@agent-cards/sdk 0.23.22 → 0.23.23

package/dist/registry.d.ts

@@ -228,9 +228,10 @@ export declare function recognizerRequestMethod(rec: Pick<Recognizer, 'request'>
  * pauses like a POST, and neither pauses in the other's method. A GET is a card
  * request only for a processor whose exact URL this build checks: Worldpay
  * eProtect's registration, whose query carries the card (payment-core's
- * grammar), and a hosted page entered with a plain GET, whose link carries no
- * card and which the cardholder's device takes over (hosted-entry.ts). Any other
- * GET recognizer is nothing this build can complete and is never paused.
+ * grammar), SB Payment Service's token request, checked through payment-core's
+ * grammar the same way, and a hosted page entered with a plain GET, whose link
+ * carries no card and which the cardholder's device takes over (hosted-entry.ts).
+ * Any other GET recognizer is nothing this build can complete and is never paused.
  */
 export declare function isRecognizerRequest(rec: Recognizer, url: string, method: string): boolean;
 /**

package/dist/registry.js

@@ -11,6 +11,8 @@ import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
 import { isEprotectTokenRequest } from './eprotect.generated.js';
 import { EPROTECT_PSP } from './eprotect.js';
 import { isSecureAcceptanceTokenRequest } from './cybersource-secure-acceptance.generated.js';
+import { isSbpsTokenRequest } from './sbps.generated.js';
+import { SBPS_PSP } from './sbps.js';
 import { SECURE_ACCEPTANCE_PSP } from './cybersource-secure-acceptance.js';
 import { hasHostedGetEntry, isHostedGetEntry } from './hosted-entry.js';
 import { TOKENEX_IFRAME_PSP, isTokenexIframeUrl } from './tokenex-iframe.generated.js';
@@ -120,6 +122,10 @@ export function findRecognizer(url, registry = BUILTIN_REGISTRY, opts = {}) {
         // /eProtect/paypage call.
         if (r.psp === EPROTECT_PSP)
             return isEprotectTokenRequest(url, 'GET');
+        // SB Payment Service's card rides in the query of a GET too: only the exact URL the browser writes
+        // for its token script's <script> is recognized, as on the server (payment-core sbps.js).
+        if (r.psp === SBPS_PSP)
+            return isSbpsTokenRequest(url, 'GET');
         // CyberSource Secure Acceptance's token create is recognized as the server
         // recognizes it: its exact URL, with no query, fragment, trailing dot or
         // doubled slash. Any other spelling stays the stop's (pre-claim.ts).
@@ -154,16 +160,18 @@ export function recognizerRequestMethod(rec) {
  * pauses like a POST, and neither pauses in the other's method. A GET is a card
  * request only for a processor whose exact URL this build checks: Worldpay
  * eProtect's registration, whose query carries the card (payment-core's
- * grammar), and a hosted page entered with a plain GET, whose link carries no
- * card and which the cardholder's device takes over (hosted-entry.ts). Any other
- * GET recognizer is nothing this build can complete and is never paused.
+ * grammar), SB Payment Service's token request, checked through payment-core's
+ * grammar the same way, and a hosted page entered with a plain GET, whose link
+ * carries no card and which the cardholder's device takes over (hosted-entry.ts).
+ * Any other GET recognizer is nothing this build can complete and is never paused.
  */
 export function isRecognizerRequest(rec, url, method) {
     const expected = recognizerRequestMethod(rec);
     if (typeof method !== 'string' || method.toUpperCase() !== expected)
         return false;
     return expected !== 'GET' || (rec.psp === EPROTECT_PSP && isEprotectTokenRequest(url, 'GET'))
-        || (rec.mode === 'hosted_form' && isHostedGetEntry(rec.psp, url));
+        || (rec.mode === 'hosted_form' && isHostedGetEntry(rec.psp, url))
+        || (rec.psp === SBPS_PSP && isSbpsTokenRequest(url, 'GET'));
 }
 /**
  * True when this processor cannot be taken over on an ordinary authorization:

package/dist/sbps.d.ts

@@ -0,0 +1,57 @@
+import { SBPS_ANSWER_CONTENT_TYPE } from './sbps.generated.js';
+/** The processor id, as the registry and the API name it. */
+export declare const SBPS_PSP = "sb_payment_service";
+/** The dark-launch capability the API serves the SBPS recognizer behind (payment-core definitions.js). */
+export declare const SBPS_CAPABILITY = "sbps_token_jsonp";
+/** What the paused <script> is answered with. */
+export { SBPS_ANSWER_CONTENT_TYPE };
+/**
+ * What a request on SBPS's token hosts is, for an attachment:
+ *   token_request  the token script's GET, exactly as the browser writes it: the card request;
+ *   unsupported    any other request on /token/generateToken: another method, query or spelling;
+ *   sibling        everything else on those hosts: the scripts and the 3-D Secure info request.
