@agent-cards/sdk 0.23.22 → 0.23.24

package/dist/amazon-payment-services.generated.js

@@ -0,0 +1,883 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: f04bf9ac19a1a9d8aed3819383514a6cc3cc1a781354142ec41879320417eb9e
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/sha256.js
+var K = /* @__PURE__ */ new Uint32Array([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function utf8(text) {
+    const out = [];
+    for (const char of text) {
+        let cp = char.codePointAt(0);
+        if (cp >= 55296 && cp <= 57343)
+            cp = 65533;
+        if (cp < 128)
+            out.push(cp);
+        else if (cp < 2048)
+            out.push(192 | cp >> 6, 128 | cp & 63);
+        else if (cp < 65536)
+            out.push(224 | cp >> 12, 128 | cp >> 6 & 63, 128 | cp & 63);
+        else
+            out.push(240 | cp >> 18, 128 | cp >> 12 & 63, 128 | cp >> 6 & 63, 128 | cp & 63);
+    }
+    return Uint8Array.from(out);
+}
+function sha256Hex(input) {
+    const isBytes = Object.prototype.toString.call(input) === "[object Uint8Array]";
+    if (typeof input !== "string" && !isBytes)
+        throw new TypeError("sha256Hex takes a string or a Uint8Array.");
+    const bytes = typeof input === "string" ? utf8(input) : input;
+    const length = bytes.length;
+    const padded = new Uint8Array((length + 8 >> 6) + 1 << 6);
+    padded.set(bytes);
+    padded[length] = 128;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(length / 536870912));
+    view.setUint32(padded.length - 4, length << 3 >>> 0);
+    const H = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+    const W = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++)
+            W[t] = view.getUint32(offset + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(W[t - 15], 7) ^ rotr(W[t - 15], 18) ^ W[t - 15] >>> 3;
+            const s1 = rotr(W[t - 2], 17) ^ rotr(W[t - 2], 19) ^ W[t - 2] >>> 10;
+            W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+        }
+        let a = H[0], b = H[1], c = H[2], d = H[3], e = H[4], f = H[5], g = H[6], h = H[7];
+        for (let t = 0; t < 64; t++) {
+            const t1 = h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[t] + W[t] >>> 0;
+            const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 >>> 0;
+        }
+        H[0] += a;
+        H[1] += b;
+        H[2] += c;
+        H[3] += d;
+        H[4] += e;
+        H[5] += f;
+        H[6] += g;
+        H[7] += h;
+    }
+    return Array.from(H, (word) => word.toString(16).padStart(8, "0")).join("");
+}
+// src/test-pans.js
+function immutableSet(values, name) {
+    const set = new Set(values);
+    for (const method of ["add", "delete", "clear"]) {
+        set[method] = () => {
+            throw new TypeError(`${name} is immutable`);
+        };
+    }
+    return Object.freeze(set);
+}
+var DOCUMENTED_TEST_PANS = /* @__PURE__ */ immutableSet([
+    "4242424242424242",
+    "4000000000000002",
+    "4000002500003155",
+    "4111111111111111"
+], "DOCUMENTED_TEST_PANS");
+// src/amazon-payment-services.js
+var APS_PSP = "amazon_payment_services";
+var APS_CAPABILITY = "aps_custom_merchant_page";
+var APS_OPERATION = "amazon_payment_services.card_request";
+var APS_HOSTS = /* @__PURE__ */ Object.freeze({ "checkout.payfort.com": "production", "sbcheckout.payfort.com": "sandbox" });
+var APS_TOKENIZATION_PATH = "/FortAPI/paymentPage";
+var APS_SIGNED_FIELDS = /* @__PURE__ */ Object.freeze([
+    "service_command",
+    "access_code",
+    "merchant_identifier",
+    "merchant_reference",
+    "language",
+    "return_url",
+    "signature"
+]);
