@agent-cards/sdk 0.23.22 → 0.23.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/CHANGELOG.md +34 -0
  2. package/PREFLIGHT.md +2 -0
  3. package/README.md +34 -4
  4. package/dist/aci.generated.js +3 -3
  5. package/dist/agent-amount.generated.d.ts +7 -0
  6. package/dist/agent-amount.generated.js +3 -0
  7. package/dist/amadeus.d.ts +5 -2
  8. package/dist/amadeus.js +18 -3
  9. package/dist/amazon-payment-services.d.ts +25 -0
  10. package/dist/amazon-payment-services.generated.d.ts +76 -0
  11. package/dist/amazon-payment-services.generated.js +883 -0
  12. package/dist/amazon-payment-services.js +53 -0
  13. package/dist/capabilities.generated.d.ts +2 -0
  14. package/dist/capabilities.generated.js +3 -0
  15. package/dist/card-fields.generated.js +1127 -25
  16. package/dist/cdp.js +116 -15
  17. package/dist/client.d.ts +107 -8
  18. package/dist/client.js +277 -128
  19. package/dist/hosted-entry.js +2 -1
  20. package/dist/hosted-form.d.ts +5 -0
  21. package/dist/hosted-form.js +5 -0
  22. package/dist/index.d.ts +1 -0
  23. package/dist/index.js +1 -0
  24. package/dist/openpay.generated.d.ts +67 -0
  25. package/dist/openpay.generated.js +446 -0
  26. package/dist/paddle-checkout-watch.d.ts +70 -0
  27. package/dist/paddle-checkout-watch.js +239 -0
  28. package/dist/paddle-tokenex.generated.d.ts +29 -1
  29. package/dist/paddle-tokenex.generated.js +175 -26
  30. package/dist/paytrail.d.ts +58 -0
  31. package/dist/paytrail.js +98 -0
  32. package/dist/pre-claim.d.ts +4 -0
  33. package/dist/pre-claim.js +46 -2
  34. package/dist/prepared-processor.d.ts +12 -4
  35. package/dist/prepared-processor.js +31 -5
  36. package/dist/primer.generated.js +1155 -53
  37. package/dist/registry.d.ts +4 -3
  38. package/dist/registry.js +12 -4
  39. package/dist/sbps.d.ts +57 -0
  40. package/dist/sbps.generated.d.ts +96 -0
  41. package/dist/sbps.generated.js +427 -0
  42. package/dist/sbps.js +90 -0
  43. package/dist/stripe-checkout.generated.js +458 -8
  44. package/dist/tap-payments.d.ts +43 -0
  45. package/dist/tap-payments.generated.d.ts +59 -0
  46. package/dist/tap-payments.generated.js +990 -0
  47. package/dist/tap-payments.js +72 -0
  48. package/dist/transbank.d.ts +33 -0
  49. package/dist/transbank.js +62 -0
  50. package/dist/url-mask-parts.d.ts +24 -0
  51. package/dist/url-mask-parts.js +22 -0
  52. package/dist/url-masks.generated.d.ts +3 -0
  53. package/dist/url-masks.generated.js +2 -0
  54. package/package.json +4 -4
@@ -1,6 +1,6 @@
1
1
  // @ts-nocheck
2
2
  // Generated from @agent-cards/payment-core. Do not edit.
3
- // artifact-sha256: 2163d0faf9f17cfd1ca85cb205df104d44da2436468a05413932b6386c56d75d
3
+ // artifact-sha256: edc05559c1ac8275ddd2aa2eef090ce7700c26b6f0c69a601c136bd19881cedf
4
4
  // src/card-number-key.js
5
5
  var CARD_NUMBER_KEY = /^(number|card_number|cardnumber|cardNum|card_num|pan)$/i;
6
6
  // src/json-path.js
@@ -365,8 +365,8 @@ var CONTROL = /[\u0000-\u001f\u007f]/;
365
365
  var cardLikeName = (name) => (name.match(/[0-9]/g) ?? []).length >= 12;
366
366
  var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
367
367
  var sameKeys = (value, keys) => {
368
- const own10 = Object.keys(value);
369
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
368
+ const own12 = Object.keys(value);
369
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
370
370
  };
371
371
  var refuse4 = (code) => Object.freeze({ verdict: "refuse", code });
372
372
  var CARD4 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -779,8 +779,8 @@ var PADDLE_TOKENEX_PSP = "paddle_tokenex";
779
779
  var PADDLE_TOKENEX_FACT_KEYS = /* @__PURE__ */ Object.freeze(["card_first_six", "card_last_four", "expiry_month", "expiry_year", "card_brand"]);
780
780
  var record4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
781
781
  var sameKeys2 = (value, keys) => {
782
- const own10 = Object.keys(value);
783
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
782
+ const own12 = Object.keys(value);
783
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
784
784
  };
785
785
  var refuse7 = (code) => Object.freeze({ verdict: "refuse", code });
786
786
  var CARD6 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1269,8 +1269,8 @@ var TEXT_LIMIT = 256;
1269
1269
  var CONTROL4 = /[\u0000-\u001f\u007f]/;
1270
1270
  var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
1271
1271
  var sameKeys3 = (value, keys) => {
1272
- const own10 = Object.keys(value);
1273
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
1272
+ const own12 = Object.keys(value);
1273
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
1274
1274
  };
1275
1275
  var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL4.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
1276
1276
  var refuse9 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -1472,8 +1472,8 @@ var EXPIRATION = /^[0-9]{2}(?:0[1-9]|1[0-2])$/;
1472
1472
  var CARD_PAYMENT = "PAYMENT_CARD";
1473
1473
  var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
1474
1474
  var sameKeys4 = (value, keys) => {
1475
- const own10 = Object.keys(value);
1476
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
1475
+ const own12 = Object.keys(value);
1476
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
1477
1477
  };
1478
1478
  var refuse11 = (code) => Object.freeze({ verdict: "refuse", code });
1479
1479
  var CARD10 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -1703,8 +1703,8 @@ var LOCALE = /^[a-z]{2}(?:-[A-Za-z]{2,4})?$/;
1703
1703
  var PAN_LIKE3 = /(?:[0-9][ _.:-]*){12,}/;
1704
1704
  var record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
1705
1705
  var sameKeys5 = (value, keys) => {
1706
- const own10 = Object.keys(value);
1707
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
1706
+ const own12 = Object.keys(value);
1707
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
1708
1708
  };
1709
1709
  var refuse13 = (code) => Object.freeze({ verdict: "refuse", code });
1710
1710
  var CARD12 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -2735,8 +2735,8 @@ var TEXT_LIMIT3 = 256;
2735
2735
  var CONTROL7 = /[\u0000-\u001f\u007f]/;
2736
2736
  var record13 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
2737
2737
  var sameKeys7 = (value, keys) => {
2738
- const own10 = Object.keys(value);
2739
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
2738
+ const own12 = Object.keys(value);
2739
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
2740
2740
  };
2741
2741
  var plainText3 = (value) => typeof value === "string" && value.length <= TEXT_LIMIT3 && !CONTROL7.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
2742
2742
  var refuse19 = (code) => Object.freeze({ verdict: "refuse", code });
@@ -2784,6 +2784,15 @@ var pin6 = (fields) => Object.freeze({ ...fields, origins: Object.freeze([...fie
2784
2784
  var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
2785
2785
  pin6({ id: "happybulle", merchant: "HappyBulle", origins: ["https://www.happybulle.com"], usernames: ["94683309.secure-gateway.hipay-tpp.com"] })
2786
2786
  ]);
2787
+ // src/deep-freeze.js
2788
+ function deepFreeze(value) {
2789
+ if (value && typeof value === "object" && !Object.isFrozen(value)) {
2790
+ for (const child of Object.values(value))
2791
+ deepFreeze(child);
2792
+ Object.freeze(value);
2793
+ }
2794
+ return value;
2795
+ }
2787
2796
  // src/amazon-payment-services.js
2788
2797
  var APS_PSP = "amazon_payment_services";
2789
2798
  var APS_HOSTS = /* @__PURE__ */ Object.freeze({ "checkout.payfort.com": "production", "sbcheckout.payfort.com": "sandbox" });
@@ -3457,8 +3466,8 @@ var HOSTNAME = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](
3457
3466
  var PUBLISHABLE_KEY = /^[A-Za-z0-9]{16,64}$/;
3458
3467
  var record18 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
3459
3468
  var sameKeys8 = (value, keys) => {
3460
- const own10 = Object.keys(value);
3461
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
3469
+ const own12 = Object.keys(value);
3470
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
3462
3471
  };
3463
3472
  var refuse24 = (code) => Object.freeze({ verdict: "refuse", code });
3464
3473
  var CARD23 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
@@ -4149,8 +4158,8 @@ var LONG_TEXT_LIMIT = BODY_LIMIT25;
4149
4158
  var record22 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
4150
4159
  var owns6 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