+ */
+export type SbpsRequest = {
+    kind: 'token_request';
+} | {
+    kind: 'unsupported';
+} | {
+    kind: 'sibling';
+};
+/** Which SBPS request this is, or null for a URL that is not on one of SBPS's token hosts. */
+export declare function classifySbpsRequest(url: string, method: string): SbpsRequest | null;
+/** The token request GET exactly as payment-core admits it: its URL alone, with no body. */
+export declare function isSbpsTokenGet(request: {
+    url: string;
+    method?: string;
+    body?: string | null;
+}): boolean;
+/**
+ * The answer a paused token request gets, or null when the stored answer is not one to hand the page:
+ * SBPS's own shape, `<callback>(<tokenRes>)` under a script type, with the callback the paused URL
+ * named. The answer must be one payment-core's judge accepts for that exact URL (result OK and the
+ * five token fields), byte for byte what the API stored after running the same judge.
+ */
+export declare function sbpsScriptAnswer(templateUrl: string, response: {
+    status: number;
+    body: string;
+}): {
+    status: 200;
+    headers: Record<string, string>;
+    body: string;
+} | null;
+/**
+ * One attachment's view of SBPS's token hosts. Inert (classify returns null) until the registry serves
+ * SBPS, which a client reaches only by syncing with the capability for an org the API enabled, so a
+ * build, an org or an API that never served it leaves every SBPS request exactly as before.
+ */
+export declare class SbpsGate {
+    private readonly vault;
+    constructor(vault: {
+        recognizesProcessor?: (psp: string) => boolean;
+    } | undefined);
+    /** What this request is, when the registry serves SBPS and the URL is on its token hosts; null leaves it to the other gates. */
+    classify(url: string, method: string): SbpsRequest | null;
+    /** Playwright's route predicate sees only the URL: route the token request family, never the scripts or the 3-D Secure info request. */
+    matches(url: string): boolean;
+}

package/dist/sbps.generated.d.ts

@@ -0,0 +1,96 @@
+declare var SBPS_PSP: string;
+declare var SBPS_CAPABILITY: string;
+declare var SBPS_OPERATION: string;
+declare var SBPS_TOKEN_PATH: string;
+declare var SBPS_TOKEN_HOSTS: Readonly<{
+    production: "token.sps-system.com";
+    sandbox: "stbtoken.sps-system.com";
+}>;
+declare function sbpsTokenEnvironment(hostname: any): "production" | "sandbox" | null;
+declare function sbpsTokenTemplate(url: any): {
+    environment: string;
+    origin: string;
+    pairs: {
+        name: string;
+        raw: string;
+    }[];
+    raws: any;
+    callback: string;
+} | null;
+declare function isSbpsTokenRequest(url: any, method: any): boolean;
+declare function isSbpsRequest(request: any): boolean;
+declare function sbpsRequestFacts(url: any): {
+    environment: string;
+    merchantId: any;
+    serviceId: any;
+    callback: string;
+    requestTime: any;
+} | null;
+declare var SBPS_MERCHANT_PINS: readonly any[];
+declare function sbpsMerchantPin(merchantId: any, serviceId: any, merchantOrigin: any, pins?: readonly any[]): any;
+declare function sbpsMerchantRefusal(environment: any, merchantId: any, serviceId: any, merchantOrigin: any, pins?: readonly any[]): "unsupported_environment" | "invalid_sbps_merchant" | "sbps_merchant_unreviewed" | null;
+declare var SBPS_PUBLIC_KEY: Readonly<{