+var APS_CARD_FIELDS = /* @__PURE__ */ Object.freeze(["card_number", "expiry_date", "card_security_code"]);
+var APS_OPTIONAL_FIELDS = /* @__PURE__ */ Object.freeze(["card_holder_name", "remember_me"]);
+var APS_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "aps_url_refused",
+    "aps_headers_refused",
+    "aps_body_unsupported",
+    "aps_service_command_refused",
+    "aps_saved_card_refused",
+    "aps_recurring_refused",
+    "aps_return_url_refused"
+]);
+var MESSAGES = /* @__PURE__ */ Object.freeze({
+    aps_url_refused: "Refusing to pay: this is not the Amazon Payment Services tokenization URL. Nothing was sent.",
+    aps_headers_refused: "Refusing to pay: this Amazon Payment Services form was not posted by the checkout page's own form. Nothing was sent.",
+    aps_body_unsupported: "Refusing to pay: this Amazon Payment Services form is not the card form this lane pays. Nothing was sent.",
+    aps_service_command_refused: "Refusing to pay: this Amazon Payment Services form asks for something other than a card token. Nothing was sent.",
+    aps_saved_card_refused: "Refusing to pay: this Amazon Payment Services form names a saved card. Nothing was sent.",
+    aps_recurring_refused: "Refusing to pay: this Amazon Payment Services form sets up recurring payments. Nothing was sent.",
+    aps_return_url_refused: "Refusing to pay: this Amazon Payment Services form names no https page to return to. Nothing was sent."
+});
+var URL_LIMIT = 2048;
+var BODY_LIMIT = 32 * 1024;
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var controlFree = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var SHAPES = /* @__PURE__ */ new Map([
+    ["service_command", (v) => v === "TOKENIZATION"],
+    ["access_code", (v) => exact(/^[A-Za-z0-9]{1,20}$/, v)],
+    ["merchant_identifier", (v) => exact(/^[A-Za-z0-9]{1,20}$/, v)],
+    ["merchant_reference", (v) => exact(/^[A-Za-z0-9._-]{1,40}$/, v)],
+    ["language", (v) => v === "en" || v === "ar"],
+    // Hex SHA-256 (APS's default), SHA-512, or the 40 characters of the SHA-1 APS calls SHA-128.
+    ["signature", (v) => exact(/^(?:[0-9A-Fa-f]{40}|[0-9A-Fa-f]{64}|[0-9A-Fa-f]{128})$/, v)],
+    ["card_number", (v) => exact(/^[0-9]{12,19}$/, v)],
+    ["expiry_date", (v) => exact(/^[0-9]{2}(?:0[1-9]|1[0-2])$/, v)],
+    ["card_security_code", (v) => exact(/^[0-9]{3,4}$/, v)],
+    ["card_holder_name", (v) => controlFree(v, 255)],
+    ["remember_me", (v) => v === "YES" || v === "NO"]
+]);
+function apsTokenizationUrl(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT || url.includes("?") || url.includes("#"))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.href !== url || parsed.protocol !== "https:" || parsed.port || parsed.username || parsed.password || parsed.pathname !== APS_TOKENIZATION_PATH || !Object.prototype.hasOwnProperty.call(APS_HOSTS, parsed.hostname))
+        return null;
+    return Object.freeze({ host: parsed.hostname, environment: APS_HOSTS[parsed.hostname] });
+}
+var isApsTokenizationUrl = (url) => apsTokenizationUrl(url) !== null;
+var apsEnvironment = (url) => apsTokenizationUrl(url)?.environment ?? null;
+function formEncode(value) {
+    let encoded;
+    try {
+        encoded = encodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+    return encoded.replace(/[!'()~]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%20/g, "+");
+}
+function formDecode(raw) {
+    if (!/^(?:[A-Za-z0-9*._+-]|%[0-9A-F]{2})*$/.test(raw))
+        return null;
+    let value;
+    try {
+        value = decodeURIComponent(raw.replace(/\+/g, "%20"));
+    }
+    catch {
+        return null;
+    }
+    return formEncode(value) === raw ? value : null;
+}
