@agent-cards/sdk 0.23.22 → 0.23.24

package/dist/tap-payments.generated.js

@@ -0,0 +1,990 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 25bf499d00df8220a58e6f28f22522db1f7a4048dcdbd95ad321614df5b68b6d
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/rsa-pkcs1v15.js
+var RsaPkcs1v15Error = class extends Error {
+    constructor(reason) {
+        super("RSA PKCS#1 v1.5 encryption refused.");
+        this.name = "RsaPkcs1v15Error";
+        this.code = "rsa_pkcs1v15_refused";
+        this.reason = reason;
+    }
+};
+var refuse = (reason) => new RsaPkcs1v15Error(reason);
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var RSA_ALGORITHM = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+var MODULUS_BYTES = [128, 256, 384, 512];
+var MIN_PADDING = 8;
+var MAX_DRAWS = 16;
+var TYPED_ARRAY = Object.getPrototypeOf(Uint8Array.prototype);
+var typedArrayName = Object.getOwnPropertyDescriptor(TYPED_ARRAY, Symbol.toStringTag).get;
+function parseRsaPublicKey(key) {
+    const spki = key && typeof key === "object" ? key.spki : void 0;
+    const pin2 = key && typeof key === "object" ? key.sha256 : void 0;
+    const named = key && typeof key === "object" && Object.prototype.hasOwnProperty.call(key, "exponent") ? key.exponent : void 0;
+    if (named !== void 0 && named !== 17)
+        throw refuse("key");
+    if (typeof spki !== "string" || spki.length > 1024 || spki.length % 4 !== 0 || !BASE64.test(spki))
+        throw refuse("key");
+    if (typeof pin2 !== "string" || !SHA256_HEX.test(pin2))
+        throw refuse("key");
+    let binary;
+    try {
+        binary = atob(spki);
+    }
+    catch {
+        throw refuse("key");
+    }
+    if (btoa(binary) !== spki)
+        throw refuse("key");
+    const der = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    if (sha256Hex(der) !== pin2)
+        throw refuse("key");
+    const outer = readElement(der, 0, 48);
+    if (outer.end !== der.length || outer.start + RSA_ALGORITHM.length > der.length)
+        throw refuse("key");
+    if (!RSA_ALGORITHM.every((byte, i) => der[outer.start + i] === byte))
+        throw refuse("key");
+    const bits = readElement(der, outer.start + RSA_ALGORITHM.length, 3);
+    if (bits.end !== outer.end || bits.start === bits.end || der[bits.start] !== 0)
+        throw refuse("key");
+    const rsa = readElement(der, bits.start + 1, 48);
+    if (rsa.end !== bits.end)
+        throw refuse("key");
+    const modulus = readPositiveInteger(der, rsa.start);
+    const exponent = readPositiveInteger(der, modulus.end);
+    if (exponent.end !== rsa.end)
+        throw refuse("key");
+    const n = modulus.bytes;
+    if (!MODULUS_BYTES.includes(n.length) || !(n[0] & 128) || !(n[n.length - 1] & 1))
+        throw refuse("key");
+    const e = exponent.bytes;
+    const expected = named === 17 ? [17] : [1, 0, 1];
+    if (e.length !== expected.length || !expected.every((byte, i) => e[i] === byte))
+        throw refuse("key");
+    return Object.freeze({ n: toBigInt(n), e: named === 17 ? 17n : 65537n, size: n.length });
+}
+function rsaesPkcs1v15Encrypt(key, message, random) {
+    const { n, e, size } = parseRsaPublicKey(key);
+    if (typedArrayName.call(message) !== "Uint8Array")
+        throw refuse("message");
+    let bytes;
+    try {
+        bytes = new Uint8Array(message);
+    }
+    catch {
+        throw refuse("message");
+    }
+    const em = new Uint8Array(size);
+    try {
+        if (bytes.length > size - MIN_PADDING - 3)
+            throw refuse("message");
+        em[1] = 2;
+        fillNonZero(em.subarray(2, size - bytes.length - 1), random);
+        em.set(bytes, size - bytes.length);
+        return toBytes(modPow(toBigInt(em), e, n), size);
+    }
+    finally {
+        em.fill(0);
+        bytes.fill(0);
+    }
+}
+function readElement(der, at, tag) {
+    if (at + 2 > der.length || der[at] !== tag)
+        throw refuse("key");
+    let length = der[at + 1];
+    let start = at + 2;
+    if (length & 128) {
+        const count = length & 127;
+        if (count === 0 || count > 2 || start + count > der.length || der[start] === 0)
+            throw refuse("key");
+        length = count === 1 ? der[start] : der[start] * 256 + der[start + 1];
+        if (length < 128)
+            throw refuse("key");
+        start += count;
+    }
+    if (start + length > der.length)
+        throw refuse("key");
+    return { start, end: start + length };
+}
+function readPositiveInteger(der, at) {
+    const { start, end } = readElement(der, at, 2);
+    if (end === start || der[start] & 128)
+        throw refuse("key");
+    if (der[start] === 0 && (end - start === 1 || !(der[start + 1] & 128)))
+        throw refuse("key");
+    return { bytes: der.subarray(der[start] === 0 ? start + 1 : start, end), end };
+}
+function fillNonZero(target, random) {
+    if (!random || typeof random.getRandomValues !== "function")
+        throw refuse("random");
+    const draw = new Uint8Array(target.length);
+    let filled = 0;
+    try {
+        for (let round = 0; round < MAX_DRAWS && filled < target.length; round++) {