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0BMW0T80ZB48dIIEkhcucncJTIthJtKnZN1vh3vfTCbuu7e1OXERSolFa8Me9bTnHqR3y8fXGXXYIxU8BBHBYWbNZWk9wMAn+Hcej8091zYu5BqAlzRxs1S9k6bX/aH24l7qXxzfW6rX71qYuP3v9RRwgnd3tOcWN9wrsIhryTryoC6KSVeh1z/27k1W8uVKCXJniihZ99nUtRSSoST9nZdXDLXyehTBZyZKAWEH5I5wRc3VnjkMUBo5Ksi7G8x0pqLrCgk46Z0YHMpU4M8TORYA1ZyFug7gCOOumfzWiJRBJmctvmwrnfobGC7z/6zSiZH/3YbigZgTsw2073cp0wIDAQAB";
+    sha256: "47d39e0b61172848ddf6bfc9417c049c6ed9e6b8e38380d31a0bf24fe873bb8d";
+}>;
+declare var SBPS_TOKEN_SCRIPT_PATH: string;
+declare var SBPS_TOKEN_SCRIPTS: Readonly<{
+    production: Readonly<{
+        host: "token.sps-system.com";
+        sha256: "f86d4d93946ef558ccb980e5d80aaf378ab13b0b78b553389d233be5a119901a";
+    }>;
+    sandbox: Readonly<{
+        host: "stbtoken.sps-system.com";
+        sha256: "068dfc8a5ba33789e439401f03e6e2ab9fa195469d5ed2e6e4da91e40f97adaf";
+    }>;
+}>;
+declare var SBPS_TOKEN_SCRIPT_MAX_BYTES: number;
+declare function sbpsTokenScriptUrl(environment: any): string;
+declare function sbpsTokenScriptVerdict(environment: any, bytes: any, scripts?: Readonly<{
+    production: Readonly<{
+        host: "token.sps-system.com";
+        sha256: "f86d4d93946ef558ccb980e5d80aaf378ab13b0b78b553389d233be5a119901a";
+    }>;
+    sandbox: Readonly<{
+        host: "stbtoken.sps-system.com";
+        sha256: "068dfc8a5ba33789e439401f03e6e2ab9fa195469d5ed2e6e4da91e40f97adaf";
+    }>;
+}>): {
+    ok: boolean;
+    reason: string;
+} | {
+    ok: boolean;
+    reason?: undefined;
+};
+declare var SBPS_REFUSAL_REASONS: readonly string[];
+declare var SbpsError: {
+    new (reason: any, message: any): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+    };
+};
+declare function isSbpsDeviceRequest(templateUrl: any, deviceUrl: any): boolean;
+declare var SBPS_ANSWER_CONTENT_TYPE: string;
+declare var SBPS_REFUSAL_CODES: readonly string[];
+declare function sbpsOutcome(status: any, bodyText: any, templateUrl: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    sanitizedJson?: undefined;
+} | {
+    outcome: string;
+    code: any;
+    reason?: undefined;
+    sanitizedJson?: undefined;
+} | {
+    outcome: string;
+    sanitizedJson: string;
+    reason?: undefined;
+    code?: undefined;
+};
+declare function sanitizeSbpsAnswer(bodyText: any, templateUrl: any): string | undefined;
+declare function sbpsJsonp(callback: any, json: any): string;
+declare function sbpsRefusalCode(bodyText: any): any;
+export { SBPS_ANSWER_CONTENT_TYPE, SBPS_CAPABILITY, SBPS_MERCHANT_PINS, SBPS_OPERATION, SBPS_PSP, SBPS_PUBLIC_KEY, SBPS_REFUSAL_CODES, SBPS_REFUSAL_REASONS, SBPS_TOKEN_HOSTS, SBPS_TOKEN_PATH, SBPS_TOKEN_SCRIPTS, SBPS_TOKEN_SCRIPT_MAX_BYTES, SBPS_TOKEN_SCRIPT_PATH, SbpsError, isSbpsDeviceRequest, isSbpsRequest, isSbpsTokenRequest, sanitizeSbpsAnswer, sbpsJsonp, sbpsMerchantPin, sbpsMerchantRefusal, sbpsOutcome, sbpsRefusalCode, sbpsRequestFacts, sbpsTokenEnvironment, sbpsTokenScriptUrl, sbpsTokenScriptVerdict, sbpsTokenTemplate };

package/dist/sbps.generated.js

@@ -0,0 +1,427 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 95b75e926c63b686635d8dddea32bc4ccf569b3598d283784e3bcba9d262bace
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/sbps.js
+var SBPS_PSP = "sb_payment_service";
+var SBPS_CAPABILITY = "sbps_token_jsonp";
+var SBPS_OPERATION = "sb_payment_service.card_request";
+var SBPS_TOKEN_PATH = "/token/generateToken";
+var SBPS_TOKEN_HOSTS = /* @__PURE__ */ Object.freeze({ production: "token.sps-system.com", sandbox: "stbtoken.sps-system.com" });
+var QUERY_ORDER = /* @__PURE__ */ Object.freeze(["callback", "mId", "sId", "key", "val", "requestTime"]);