+function parseForm(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    const pairs = [];
+    const values = /* @__PURE__ */ new Map();
+    for (const chunk of body.split("&")) {
+        const separator = chunk.indexOf("=");
+        if (separator < 1)
+            return null;
+        const rawName = chunk.slice(0, separator), raw = chunk.slice(separator + 1);
+        const name = formDecode(rawName), value = formDecode(raw);
+        if (name === null || value === null || values.has(name))
+            return null;
+        pairs.push({ name, rawName, raw, value });
+        values.set(name, value);
+    }
+    return { pairs, values };
+}
+function returnUrlAdmitted(value) {
+    if (typeof value !== "string" || value.length > 400 || value.includes("#") || /[\u0000- \u007f]/.test(value))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === "https:" && !parsed.username && !parsed.password && parsed.href === value;
+}
+function apsBodyRefusal(body) {
+    const form = parseForm(body);
+    if (!form)
+        return "aps_body_unsupported";
+    const has = (name) => form.values.has(name);
+    if (has("token_name"))
+        return "aps_saved_card_refused";
+    if ([...form.values.keys()].some((name) => /^merchant_extra[1-5]?$|^agreement_id$|^recurring_/.test(name)))
+        return "aps_recurring_refused";
+    if (has("service_command") && form.values.get("service_command") !== "TOKENIZATION")
+        return "aps_service_command_refused";
+    const allowed = /* @__PURE__ */ new Set([...APS_SIGNED_FIELDS, ...APS_CARD_FIELDS, ...APS_OPTIONAL_FIELDS]);
+    if (form.pairs.some(({ name }) => !allowed.has(name)))
+        return "aps_body_unsupported";
+    if (!returnUrlAdmitted(form.values.get("return_url")))
+        return "aps_return_url_refused";
+    for (const name of [...APS_SIGNED_FIELDS, ...APS_CARD_FIELDS]) {
+        if (name !== "return_url" && !SHAPES.get(name)(form.values.get(name)))
+            return "aps_body_unsupported";
+    }
+    for (const name of APS_OPTIONAL_FIELDS) {
+        if (has(name) && !SHAPES.get(name)(form.values.get(name)))
+            return "aps_body_unsupported";
+    }
+    return null;
+}
+function apsBodyVerdict(body, url) {
+    if (url !== void 0 && !apsTokenizationUrl(url))
+        return { verdict: "refuse", code: "aps_url_refused" };
+    const form = parseForm(body);
+    const names = form ? [...form.values.keys()] : typeof body === "string" ? body.split("&").map((chunk) => {
+        try {
+            return decodeURIComponent(chunk.split("=")[0].replace(/\+/g, " "));
+        }
+        catch {
+            return APS_CARD_FIELDS[0];
+        }
+    }) : [APS_CARD_FIELDS[0]];
+    const mentionsCard = !form && typeof body === "string" && APS_CARD_FIELDS.some((name) => body.toLowerCase().includes(name) || body.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16))).toLowerCase().includes(name));
+    if (!mentionsCard && !names.some((name) => APS_CARD_FIELDS.includes(name.trim().toLowerCase())))
+        return { verdict: "continue" };
+    const code = apsBodyRefusal(body);
+    return code ? { verdict: "refuse", code } : { verdict: "card" };
+}
+function apsRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(MESSAGES, code) ? MESSAGES[code] : MESSAGES.aps_body_unsupported;
+}
+var FORM_TYPE = "application/x-www-form-urlencoded";
+var record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+function requestHeaders(headers) {
+    if (headers === void 0)
+        return /* @__PURE__ */ new Map();
+    if (!record(headers))
+        return null;
+    const out = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (typeof value !== "string" || out.has(lower))