+            draw.fill(0);
+            random.getRandomValues(draw);
+            for (let i = 0; i < draw.length && filled < target.length; i++)
+                if (draw[i] !== 0)
+                    target[filled++] = draw[i];
+        }
+    }
+    catch {
+        throw refuse("random");
+    }
+    finally {
+        draw.fill(0);
+    }
+    if (filled < target.length)
+        throw refuse("random");
+}
+function toBigInt(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++)
+        hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return BigInt(`0x${hex}`);
+}
+function toBytes(value, size) {
+    const hex = value.toString(16).padStart(size * 2, "0");
+    const out = new Uint8Array(size);
+    for (let i = 0; i < size; i++)
+        out[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+function modPow(base, exponent, modulus) {
+    let result = 1n;
+    let square = base % modulus;
+    for (let rest = exponent; rest > 0n; rest >>= 1n) {
+        if (rest & 1n)
+            result = result * square % modulus;
+        square = square * square % modulus;
+    }
+    return result;
+}
+// src/adyen-jwe.js
+var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+function isAdyenJweCompact(s) {
+    if (typeof s !== "string" || s.length > 2048)
+        return false;
+    const parts = s.split(".");
+    if (parts.length !== 5)
+        return false;
+    const [header, encryptedKey, iv, ciphertext, tag] = parts;
+    if (!parts.every((p) => p.length > 0 && BASE64URL.test(p)))
+        return false;
+    if (encryptedKey.length !== 342 || iv.length !== 16 || tag.length !== 22)
+        return false;
+    if (ciphertext.length > 1024)
+        return false;
+    return isAdyenJweHeader(header);
+}
+function isAdyenJweHeader(segment) {
+    if (!BASE64URL.test(segment) || segment.length > 128)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(segment.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const obj = parsed;
+    const keys = Object.keys(obj).sort();
+    if (keys.join(",") !== "alg,enc,version")
+        return false;
+    return obj.alg === ADYEN_JWE_HEADER.alg && obj.enc === ADYEN_JWE_HEADER.enc && obj.version === ADYEN_JWE_HEADER.version;
+}
+// src/json-path.js
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isPlainObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+var MAX_PATH_STEPS = 16;
+function isJsonPath(path) {
+    return Array.isArray(path) && path.length <= MAX_PATH_STEPS && path.every((step) => typeof step === "string" ? step.length > 0 && !FORBIDDEN_KEYS.has(step) : Number.isSafeInteger(step) && step >= 0);
+}
+function jsonAt(root, path) {
+    let node = root;
+    for (const step of path) {
+        if (typeof step === "string") {
+            if (!isPlainObject(node) || FORBIDDEN_KEYS.has(step) || !Object.prototype.hasOwnProperty.call(node, step))
+                return { found: false };
+        }
+        else if (!Array.isArray(node) || !Number.isSafeInteger(step) || step < 0 || step >= node.length) {
+            return { found: false };
+        }
+        node = node[step];
+    }
+    return { found: true, value: node };
+}
+function roundTrips(parsed, body) {
+    try {
+        return JSON.stringify(parsed) === body;
+    }
+    catch {
+        return false;
+    }
+}
+function sameSteps(a, b) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((step, i) => step === b[i]);
+}
+function pathsOverlap(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+function describePath(path) {
+    return path.length ? path.map((step) => typeof step === "number" ? `[${step}]` : `.${step}`).join("").replace(/^\./, "") : "(root)";
+}
+// src/substitution-primitives.js
+var SubstitutionError = class extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SubstitutionError";
+    }
+};
+var SWAP_MEMBERS = /* @__PURE__ */ new Set(["path", "fields", "remove", "set"]);
+function checkedSet(set, path, names, remove) {
+    if (!Array.isArray(set))
+        throw new SubstitutionError("substitutions.set is not a list");
+    const entries = [...set].map((raw) => {
+        const entry = isPlainObject(raw) ? Object.fromEntries(Object.entries(raw)) : null;
+        if (!entry || Object.keys(entry).sort().join(",") !== "path,value")
+            throw new SubstitutionError("a set entry is not a {path, value}");
+        const at = Array.isArray(entry.path) ? [...entry.path] : entry.path;
+        if (!isJsonPath(at) || at.length === 0 || typeof at[at.length - 1] !== "string")
+            throw new SubstitutionError("refusing set path");
+        const value = entry.value;
+        if (value !== null && !["string", "boolean"].includes(typeof value) && !(typeof value === "number" && Number.isFinite(value))) {
+            throw new SubstitutionError(`the set value at ${describePath(at)} is not a string, number, boolean or null`);
+        }
+        const key = at[at.length - 1];
+        if (sameSteps(at.slice(0, -1), path) && (names.includes(key) || remove.includes(key))) {
+            throw new SubstitutionError(`the set entry at ${describePath(at)} writes over an encrypted field or a removed key`);
