501",
+    "1502",
+    "1600",
+    "1601",
+    "1700"
+]);
+var ANSWER_LIMIT = 4096;
+var TOKEN = /^[A-Za-z0-9+/=_.-]{8,256}$/;
+var MASKED = /^(?=.{12,19}$)[0-9]{0,6}[*Xx]{2,}[0-9]{4}$/;
+var VALID_UNTIL = /^[0-9][0-9 :/.T-]{7,31}$/;
+var FINGERPRINT = /^[A-Za-z0-9+/=_.-]{1,256}$/;
+var TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["token", "masked_card_number", "valid_until", "fingerprint"]);
+var HC = /^[A-Za-z0-9+/=_.-]{1,256}$/;
+function readAnswer(status, text) {
+    if (status !== 200)
+        return { kind: "unknown", reason: status >= 500 ? "server_error" : "paygent_answer_status" };
+    if (typeof text !== "string" || text.length > ANSWER_LIMIT)
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    let answer;
+    try {
+        answer = JSON.parse(text);
+    }
+    catch {
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    }
+    if (!record(answer) || typeof answer.result !== "string")
+        return { kind: "unknown", reason: "paygent_answer_unreadable" };
+    if (answer.result !== "0000") {
+        return PAYGENT_ANSWER_REFUSAL_CODES.includes(answer.result) ? { kind: "refused", code: answer.result } : { kind: "unknown", reason: "paygent_answer_unknown_result" };
+    }
+    const card = answer.tokenizedCardObject;
+    if (!record(card) || typeof card.token !== "string" || !TOKEN.test(card.token) || typeof card.masked_card_number !== "string" || !MASKED.test(card.masked_card_number) || typeof card.valid_until !== "string" || !VALID_UNTIL.test(card.valid_until) || card.fingerprint !== void 0 && (typeof card.fingerprint !== "string" || !FINGERPRINT.test(card.fingerprint))) {
+        return { kind: "unknown", reason: "paygent_token_unconfirmed" };
+    }
+    if (answer.hc !== void 0 && (typeof answer.hc !== "string" || !HC.test(answer.hc))) {
+        return { kind: "unknown", reason: "paygent_token_unconfirmed" };
+    }
+    return { kind: "token", answer: card, hc: answer.hc };
+}
+var rebuild = (card, hc) => JSON.stringify({ result: "0000", tokenizedCardObject: Object.fromEntries(TOKEN_KEYS.filter((key) => card[key] !== void 0).map((key) => [key, card[key]])), ...hc !== void 0 ? { hc } : {} });
+function paygentAnswerOutcome(status, text, card) {
+    const read = readAnswer(status, text);
+    if (read.kind === "refused")
+        return { outcome: "refused", code: read.code };
+    if (read.kind !== "token")
+        return { outcome: "unknown", reason: read.reason };
+    if (card) {
+        const number = String(card.number);
+        const masked = read.answer.masked_card_number;
+        const inPlace = masked.length === number.length && [...masked].every((ch, at) => !/[0-9]/.test(ch) || ch === number[at]);
+        if (!inPlace || [...TOKEN_KEYS.map((key) => read.answer[key]), read.hc].some((value) => typeof value === "string" && value.includes(number))) {
+            return { outcome: "unknown", reason: "paygent_token_mismatch" };
+        }
+    }
+    return { outcome: "approved", body: rebuild(read.answer, read.hc) };
+}
+function paygentRefusalCode(text) {
+    const read = readAnswer(200, text);
+    return read.kind === "refused" ? read.code : null;
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    paygent_url_refused: "Refusing to pay: this Paygent card request does not go to Paygent's token address exactly as Paygent's script sends it. Nothing was sent.",
+    paygent_headers_refused: "Refusing to pay: this Paygent card request does not carry Paygent's own content type. Nothing was sent.",
+    paygent_cvc_only: "Refusing to pay: this Paygent request is for a card the merchant keeps on file, not a card from your Vault. Nothing was sent.",
+    paygent_key_environment: "Refusing to pay: this Paygent card request uses a test key on Paygent's live address, or a live key on its test address. Nothing was sent.",
+    paygent_body_unsupported: "Refusing to pay: this is not the card request of Paygent's token script. Nothing was sent."
+});
+function paygentRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.paygent_body_unsupported;
+}
+export { PAYGENT_ANSWER_REFUSAL_CODES, PAYGENT_BODY_KEYS, PAYGENT_CAPABILITY, PAYGENT_CONTENT_TYPE, PAYGENT_MERCHANT_PINS, PAYGENT_OPERATION, PAYGENT_PSP, PAYGENT_REFUSAL_CODES, PAYGENT_TOKEN_HOSTS, PAYGENT_TOKEN_PATH, injectPaygentCard, isPaygentTokenUrl, isPreparedPaygentRequest, paygentAnswerOutcome, paygentBodyMerchant, paygentBodyVerdict, paygentEnvironment, paygentMerchantId, paygentMerchantPin, paygentMerchantRefusal, paygentPreparationUrl, paygentRefusalCode, paygentRefusalMessage, paygentRequestRefusal, paygentRequestVerdict };