+            return null;
+        out.set(lower, value);
+    }
+    return out;
+}
+function checkoutOriginOf(value) {
+    if (typeof value !== "string" || value.length > URL_LIMIT)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    return parsed.origin === value && parsed.protocol === "https:" ? value : null;
+}
+function apsRequestRefusal(request, options) {
+    if (!record(request) || request.method !== "POST" || !apsTokenizationUrl(request.url))
+        return "aps_url_refused";
+    const headers = requestHeaders(request.headers);
+    const type = headers?.get("content-type");
+    if (!headers || typeof type !== "string" || type.trim().toLowerCase() !== FORM_TYPE)
+        return "aps_headers_refused";
+    if (record(options) && options.merchantOrigin !== void 0) {
+        const origin = checkoutOriginOf(options.merchantOrigin);
+        if (!origin || headers.get("origin") !== origin)
+            return "aps_headers_refused";
+        if (headers.has("referer")) {
+            let referer = null;
+            try {
+                referer = new URL(headers.get("referer"));
+            }
+            catch {
+                referer = null;
+            }
+            if (!referer || referer.href !== headers.get("referer") || referer.origin !== origin || referer.username || referer.password)
+                return "aps_headers_refused";
+        }
+    }
+    return apsBodyRefusal(request.body);
+}
+function apsKeepsCardOnFile(body) {
+    const form = parseForm(body);
+    return form ? form.values.get("remember_me") !== "NO" : null;
+}
+function apsRequestFacts(request) {
+    if (!record(request) || request.method !== "POST" || !apsTokenizationUrl(request.url) || apsBodyRefusal(request.body) !== null)
+        return null;
+    const values = parseForm(request.body).values;
+    const v = (name) => values.get(name);
+    return Object.freeze({
+        environment: apsEnvironment(request.url),
+        merchantIdentifier: v("merchant_identifier"),
+        accessCodeSha256: sha256Hex(v("access_code")),
+        merchantReference: v("merchant_reference"),
+        returnUrl: v("return_url"),
+        keepsCardOnFile: v("remember_me") !== "NO"
+    });
+}
+var APS_MERCHANTS = /* @__PURE__ */ deepFreeze([]);
+var APS_MERCHANT_REFUSALS = /* @__PURE__ */ Object.freeze([
+    "aps_request_unreadable",
+    "aps_unsupported_environment",
+    "aps_merchant_unreviewed",
+    "aps_merchant_pending",
+    "aps_access_code_unreviewed",
+    "aps_return_url_unreviewed",
+    "aps_merchant_client_signed",
+    "aps_merchant_observe"
+]);
+var DECISION_DATE = /^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])$/;
+var pinList = (value) => Array.isArray(value) ? value : [];
+var decided = (entry) => record(entry.decision) && typeof entry.decision.reference === "string" && entry.decision.reference.trim() !== "" && exact(DECISION_DATE, entry.decision.reviewed_on);
+function originOf(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+function apsMerchantRefusal(facts, merchantOrigin, entries = APS_MERCHANTS) {
+    if (!record(facts) || typeof facts.merchantIdentifier !== "string" || typeof facts.accessCodeSha256 !== "string" || typeof facts.returnUrl !== "string")
+        return "aps_request_unreadable";
+    if (facts.environment === "sandbox")
+        return null;
+    if (facts.environment !== "production")
+        return "aps_unsupported_environment";
+    const forOrigin = pinList(entries).filter((entry2) => record(entry2) && entry2.environment === "production" && pinList(entry2.origins).includes(merchantOrigin));
+    if (forOrigin.length === 0)