+        }
+        return { path: at, value };
+    });
+    for (const [i, a] of entries.entries()) {
+        for (const b of entries.slice(i + 1)) {
+            if (pathsOverlap(a.path, b.path))
+                throw new SubstitutionError(`two set entries write at ${describePath(a.path)}`);
+        }
+    }
+    return entries;
+}
+var ADYEN_JWE = /* @__PURE__ */ Object.freeze({ accepts: isAdyenJweCompact, label: "an Adyen JWE" });
+function swapMerchantHostedFields(body, spec, ciphertext = ADYEN_JWE) {
+    if (!isPlainObject(spec))
+        throw new SubstitutionError("refusing a substitution that is not an object");
+    for (const member of Object.keys(spec)) {
+        if (!SWAP_MEMBERS.has(member))
+            throw new SubstitutionError(`unexpected substitution member ${member}`);
+    }
+    const path = Array.isArray(spec.path) ? [...spec.path] : spec.path;
+    const fields = isPlainObject(spec.fields) ? Object.fromEntries(Object.entries(spec.fields)) : null;
+    const remove = Array.isArray(spec.remove) ? [...spec.remove] : spec.remove ?? [];
+    if (!isJsonPath(path))
+        throw new SubstitutionError("refusing substitution path");
+    if (!fields || Object.keys(fields).length === 0)
+        throw new SubstitutionError("substitutions carry no fields");
+    const names = Object.keys(fields);
+    const values = names.map((name) => fields[name]);
+    for (const name of names) {
+        if (FORBIDDEN_KEYS.has(name))
+            throw new SubstitutionError(`refusing substitution field ${name}`);
+        if (!ciphertext.accepts(fields[name]))
+            throw new SubstitutionError(`substitution for ${name} is not ${ciphertext.label}`);
+    }
+    if (!Array.isArray(remove))
+        throw new SubstitutionError("substitutions.remove is not a list");
+    for (const key of remove) {
+        if (typeof key !== "string" || !key || FORBIDDEN_KEYS.has(key))
+            throw new SubstitutionError(`refusing removal of ${String(key)}`);
+        if (names.includes(key))
+            throw new SubstitutionError(`substitution field ${key} is also listed for removal`);
+    }
+    if (new Set(remove).size !== remove.length)
+        throw new SubstitutionError("substitutions.remove names a key twice");
+    const set = checkedSet(spec.set ?? [], path, names, remove);
+    if (typeof body !== "string")
+        throw new SubstitutionError("the paused body is not JSON");
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        throw new SubstitutionError("the paused body is not JSON");
+    }
+    if (!isPlainObject(parsed))
+        throw new SubstitutionError("the paused body is not a JSON object");
+    const holder = jsonAt(parsed, path);
+    if (!holder.found || !isPlainObject(holder.value))
+        throw new SubstitutionError(`the paused body has no object at ${describePath(path)}`);
+    const swaps = /* @__PURE__ */ new Map();
+    for (const name of names) {
+        const dummy = Object.prototype.hasOwnProperty.call(holder.value, name) ? holder.value[name] : void 0;
+        if (typeof dummy !== "string")
+            throw new SubstitutionError(`the paused body has no string field ${name} at ${describePath(path)}`);
+        if (!ciphertext.accepts(dummy))
+            throw new SubstitutionError(`the paused field ${name} is not ${ciphertext.label}`);
+        if (swaps.has(dummy))
+            throw new SubstitutionError("two paused fields carry the same ciphertext");
+        swaps.set(dummy, fields[name]);
+    }
+    const dummies = [...swaps.keys()];
+    if (new Set(values).size !== values.length || values.some((value) => swaps.has(value))) {
+        throw new SubstitutionError("two ciphertexts in this substitution are the same");
+    }
+    const texts = [...dummies, ...values];
+    for (const a of texts)
+        for (const b of texts)
+            if (a !== b && b.includes(a))
+                throw new SubstitutionError("one ciphertext is part of another");
+    if ((remove.length > 0 || set.length > 0) && !roundTrips(parsed, body)) {
+        throw new SubstitutionError("the paused body does not round-trip through JSON, so it cannot be edited");
+    }
+    for (const entry of set) {
+        const parent = jsonAt(parsed, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value)) {
+            throw new SubstitutionError(`the paused body has no object at ${describePath(entry.path.slice(0, -1))} to write a value in`);
+        }
+        const key = entry.path[entry.path.length - 1];
+        const current = Object.prototype.hasOwnProperty.call(parent.value, key) ? parent.value[key] : void 0;
+        if (current !== null && typeof current === "object") {
+            throw new SubstitutionError(`refusing to write over the object at ${describePath(entry.path)}`);
+        }
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const pattern = new RegExp(dummies.map((text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g");
+    const swapped = body.replace(pattern, (text) => {
+        seen.add(text);
+        return swaps.get(text);
+    });
+    if (seen.size !== dummies.length)