+var URL_LIMIT = 2048;
+var CALLBACK_RAW = /^com_sbps_system\.rm\[%27([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})%27\]\.cb$/;
+var MERCHANT_ID = /^[0-9]{5}$/;
+var SERVICE_ID = /^[0-9]{3}$/;
+var REQUEST_TIME = /^[0-9]{10,15}$/;
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+var KEY_MIN_BYTES = 248;
+var KEY_MAX_BYTES = 256;
+var VAL_BYTES = 32;
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+function sbpsTokenEnvironment(hostname) {
+    if (hostname === SBPS_TOKEN_HOSTS.production)
+        return "production";
+    if (hostname === SBPS_TOKEN_HOSTS.sandbox)
+        return "sandbox";
+    return null;
+}
+function base64Length(text) {
+    if (typeof text !== "string" || text.length === 0 || text.length % 4 !== 0 || !BASE64.test(text))
+        return -1;
+    let binary;
+    try {
+        binary = atob(text);
+    }
+    catch {
+        return -1;
+    }
+    return btoa(binary) === text ? binary.length : -1;
+}
+function encodedBase64(raw) {
+    let value;
+    try {
+        value = decodeURIComponent(raw);
+    }
+    catch {
+        return null;
+    }
+    return encodeURIComponent(value) === raw ? value : null;
+}
+var RAW_RULES = {
+    callback: (raw) => CALLBACK_RAW.test(raw),
+    mId: (raw) => MERCHANT_ID.test(raw),
+    sId: (raw) => SERVICE_ID.test(raw),
+    key: (raw) => {
+        const length = base64Length(encodedBase64(raw));
+        return length >= KEY_MIN_BYTES && length <= KEY_MAX_BYTES;
+    },
+    val: (raw) => base64Length(encodedBase64(raw)) === VAL_BYTES,
+    requestTime: (raw) => REQUEST_TIME.test(raw)
+};
+function parseSbpsTokenUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
+        return null;
+    const environment = sbpsTokenEnvironment(parsed.hostname);
+    if (!environment || parsed.pathname !== SBPS_TOKEN_PATH || !parsed.search.startsWith("?"))
+        return null;
+    const chunks = parsed.search.slice(1).split("&");
+    if (chunks.length !== QUERY_ORDER.length)
+        return null;
+    const pairs = [];
+    const raws = /* @__PURE__ */ Object.create(null);
+    for (let i = 0; i < chunks.length; i++) {
+        const name = QUERY_ORDER[i];
+        if (!chunks[i].startsWith(`${name}=`))
+            return null;
+        const raw = chunks[i].slice(name.length + 1);
+        if (!RAW_RULES[name](raw))
+            return null;
+        pairs.push({ name, raw });
+        raws[name] = raw;
+    }
+    return {
+        environment,
+        origin: parsed.origin,
+        pairs,
+        raws,
+        callback: `com_sbps_system.rm['${CALLBACK_RAW.exec(raws.callback)[1]}'].cb`
+    };
+}
+function sbpsTokenTemplate(url) {
+    return parseSbpsTokenUrl(url);
+}
+function isSbpsTokenRequest(url, method) {
+    return method === "GET" && parseSbpsTokenUrl(url) !== null;
+}
+function isSbpsRequest(request) {
+    return !!request && typeof request === "object" && !Array.isArray(request) && request.method === "GET" && (!own(request, "body") || request.body === void 0 || request.body === null || request.body === "") && isSbpsTokenRequest(request.url, "GET");
+}
+function sbpsRequestFacts(url) {
+    const parsed = parseSbpsTokenUrl(url);
+    if (!parsed)
+        return null;
+    return {
+        environment: parsed.environment,
+        merchantId: parsed.raws.mId,
+        serviceId: parsed.raws.sId,
+        callback: parsed.callback,
+        requestTime: parsed.raws.requestTime
+    };
+}