+        return "aps_merchant_unreviewed";
+    const pending = (entry2) => !Array.isArray(entry2.pending) || entry2.pending.length > 0;
+    const entry = forOrigin.find((candidate) => pinList(candidate.merchantIdentifiers).includes(facts.merchantIdentifier));
+    if (!entry)
+        return forOrigin.some(pending) ? "aps_merchant_pending" : "aps_merchant_unreviewed";
+    if (pending(entry))
+        return "aps_merchant_pending";
+    if (!pinList(entry.accessCodeSha256).includes(facts.accessCodeSha256))
+        return "aps_access_code_unreviewed";
+    if (!pinList(entry.returnOrigins).includes(originOf(facts.returnUrl)))
+        return "aps_return_url_unreviewed";
+    if (entry.signing !== "server" && !decided(entry))
+        return "aps_merchant_client_signed";
+    return entry.status === "enabled" ? null : "aps_merchant_observe";
+}
+function apsMerchantPin(facts, merchantOrigin, entries = APS_MERCHANTS) {
+    if (!record(facts) || facts.environment !== "production" || apsMerchantRefusal(facts, merchantOrigin, entries) !== null)
+        return null;
+    return pinList(entries).find((entry) => record(entry) && entry.environment === "production" && pinList(entry.origins).includes(merchantOrigin) && pinList(entry.merchantIdentifiers).includes(facts.merchantIdentifier)) ?? null;
+}
+var APS_TEST_PANS = /* @__PURE__ */ immutableSet([
+    "4005550000000001",
+    "5123456789012346",
+    "345678901234564",
+    "4557012345678902",
+    "5313581000123430",
+    "374200000000004",
+    "4916783391760242",
+    "4556437649762022",
+    "5308097663032831",
+    "4188870000000002",
+    "4546830000000003",
+    "4278370000000004",
+    "5297410000000002",
+    "5078036246600381"
+], "APS_TEST_PANS");
+var FILL_FAILED = "Could not fill the card fields for Amazon Payment Services. Nothing was sent.";
+var SANDBOX_CARD = "Refusing to pay: a sandbox or test host accepts only the processor's documented test cards, not a real card.";
+var MALFORMED = "Refusing to pay: malformed payment request.";
+function luhn(number) {
+    let sum = 0;
+    for (let i = 0; i < number.length; i++) {
+        let digit = number.charCodeAt(number.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function yymmOf(card) {
+    const month = typeof card?.month === "number" || typeof card?.month === "string" ? String(card.month) : "";
+    const year = typeof card?.year === "number" || typeof card?.year === "string" ? String(card.year) : "";
+    if (!/^[0-9]{1,2}$/.test(month) || Number(month) < 1 || Number(month) > 12 || !/^(?:[0-9]{2}|20[0-9]{2})$/.test(year))
+        return null;
+    return `${year.slice(-2)}${month.padStart(2, "0")}`;
+}
+function apsCardRefusal(environment, card) {
+    if (environment !== "production" && environment !== "sandbox")
+        return "unsupported_environment";
+    const pan = record(card) && typeof card.number === "string" ? card.number : "";
+    if (!/^[0-9]{12,19}$/.test(pan) || /^([0-9])\1+$/.test(pan) || !luhn(pan))
+        return "invalid_card_number";
+    const test = APS_TEST_PANS.has(pan) || DOCUMENTED_TEST_PANS.has(pan);
+    if (environment === "sandbox" && !test)
+        return "sandbox_host_requires_documented_test_card";
+    if (environment === "production" && test)
+        return "live_host_refuses_documented_test_card";
+    if (!yymmOf(card))
+        return "invalid_expiry";
+    if (!exact(/^[0-9]{3,4}$/, card.cvc))
+        return "invalid_security_code";
+    return null;
+}
+function isApsDeviceRequest(templateBody, deviceBody, environment) {
+    const template = parseForm(templateBody);
+    const device = parseForm(deviceBody);