+        throw new SubstitutionError("a paused field is not written verbatim in the body");
+    let out;
+    try {
+        out = JSON.parse(swapped);
+    }
+    catch {
+        throw new SubstitutionError("the substituted body is not JSON");
+    }
+    const written = jsonAt(out, path);
+    if (!written.found || !isPlainObject(written.value) || names.some((name) => written.value[name] !== fields[name]) || dummies.some((dummy) => swapped.includes(dummy))) {
+        throw new SubstitutionError(`the substitution did not land at ${describePath(path)}`);
+    }
+    if (remove.length === 0 && set.length === 0)
+        return swapped;
+    for (const key of remove)
+        if (Object.prototype.hasOwnProperty.call(written.value, key))
+            delete written.value[key];
+    for (const entry of set) {
+        const parent = jsonAt(out, entry.path.slice(0, -1));
+        if (!parent.found || !isPlainObject(parent.value))
+            throw new SubstitutionError(`the set entry at ${describePath(entry.path)} did not land`);
+        parent.value[entry.path[entry.path.length - 1]] = entry.value;
+    }
+    return JSON.stringify(out);
+}
+// src/tap-payments.js
+var TAP_PAYMENTS_PSP = "tap_payments";
+var TAP_PAYMENTS_CAPABILITY = "tap_card_sdk_token";
+var TAP_PAYMENTS_OPERATION = "tap_payments.encrypted_card";
+var TAP_PAYMENTS_SCHEME = "rsa-pkcs1v15";
+var TAP_PAYMENTS_HOST = "sdk.tap.company";
+var TAP_PAYMENTS_TOKEN_URL = "https://sdk.tap.company/v2/card/token";
+var TAP_PAYMENTS_FIELD = "encryptedData";
+var TAP_PAYMENTS_PURPOSES = /* @__PURE__ */ Object.freeze(["CHARGE", "AUTHORIZE"]);
+var TAP_PAYMENTS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "tap_payments_url_refused",
+    "tap_payments_headers_refused",
+    "tap_payments_body_unsupported",
+    "tap_payments_keep_on_file",
+    "tap_payments_merchant_unreviewed",
+    "tap_payments_card_unsupported"
+]);
+var MESSAGES = /* @__PURE__ */ Object.freeze({
+    tap_payments_url_refused: "Refusing to pay: this Tap card request does not go to Tap's card frame exactly as the frame sends it. Nothing was sent.",
+    tap_payments_headers_refused: "Refusing to pay: this Tap card request does not carry the frame's own headers. Nothing was sent.",
+    tap_payments_body_unsupported: "Refusing to pay: this is not the card request of Tap's card form. Nothing was sent.",
+    tap_payments_keep_on_file: "Refusing to pay: this Tap payment asks to keep the card on file. Nothing was sent.",
+    tap_payments_merchant_unreviewed: "Refusing to pay: Agentcard has not reviewed this Tap merchant. Nothing was sent.",
+    tap_payments_card_unsupported: "Could not encrypt this card for Tap. Nothing was sent."
+});
+function tapPaymentsRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(MESSAGES, code) ? MESSAGES[code] : MESSAGES.tap_payments_body_unsupported;
+}
+var TapPaymentsError = class extends Error {
+    constructor(code) {
+        const known = Object.prototype.hasOwnProperty.call(MESSAGES, code) ? code : "tap_payments_body_unsupported";
+        super(MESSAGES[known]);
+        this.name = "TapPaymentsError";
+        this.code = known;
+    }
+};
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function isTapPaymentsTokenUrl(url) {
+    return url === TAP_PAYMENTS_TOKEN_URL;
+}
+var PUBLISHABLE_KEY = /^pk_(live|test)_[A-Za-z0-9]{16,64}$/;
+function tapPaymentsKeyEnvironment(publishableKey) {
+    const match = typeof publishableKey === "string" ? PUBLISHABLE_KEY.exec(publishableKey) : null;
+    if (!match)
+        return null;
+    return match[1] === "live" ? "production" : "sandbox";
+}
+var pin = (fields) => Object.freeze({
+    ...fields,
+    origins: Object.freeze([...fields.origins]),
+    sessions: Object.freeze({ ...fields.sessions }),
+    key: Object.freeze({ ...fields.key })
+});
+var TAP_PAYMENTS_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([
+    pin({
+        id: "casefilegame",
+        merchant: "Casefilegame",
+        tapMerchantId: "67977048",
+        publishableKey: "pk_live_ydlRjrWcLXaVvpsSBQKOie86",
+        environment: "production",
+        origins: ["https://checkout.tap.company"],
+        // The WooCommerce plugin's redirect (Plugin-WooCommerce-All-in-one tap.php 567-586, read 2026-10-17)
+        // creates the src_all charge with save_card false and names no agreement, subscription or destinations.
+        sessions: { saveCard: false, agreement: false, subscription: false, destinations: false },
+        key: {
+            spki: "MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAzja2vB+Iyafj2Mm3pFg65z7Yvj9ZeoFLdMBgWFyyjF020r5HSPKVhuZ39uJkjs0U/kWgEpKDzHZAKdtGv36dS33NjMAzYpgFkD8j+9/YWqpvAGRj5nv1b/q7NaiZk3b1wm7aXHJOx5L6rPQf2qDQxhcSNHocU+Uy8wGmGxRRu6QRKN3khaz4o4jJDzqxns4h/ShzHjdZeWIVfpCAyVoED0IESBYrvGEhJeyKnga5XdHdBU2yP8P1huO4RbSKcZv00ZgxVHAQQ9CqArW3TE8SyLLnJPkSpSHHBnIPSQS1z3ld1mImy/zqTd4ltkV6XHpYqVvoPmys2EuZX3pMvCcPGwIBEQ==",
+            sha256: "6eb4e89a1e05a06a39d631f6fb450c052a9cad9935edc1921e84e80207470552",
+            // The shared parser takes exponent 17 only under a pin that names it (rsa-pkcs1v15.js).