4151
4160
  var sameKeys9 = (value, keys) => {
4152
- const own10 = Object.keys(value);
4153
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
4161
+ const own12 = Object.keys(value);
4162
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
4154
4163
  };
4155
4164
  var exact3 = (pattern, value) => typeof value === "string" && pattern.test(value);
4156
4165
  var printable3 = (text9) => [...text9].every((character) => {
@@ -4549,8 +4558,8 @@ var POSTAL_CODE4 = /^[A-Za-z0-9 -]{0,16}$/;
4549
4558
  var CIPHERTEXT_B64 = /^[A-Za-z0-9+/]{341}[AQgw]==$/;
4550
4559
  var record24 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
4551
4560
  var sameKeys11 = (value, keys) => {
4552
- const own10 = Object.keys(value);
4553
- return own10.length === keys.length && own10.every((key, at) => key === keys[at]);
4561
+ const own12 = Object.keys(value);
4562
+ return own12.length === keys.length && own12.every((key, at) => key === keys[at]);
4554
4563
  };
4555
4564
  var refuse29 = (code) => Object.freeze({ verdict: "refuse", code });
4556
4565
  var failed = (code) => (
@@ -4614,7 +4623,8 @@ function toastBodyVerdict(body) {
4614
4623
  // src/fastspring.js
4615
4624
  var FASTSPRING_PSP = "fastspring";
4616
4625
  var FASTSPRING_STORE_PINS = /* @__PURE__ */ Object.freeze([
4617
- Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" })
4626
+ Object.freeze({ environment: "production", store: "daisydisk", storefront: "", merchant: "DaisyDisk" }),
4627
+ Object.freeze({ environment: "production", store: "stardock", storefront: "/popup-store", merchant: "Stardock" })
4618
4628
  ]);
4619
4629
  var URL_LIMIT11 = 256;
4620
4630
  var BODY_LIMIT28 = 32768;
@@ -5071,6 +5081,1083 @@ function xenditBodyVerdict(body) {
5071
5081
  return refuse32("xendit_body_unsupported");
5072
5082
  return CARD31;
5073
5083
  }
5084
+ // src/tappay.js
5085
+ var TAPPAY_PSP = "tappay";
5086
+ var TAPPAY_GETPRIME_URL = "https://js.tappaysdk.com/payment/tpdirect/production/getprime";
5087
+ var BODY_LIMIT31 = 8192;
5088
+ var REQUIRED_KEYS3 = /* @__PURE__ */ Object.freeze(["cardnumber", "cardduedate", "appid", "appkey", "appname", "url", "protocol", "tappay_sdk_version", "cardholder_info"]);
5089
+ var KEY_ORDER = /* @__PURE__ */ Object.freeze(["cardnumber", "cardduedate", "appid", "appkey", "appname", "url", "port", "protocol", "tappay_sdk_version", "cardholder_info", "cardccv", "device_id"]);
5090
+ var OPTIONAL_KEYS2 = /* @__PURE__ */ Object.freeze(["port", "cardccv", "device_id"]);
5091
+ var CARDHOLDER_KEYS = /* @__PURE__ */ Object.freeze(["name_en", "email", "phone_number_country_code", "phone_number"]);
5092
+ var CARD_NUMBER16 = /^[0-9]{12,19}$/;
5093
+ var CARD_DUE_DATE = /^20[0-9]{2}(?:0[1-9]|1[0-2])$/;
5094
+ var SECURITY_CODE19 = /^[0-9]{3,4}$/;
5095
+ var APP_KEY = /^[A-Za-z0-9_-]{16,512}$/;
5096
+ var SDK_VERSION = /^v[0-9]+(?:\.[0-9]+){1,3}$/;
5097
+ var HOSTNAME2 = /^[A-Za-z0-9.:-]{1,255}$/;
5098
+ var ORIGIN_URL = /^https?:\/\/[A-Za-z0-9.:_/-]{1,255}$/;
5099
+ var PROTOCOL = /^https?:$/;
5100
+ var PORT = /^[0-9]{0,5}$/;
5101
+ var CONTROL13 = /[\u0000-\u001f\u007f]/;
5102
+ var TEXT_LIMIT12 = 256;
5103
+ var DEVICE_ID = /^[A-Za-z0-9_-]{1,128}$/;
5104
+ var record28 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
5105
+ var plainText7 = (value) => typeof value === "string" && value.length <= TEXT_LIMIT12 && !CONTROL13.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
5106
+ var holderField = (value) => value === null || plainText7(value);
5107
+ var refuse33 = (code) => Object.freeze({ verdict: "refuse", code });
5108
+ var CARD32 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
5109
+ function isTappayGetPrimeUrl(url) {
5110
+ return url === TAPPAY_GETPRIME_URL;
5111
+ }
5112
+ function readBody19(body) {
5113
+ if (typeof body !== "string" || body.length > BODY_LIMIT31)
5114
+ return null;
5115
+ const eq = body.indexOf("=");
5116
+ if (eq !== "jsonString".length || body.slice(0, eq) !== "jsonString")
5117
+ return null;
5118
+ const json = body.slice(eq + 1);
5119
+ let value;
5120
+ try {
5121
+ value = JSON.parse(json);
5122
+ if (!record28(value) || JSON.stringify(value) !== json)
5123
+ return null;
5124
+ }
5125
+ catch {
5126
+ return null;
5127
+ }
5128
+ return value;
5129
+ }
5130
+ function keysInOrder(value) {
5131
+ const keys = Object.keys(value);
5132
+ for (const key of REQUIRED_KEYS3) {
5133
+ if (!keys.includes(key))
5134
+ return false;
5135
+ }
5136
+ for (const key of keys) {
5137
+ if (!KEY_ORDER.includes(key) || !REQUIRED_KEYS3.includes(key) && !OPTIONAL_KEYS2.includes(key))
5138
+ return false;
5139
+ }
5140
+ const rank = (key) => KEY_ORDER.indexOf(key);
5141
+ for (let at = 1; at < keys.length; at += 1) {
5142
+ if (rank(keys[at]) <= rank(keys[at - 1]))
5143
+ return false;
5144
+ }
5145
+ return true;
5146
+ }
5147
+ function cardholderInfo(value) {
5148
+ if (!record28(value))
5149
+ return false;
5150
+ const keys = Object.keys(value);
5151
+ return keys.length <= CARDHOLDER_KEYS.length && keys.every((key) => CARDHOLDER_KEYS.includes(key) && holderField(value[key]));
5152
+ }
5153
+ function tappayBodyVerdict(body) {
5154
+ const value = readBody19(body);
5155
+ if (value === null || !keysInOrder(value))
5156
+ return refuse33("tappay_body_unsupported");
5157
+ if (typeof value.cardnumber !== "string" || !CARD_NUMBER16.test(value.cardnumber) || typeof value.cardduedate !== "string" || !CARD_DUE_DATE.test(value.cardduedate) || !Number.isInteger(value.appid) || value.appid < 0 || typeof value.appkey !== "string" || !APP_KEY.test(value.appkey) || typeof value.appname !== "string" || !HOSTNAME2.test(value.appname) || typeof value.url !== "string" || !ORIGIN_URL.test(value.url) || typeof value.protocol !== "string" || !PROTOCOL.test(value.protocol) || typeof value.tappay_sdk_version !== "string" || !SDK_VERSION.test(value.tappay_sdk_version) || !cardholderInfo(value.cardholder_info)) {
5158
+ return refuse33("tappay_body_unsupported");
5159
+ }
5160
+ if (Object.prototype.hasOwnProperty.call(value, "port") && (typeof value.port !== "string" || !PORT.test(value.port)))
5161
+ return refuse33("tappay_body_unsupported");
5162
+ if (Object.prototype.hasOwnProperty.call(value, "cardccv") && (typeof value.cardccv !== "string" || !SECURITY_CODE19.test(value.cardccv)))
5163
+ return refuse33("tappay_body_unsupported");
5164
+ if (Object.prototype.hasOwnProperty.call(value, "device_id") && (typeof value.device_id !== "string" || !DEVICE_ID.test(value.device_id)))
5165
+ return refuse33("tappay_body_unsupported");
5166
+ return CARD32;
5167
+ }
5168
+ // src/paymob.js
5169
+ var PAYMOB_PSP = "paymob";
5170
+ var PAYMOB_HOSTS = /* @__PURE__ */ Object.freeze(["accept.paymob.com", "uae.paymob.com", "ksa.paymob.com", "oman.paymob.com", "accept.paymobsolutions.com"]);
5171
+ var PAYMOB_PAY_PATH = "/api/acceptance/payments/pay";
5172
+ var URL_LIMIT12 = 128;
5173
+ var BODY_LIMIT32 = 16384;
5174
+ var KEY_LIMIT = 8192;
5175
+ var NUMBER7 = /^[0-9]{12,19}$/;
5176
+ var MONTH17 = /^(?:0[1-9]|1[0-2])$/;
5177
+ var YEAR18 = /^[0-9]{2}$/;
5178
+ var SECURITY_CODE20 = /^[0-9]{3,4}$/;
5179
+ var TEXT3 = /^[^\x00-\x1f\x7f]{0,256}$/;
5180
+ var HOLDER_TEXT = /^[^\x00-\x1f\x7f]{0,128}$/;
5181
+ var FIELD = /^[a-z][a-z0-9_]{0,39}$/;
5182
+ var FINGERPRINT3 = /^[\x21-\x7e]{1,256}$/;
5183
+ var ORIGIN2 = /^https?:\/\/[A-Za-z0-9.-]{1,253}(?::[0-9]{1,5})?$/;
5184
+ var SWITCH = /* @__PURE__ */ new Set(["True", "False"]);
5185
+ var SOURCE_FOR = /* @__PURE__ */ Object.freeze({ IFRAME: "True", PIXEL: "False" });
5186
+ var CARD_MEMBER4 = /^(?:card_?number|pan|cvv|cvc|cvn|card_pin|card_expiry|expiry_month|expiry_year|security_code)$/i;
5187
+ var SAVED_CARD = "TOKEN";
5188
+ var OTHER_CARD_SUBTYPES = /* @__PURE__ */ new Set(["OMANNET", "PREMIUM", "PREMIUM6_ONLINE", "SYMPL"]);
5189
+ var CARD_SOURCE_KEYS = /* @__PURE__ */ new Set(["identifier", "sourceholder_name", "subtype", "expiry_month", "expiry_year", "cvn", "unified_checkout", "save_card"]);
5190
+ var TOP_KEYS3 = /* @__PURE__ */ new Set([
5191
+ "source",
5192
+ "billing",
5193
+ "shipping_data",
5194
+ "payment_token",
5195
+ "api_source",
5196
+ "unified_checkout",
5197
+ "save_card",
5198
+ "fingerprint",
5199
+ "merchant-domain",
5200
+ "customer",
5201
+ "converted_currency",
5202
+ "no_of_cards_selected",
5203
+ "split_payment_amount"
5204
+ ]);
5205
+ var REQUIRED_TOP_KEYS = ["source", "payment_token", "api_source", "unified_checkout", "save_card"];