+    if (!template || !device || apsBodyRefusal(templateBody) !== null || device.pairs.length !== template.pairs.length)
+        return false;
+    return device.pairs.every((pair, i) => {
+        const page = template.pairs[i];
+        if (pair.rawName !== page.rawName)
+            return false;
+        if (!APS_CARD_FIELDS.includes(pair.name))
+            return pair.raw === page.raw;
+        if (!SHAPES.get(pair.name)(pair.value))
+            return false;
+        if (pair.name !== "card_number" || pair.raw !== page.raw)
+            return true;
+        return environment === "sandbox" && (APS_TEST_PANS.has(pair.value) || DOCUMENTED_TEST_PANS.has(pair.value));
+    });
+}
+function apsDeviceRequest(request, card, options) {
+    const merchantOrigin = record(options) ? options.merchantOrigin : void 0;
+    if (typeof merchantOrigin !== "string" || apsRequestRefusal(request, { merchantOrigin }) !== null)
+        throw new Error(MALFORMED);
+    const environment = apsEnvironment(request.url);
+    const refusal = apsCardRefusal(environment, card);
+    if (refusal === "sandbox_host_requires_documented_test_card")
+        throw new Error(SANDBOX_CARD);
+    if (refusal)
+        throw new Error(FILL_FAILED);
+    const fresh = /* @__PURE__ */ new Map([["card_number", card.number], ["expiry_date", yymmOf(card)], ["card_security_code", card.cvc]]);
+    const form = parseForm(request.body);
+    const body = form.pairs.map(({ name, rawName, raw }) => `${rawName}=${fresh.has(name) ? formEncode(fresh.get(name)) : raw}`).join("&");
+    if (!isApsDeviceRequest(request.body, body, environment))
+        throw new Error(MALFORMED);
+    const captured = requestHeaders(request.headers);
+    const headers = { "content-type": FORM_TYPE, origin: merchantOrigin };
+    if (captured.has("referer"))
+        headers.referer = captured.get("referer");
+    return { url: request.url, method: "POST", headers, body, where: form.pairs.filter(({ name }) => fresh.has(name)).map(({ name }) => name) };
+}
+var APS_TOKEN_RESPONSE_CODES = /* @__PURE__ */ Object.freeze(["18000", "18062", "18063"]);
+var APS_KEPT_CARD_CODES = /* @__PURE__ */ Object.freeze(["18062", "18063"]);
+var APS_REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze([
+    "001",
+    "002",
+    "003",
+    "004",
+    "007",
+    "008",
+    "009",
+    "010",
+    "012",
+    "014",
+    "015",
+    "016",
+    "017",
+    "018",
+    "027",
+    "032",
+    "033",
+    "034",
+    "037",
+    "038",
+    "039",
+    "040",
+    "046",
+    "066",
+    "073",
+    "080",
+    "087",
+    "100",
+    "110",
+    "123"
+]);
+var APS_ANSWER_REASONS = /* @__PURE__ */ Object.freeze([
+    "answer_unreadable",
+    "answer_status",
+    "answer_type",
+    "answer_size",
+    "answer_location",
+    "answer_page",
+    "answer_fields",
+    "answer_mismatch",
+    "card_in_answer",
+    "card_mismatch",
+    "card_kept",
+    "token_shape",
+    "answer_unconfirmed"
+]);
+var APS_PAGE_CONTENT_TYPE = "text/html;charset=UTF-8";
+var ANSWER_LIMIT = 64 * 1024;
+var TOKEN_NAME = /^[A-Za-z0-9.@_-]{1,100}$/;
+var MASKED_NUMBER = /^([0-9]{6,8})[*Xx]{2,9}[0-9]{4}$/;
+var SIGNATURE = /^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64}|[0-9a-fA-F]{128})$/;
+var NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+function decodeEntities(text) {
+    return text.replace(/&(#[xX][0-9a-fA-F]{1,6}|#[0-9]{1,7}|[A-Za-z]{2,4});/g, (whole, name) => {
+        if (name[0] !== "#")
+            return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, name.toLowerCase()) ? NAMED_ENTITIES[name.toLowerCase()] : whole;
+        const code = name[1] === "x" || name[1] === "X" ? parseInt(name.slice(2), 16) : parseInt(name.slice(1), 10);