+var pin = (fields) => /* @__PURE__ */ Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    accounts: Object.freeze(fields.accounts.map((account) => Object.freeze({ ...account })))
+});
+var SBPS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    /* @__PURE__ */ pin({
+        id: "boss_ezo_fukuoka",
+        merchant: `BOSS E${ /* @__PURE__ */String.fromCharCode(12539)}ZO FUKUOKA`,
+        origins: ["https://ticket.e-zofukuoka.com"],
+        accounts: [{ merchantId: "75082", serviceId: "001" }]
+    })
+]);
+function sbpsMerchantPin(merchantId, serviceId, merchantOrigin, pins = SBPS_MERCHANT_PINS) {
+    if (typeof merchantId !== "string" || !MERCHANT_ID.test(merchantId) || typeof serviceId !== "string" || !SERVICE_ID.test(serviceId) || typeof merchantOrigin !== "string" || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => !!entry && Array.isArray(entry.origins) && Array.isArray(entry.accounts) && entry.origins.includes(merchantOrigin) && entry.accounts.some((account) => !!account && account.merchantId === merchantId && account.serviceId === serviceId)) ?? null;
+}
+function sbpsMerchantRefusal(environment, merchantId, serviceId, merchantOrigin, pins = SBPS_MERCHANT_PINS) {
+    if (typeof merchantId !== "string" || !MERCHANT_ID.test(merchantId) || typeof serviceId !== "string" || !SERVICE_ID.test(serviceId)) {
+        return "invalid_sbps_merchant";
+    }
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    return sbpsMerchantPin(merchantId, serviceId, merchantOrigin, pins) ? null : "sbps_merchant_unreviewed";
+}
+var SBPS_PUBLIC_KEY = /* @__PURE__ */ Object.freeze({
+    spki: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0BMW0T80ZB48dIIEkhcucncJTIthJtKnZN1vh3vfTCbuu7e1OXERSolFa8Me9bTnHqR3y8fXGXXYIxU8BBHBYWbNZWk9wMAn+Hcej8091zYu5BqAlzRxs1S9k6bX/aH24l7qXxzfW6rX71qYuP3v9RRwgnd3tOcWN9wrsIhryTryoC6KSVeh1z/27k1W8uVKCXJniihZ99nUtRSSoST9nZdXDLXyehTBZyZKAWEH5I5wRc3VnjkMUBo5Ksi7G8x0pqLrCgk46Z0YHMpU4M8TORYA1ZyFug7gCOOumfzWiJRBJmctvmwrnfobGC7z/6zSiZH/3YbigZgTsw2073cp0wIDAQAB",
+    sha256: "47d39e0b61172848ddf6bfc9417c049c6ed9e6b8e38380d31a0bf24fe873bb8d"
+});
+var SBPS_TOKEN_SCRIPT_PATH = "/sbpstoken/com_sbps_system_token.js";
+var SBPS_TOKEN_SCRIPTS = /* @__PURE__ */ Object.freeze({
+    production: /* @__PURE__ */ Object.freeze({ host: "token.sps-system.com", sha256: "f86d4d93946ef558ccb980e5d80aaf378ab13b0b78b553389d233be5a119901a" }),
+    sandbox: /* @__PURE__ */ Object.freeze({ host: "stbtoken.sps-system.com", sha256: "068dfc8a5ba33789e439401f03e6e2ab9fa195469d5ed2e6e4da91e40f97adaf" })
+});
+var SBPS_TOKEN_SCRIPT_MAX_BYTES = 131072;
+function sbpsTokenScriptUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_sbps_environment");
+    return `https://${SBPS_TOKEN_SCRIPTS[environment].host}${SBPS_TOKEN_SCRIPT_PATH}`;
+}
+function sbpsTokenScriptVerdict(environment, bytes, scripts = SBPS_TOKEN_SCRIPTS) {
+    const pin2 = (environment === "production" || environment === "sandbox") && scripts && typeof scripts === "object" && scripts[environment] && typeof scripts[environment] === "object" ? scripts[environment].sha256 : null;
+    if (typeof pin2 !== "string" || !/^[0-9a-f]{64}$/.test(pin2))
+        return { ok: false, reason: "unsupported_sbps_environment" };
+    if (!ArrayBuffer.isView(bytes) || Object.prototype.toString.call(bytes) !== "[object Uint8Array]" || bytes.byteLength === 0 || bytes.byteLength > SBPS_TOKEN_SCRIPT_MAX_BYTES)
+        return { ok: false, reason: "sbps_script_unreadable" };