+            exponent: 17
+        }
+    })
+]);
+var SESSION_REVIEW = /* @__PURE__ */ Object.freeze(["saveCard", "agreement", "subscription", "destinations"]);
+var keepsNoCard = (entry) => record(entry.sessions) && SESSION_REVIEW.every((key) => entry.sessions[key] === false);
+function tapPaymentsMerchantPin(publishableKey, pins = TAP_PAYMENTS_MERCHANT_PINS) {
+    const environment = tapPaymentsKeyEnvironment(publishableKey);
+    if (!environment || !Array.isArray(pins))
+        return null;
+    return pins.find((entry) => record(entry) && entry.publishableKey === publishableKey && entry.environment === environment && keepsNoCard(entry)) ?? null;
+}
+function tapPaymentsMerchantRefusal(environment, publishableKey, merchantOrigin, pins = TAP_PAYMENTS_MERCHANT_PINS) {
+    const found = tapPaymentsMerchantPin(publishableKey, pins);
+    if (!found || found.environment !== environment || typeof merchantOrigin !== "string" || !found.origins.includes(merchantOrigin)) {
+        return "tap_payments_merchant_unreviewed";
+    }
+    return null;
+}
+var BODY_LIMIT = 16384;
+var ROOT_KEYS = /* @__PURE__ */ Object.freeze([
+    "encryptedData",
+    "purpose",
+    "customer",
+    "consent",
+    "merchant",
+    "order",
+    "payment_agreement",
+    "client_ip",
+    "device",
+    "browser",
+    "app"
+]);
+var REQUIRED_KEYS = /* @__PURE__ */ Object.freeze(["encryptedData", "purpose", "order", "device", "browser", "app"]);
+var SAVE_PURPOSES = /* @__PURE__ */ Object.freeze(["SAVE_TOKEN", "SAVE_AUTHENTICATED_TOKEN"]);
+var ORDER_KEYS = /* @__PURE__ */ Object.freeze(["amount", "currency", "id", "description", "metadata", "reference"]);
+var DEVICE_KEYS = /* @__PURE__ */ Object.freeze(["source", "ip"]);
+var BROWSER_KEYS = /* @__PURE__ */ Object.freeze(["name", "id"]);
+var APP_KEYS = /* @__PURE__ */ Object.freeze(["identifier", "name", "version", "iframe_version", "sdk_version"]);
+var CIPHERTEXT_BYTES = /* @__PURE__ */ Object.freeze([128, 256, 384, 512]);
+var BASE642 = /^[A-Za-z0-9+/]+={0,2}$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var TEXT_LIMIT = 512;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var CARD_LONG_DIGITS = /(?:\p{Nd}[\s-]?){12}\p{Nd}/u;
+var NESTING_LIMIT = 4;
+var MEMBERS_LIMIT = 64;
+var refuse2 = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function decodedBytes(value) {
+    if (typeof value !== "string" || value.length % 4 !== 0 || !BASE642.test(value))
+        return -1;
+    try {
+        if (btoa(atob(value)) !== value)
+            return -1;
+    }
+    catch {
+        return -1;
+    }
+    const pad = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+    return value.length / 4 * 3 - pad;
+}
+function isTapPaymentsCiphertext(value) {
+    return CIPHERTEXT_BYTES.includes(decodedBytes(value));
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var inOrder = (keys, order) => {
+    let at = -1;
+    for (const key of keys) {
+        const next = order.indexOf(key);
+        if (next <= at)
+            return false;
+        at = next;
+    }
+    return true;
+};
+var onlyKeys = (value, allowed) => record(value) && Object.keys(value).every((key) => allowed.includes(key));
+var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL.test(value) && !CARD_LONG_DIGITS.test(value);
+var plainScalar = (value) => value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) && !CARD_LONG_DIGITS.test(String(value)) || plainText(value);
+function plainJson(value, depth = 0, budget = { members: 0 }) {
+    if (depth > NESTING_LIMIT)
+        return false;
+    if (Array.isArray(value)) {
+        budget.members += value.length;
+        return budget.members <= MEMBERS_LIMIT && value.every((item) => plainJson(item, depth + 1, budget));
+    }
+    if (record(value)) {
+        const keys = Object.keys(value);
+        budget.members += keys.length;
+        return budget.members <= MEMBERS_LIMIT && keys.every((key) => plainText(key) && plainJson(value[key], depth + 1, budget));
+    }
+    return plainScalar(value);
+}
+function soundOrder(order) {
+    if (!onlyKeys(order, ORDER_KEYS) || !inOrder(Object.keys(order), ORDER_KEYS))
+        return false;
+    if ("amount" in order && !(typeof order.amount === "number" && Number.isFinite(order.amount) && order.amount >= 0 && !CARD_LONG_DIGITS.test(String(order.amount))))
+        return false;
+    if ("currency" in order && !(typeof order.currency === "string" && CURRENCY.test(order.currency)))
+        return false;
+    if ("id" in order && !plainText(order.id))
+        return false;
+    if ("description" in order && !plainText(order.description))
+        return false;
+    if ("metadata" in order && !plainJson(order.metadata))
+        return false;
+    return !("reference" in order) || plainJson(order.reference);