5206
+ var REQUIRED_SOURCE_KEYS = ["identifier", "subtype", "expiry_month", "expiry_year", "cvn", "unified_checkout", "save_card"];
5207
+ var record29 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
5208
+ var own10 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
5209
+ var refuse34 = (code) => Object.freeze({ verdict: "refuse", code });
5210
+ var CARD33 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
5211
+ var CONTINUE12 = /* @__PURE__ */ Object.freeze({ verdict: "continue" });
5212
+ function paymobPayHost(url) {
5213
+ if (typeof url !== "string" || url.length > URL_LIMIT12 || url.includes("?") || url.includes("#"))
5214
+ return null;
5215
+ let parsed;
5216
+ try {
5217
+ parsed = new URL(url);
5218
+ }
5219
+ catch {
5220
+ return null;
5221
+ }
5222
+ if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || !PAYMOB_HOSTS.includes(parsed.hostname) || parsed.pathname !== PAYMOB_PAY_PATH)
5223
+ return null;
5224
+ return parsed.hostname;
5225
+ }
5226
+ function isPaymobPayUrl(url) {
5227
+ return paymobPayHost(url) !== null;
5228
+ }
5229
+ var BASE645 = /^[A-Za-z0-9+/]+={0,2}$/;
5230
+ var BASE64URL = /^[A-Za-z0-9_-]+$/;
5231
+ var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
5232
+ function decodeBase642(text9, url) {
5233
+ if (typeof text9 !== "string" || text9 === "")
5234
+ return null;
5235
+ let body = text9;
5236
+ if (url) {
5237
+ if (!BASE64URL.test(body) || body.length % 4 === 1)
5238
+ return null;
5239
+ }
5240
+ else {
5241
+ if (!BASE645.test(body) || body.length % 4 !== 0)
5242
+ return null;
5243
+ body = body.replace(/=+$/, "");
5244
+ }
5245
+ const extra = url ? "-_" : "+/";
5246
+ const bytes = new Uint8Array(Math.floor(body.length * 3 / 4));
5247
+ let buffer = 0;
5248
+ let bits = 0;
5249
+ let at = 0;
5250
+ for (const char of body) {
5251
+ const value = (ALPHABET + extra).indexOf(char);
5252
+ if (value < 0)
5253
+ return null;
5254
+ buffer = buffer << 6 | value;
5255
+ bits += 6;
5256
+ if (bits >= 8) {
5257
+ bits -= 8;
5258
+ bytes[at++] = buffer >> bits & 255;
5259
+ }
5260
+ }
5261
+ if (buffer & (1 << bits) - 1)
5262
+ return null;
5263
+ return bytes.subarray(0, at);
5264
+ }
5265
+ function jsonOf(bytes) {
5266
+ if (!bytes)
5267
+ return null;
5268
+ let text9;
5269
+ try {
5270
+ text9 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
5271
+ }
5272
+ catch {
5273
+ return null;
5274
+ }
5275
+ try {
5276
+ const value = JSON.parse(text9);
5277
+ return record29(value) ? value : null;
5278
+ }
5279
+ catch {
5280
+ return null;
5281
+ }
5282
+ }
5283
+ var positive = (value) => Number.isSafeInteger(value) && value > 0;
5284
+ var CURRENCY5 = /^[A-Z]{3}$/;
5285
+ var KEY_CLAIMS = /* @__PURE__ */ new Set([
5286
+ "user_id",
5287
+ "integration_id",
5288
+ "order_id",
5289
+ "amount_cents",
5290
+ "currency",
5291
+ "exp",
5292
+ "billing_data",
5293
+ "extra",
5294
+ "notification_url",
5295
+ "redirection_url",
5296
+ "redirect_url",
5297
+ "lock_order_when_paid",
5298
+ "single_payment_attempt",
5299
+ "next_payment_intention",
5300
+ "created_by",
5301
+ "is_partner",
5302
+ "split_payment_methods"
5303
+ ]);
5304
+ var SUBSCRIPTION_CLAIMS = /* @__PURE__ */ new Set(["subscription_plan_id", "subscription_start_date"]);
5305
+ var UNREADABLE_KEY = /* @__PURE__ */ Object.freeze({ facts: null, code: "paymob_payment_key_unreadable" });
5306
+ function readPaymentKey(key) {
5307
+ if (typeof key !== "string" || key.length > KEY_LIMIT)
5308
+ return UNREADABLE_KEY;
5309
+ const outer = decodeBase642(key, false);
5310
+ if (!outer)
5311
+ return UNREADABLE_KEY;
5312
+ let jwt;
5313
+ try {
5314
+ jwt = new TextDecoder("utf-8", { fatal: true }).decode(outer);
5315
+ }
5316
+ catch {
5317
+ return UNREADABLE_KEY;
5318
+ }
5319
+ const parts = jwt.split(".");
5320
+ if (parts.length !== 3 || parts.some((part) => part === "" || !BASE64URL.test(part)))
5321
+ return UNREADABLE_KEY;
5322
+ const header = jsonOf(decodeBase642(parts[0], true));
5323
+ if (!header || Object.keys(header).length !== 2 || header.alg !== "HS512" || header.typ !== "JWT")
5324
+ return UNREADABLE_KEY;
5325
+ const signature = decodeBase642(parts[2], true);
5326
+ if (!signature || signature.length !== 64)
5327
+ return UNREADABLE_KEY;
5328
+ const payload = jsonOf(decodeBase642(parts[1], true));
5329
+ if (!payload)
5330
+ return UNREADABLE_KEY;
5331
+ const claims = Object.keys(payload);
5332
+ if (claims.some((claim) => SUBSCRIPTION_CLAIMS.has(claim) && payload[claim] !== null))
5333
+ return Object.freeze({ facts: null, code: "paymob_subscription" });
5334
+ if (claims.some((claim) => !KEY_CLAIMS.has(claim) && !SUBSCRIPTION_CLAIMS.has(claim)))
5335
+ return UNREADABLE_KEY;
5336
+ const { user_id: merchantId, integration_id: integrationId, order_id: orderId, amount_cents: amountCents, currency, exp } = payload;
5337
+ if (!positive(merchantId) || !positive(integrationId) || !positive(orderId) || !Number.isSafeInteger(amountCents) || amountCents < 0 || typeof currency !== "string" || !CURRENCY5.test(currency) || own10(payload, "exp") && !positive(exp))
5338
+ return UNREADABLE_KEY;
5339
+ if (amountCents === 0)
5340
+ return Object.freeze({ facts: null, code: "paymob_no_amount" });
5341
+ return Object.freeze({ facts: Object.freeze({ merchantId, integrationId, orderId, amountCents, currency, expiresAt: own10(payload, "exp") ? exp : null }), code: null });
5342
+ }
5343
+ function readJson8(body) {
5344
+ if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT32)
5345
+ return { parsed: null, exact: false };
5346
+ let parsed;
5347
+ try {
5348
+ parsed = JSON.parse(body);
5349
+ }
5350
+ catch {
5351
+ return { parsed: null, exact: false };
5352
+ }
5353
+ let exact5 = false;
5354
+ try {
5355
+ exact5 = body.length <= BODY_LIMIT32 && JSON.stringify(parsed) === body;
5356
+ }
5357
+ catch {
5358
+ exact5 = false;
5359
+ }
5360
+ return { parsed, exact: exact5 };
5361
+ }
5362
+ function namesCardValue3(parsed) {
5363
+ const pending = parsed !== null && typeof parsed === "object" ? [parsed] : [];
5364
+ while (pending.length > 0) {
5365
+ const node = pending.pop();
5366
+ for (const key of Object.keys(node)) {
5367
+ if (!Array.isArray(node) && CARD_MEMBER4.test(key))
5368
+ return true;
5369
+ const value = node[key];
5370
+ if (value !== null && typeof value === "object")
5371
+ pending.push(value);
5372
+ }
5373
+ }
5374
+ return false;
5375
+ }
5376
+ function addressBlock(value) {
5377
+ return record29(value) && Object.keys(value).length <= 32 && Object.entries(value).every(([key, text9]) => FIELD.test(key) && !CARD_MEMBER4.test(key) && (text9 === null || typeof text9 === "string" && TEXT3.test(text9)));
5378
+ }
5379
+ function judgeCardPayment(parsed) {
5380
+ const source = parsed.source;
5381
+ for (const key of Object.keys(parsed))
5382
+ if (!TOP_KEYS3.has(key))
5383
+ return "paymob_body_unsupported";
5384
+ for (const key of Object.keys(source)) {
5385
+ if (key === "is_card_to_installment" || key === "tenure")
5386
+ return "paymob_installments";
5387
+ if (!CARD_SOURCE_KEYS.has(key))
5388
+ return "paymob_body_unsupported";
5389
+ }
5390
+ if (own10(parsed, "customer"))
5391
+ return "paymob_account";
5392
+ if (own10(parsed, "no_of_cards_selected") || own10(parsed, "split_payment_amount"))
5393
+ return "paymob_split_payment";
5394
+ if (own10(parsed, "converted_currency"))
5395
+ return "paymob_currency_conversion";
5396
+ if (!REQUIRED_TOP_KEYS.every((key) => own10(parsed, key)) || !REQUIRED_SOURCE_KEYS.every((key) => own10(source, key)))
5397
+ return "paymob_body_unsupported";
5398
+ if (source.save_card === true || parsed.save_card === true)
5399
+ return "paymob_keep_on_file";
5400
+ if (source.save_card !== false || parsed.save_card !== false)
5401
+ return "paymob_body_unsupported";
5402
+ if (typeof source.identifier !== "string" || !NUMBER7.test(source.identifier) || typeof source.expiry_month !== "string" || !MONTH17.test(source.expiry_month) || typeof source.expiry_year !== "string" || !YEAR18.test(source.expiry_year) || typeof source.cvn !== "string" || !SECURITY_CODE20.test(source.cvn) || own10(source, "sourceholder_name") && !(typeof source.sourceholder_name === "string" && HOLDER_TEXT.test(source.sourceholder_name))) {
5403
+ return "paymob_body_unsupported";
5404
+ }
5405
+ if (!own10(SOURCE_FOR, parsed.api_source) || !SWITCH.has(parsed.unified_checkout) || parsed.unified_checkout !== SOURCE_FOR[parsed.api_source] || source.unified_checkout !== parsed.unified_checkout)