+    return sha256Hex(bytes) === pin2 ? { ok: true } : { ok: false, reason: "sbps_script_changed" };
+}
+var SBPS_REFUSAL_REASONS = /* @__PURE__ */ Object.freeze([
+    "request",
+    "psp",
+    "url",
+    "environment_mismatch",
+    "template",
+    "card",
+    "test_card_required",
+    "crypto"
+]);
+var SbpsError = class extends Error {
+    /** @param {string} reason one of SBPS_REFUSAL_REASONS @param {string} message */
+    constructor(reason, message) {
+        super(`Refusing to pay: ${message}`);
+        this.name = "SbpsError";
+        this.reason = reason;
+    }
+};
+function isSbpsDeviceRequest(templateUrl, deviceUrl) {
+    const template = parseSbpsTokenUrl(templateUrl);
+    const device = parseSbpsTokenUrl(deviceUrl);
+    if (!template || !device || device.origin !== template.origin)
+        return false;
+    return device.pairs.every((pair, i) => pair.name === template.pairs[i].name && (pair.name === "key" || pair.name === "val" ? pair.raw !== template.pairs[i].raw : pair.raw === template.pairs[i].raw));
+}
+var SBPS_ANSWER_CONTENT_TYPE = "application/javascript;charset=UTF-8";
+var ERROR_TYPES = /* @__PURE__ */ Object.freeze(["03", "04", "05", "07", "99"]);
+var ERROR_FIELDS = /* @__PURE__ */ Object.freeze(["001", "002", "003", "004", "005", "999"]);
+var SBPS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze(ERROR_TYPES.flatMap((type) => ERROR_FIELDS.map((field) => `${type}${field}`)));
+var ANSWER_LIMIT = 8192;
+var TOKEN = /^[A-Za-z0-9+/=_.:-]{1,256}$/;
+var MASKED = /^([0-9]{0,6})[*Xx]{4,15}([0-9]{4})$/;
+var EXPIRY = /^20[0-9]{2}(?:0[1-9]|1[0-2])$/;
+var BRANDS = /* @__PURE__ */ Object.freeze(["J", "V", "M", "A", "D", "X"]);
+var TOKEN_FIELDS = /* @__PURE__ */ Object.freeze(["token", "tokenKey", "maskedCcNumber", "ccExpiration", "cardBrandCode"]);
+var plainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function readAnswer(text, callback) {
+    if (typeof text !== "string" || text.length > ANSWER_LIMIT || typeof callback !== "string")
+        return null;
+    const body = text.replace(/^\s+/, "");
+    if (!body.startsWith(`${callback}(`))
+        return null;
+    const close = /\)\s*;?\s*$/.exec(body);
+    if (!close || close.index < callback.length + 1)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(body.slice(callback.length + 1, close.index));
+    }
+    catch {
+        return null;
+    }
+    if (!plainObject(parsed) || Object.keys(parsed).length !== 1 || !plainObject(parsed.tokenRes))
+        return null;
+    return parsed.tokenRes;
+}
+function tokenFields(tokenRes) {
+    if (!Object.keys(tokenRes).every((key) => ["result", "tokenResponse", "errorCode"].includes(key)))
+        return null;
+    if (own(tokenRes, "errorCode") && tokenRes.errorCode !== null && tokenRes.errorCode !== "")
+        return null;
+    const response = tokenRes.tokenResponse;
+    if (!plainObject(response) || !TOKEN_FIELDS.every((key) => typeof response[key] === "string"))
+        return null;
+    const { token, tokenKey, maskedCcNumber, ccExpiration, cardBrandCode } = response;
+    const masked = MASKED.exec(maskedCcNumber);
+    if (!TOKEN.test(token) || !TOKEN.test(tokenKey) || !masked || maskedCcNumber.length < 12 || maskedCcNumber.length > 19 || !EXPIRY.test(ccExpiration) || !BRANDS.includes(cardBrandCode))
+        return null;
+    return { token, tokenKey, maskedCcNumber, ccExpiration, cardBrandCode, head: masked[1], tail: masked[2] };
+}
+function sbpsOutcome(status, bodyText, templateUrl, card) {