+}
+var soundDevice = (device) => onlyKeys(device, DEVICE_KEYS) && inOrder(Object.keys(device), DEVICE_KEYS) && (device.source === "web" || device.source === "app") && (!("ip" in device) || plainText(device.ip));
+var soundBrowser = (browser) => onlyKeys(browser, BROWSER_KEYS) && inOrder(Object.keys(browser), BROWSER_KEYS) && (!("name" in browser) || plainText(browser.name)) && plainText(browser.id);
+var versionValue = (value) => plainText(value) || typeof value === "number" && Number.isFinite(value) && !CARD_LONG_DIGITS.test(String(value));
+var soundApp = (app) => onlyKeys(app, APP_KEYS) && inOrder(Object.keys(app), APP_KEYS) && app.identifier === "card_sdk" && app.name === "card_sdk" && ["version", "iframe_version", "sdk_version"].every((key) => !(key in app) || versionValue(app[key]));
+function tapPaymentsBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse2("tap_payments_body_unsupported");
+    const keys = Object.keys(value);
+    if (!keys.every((key) => ROOT_KEYS.includes(key)) || !inOrder(keys, ROOT_KEYS) || !REQUIRED_KEYS.every((key) => keys.includes(key))) {
+        return refuse2("tap_payments_body_unsupported");
+    }
+    if (!isTapPaymentsCiphertext(value.encryptedData))
+        return refuse2("tap_payments_body_unsupported");
+    if (typeof value.purpose !== "string")
+        return refuse2("tap_payments_body_unsupported");
+    if (SAVE_PURPOSES.includes(value.purpose))
+        return refuse2("tap_payments_keep_on_file");
+    if (!TAP_PAYMENTS_PURPOSES.includes(value.purpose))
+        return refuse2("tap_payments_body_unsupported");
+    if ("payment_agreement" in value && value.payment_agreement !== null)
+        return refuse2("tap_payments_keep_on_file");
+    if ("consent" in value) {
+        const consent = value.consent;
+        if (!record(consent) || Object.keys(consent).length !== 1 || typeof consent.acknowledge !== "boolean")
+            return refuse2("tap_payments_body_unsupported");
+        if (consent.acknowledge)
+            return refuse2("tap_payments_keep_on_file");
+    }
+    if ("customer" in value && !(record(value.customer) && plainJson(value.customer)) || "merchant" in value && !(record(value.merchant) && plainJson(value.merchant)) || "client_ip" in value && value.client_ip !== null && !plainText(value.client_ip) || !soundOrder(value.order) || !soundDevice(value.device) || !soundBrowser(value.browser) || !soundApp(value.app)) {
+        return refuse2("tap_payments_body_unsupported");
+    }
+    return CARD;
+}
+function tapPaymentsOrderAmount(body) {
+    if (tapPaymentsBodyVerdict(body).verdict !== "card")
+        return null;
+    const order = JSON.parse(body).order;
+    return "amount" in order && "currency" in order ? Object.freeze({ amount: order.amount, currency: order.currency }) : null;
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+var JSON_TYPE = /^application\/json(?:\s*;\s*charset=utf-8)?$/i;
+function tapPaymentsRequestKey(request) {
+    const headers = record(request) && record(request.headers) ? request.headers : {};
+    const authorization = headerValue(headers, "authorization");
+    return authorization !== null && tapPaymentsKeyEnvironment(authorization) ? authorization : null;
+}
+function namesPinnedMerchant(body, merchantPin) {
+    if (!("merchant" in body))
+        return true;
+    const keys = Object.keys(body.merchant);
+    if (keys.length === 0)
+        return true;
+    if (keys.length !== 1 || keys[0] !== "id")
+        return false;
+    const id = body.merchant.id;
+    return (typeof id === "number" && Number.isSafeInteger(id) ? String(id) : id) === merchantPin.tapMerchantId;
+}
+function tapPaymentsRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "tap_payments_url_refused";
+    if (!isTapPaymentsTokenUrl(request.url))
+        return "tap_payments_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const publishableKey = tapPaymentsRequestKey(request);
+    if (contentType === null || !JSON_TYPE.test(contentType.trim()) || publishableKey === null)
+        return "tap_payments_headers_refused";
+    const verdict = tapPaymentsBodyVerdict(request.body);
+    if (verdict.verdict !== "card")
+        return verdict.code;
+    const merchantPin = tapPaymentsMerchantPin(publishableKey);
+    return merchantPin && namesPinnedMerchant(JSON.parse(request.body), merchantPin) ? null : "tap_payments_merchant_unreviewed";
+}
+var NAME_LIMIT = 24;
+var NETWORKS = /* @__PURE__ */ Object.freeze([
+    { network: "visa", test: /^4[0-9]{15}$/, cvc: /^[0-9]{3}$/ },
+    { network: "mastercard", test: /^(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$/, cvc: /^[0-9]{3}$/ },
+    { network: "amex", test: /^3[47][0-9]{13}$/, cvc: /^[0-9]{4}$/ }
+]);
+function holderName(name) {