5406
+ return "paymob_body_unsupported";
5407
+ if (own10(parsed, "billing") && !addressBlock(parsed.billing) || own10(parsed, "shipping_data") && !addressBlock(parsed.shipping_data)) {
5408
+ return "paymob_body_unsupported";
5409
+ }
5410
+ if (own10(parsed, "fingerprint") && parsed.fingerprint !== null && !(typeof parsed.fingerprint === "string" && FINGERPRINT3.test(parsed.fingerprint))) {
5411
+ return "paymob_body_unsupported";
5412
+ }
5413
+ if (own10(parsed, "merchant-domain") && !(typeof parsed["merchant-domain"] === "string" && ORIGIN2.test(parsed["merchant-domain"]))) {
5414
+ return "paymob_body_unsupported";
5415
+ }
5416
+ return readPaymentKey(parsed.payment_token).code;
5417
+ }
5418
+ function paymobBodyVerdict(body) {
5419
+ if (body === void 0 || body === null || body === "")
5420
+ return CONTINUE12;
5421
+ const { parsed, exact: exact5 } = readJson8(body);
5422
+ if (!exact5 || !record29(parsed) || !record29(parsed.source) || typeof parsed.source.subtype !== "string")
5423
+ return refuse34("paymob_body_unsupported");
5424
+ const subtype = parsed.source.subtype;
5425
+ if (subtype === "CARD") {
5426
+ const code = judgeCardPayment(parsed);
5427
+ return code === null ? CARD33 : refuse34(code);
5428
+ }
5429
+ if (subtype === SAVED_CARD)
5430
+ return refuse34("paymob_saved_card");
5431
+ if (OTHER_CARD_SUBTYPES.has(subtype) || namesCardValue3(parsed))
5432
+ return refuse34("paymob_body_unsupported");
5433
+ return CONTINUE12;
5434
+ }
5435
+ // src/payu-latam.js
5436
+ var PAYU_LATAM_PSP = "payu_latam";
5437
+ var PAYU_LATAM_HOSTS = /* @__PURE__ */ Object.freeze({
5438
+ production: Object.freeze(["checkout.payulatam.com"]),
5439
+ sandbox: Object.freeze(["sandbox.checkout.payulatam.com"])
5440
+ });
5441
+ var PAYU_LATAM_COUNTRIES = /* @__PURE__ */ Object.freeze(["cl", "co", "mx", "pa", "pe"]);
5442
+ var UNREVIEWED_COUNTRIES = /* @__PURE__ */ Object.freeze(["ar", "br"]);
5443
+ var PAYU_LATAM_CARD_BRANDS = /* @__PURE__ */ Object.freeze(["VISA", "MASTERCARD", "AMEX", "DINERS"]);
5444
+ var BODY_LIMIT33 = 65536;
5445
+ var URL_LIMIT13 = 256;
5446
+ var SUBMIT_PATH = /^\/ppp-web-gateway-payu\/checkout\/submit\/([a-z]{2})\/credit_card\/([0-9a-f]{32})$/;
5447
+ var KEY = /^[0-9a-f]{32}$/;
5448
+ var CARD_KEYS14 = /* @__PURE__ */ Object.freeze(["number", "securityCode", "expirationDateMonth", "expirationDateYear", "cardType"]);
5449
+ var CARD_REQUIRED2 = /* @__PURE__ */ Object.freeze(["number", "securityCode", "expirationDateMonth", "expirationDateYear"]);
5450
+ var CARD_TYPES2 = /* @__PURE__ */ Object.freeze(["CREDIT", "DEBIT", "PREPAID"]);
5451
+ var NOT_THE_CARD_FORM = /* @__PURE__ */ Object.freeze([
5452
+ "checkoutPaymentMethod",
5453
+ "response",
5454
+ "checkoutPse",
5455
+ "checkoutKhipu",
5456
+ "smsCode",
5457
+ "checkoutDebitCard"
5458
+ ]);
5459
+ var TRANSACTION_MEMBERS = /* @__PURE__ */ Object.freeze([
5460
+ "id",
5461
+ "key",
5462
+ "isPaymentAttempt",
5463
+ "payer",
5464
+ "state",
5465
+ "merchantId",
5466
+ "orderId",
5467
+ "order",
5468
+ "checkoutPaymentMethod",
5469
+ "paymentNetwork",
5470
+ "paymentMethodType",
5471
+ "paymentMethodMain",
5472
+ "bank",
5473
+ "paymentAgreementId",
5474
+ "paymentCountry",
5475
+ "paymentExchangeRate",
5476
+ "response",
5477
+ "expirationDate",
5478
+ "lastUpdatedDate",
5479
+ "creationDate",
5480
+ "termsAndConditionId",
5481
+ "installments",
5482
+ "installmentValue",
5483
+ "internationalCard",
5484
+ "checkoutVersion",
5485
+ "payerCommissionValue",
5486
+ "payerInterestValue",
5487
+ "payerPricingValue",
5488
+ "promotionId",
5489
+ "shippingValue",
5490
+ "shipmentMerchantValue",
5491
+ "additionalValue",
5492
+ "administrativeFee",
5493
+ "payerTotalAmount",
5494
+ "source",
5495
+ "integrationMethod",
5496
+ "cardType",
5497
+ "creditCardCountry",
5498
+ "shippingInfo",
5499
+ "questionnaire",
5500
+ "merchantSoftDescriptor",
5501
+ "pmNetworkValue",
5502
+ "tea",
5503
+ "cft",
5504
+ "hasPaymentByPoints",
5505
+ "loyaltyProgramRedeemedAmount",
5506
+ "loyaltyProgramRedeemedPoints",
5507
+ "lendingEligible",
5508
+ "registerLendingDevice",
5509
+ "lendingDeviceToken",
5510
+ "abandonedLendingTransaction",
5511
+ "masterpassObfuscateCreditCardNumber",
5512
+ "isMasterpass",
5513
+ "brandName",
5514
+ "transactionType",
5515
+ "nossoNumero",
5516
+ "paymentTaxesDetails",
5517
+ "shopifyGid",
5518
+ "shopifyVersion",
5519
+ "shopifyShopDomain",
5520
+ "shopifyRedirectTime",
5521
+ "paymentCancelUrl",
5522
+ "checkoutCreditCard",
5523
+ "isRegisterPayer",
5524
+ "creditCardTokenId",
5525
+ "checkoutPse",
5526
+ "checkoutKhipu",
5527
+ "smsCode",
5528
+ "checkoutDebitCard"
5529
+ ]);
5530
+ var ADDRESS = ["street1", "street2", "street3", "city", "state", "country", "postalCode", "phone"];
5531
+ var PERSON = [
5532
+ "fullName",
5533
+ "emailAddress",
5534
+ "contactPhone",
5535
+ "phoneCountryCode",
5536
+ "dniNumber",
5537
+ "isDniNumberEncrypt",
5538
+ "dniType",
5539
+ "personType",
5540
+ "businessName",
5541
+ "cnpj",
5542
+ "gender"
5543
+ ];
5544
+ var MONEY = ["value", "symbol", "currency"];
5545
+ var RECORD_MEMBERS = /* @__PURE__ */ Object.freeze({
5546
+ payer: [...PERSON, "merchantBuyerId", "billingAddress", "birthDate", "identificationNumber", "identificationType"],
5547
+ "payer.billingAddress": ADDRESS,
5548
+ order: [
5549
+ "id",
5550
+ "referenceCode",
5551
+ "airlineCode",
5552
+ "description",
5553
+ "isTest",
5554
+ "signature",
5555
+ "language",
5556
+ "buyer",
5557
+ "shipment",
5558
+ "state",
5559
+ "status",
5560
+ "paymentApprovalDate",
5561
+ "creationDate",
5562
+ "accountId",
5563
+ "amount",
5564
+ "tax",
5565
+ "totalPurchase",
5566
+ "currency",
5567
+ "amountConvertedValue",
5568
+ "taxConvertedValue",
5569
+ "taxReturnBase",
5570
+ "taxReturnBaseConvertedValue",
5571
+ "additionalValue",
5572
+ "administrativeFee",
5573
+ "taxAdministrativeFee",
5574
+ "taxAdministrativeFeeReturnBase",
5575
+ "enabledPaymentMethods",
5576
+ "enabledInstallments",
5577
+ "enabledPaymentMethodTypes",
5578
+ "enabledIin",
5579
+ "enabledPseBanks",
5580
+ "enabledKhipuBanks",
5581
+ "paymentMethodsDescription",
5582
+ "urlEncodedId",
5583
+ "shippingValue",
5584
+ "paymentRequestLinkId",
5585
+ "airlineDescription",
5586
+ "displayShipping",
5587
+ "displayBuyerComments",
5588
+ "buyerCommentsLabel",
5589
+ "extraParameters",
5590
+ "dispersion"
5591
+ ],
5592
+ "order.buyer": [...PERSON, "merchantBuyerId", "buyerAddress", "comments"],
5593
+ "order.buyer.buyerAddress": ADDRESS,
5594
+ "order.shipment": [...PERSON, "merchantShipmentId", "shippingAddress", "comments"],
5595
+ "order.shipment.shippingAddress": ADDRESS,
5596
+ "order.amount": MONEY,
5597
+ "order.tax": MONEY,
5598
+ "order.totalPurchase": MONEY,
5599
+ "order.amountConvertedValue": MONEY,
5600
+ "order.taxConvertedValue": MONEY,
5601
+ "order.taxReturnBase": MONEY,
5602
+ "order.taxReturnBaseConvertedValue": MONEY,
5603
+ shippingInfo: [
5604
+ "userLogin",
5605
+ "id",
5606
+ "reference",
5607
+ "description",
5608
+ "currency",
5609
+ "deliveryCity",
5610
+ "deliveryCityName",
5611
+ "deliveryAddress1",
5612
+ "deliveryAddress2",
5613
+ "deliveryAddress3",
5614
+ "postalCode",
5615
+ "fullName",
5616
+ "documentType",
5617
+ "document",
5618
+ "phoneNumber",
5619
+ "observationsReceivingShipment",
5620
+ "destinationState",
5621
+ "destinationStateName",
5622
+ "destinationCountry",
5623
+ "destinationEmail",
5624
+ "originFullName",
5625
+ "originIdentificationType",
5626
+ "originIdentification",
5627
+ "originCity",
5628
+ "originState",
5629
+ "originCountry",
5630
+ "originAddress",
5631
+ "originZipCode",
5632
+ "originPhone",
5633
+ "originEmail",
5634
+ "kilogramWeight",
5635
+ "volumetricWeight",
5636
+ "totalValue",
5637
+ "declaredValue",
5638
+ "shippingValue",
5639
+ "guideNumber",
5640
+ "enlistmentApplies",
5641
+ "deliveryDate",
5642
+ "deliveryDays",
5643
+ "minDeliveryDays",
5644
+ "packageHeight",
5645
+ "packageWidth",
5646
+ "packageLength",
5647
+ "shippingProvider",
5648
+ "shippingState",
5649
+ "creationDate",
5650
+ "lastUpdateDate",
5651
+ "expirationDate",
5652
+ "signature",
5653
+ "strCreationDate",
5654
+ "comment",
5655
+ "warehouseId",
5656
+ "additionalDeliveryDays",
5657
+ "shippingMerchantValue"
5658
+ ],
5659
+ // PayU's own ten, as transaction/create names them, and the merchant's extra1 to extra4 (the payment form's
5660
+ // optional fields), each text or nothing.