+    const facts = sbpsRequestFacts(templateUrl);
+    if (!facts)
+        return { outcome: "unknown", reason: "sbps_template_invalid" };
+    if (status !== 200)
+        return { outcome: "unknown", reason: "sbps_status" };
+    const tokenRes = readAnswer(bodyText, facts.callback);
+    if (!tokenRes)
+        return { outcome: "unknown", reason: "sbps_unreadable" };
+    if (tokenRes.result === "NG") {
+        const extra = Object.keys(tokenRes).some((key) => !["result", "errorCode", "tokenResponse"].includes(key));
+        const token2 = own(tokenRes, "tokenResponse") && tokenRes.tokenResponse !== null;
+        return !extra && !token2 && SBPS_REFUSAL_CODES.includes(tokenRes.errorCode) ? { outcome: "refused", code: tokenRes.errorCode } : { outcome: "unknown", reason: "sbps_unconfirmed" };
+    }
+    if (tokenRes.result !== "OK")
+        return { outcome: "unknown", reason: "sbps_unconfirmed" };
+    const fields = tokenFields(tokenRes);
+    if (!fields)
+        return { outcome: "unknown", reason: "sbps_shape" };
+    if (card) {
+        const number = String(card.number ?? "").replace(/[ -]/g, "");
+        const month = String(card.month ?? "").padStart(2, "0");
+        const year = String(card.year ?? "").length === 2 ? `20${card.year}` : String(card.year ?? "");
+        if (!number.startsWith(fields.head) || !number.endsWith(fields.tail) || fields.ccExpiration !== `${year}${month}` || number.length >= 12 && (fields.token.includes(number) || fields.tokenKey.includes(number))) {
+            return { outcome: "unknown", reason: "sbps_card_mismatch" };
+        }
+    }
+    const { token, tokenKey, maskedCcNumber, ccExpiration, cardBrandCode } = fields;
+    return { outcome: "token", sanitizedJson: JSON.stringify({ tokenRes: {
+                result: "OK",
+                tokenResponse: { token, tokenKey, maskedCcNumber, ccExpiration, cardBrandCode }
+            } }) };
+}
+function sanitizeSbpsAnswer(bodyText, templateUrl) {
+    const verdict = sbpsOutcome(200, bodyText, templateUrl, void 0);
+    if (verdict.outcome !== "token")
+        throw new Error("Invalid SB Payment Service token answer.");
+    return verdict.sanitizedJson;
+}
+function sbpsJsonp(callback, json) {
+    let parsed = null;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+    }
+    if (typeof callback !== "string" || !/^com_sbps_system\.rm\['[0-9a-f-]{36}'\]\.cb$/.test(callback) || !plainObject(parsed) || JSON.stringify(parsed) !== json)
+        throw new Error("Refusing to answer: malformed SB Payment Service callback.");
+    return `${callback}(${json})`;
+}
+function sbpsRefusalCode(bodyText) {
+    const callback = typeof bodyText === "string" ? /^\s*(com_sbps_system\.rm\['[0-9a-f-]{36}'\]\.cb)\(/.exec(bodyText)?.[1] : void 0;
+    const tokenRes = callback ? readAnswer(bodyText, callback) : null;
+    return tokenRes && tokenRes.result === "NG" && SBPS_REFUSAL_CODES.includes(tokenRes.errorCode) ? tokenRes.errorCode : null;
+}
+export { SBPS_ANSWER_CONTENT_TYPE, SBPS_CAPABILITY, SBPS_MERCHANT_PINS, SBPS_OPERATION, SBPS_PSP, SBPS_PUBLIC_KEY, SBPS_REFUSAL_CODES, SBPS_REFUSAL_REASONS, SBPS_TOKEN_HOSTS, SBPS_TOKEN_PATH, SBPS_TOKEN_SCRIPTS, SBPS_TOKEN_SCRIPT_MAX_BYTES, SBPS_TOKEN_SCRIPT_PATH, SbpsError, isSbpsDeviceRequest, isSbpsRequest, isSbpsTokenRequest, sanitizeSbpsAnswer, sbpsJsonp, sbpsMerchantPin, sbpsMerchantRefusal, sbpsOutcome, sbpsRefusalCode, sbpsRequestFacts, sbpsTokenEnvironment, sbpsTokenScriptUrl, sbpsTokenScriptVerdict, sbpsTokenTemplate };