+    if (typeof name !== "string")
+        return "";
+    return name.normalize("NFKD").replace(/[^A-Za-z\s.'-]/g, "").replace(/\s+/g, " ").trim().toUpperCase().slice(0, NAME_LIMIT).trim();
+}
+function tapPaymentsPlaintext(card) {
+    if (!record(card))
+        throw new TapPaymentsError("tap_payments_card_unsupported");
+    const number = String(card.number ?? "").replace(/[\s-]/g, "");
+    const cvc = String(card.cvc ?? "");
+    const monthText = String(card.month ?? "");
+    const yearText = String(card.year ?? "");
+    const network = NETWORKS.find((entry) => entry.test.test(number));
+    const month = /^[0-9]{1,2}$/.test(monthText) ? Number(monthText) : 0;
+    const name = holderName(card.name);
+    if (!network || !network.cvc.test(cvc) || month < 1 || month > 12 || !/^(?:[0-9]{2}|[0-9]{4})$/.test(yearText) || name === "") {
+        throw new TapPaymentsError("tap_payments_card_unsupported");
+    }
+    return JSON.stringify({ cvc, exp_month: String(month).padStart(2, "0"), exp_year: yearText.slice(-2), name, number });
+}
+function base64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return btoa(binary);
+}
+function encryptTapPaymentsCard(card, publishableKey, facilities = {}) {
+    const merchantPin = tapPaymentsMerchantPin(publishableKey);
+    if (!merchantPin)
+        throw new TapPaymentsError("tap_payments_merchant_unreviewed");
+    const message = new TextEncoder().encode(tapPaymentsPlaintext(card));
+    try {
+        return Object.freeze({ encryptedData: base64(rsaesPkcs1v15Encrypt(merchantPin.key, message, facilities.crypto ?? globalThis.crypto)) });
+    }
+    finally {
+        message.fill(0);
+    }
+}
+function ciphertextInteger(value) {
+    const binary = atob(value);
+    let hex = "";
+    for (let i = 0; i < binary.length; i++)
+        hex += binary.charCodeAt(i).toString(16).padStart(2, "0");
+    return BigInt(`0x${hex}`);
+}
+function isTapPaymentsCiphertextUnderPin(value, merchantPin) {
+    if (!record(merchantPin) || !record(merchantPin.key))
+        return false;
+    let parsed;
+    try {
+        parsed = parseRsaPublicKey(merchantPin.key);
+    }
+    catch {
+        return false;
+    }
+    if (decodedBytes(value) !== parsed.size)
+        return false;
+    const c = ciphertextInteger(value);
+    return c > 1n && c < parsed.n;
+}
+var TAP_CIPHERTEXT = /* @__PURE__ */ Object.freeze({ accepts: isTapPaymentsCiphertext, label: "a Tap ciphertext" });
+function substitutionOf(substitution) {
+    if (!record(substitution))
+        return null;
+    const keys = Object.keys(substitution);
+    return keys.length === 1 && keys[0] === TAP_PAYMENTS_FIELD && typeof substitution.encryptedData === "string" ? substitution.encryptedData : null;
+}
+function substituteTapPayments(request, substitution) {
+    const refusal = tapPaymentsRequestRefusal(request);
+    if (refusal)
+        throw new SubstitutionError(tapPaymentsRefusalMessage(refusal));
+    const value = substitutionOf(substitution);
+    if (value === null)
+        throw new SubstitutionError("the substitution must carry exactly encryptedData");
+    const merchantPin = tapPaymentsMerchantPin(tapPaymentsRequestKey(request));
+    if (!isTapPaymentsCiphertextUnderPin(value, merchantPin)) {
+        throw new SubstitutionError("substitution for encryptedData does not have the size and range of the merchant's pinned key");
+    }
+    if (value === JSON.parse(request.body).encryptedData)
+        throw new SubstitutionError("the ciphertext in this substitution is already in the body");
+    const out = swappedBody(request.body, value);
+    if (out === null)
+        throw new SubstitutionError("the substitution did not land at encryptedData alone");
+    return out;
+}
+function swappedBody(body, value) {
+    let out;
+    try {
+        out = swapMerchantHostedFields(body, { path: [], fields: { encryptedData: value } }, TAP_CIPHERTEXT);
+    }
+    catch (error) {
+        if (error instanceof SubstitutionError)
+            return null;
+        throw error;
+    }
+    const paused = JSON.parse(body);
+    const written = tapPaymentsBodyVerdict(out).verdict === "card" ? JSON.parse(out) : null;
+    if (!written || written.encryptedData !== value || JSON.stringify({ ...written, encryptedData: "" }) !== JSON.stringify({ ...paused, encryptedData: "" })) {
+        return null;
+    }
+    return out;
+}
+function tapPaymentsSubstitutionsRefusal(template, substitution) {
+    const refuseWith = (message) => ({ code: "invalid_substitutions", message });
+    if (tapPaymentsRequestRefusal(template) !== null)
+        return refuseWith("This authorization is not the card request of a reviewed Tap merchant.");
+    const value = substitutionOf(substitution);
+    if (value === null)