5661
+ "order.extraParameters": [
5662
+ "CURRENCY",
5663
+ "LANGUAGE",
5664
+ "ACCOUNT_ID",
5665
+ "ALGORITHM_SIGNATURE",
5666
+ "CHECKOUT_VERSION",
5667
+ "RESPONSE_URL",
5668
+ "IS_TEST",
5669
+ "SIGNATURE",
5670
+ "NOTIFY_URL",
5671
+ "IP_COUNTRY",
5672
+ "EXTRA1",
5673
+ "EXTRA2",
5674
+ "EXTRA3",
5675
+ "EXTRA4"
5676
+ ]
5677
+ });
5678
+ var TEXT_RECORDS = /* @__PURE__ */ Object.freeze(["order.extraParameters"]);
5679
+ var CARD_WORDS = /* @__PURE__ */ Object.freeze([
5680
+ "card",
5681
+ "cards",
5682
+ "pan",
5683
+ "cvv",
5684
+ "cvv2",
5685
+ "cvc",
5686
+ "cvd",
5687
+ "csc",
5688
+ "ccv",
5689
+ "cc",
5690
+ "token",
5691
+ "masterpass",
5692
+ "wallet",
5693
+ "register",
5694
+ "recurring",
5695
+ "recurrent",
5696
+ "recurrence",
5697
+ "keep",
5698
+ "store",
5699
+ "save",
5700
+ "saved",
5701
+ "vault",
5702
+ "exp",
5703
+ "expiry",
5704
+ "expiration",
5705
+ "expiracion",
5706
+ "tarjeta",
5707
+ "tarjetas",
5708
+ "vencimiento"
5709
+ ]);
5710
+ var OWN_CARD_MEMBERS = /* @__PURE__ */ Object.freeze([
5711
+ "checkoutCreditCard",
5712
+ "cardType",
5713
+ "internationalCard",
5714
+ "creditCardCountry",
5715
+ "isMasterpass",
5716
+ "masterpassObfuscateCreditCardNumber",
5717
+ "isRegisterPayer",
5718
+ "registerLendingDevice",
5719
+ "lendingDeviceToken",
5720
+ "creditCardTokenId",
5721
+ "checkoutDebitCard",
5722
+ "expirationDate",
5723
+ "shippingInfo.expirationDate"
5724
+ ]);
5725
+ var SIGNATURE2 = /^[0-9a-f]{32,128}$/i;
5726
+ var OPAQUE_MEMBERS = /* @__PURE__ */ Object.freeze({
5727
+ key: /^[0-9a-f]{32}$/,
5728
+ "order.signature": SIGNATURE2,
5729
+ "order.extraParameters.SIGNATURE": SIGNATURE2,
5730
+ "shippingInfo.signature": SIGNATURE2,
5731
+ "order.urlEncodedId": /^[A-Za-z0-9+/=_-]{1,256}$/,
5732
+ shopifyGid: /^gid:\/\/shopify\/[A-Za-z]+\/[0-9]{1,20}$/
5733
+ });
5734
+ var IS_TEST_TEXT = /* @__PURE__ */ Object.freeze({ true: ["true", "1"], false: ["false", "0"] });
5735
+ var MASKS = /* @__PURE__ */ Object.freeze({ VISA: [4, 4, 4, 4], MASTERCARD: [4, 4, 4, 4], AMEX: [4, 6, 5], DINERS: [4, 6, 4] });
5736
+ var NETWORK2 = /* @__PURE__ */ Object.freeze({
5737
+ VISA: /^4(?:[0-9]{12}|[0-9]{15})$/,
5738
+ MASTERCARD: /^(?:5[1-5][0-9]{14}|2(?:2(?:2[1-9]|[3-9][0-9])|[3-6][0-9]{2}|7(?:[01][0-9]|20))[0-9]{12})$/,
5739
+ AMEX: /^3[47][0-9]{13}$/,
5740
+ DINERS: /^(?:3(?:0[0-5]|[68][0-9])[0-9]{11}|3095[0-9]{10}|3[89][0-9]{12})$/
5741
+ });
5742
+ var SECURITY_CODE21 = /^[0-9]{3,4}$/;
5743
+ var COUNTRY6 = /^[A-Z]{2}$/;
5744
+ var record30 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
5745
+ var owns7 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
5746
+ var refuse35 = (code) => Object.freeze({ verdict: "refuse", code });
5747
+ var CARD34 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
5748
+ var absent = (value, key) => !owns7(value, key) || value[key] === null;
5749
+ function payuLatamSubmitTarget(url) {
5750
+ if (typeof url !== "string" || url.length > URL_LIMIT13 || url.includes("?") || url.includes("#"))
5751
+ return null;
5752
+ let parsed;
5753
+ try {
5754
+ parsed = new URL(url);
5755
+ }
5756
+ catch {
5757
+ return null;
5758
+ }
5759
+ if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password)
5760
+ return null;
5761
+ const environment2 = PAYU_LATAM_HOSTS.production.includes(parsed.hostname) ? "production" : PAYU_LATAM_HOSTS.sandbox.includes(parsed.hostname) ? "sandbox" : null;
5762
+ const match = environment2 === null ? null : SUBMIT_PATH.exec(parsed.pathname);
5763
+ if (match === null || !(PAYU_LATAM_COUNTRIES.includes(match[1]) || UNREVIEWED_COUNTRIES.includes(match[1])))
5764
+ return null;
5765
+ return Object.freeze({ host: parsed.hostname, environment: environment2, country: match[1], key: match[2] });
5766
+ }
5767
+ function readJson9(body) {
5768
+ if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT33)
5769
+ return null;
5770
+ let at = 0;
5771
+ let nodes = 0;
5772
+ const fail = () => {
5773
+ throw new Error("invalid_payu_latam_json");
5774
+ };
5775
+ const space = () => {
5776
+ while (" \r\n".includes(body[at] ?? "\0"))
5777
+ at += 1;
5778
+ };
5779
+ const string = () => {
5780
+ space();
5781
+ const start = at;
5782
+ if (body[at++] !== '"')
5783
+ fail();
5784
+ while (at < body.length) {
5785
+ const character = body[at++];
5786
+ if (character === "\\") {
5787
+ at += 1;
5788
+ continue;
5789
+ }
5790
+ if (character === '"')
5791
+ return JSON.parse(body.slice(start, at));
5792
+ }
5793
+ return fail();
5794
+ };
5795
+ const value = (depth) => {
5796
+ if (depth > 8 || ++nodes > 4096)
5797
+ fail();
5798
+ space();
5799
+ const character = body[at];
5800
+ if (character === '"')
5801
+ return string();
5802
+ if (character === "{") {
5803
+ at += 1;
5804
+ const result = /* @__PURE__ */ Object.create(null);
5805
+ const seen = /* @__PURE__ */ new Set();
5806
+ space();
5807
+ if (body[at] === "}") {
5808
+ at += 1;
5809
+ return result;
5810
+ }
5811
+ for (;;) {
5812
+ const key = string();
5813
+ if (seen.has(key) || ["__proto__", "prototype", "constructor"].includes(key))
5814
+ fail();
5815
+ seen.add(key);
5816
+ space();
5817
+ if (body[at++] !== ":")
5818
+ fail();
5819
+ result[key] = value(depth + 1);
5820
+ space();
5821
+ const next = body[at++];
5822
+ if (next === "}")
5823
+ return result;
5824
+ if (next !== ",")
5825
+ fail();
5826
+ }
5827
+ }
5828
+ if (character === "[") {
5829
+ at += 1;
5830
+ const result = [];
5831
+ space();
5832
+ if (body[at] === "]") {
5833
+ at += 1;
5834
+ return result;
5835
+ }
5836
+ for (;;) {
5837
+ result.push(value(depth + 1));
5838
+ space();
5839
+ const next = body[at++];
5840
+ if (next === "]")
5841
+ return result;
5842
+ if (next !== ",")
5843
+ fail();
5844
+ }
5845
+ }
5846
+ for (const literal of ["true", "false", "null"]) {
5847
+ if (body.startsWith(literal, at)) {
5848
+ at += literal.length;
5849
+ return JSON.parse(literal);
5850
+ }
5851
+ }
5852
+ const number = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(body.slice(at, at + 32));
5853
+ if (!number || /^-?[0-9]{16,}$/.test(number[0]))
5854
+ fail();
5855
+ at += number[0].length;
5856
+ const parsed = Number(number[0]);
5857
+ if (!Number.isFinite(parsed))
5858
+ fail();
5859
+ return parsed;
5860
+ };
5861
+ try {
5862
+ const parsed = value(0);
5863
+ space();
5864
+ return at === body.length && record30(parsed) ? parsed : null;
5865
+ }
5866
+ catch {
5867
+ return null;
5868
+ }
5869
+ }
5870
+ function cardNamed2(key) {
5871
+ const words = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean).map((word) => word.toLowerCase());
5872
+ const phrase = words.join(" ");
5873
+ return words.some((word) => CARD_WORDS.includes(word)) || ["security code", "codigo seguridad", "codigo verificacion"].some((said) => phrase.includes(said));
5874
+ }
5875
+ function carriesCardNumber(text9) {
5876
+ for (const [run] of text9.matchAll(/[0-9]+(?:[ ._/,-][0-9]+)*/g)) {
5877
+ const groups = run.split(/[ ._/,-]/);
5878
+ for (let first = 0; first < groups.length; first += 1) {
5879
+ let digits4 = "";
5880
+ for (let last = first; last < groups.length && digits4.length + groups[last].length <= 19; last += 1) {
5881
+ digits4 += groups[last];
5882
+ if (digits4.length >= 13 && digits4[0] >= "2" && digits4[0] <= "6" && luhn7(digits4))
5883
+ return true;
5884
+ }
5885
+ }
5886
+ }
5887
+ return false;
5888
+ }
5889
+ var wholeCardNumber = (text9) => /^[2-6][0-9]{12,18}$/.test(text9) && luhn7(text9);
5890
+ function membersRefusal(root) {
5891
+ const pending = [[root, ""]];
5892
+ while (pending.length > 0) {
5893
+ const [node, path] = pending.pop();
5894
+ const own12 = path === "" ? TRANSACTION_MEMBERS : owns7(RECORD_MEMBERS, path) ? RECORD_MEMBERS[path] : null;
5895
+ for (const [key, child] of Object.entries(node)) {
5896
+ const at = Array.isArray(node) ? path : path === "" ? key : `${path}.${key}`;
5897
+ if (at === "checkoutCreditCard")
5898
+ continue;
5899
+ if (own12 !== null && !own12.includes(key))
5900
+ return true;
5901
+ if (TEXT_RECORDS.includes(path) && child !== null && typeof child !== "string")
5902
+ return true;
5903
+ if (!Array.isArray(node) && owns7(OPAQUE_MEMBERS, at)) {
5904
+ if (child !== null && (typeof child !== "string" || !OPAQUE_MEMBERS[at].test(child) || wholeCardNumber(child)))
5905
+ return true;
5906
+ continue;
5907
+ }
5908
+ if (!Array.isArray(node) && !OWN_CARD_MEMBERS.includes(at) && cardNamed2(key) && child !== null && child !== false)
5909
+ return true;
5910
+ if (typeof child === "string" && carriesCardNumber(child))
5911
+ return true;
5912
+ if (typeof child === "number" && (!/Date$/.test(key) || String(child).length > 13) && carriesCardNumber(String(child)))
5913
+ return true;
5914
+ if (child !== null && typeof child === "object")
5915
+ pending.push([child, at]);
5916
+ }
5917
+ }
5918
+ return false;
5919
+ }
5920
+ function cardDigits(number, brand) {
5921
+ if (typeof number !== "string")
5922
+ return null;
5923
+ if (/^[0-9]{12,19}$/.test(number))
5924
+ return number;
5925
+ const groups = number.split(" ");
5926
+ const mask = MASKS[brand];
5927
+ if (!mask || groups.length !== mask.length || !groups.every((group, at) => group.length === mask[at] && /^[0-9]+$/.test(group)))
5928
+ return null;
5929
+ return groups.join("");
5930
+ }
5931
+ function luhn7(digits4) {
5932
+ let sum = 0;
5933
+ for (let at = digits4.length - 1, double = false; at >= 0; at -= 1, double = !double) {
5934
+ let digit = digits4.charCodeAt(at) - 48;
5935
+ if (double) {
5936
+ digit *= 2;
5937
+ if (digit > 9)
5938
+ digit -= 9;
5939