+        return code > 0 && code <= 1114111 ? String.fromCodePoint(code) : whole;
+    });
+}
+function answerHeaders(headers) {
+    if (headers === void 0)
+        return void 0;
+    const out = /* @__PURE__ */ new Map();
+    const add = (name, value) => {
+        if (typeof name !== "string" || typeof value !== "string")
+            return false;
+        out.set(name.toLowerCase(), [...out.get(name.toLowerCase()) ?? [], value]);
+        return true;
+    };
+    if (Array.isArray(headers)) {
+        for (const pair of headers)
+            if (!Array.isArray(pair) || pair.length !== 2 || !add(pair[0], pair[1]))
+                return null;
+        return out;
+    }
+    if (!record(headers))
+        return null;
+    for (const [name, value] of Object.entries(headers))
+        for (const item of Array.isArray(value) ? value : [value])
+            if (!add(name, item))
+                return null;
+    return out;
+}
+function htmlUtf8(values, text) {
+    if (!values || values.length !== 1)
+        return false;
+    const [type, ...params] = values[0].split(";").map((part) => part.trim());
+    const charsets = params.filter((param) => /^charset\s*=/i.test(param)).map((param) => param.replace(/^charset\s*=\s*"?([^"]*)"?$/i, "$1").toLowerCase());
+    if (type.toLowerCase() !== "text/html" || charsets.length > 1)
+        return false;
+    return charsets.length === 1 ? charsets[0] === "utf-8" || charsets[0] === "utf8" : /^[\u0000-\u007f]*$/.test(text);
+}
+var JSON_STRING = /"(?:[^"\\\u0000-\u001f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"/y;
+var JSON_WHOLE = /0|[1-9][0-9]{0,14}/y;
+var JSON_NULL = /null/y;
+var JSON_SPACE = /[ \t\n\r]*/y;
+function returnUrlParamsOf(html) {
+    const assignments = [...html.matchAll(/\breturnUrlParams\s*=\s*/g)];
+    if (assignments.length !== 1)
+        return null;
+    let at = assignments[0].index + assignments[0][0].length;
+    const take = (pattern) => {
+        pattern.lastIndex = at;
+        const match = pattern.exec(html);
+        if (match)
+            at = pattern.lastIndex;
+        return match ? match[0] : null;
+    };
+    if (html[at] !== "{")
+        return null;
+    at += 1;
+    take(JSON_SPACE);
+    const out = /* @__PURE__ */ new Map();
+    if (html[at] === "}")
+        return out;
+    for (;;) {
+        const key = take(JSON_STRING);
+        take(JSON_SPACE);
+        if (key === null || html[at] !== ":")
+            return null;
+        at += 1;
+        take(JSON_SPACE);
+        const start = at;
+        const raw = html[at] === '"' ? take(JSON_STRING) : html[at] === "n" ? take(JSON_NULL) : take(JSON_WHOLE);
+        const name = JSON.parse(key);
+        if (raw === null || out.has(name))
+            return null;
+        const quoted = raw[0] === '"';
+        out.set(name, {
+            value: quoted ? JSON.parse(raw) : raw === "null" ? null : raw,
+            numeric: !quoted && raw !== "null",
+            start: quoted ? start + 1 : start,
+            end: quoted ? at - 1 : at
+        });
+        take(JSON_SPACE);
+        if (html[at] === "}")
+            return out;
+        if (html[at] !== ",")
+            return null;
+        at += 1;
+        take(JSON_SPACE);
+    }
+}
+function returnUrlFormOf(html) {
+    const forms = [...html.matchAll(/<form\b([^>]*)>/gi)];
+    if (forms.length !== 1)
+        return null;
+    const base = forms[0].index + "<form".length;
+    const attrs = /* @__PURE__ */ new Map();
+    for (const match of forms[0][1].matchAll(/([A-Za-z_:][-A-Za-z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/g)) {