+        return refuseWith("substitutions must carry exactly this field: encryptedData.");
+    if (!isTapPaymentsCiphertextUnderPin(value, tapPaymentsMerchantPin(tapPaymentsRequestKey(template)))) {
+        return refuseWith("substitutions.encryptedData does not have the size and range of the merchant's pinned key.");
+    }
+    if (value === JSON.parse(template.body).encryptedData)
+        return refuseWith("substitutions must be a new ciphertext, not the one in the paused request.");
+    if (swappedBody(template.body, value) === null)
+        return refuseWith("substitutions.encryptedData cannot be written at encryptedData alone in the paused request.");
+    return null;
+}
+function tapPaymentsKeyUsable(authorization) {
+    if (!record(authorization) || !record(authorization.cse))
+        return false;
+    const cse = authorization.cse;
+    if (cse.psp !== TAP_PAYMENTS_PSP || cse.scheme !== TAP_PAYMENTS_SCHEME)
+        return false;
+    if (cse.public_key != null || cse.client_key != null || Object.prototype.hasOwnProperty.call(cse, "merchant_hosted"))
+        return false;
+    if (!isTapPaymentsTokenUrl(authorization.url))
+        return false;
+    const merchantPin = tapPaymentsMerchantPin(cse.publishable_key);
+    if (!merchantPin || cse.environment !== merchantPin.environment || authorization.sandbox !== (merchantPin.environment === "sandbox"))
+        return false;
+    try {
+        return parseRsaPublicKey(merchantPin.key).size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+var ANSWER_LIMIT = 65536;
+var TOKEN_ID = /^tok_[A-Za-z0-9]{8,64}$/;
+var REFUSAL_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
+var MAX_CODE_DIGITS = 11;
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var boundedCode = (value) => typeof value === "string" && REFUSAL_CODE.test(value) && (value.match(/[0-9]/g) ?? []).length <= MAX_CODE_DIGITS ? value : null;
+function tapPaymentsRefusalCode(text) {
+    const answer = readAnswer(text);
+    const first = answer && Array.isArray(answer.errors) && record(answer.errors[0]) ? answer.errors[0] : null;
+    if (!first)
+        return null;
+    const code = typeof first.code === "number" && Number.isSafeInteger(first.code) ? String(first.code) : first.code;
+    return boundedCode(code) ?? boundedCode(first.error);
+}
+function tapPaymentsAnswerOutcome(status, text, card) {
+    const unknown = (reason) => ({ outcome: "unknown", reason });
+    if (!Number.isInteger(status))
+        return unknown("tap_payments_unconfirmed");
+    if (status >= 500)
+        return unknown("server_error");
+    if (status >= 400)
+        return { outcome: "refused", code: tapPaymentsRefusalCode(text) ?? `http_${status}` };
+    if (status < 200 || status >= 300)
+        return unknown("tap_payments_unconfirmed");
+    const answer = readAnswer(text);
+    if (answer === null)
+        return unknown("tap_payments_unconfirmed");
+    if (Array.isArray(answer.errors) && answer.errors.length > 0) {
+        return { outcome: "refused", code: tapPaymentsRefusalCode(text) ?? "tap_payments_error" };
+    }
+    if (Object.prototype.hasOwnProperty.call(answer, "errors") && answer.errors !== null && !Array.isArray(answer.errors)) {
+        return unknown("tap_payments_unconfirmed");
+    }
+    if (typeof answer.id !== "string" || !TOKEN_ID.test(answer.id) || answer.object !== "token" || Object.prototype.hasOwnProperty.call(answer, "status") && answer.status !== "ACTIVE") {
+        return unknown("tap_payments_unconfirmed");
+    }
+    if (card) {
+        const number = String(card.number ?? "").replace(/[^0-9]/g, "");
+        if (number.length >= 12 && text.includes(number))
+            return unknown("tap_payments_unsafe_response");
+        const facts = record(answer.card) ? answer.card : null;
+        if (!facts || facts.last_four !== number.slice(-4) || Object.prototype.hasOwnProperty.call(facts, "first_six") && facts.first_six !== number.slice(0, 6)) {
+            return unknown("tap_payments_token_mismatch");
+        }
+    }
+    return { outcome: "approved" };
+}
+export { TAP_PAYMENTS_CAPABILITY, TAP_PAYMENTS_FIELD, TAP_PAYMENTS_HOST, TAP_PAYMENTS_MERCHANT_PINS, TAP_PAYMENTS_OPERATION, TAP_PAYMENTS_PSP, TAP_PAYMENTS_PURPOSES, TAP_PAYMENTS_REFUSAL_CODES, TAP_PAYMENTS_SCHEME, TAP_PAYMENTS_TOKEN_URL, TapPaymentsError, encryptTapPaymentsCard, isTapPaymentsCiphertext, isTapPaymentsCiphertextUnderPin, isTapPaymentsTokenUrl, substituteTapPayments, tapPaymentsAnswerOutcome, tapPaymentsBodyVerdict, tapPaymentsKeyEnvironment, tapPaymentsKeyUsable, tapPaymentsMerchantPin, tapPaymentsMerchantRefusal, tapPaymentsOrderAmount, tapPaymentsPlaintext, tapPaymentsRefusalCode, tapPaymentsRefusalMessage, tapPaymentsRequestKey, tapPaymentsRequestRefusal, tapPaymentsSubstitutionsRefusal };