+ }
5940
+ sum += digit;
5941
+ }
5942
+ return sum % 10 === 0;
5943
+ }
5944
+ function cardRefusal(card, brand) {
5945
+ if (!record30(card) || !Object.keys(card).every((key) => CARD_KEYS14.includes(key)) || !CARD_REQUIRED2.every((key) => owns7(card, key))) {
5946
+ return "payu_latam_body_unsupported";
5947
+ }
5948
+ const digits4 = cardDigits(card.number, brand);
5949
+ if (digits4 === null || !NETWORK2[brand].test(digits4) || !luhn7(digits4))
5950
+ return "payu_latam_body_unsupported";
5951
+ const code = card.securityCode;
5952
+ if (typeof code !== "string" || !SECURITY_CODE21.test(code) || code.length !== (brand === "AMEX" ? 4 : 3))
5953
+ return "payu_latam_body_unsupported";
5954
+ const { expirationDateMonth: month, expirationDateYear: year } = card;
5955
+ if (!Number.isSafeInteger(month) || month < 1 || month > 12 || !Number.isSafeInteger(year) || year < 0 || year > 99)
5956
+ return "payu_latam_body_unsupported";
5957
+ if (!absent(card, "cardType") && !CARD_TYPES2.includes(card.cardType))
5958
+ return "payu_latam_body_unsupported";
5959
+ return null;
5960
+ }
5961
+ function judgeBody5(body, target) {
5962
+ const value = readJson9(body);
5963
+ if (value === null || value.paymentMethodType !== "CREDIT_CARD" || typeof value.key !== "string" || !KEY.test(value.key) || !record30(value.order) || !record30(value.payer))
5964
+ return { code: "payu_latam_body_unsupported", value: null };
5965
+ if (target !== void 0 && value.key !== target.key)
5966
+ return { code: "payu_latam_session_mismatch", value: null };
5967
+ if (!absent(value, "creditCardTokenId") || value.isMasterpass === true || !absent(value, "masterpassObfuscateCreditCardNumber")) {
5968
+ return { code: "payu_latam_saved_card", value: null };
5969
+ }
5970
+ if (NOT_THE_CARD_FORM.some((key) => !absent(value, key)) || membersRefusal(value) || !absent(value, "lendingDeviceToken") || !absent(value, "questionnaire") || !(absent(value, "registerLendingDevice") || value.registerLendingDevice === false))
5971
+ return { code: "payu_latam_body_unsupported", value: null };
5972
+ const brand = value.paymentMethodMain;
5973
+ if (typeof brand !== "string" || !PAYU_LATAM_CARD_BRANDS.includes(brand))
5974
+ return { code: "payu_latam_card_unsupported", value: null };
5975
+ const card = cardRefusal(value.checkoutCreditCard, brand);
5976
+ if (card !== null)
5977
+ return { code: card, value: null };
5978
+ if (value.installments !== 1 && value.installments !== "1")
5979
+ return { code: "payu_latam_installments_unsupported", value: null };
5980
+ if (!absent(value, "cardType") && !CARD_TYPES2.includes(value.cardType) || !absent(value, "internationalCard") && typeof value.internationalCard !== "boolean" || !absent(value, "creditCardCountry") && (typeof value.creditCardCountry !== "string" || !COUNTRY6.test(value.creditCardCountry)) || !absent(value, "transactionType") && value.transactionType !== "AUTHORIZATION_AND_CAPTURE" || !absent(value, "isMasterpass") && typeof value.isMasterpass !== "boolean" || typeof value.order.isTest !== "boolean")
5981
+ return { code: "payu_latam_body_unsupported", value: null };
5982
+ const extra = value.order.extraParameters;
5983
+ if (!record30(extra) || !IS_TEST_TEXT[value.order.isTest].includes(extra.IS_TEST)) {
5984
+ return { code: "payu_latam_body_unsupported", value: null };
5985
+ }
5986
+ if (value.isRegisterPayer === true)
5987
+ return { code: "payu_latam_keep_on_file", value: null };
5988
+ if (!absent(value, "isRegisterPayer") && value.isRegisterPayer !== false)
5989
+ return { code: "payu_latam_body_unsupported", value: null };
5990
+ if (target !== void 0 && target.environment === "production" && value.order.isTest)
5991
+ return { code: "payu_latam_environment_mismatch", value: null };
5992
+ return { code: null, value };
5993
+ }
5994
+ function payuLatamBodyVerdict(body, url) {
5995
+ let target;
5996
+ if (url !== void 0) {
5997
+ target = payuLatamSubmitTarget(url);
5998
+ if (target === null)
5999
+ return refuse35("payu_latam_url_refused");
6000
+ if (!PAYU_LATAM_COUNTRIES.includes(target.country))
6001
+ return refuse35("payu_latam_country_unreviewed");
6002
+ }
6003
+ const { code } = judgeBody5(body, target);
6004
+ return code === null ? CARD34 : refuse35(code);
6005
+ }
6006
+ // src/registration.js
6007
+ var PARTS = { psp: "id", definitions: "list", refusedOperations: "list", settlementReadback: "any", exactUrl: "rule", bodyGate: "rule", amount: "rule" };
6008
+ var PSP_ID = /^[a-z][a-z0-9_]*$/;
6009
+ var registrationProblems = (spec) => problemsOf(spec, PARTS);
6010
+ function problemsOf(spec, parts) {
6011
+ if (!spec || typeof spec !== "object")
6012
+ return ["a registration is an object"];
6013
+ const psp = spec.psp;
6014
+ if (typeof psp !== "string" || !PSP_ID.test(psp))
6015
+ return [`${JSON.stringify(psp)} is not a processor id`];
6016
+ const problems2 = Object.keys(spec).filter((key) => !(key in parts)).map((key) => `${psp}: ${key} is no registration part`);
6017
+ for (const [key, kind] of Object.entries(parts)) {
6018
+ const value = spec[key];
6019
+ if (value === void 0)
6020
+ continue;
6021
+ if (kind === "rule" && typeof value !== "function")
6022
+ problems2.push(`${psp}: ${key} is not a function`);
6023
+ if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
6024
+ problems2.push(`${psp}: ${key} is not a list of card numbers`);
6025
+ }
6026
+ }
6027
+ if ("definitions" in parts) {
6028
+ if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
6029
+ problems2.push(`${psp}: names no definition`);
6030
+ else if (spec.definitions.some((definition) => definition?.psp !== psp))
6031
+ problems2.push(`${psp}: a definition names another processor`);
6032
+ for (const id of spec.refusedOperations ?? []) {
6033
+ if (typeof id !== "string" || !id.startsWith(`${psp}.`))
6034
+ problems2.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
6035
+ }
6036
+ }
6037
+ return problems2;
6038
+ }
6039
+ function registered(spec, parts) {
6040
+ const problems2 = problemsOf(spec, parts);
6041
+ if (problems2.length)
6042
+ throw new Error(`payment-core registration refused: ${problems2.join("; ")}`);
6043
+ return deepFreeze({ ...spec });
6044
+ }
6045
+ function registerProcessor(spec) {
6046
+ return registered(spec, PARTS);
6047
+ }
6048
+ // src/processors/midtrans.js
6049
+ var MIDTRANS_PSP = "midtrans";
6050
+ var MIDTRANS_OPERATION = "midtrans.card_request";
6051
+ var MIDTRANS_TOKEN_URL = "https://api.midtrans.com/v2/token";
6052
+ var MIDTRANS_SANDBOX_TOKEN_URL = "https://api.sandbox.midtrans.com/v2/token";
6053
+ var MIDTRANS_TOKEN_KEYS = /* @__PURE__ */ Object.freeze(["card_cvv", "card_number", "card_exp_month", "card_exp_year", "installment_term"]);
6054
+ var BODY_LIMIT34 = 4096;
6055
+ var CARD_NUMBER17 = /^[0-9]{12,19}$/;
6056
+ var SECURITY_CODE22 = /^[0-9]{3,4}$/;
6057
+ var MONTH18 = /^(?:0[1-9]|1[0-2])$/;
6058
+ var YEAR19 = /^20[0-9]{2}$/;
6059
+ var TERM = /^[0-9]{1,3}$/;
6060
+ var record31 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
6061
+ var own11 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
6062
+ var inOrder6 = (value, keys) => {
6063
+ let at = 0;
6064
+ for (const name of Object.keys(value)) {
6065
+ while (at < keys.length && keys[at] !== name)
6066
+ at += 1;
6067
+ if (at === keys.length)
6068
+ return false;
6069
+ at += 1;
6070
+ }
6071
+ return true;
6072
+ };
6073
+ var refuse36 = (code) => Object.freeze({ verdict: "refuse", code });
6074
+ var CARD35 = /* @__PURE__ */ Object.freeze({ verdict: "card" });
6075
+ function isMidtransTokenUrl(url) {
6076
+ return url === MIDTRANS_TOKEN_URL || url === MIDTRANS_SANDBOX_TOKEN_URL;
6077
+ }
6078
+ function readBody20(body) {
6079
+ if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT34)
6080
+ return null;
6081
+ let value;
6082
+ try {
6083
+ value = JSON.parse(body);
6084
+ if (!record31(value) || JSON.stringify(value) !== body)
6085
+ return null;
6086
+ }
6087
+ catch {
6088
+ return null;
6089
+ }
6090
+ return value;
6091
+ }
6092
+ function midtransBodyVerdict(body) {
6093
+ const value = readBody20(body);
6094
+ if (value === null || !inOrder6(value, MIDTRANS_TOKEN_KEYS)) {
6095
+ if (record31(value) && (own11(value, "token_id") || own11(value, "two_click")) && !own11(value, "card_number"))
6096
+ return refuse36("midtrans_saved_card");
6097
+ return refuse36("midtrans_body_unsupported");
6098
+ }
6099
+ if (!own11(value, "card_cvv") || !own11(value, "card_number") || !own11(value, "card_exp_month") || !own11(value, "card_exp_year")) {
6100
+ return refuse36("midtrans_body_unsupported");
6101
+ }
6102
+ if (typeof value.card_cvv !== "string" || !SECURITY_CODE22.test(value.card_cvv) || typeof value.card_number !== "string" || !CARD_NUMBER17.test(value.card_number) || typeof value.card_exp_month !== "string" || !MONTH18.test(value.card_exp_month) || typeof value.card_exp_year !== "string" || !YEAR19.test(value.card_exp_year))
6103
+ return refuse36("midtrans_body_unsupported");
6104
+ if (own11(value, "installment_term") && (typeof value.installment_term !== "string" || !TERM.test(value.installment_term)))
6105
+ return refuse36("midtrans_body_unsupported");
6106
+ return CARD35;
6107
+ }
6108
+ var midtrans_default = /* @__PURE__ */ registerProcessor({
6109
+ psp: MIDTRANS_PSP,
6110
+ definitions: [
6111
+ {
6112
+ psp: "midtrans",
6113
+ // Snap's token request, as the header above reads it. Sandbox has its own host, so the device sends a
6114
+ // test-mode request only Midtrans' documented test cards (hostEnvironmentPinned, device-replay.js S7).
6115
+ // Ships dark: served only to a client that declares `midtrans_card_token`, gated off for every org until an
6116
+ // operator lists one (`midtrans:<org>`), and the backend's gate serves only Agentcard's own company until the
6117
+ // token's publishable key is bound to the merchant (backend config.ts MIDTRANS_KEY_BOUND_TO_MERCHANT).
6118
+ capability: "midtrans_card_token",
6119
+ match: "api\\.(?:sandbox\\.)?midtrans\\.com/v2/token",
6120
+ hosts: ["^api\\.midtrans\\.com$", "^api\\.sandbox\\.midtrans\\.com$"],
6121
+ sandboxHosts: ["^api\\.sandbox\\.midtrans\\.com$"],
6122
+ hostEnvironmentPinned: true,
6123
+ encoding: "json",
6124
+ // Snap's own headers: the publishable client key (Authorization Basic) and X-Service. Origin, Referer and
6125
+ // cookies never ride.
6126
+ passthroughHeaders: ["^authorization$", "^x-service$"],
6127
+ jsonCardFields: [["card_number"]]
6128
+ }
6129
+ ],
6130
+ // Only the cardholder's device sends a token, after a person approves; no reviewed list names midtrans.
6131
+ refusedOperations: [MIDTRANS_OPERATION],
6132
+ // Not surveyed: the token moves no money, and the merchant's own charge names its status by the order id alone.
6133
+ settlementReadback: "not_surveyed",
6134
+ exactUrl: isMidtransTokenUrl,
6135
+ bodyGate: (url, body) => url !== void 0 && !isMidtransTokenUrl(url) ? { verdict: "refuse", code: "midtrans_url_refused" } : midtransBodyVerdict(body)
6136
+ });
6137
+ // src/processors/index.generated.js
6138
+ var REGISTERED_MODULES = Object.freeze({
6139
+ midtrans: midtrans_default
6140
+ });
6141
+ // src/registry.js
6142
+ var REGISTERED_PROCESSORS = Object.values(REGISTERED_MODULES);
6143
+ var ids = REGISTERED_PROCESSORS.map((processor) => processor.psp);
6144
+ var problems = REGISTERED_PROCESSORS.flatMap(registrationProblems);
6145
+ for (const [name, processor] of Object.entries(REGISTERED_MODULES)) {
6146
+ if (processor.psp !== name)
6147
+ problems.push(`processors/${name}.js registers ${JSON.stringify(processor.psp)}`);
6148
+ }
6149
+ if (ids.some((id, i) => i > 0 && ids[i - 1] >= id))
6150
+ problems.push(`registered processors out of id order: ${ids.join(", ")}`);
6151
+ if (problems.length)
6152
+ throw new Error(`payment-core registry refused: ${problems.join("; ")}`);
6153
+ var BY_PSP = new Map(REGISTERED_PROCESSORS.map((processor) => [processor.psp, processor]));
6154
+ var REGISTERED_IDS = Object.freeze(ids);
6155
+ var REGISTERED_DEFINITIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.definitions));
6156
+ var REGISTERED_REFUSED_OPERATIONS = Object.freeze(REGISTERED_PROCESSORS.flatMap((processor) => processor.refusedOperations ?? []));
6157
+ var REGISTERED_SETTLEMENT_READBACK = Object.freeze(REGISTERED_PROCESSORS.filter((processor) => processor.settlementReadback !== void 0).map((processor) => [processor.psp, processor.settlementReadback]));
6158
+ function registeredRule(psp, name) {
6159
+ return typeof psp === "string" ? BY_PSP.get(psp)?.[name] : void 0;
6160
+ }
5074
6161
  // src/card-fields.js
5075
6162
  function processorGate(recognizer, url, body) {
5076
6163
  if (recognizer && recognizer.psp === LYRA_PSP)
@@ -5108,6 +6195,8 @@ function processorGate(recognizer, url, body) {
5108
6195
  return { verdict: "refuse", code: "toast_url_refused" };
5109
6196
  return toastBodyVerdict(body);
5110
6197
  }
6198
+ if (recognizer && recognizer.psp === PAYU_LATAM_PSP)
6199
+ return payuLatamBodyVerdict(body, url);
5111
6200
  if (recognizer && recognizer.psp === PADDLE_VGS_PSP) {
5112
6201
  if (url !== void 0 && !isPaddleVgsCardsUrl(url))
5113
6202
  return { verdict: "refuse", code: "paddle_vgs_url_refused" };
@@ -5191,6 +6280,11 @@ function processorGate(recognizer, url, body) {
5191
6280
  return { verdict: "refuse", code: "xendit_url_refused" };
5192
6281
  return xenditBodyVerdict(body);
5193
6282
  }
6283
+ if (recognizer && recognizer.psp === PAYMOB_PSP) {
6284
+ if (url !== void 0 && !isPaymobPayUrl(url))
6285
+ return { verdict: "refuse", code: "paymob_url_refused" };
6286
+ return paymobBodyVerdict(body);
6287
+ }
5194
6288
  if (recognizer && recognizer.psp === GRAVY_PSP)
5195
6289
  return gravyBodyVerdict(body);
5196
6290
  if (recognizer && recognizer.psp === MONERIS_PSP) {
@@ -5198,6 +6292,14 @@ function processorGate(recognizer, url, body) {
5198
6292
  return { verdict: "refuse", code: "moneris_url_refused" };
5199
6293
  return monerisBodyVerdict(body);
5200
6294
  }
6295
+ if (recognizer && recognizer.psp === TAPPAY_PSP) {
6296
+ if (url !== void 0 && !isTappayGetPrimeUrl(url))
6297
+ return { verdict: "refuse", code: "tappay_url_refused" };
6298
+ return tappayBodyVerdict(body);
6299
+ }
6300
+ const ownGate = registeredRule(recognizer?.psp, "bodyGate");
6301
+ if (ownGate)
6302
+ return ownGate(url, body);
5201
6303
  if (!recognizer || recognizer.psp !== "elavon_converge")
5202
6304
  return null;
5203
6305
  if (url !== void 0 && !isConvergeProcessUrl(url))
@@ -5311,21 +6413,21 @@ var KEEP_ON_FILE_REFUSAL = "Refusing to pay: this Primer payment would keep the
5311
6413
  var UNSUPPORTED_SDK_REFUSAL = "Refusing to pay: this checkout uses a Primer SDK Agentcard does not support yet. Nothing was sent.";
5312
6414
  var NETWORK_MISMATCH_REFUSAL = "Refusing to pay: this Primer payment names a card network that is not your card's. Nothing was sent.";
5313
6415
  var FILL_REFUSAL = "Could not fill the card fields for Primer. Nothing was sent.";
5314
- var BODY_LIMIT31 = 16384;
6416
+ var BODY_LIMIT35 = 16384;
5315
6417
  var RESPONSE_LIMIT = 32768;
5316
6418
  var ROOT_KEYS10 = ["paymentInstrument", "userDescription", "tokenType", "paymentFlow"];
5317
6419
  var INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear", "cardholderName", "preferredNetwork"];
5318
6420
  var REQUIRED_INSTRUMENT_KEYS = ["number", "cvv", "expirationMonth", "expirationYear"];
5319
- var record28 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
5320
- var owns7 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
6421
+ var record32 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
6422
+ var owns8 = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
5321
6423
  var exact4 = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
5322
6424
  var text8 = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
5323
6425
  var digits3 = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
5324
6426
  var panLike2 = (value) => /(?:[0-9][ _.:-]*){12,}/.test(value);
5325
6427
  var plain2 = (value, max) => text8(value, max) && !panLike2(value);
5326
- var MONTH17 = /^(?:0[1-9]|1[0-2])$/;
5327
- var YEAR18 = /^20[0-9]{2}$/;
5328
- var NETWORK2 = /^[A-Z][A-Z_]{1,31}$/;
6428
+ var MONTH19 = /^(?:0[1-9]|1[0-2])$/;
6429
+ var YEAR20 = /^20[0-9]{2}$/;
6430
+ var NETWORK3 = /^[A-Z][A-Z_]{1,31}$/;
5329
6431
  function isPrimerTokenizeUrl(url, method = "POST") {
5330
6432
  if (method !== "POST" || typeof url !== "string" || url.length > 256 || url.includes("?") || url.includes("#"))
5331
6433
  return false;
@@ -5338,8 +6440,8 @@ function isPrimerTokenizeUrl(url, method = "POST") {
5338
6440
  }
5339
6441
  return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && !parsed.search && !parsed.hash && PRIMER_PCI_HOSTS.includes(parsed.hostname) && parsed.pathname === PRIMER_TOKENIZE_PATH;
5340
6442
  }
5341
- function judgeBody5(body) {
5342
- if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT31)
6443
+ function judgeBody6(body) {
6444
+ if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT35)
5343
6445
  return null;
5344
6446
  let value;
5345
6447
  try {
@@ -5348,21 +6450,21 @@ function judgeBody5(body) {
5348
6450
  catch {
5349
6451
  return null;
5350
6452
  }
5351
- if (!record28(value) || !roundTrips(value, body))
6453
+ if (!record32(value) || !roundTrips(value, body))
5352
6454
  return null;
5353
- if (!Object.keys(value).every((key) => ROOT_KEYS10.includes(key)) || !owns7(value, "paymentInstrument"))
6455
+ if (!Object.keys(value).every((key) => ROOT_KEYS10.includes(key)) || !owns8(value, "paymentInstrument"))
5354
6456
  return null;
5355
6457
  const instrument = value.paymentInstrument;
5356
- if (!record28(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns7(instrument, key)))
6458
+ if (!record32(instrument) || !Object.keys(instrument).every((key) => INSTRUMENT_KEYS.includes(key)) || !REQUIRED_INSTRUMENT_KEYS.every((key) => owns8(instrument, key)))
5357
6459
  return null;
5358
- if (!digits3(instrument.number, 12, 19) || !digits3(instrument.cvv, 3, 4) || !exact4(MONTH17, instrument.expirationMonth) || !exact4(YEAR18, instrument.expirationYear))
6460
+ if (!digits3(instrument.number, 12, 19) || !digits3(instrument.cvv, 3, 4) || !exact4(MONTH19, instrument.expirationMonth) || !exact4(YEAR20, instrument.expirationYear))
5359
6461
  return null;
5360
- if (owns7(instrument, "cardholderName") && instrument.cardholderName !== null && !plain2(instrument.cardholderName, 256) || owns7(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact4(NETWORK2, instrument.preferredNetwork) || owns7(value, "userDescription") && value.userDescription !== null && !plain2(value.userDescription, 256) || owns7(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns7(value, "paymentFlow") && value.paymentFlow !== "VAULT")
6462
+ if (owns8(instrument, "cardholderName") && instrument.cardholderName !== null && !plain2(instrument.cardholderName, 256) || owns8(instrument, "preferredNetwork") && instrument.preferredNetwork !== null && !exact4(NETWORK3, instrument.preferredNetwork) || owns8(value, "userDescription") && value.userDescription !== null && !plain2(value.userDescription, 256) || owns8(value, "tokenType") && value.tokenType !== "MULTI_USE" || owns8(value, "paymentFlow") && value.paymentFlow !== "VAULT")
5361
6463
  return null;
5362
- return { value, keepOnFile: owns7(value, "tokenType") || owns7(value, "paymentFlow") };
6464
+ return { value, keepOnFile: owns8(value, "tokenType") || owns8(value, "paymentFlow") };
5363
6465
  }
5364
6466
  function primerBodyRefusal(body) {
5365
- const judged = judgeBody5(body);
6467
+ const judged = judgeBody6(body);
5366
6468
  if (!judged)
5367
6469
  return "unsupported";
5368
6470
  return judged.keepOnFile ? "keep_on_file" : null;
@@ -5371,7 +6473,7 @@ function isPrimerNewCardBody(body) {
5371
6473
  return primerBodyRefusal(body) === null;
5372
6474
  }
5373
6475
  function primerKeepOnFileRequested(body) {
5374
- const judged = judgeBody5(body);
6476
+ const judged = judgeBody6(body);
5375
6477
  return judged ? judged.keepOnFile : null;
5376
6478
  }
5377
6479
  var CARD_GATE = /* @__PURE__ */ Object.freeze({ psp: "primer", encoding: "json", jsonCardFields: [["paymentInstrument", "number"]] });
@@ -5381,7 +6483,7 @@ var CLIENT_TOKEN = /^[A-Za-z0-9._~+/=-]{16,4096}$/;
5381
6483
  var REQUEST_ID = /^[A-Za-z0-9-]{1,64}$/;
5382
6484
  var API_VERSION = /^2\.[0-9]{1,2}$/;
5383
6485
  function readHeaders(headers) {
5384
- if (!record28(headers))
6486
+ if (!record32(headers))
5385
6487
  return null;
5386
6488
  const folded = /* @__PURE__ */ new Map();
5387
6489
  for (const [name, value] of Object.entries(headers)) {
@@ -5428,7 +6530,7 @@ function onTokenizePath(url) {
5428
6530
  }
5429
6531
  }
5430
6532
  function primerTokenizeRefusal(request) {
5431
- if (!record28(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
6533
+ if (!record32(request) || request.method !== "POST" || !isPrimerTokenizeUrl(request.url))
5432
6534
  return "unsupported";
5433
6535
  return headersRefusal(request.headers) ?? primerBodyRefusal(request.body);
5434
6536
  }
@@ -5443,7 +6545,7 @@ function primerCardOnFileRefusal(url, options, policy = PRIMER_SESSION_CARD_ON_F
5443
6545
  return "unsupported";
5444
6546
  if (new URL(url).hostname !== LIVE_PCI_HOST)
5445
6547
  return null;
5446
- return primerCardOnFileDisclosure(url, policy) && record28(options) && options.keepOnFile === true ? null : "keep_on_file";
6548
+ return primerCardOnFileDisclosure(url, policy) && record32(options) && options.keepOnFile === true ? null : "keep_on_file";
5447
6549
  }
5448
6550
  function primerRefusalMessage(reason) {
5449
6551
  if (reason === "keep_on_file")
@@ -5468,7 +6570,7 @@ function primerCardNetwork(number) {
5468
6570
  return null;
5469
6571
  }
5470
6572
  function primerNetworkRefusal(body, card) {
5471
- const judged = judgeBody5(body);
6573
+ const judged = judgeBody6(body);
5472
6574
  if (!judged)
5473
6575
  return "unsupported";
5474
6576
  const preferred = judged.value.paymentInstrument.preferredNetwork;
@@ -5478,7 +6580,7 @@ function primerNetworkRefusal(body, card) {
5478
6580
  return network !== null && network === preferred ? null : "network_mismatch";
5479
6581
  }
5480
6582
  function injectPrimerCard(body, card) {
5481
- const judged = judgeBody5(body);
6583
+ const judged = judgeBody6(body);
5482
6584
  if (!judged)
5483
6585
  throw new Error(UNSUPPORTED_REFUSAL);
5484
6586
  if (judged.keepOnFile)
@@ -5508,7 +6610,7 @@ var CODE7 = /^[A-Z][A-Z0-9_]{0,63}$/;
5508
6610
  var NETWORK_NAME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
5509
6611
  var RESPONSE_MONTH = /^(?:0?[1-9]|1[0-2])$/;
5510
6612
  var RESPONSE_YEAR = /^(?:[0-9]{2}|20[0-9]{2})$/;
5511
- var PROTOCOL = /^[0-9]{1,2}(?:\.[0-9]{1,2}){0,2}$/;
6613
+ var PROTOCOL2 = /^[0-9]{1,2}(?:\.[0-9]{1,2}){0,2}$/;
5512
6614
  var BIN_KEYS = [
5513
6615
  "network",
5514
6616
  "issuerCountryCode",
@@ -5527,28 +6629,28 @@ function readAnswer(body) {
5527
6629
  return null;
5528
6630
  try {
5529
6631
  const value = JSON.parse(body);
5530
- return record28(value) ? value : null;
6632
+ return record32(value) ? value : null;
5531
6633
  }
5532
6634
  catch {
5533
6635
  return null;
5534
6636
  }
5535
6637
  }
5536
6638
  var tokenValue = (value) => exact4(TOKEN4, value) && !panLike2(value);
5537
- var optional = (value, key, check) => !owns7(value, key) || value[key] === null || check(value[key]);
6639
+ var optional = (value, key, check) => !owns8(value, key) || value[key] === null || check(value[key]);
5538
6640
  function cardDetails(data) {
5539
- if (!record28(data) || !exact4(/^[0-9]{4}$/, data.last4Digits))
6641
+ if (!record32(data) || !exact4(/^[0-9]{4}$/, data.last4Digits))
5540
6642
  return null;
5541
- if (!optional(data, "first6Digits", (v) => exact4(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact4(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact4(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain2(v, 256)) || !optional(data, "network", (v) => exact4(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record28))
6643
+ if (!optional(data, "first6Digits", (v) => exact4(/^[0-9]{6}$/, v)) || !optional(data, "expirationMonth", (v) => exact4(RESPONSE_MONTH, v)) || !optional(data, "expirationYear", (v) => exact4(RESPONSE_YEAR, v)) || !optional(data, "cardholderName", (v) => plain2(v, 256)) || !optional(data, "network", (v) => exact4(NETWORK_NAME, v)) || !optional(data, "isNetworkTokenized", (v) => typeof v === "boolean") || !optional(data, "binData", record32))
5542
6644
  return null;
5543
6645
  const safe = { last4Digits: data.last4Digits };
5544
6646
  for (const key of ["first6Digits", "expirationMonth", "expirationYear", "cardholderName", "network", "isNetworkTokenized"]) {
5545
- if (owns7(data, key) && data[key] !== null)
6647
+ if (owns8(data, key) && data[key] !== null)
5546
6648
  safe[key] = data[key];
5547
6649
  }
5548
- if (record28(data.binData)) {
6650
+ if (record32(data.binData)) {
5549
6651
  const bin = {};
5550
6652
  for (const key of BIN_KEYS) {
5551
- if (!owns7(data.binData, key) || data.binData[key] === null)
6653
+ if (!owns8(data.binData, key) || data.binData[key] === null)
5552
6654
  continue;
5553
6655
  if (!plain2(data.binData[key], 128))
5554
6656
  return null;
@@ -5561,11 +6663,11 @@ function cardDetails(data) {
5561
6663
  function threeDsSummary(value) {
5562
6664
  if (value === void 0 || value === null)
5563
6665
  return null;
5564
- if (!record28(value) || !exact4(CODE7, value.responseCode) || !optional(value, "reasonCode", (v) => exact4(CODE7, v)) || !optional(value, "reasonText", (v) => plain2(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact4(PROTOCOL, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
6666
+ if (!record32(value) || !exact4(CODE7, value.responseCode) || !optional(value, "reasonCode", (v) => exact4(CODE7, v)) || !optional(value, "reasonText", (v) => plain2(v, 256)) || !optional(value, "protocolVersion", (v) => v === "" || exact4(PROTOCOL2, v)) || !optional(value, "challengeIssued", (v) => typeof v === "boolean"))
5565
6667
  return void 0;
5566
6668
  const safe = { responseCode: value.responseCode };
5567
6669
  for (const key of ["reasonCode", "reasonText", "protocolVersion", "challengeIssued"]) {
5568
- if (owns7(value, key) && value[key] !== null)
6670
+ if (owns8(value, key) && value[key] !== null)
5569
6671
  safe[key] = value[key];
5570
6672
  }
5571
6673
  return safe;
@@ -5578,7 +6680,7 @@ function rebuildToken(value) {
5578
6680
  if (!details || threeDs === void 0)
5579
6681
  return null;
5580
6682
  const safe = { token: value.token };
5581
- if (owns7(value, "analyticsId") && value.analyticsId !== null)
6683
+ if (owns8(value, "analyticsId") && value.analyticsId !== null)
5582
6684
  safe.analyticsId = value.analyticsId;
5583
6685
  safe.tokenType = "SINGLE_USE";
5584
6686
  safe.paymentInstrumentType = "PAYMENT_CARD";
@@ -5589,7 +6691,7 @@ function rebuildToken(value) {
5589
6691
  }
5590
6692
  function primerErrorId(body) {
5591
6693
  const value = readAnswer(body);
5592
- const id = value && record28(value.error) ? value.error.errorId : null;
6694
+ const id = value && record32(value.error) ? value.error.errorId : null;
5593
6695
  return exact4(ERROR_ID, id) && !panLike2(id) ? id : null;
5594
6696
  }
5595
6697
  function matchesCard(details, card) {