+        const name = match[1].toLowerCase();
+        if (attrs.has(name))
+            return null;
+        const raw = match[2] ?? match[3] ?? match[4];
+        const end = base + match.index + match[0].length - (match[4] === void 0 ? 1 : 0);
+        attrs.set(name, { value: decodeEntities(raw), start: end - raw.length, end });
+    }
+    const action = attrs.get("action");
+    return attrs.get("id")?.value === "returnUrlForm" ? { action: action?.value, actionSpan: action ? { start: action.start, end: action.end } : null, method: (attrs.get("method")?.value ?? "").toLowerCase() } : null;
+}
+function answerParams(reply, returnUrl) {
+    const headers = answerHeaders(reply.headers);
+    if (headers === null)
+        return { error: "answer_type" };
+    if (reply.status === 302 || reply.status === 303) {
+        const location = headers?.get("location");
+        const prefix = `${returnUrl}${returnUrl.includes("?") ? "&" : "?"}`;
+        if (!location || location.length !== 1 || location[0].length > 16 * 1024 || !location[0].startsWith(prefix) || location[0].includes("#"))
+            return { error: "answer_location" };
+        const fields2 = /* @__PURE__ */ new Map();
+        let at = prefix.length;
+        for (const chunk of location[0].slice(prefix.length).split("&")) {
+            const eq = chunk.indexOf("=");
+            let name = null, value = null;
+            try {
+                name = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+                value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+            }
+            catch {
+                name = null;
+            }
+            if (eq < 1 || name === null || fields2.has(name))
+                return { error: "answer_location" };
+            fields2.set(name, { value, start: at + eq + 1, end: at + chunk.length });
+            at += chunk.length + 1;
+        }
+        return { shape: "redirect", fields: fields2, text: location[0], own: [{ start: 0, end: returnUrl.length }] };
+    }
+    if (reply.status !== 200)
+        return { error: "answer_status" };
+    if (headers?.has("location"))
+        return { error: "answer_location" };
+    if (headers !== void 0 && !htmlUtf8(headers.get("content-type"), reply.bodyText))
+        return { error: "answer_type" };
+    if (new TextEncoder().encode(reply.bodyText).length > ANSWER_LIMIT)
+        return { error: "answer_size" };
+    const form = returnUrlFormOf(reply.bodyText);
+    const fields = returnUrlParamsOf(reply.bodyText);
+    if (!form || !fields || form.method !== "post" || form.action !== returnUrl)
+        return { error: "answer_page" };
+    return { shape: "page", fields, text: reply.bodyText, own: [form.actionSpan] };
+}
+function writesCardNumber(text) {
+    const digit = String.raw `(?:[0-9]|\\u003[0-9]|%3[0-9]|&#0*(?:4[89]|5[0-7]);|&#x0*3[0-9];)`;
+    const escape = String.raw `\\(?:[/\\"bfnrt]|u(?:00(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])|0[1-9a-f][0-9a-f]{2}|[1-9a-f][0-9a-f]{3}))` + String.raw `|%(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])` + String.raw `|&(?:#0*(?:[0-9]|[1-3][0-9]|4[0-7]|5[89]|6[0-4]|9[1-6]|12[3-9]|1[3-9][0-9]|[2-9][0-9]{2}|[1-9][0-9]{3,6})|#x0*(?:[0-9a-f]|[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f]|[1-9a-f][0-9a-f]{2,5})|[a-z][a-z0-9]{1,31});`;
+    const separator = `(?:${escape}|[^0-9A-Za-z\\\\%&]|%(?![0-9a-f]{2})|&(?!#?x?[0-9a-z]+;))`;
+    for (const [run] of text.matchAll(new RegExp(`${digit}(?:${separator}*${digit})*`, "gi"))) {
+        const groups = run.replace(new RegExp(escape, "gi"), " ").replace(/\\u003([0-9])/gi, "$1").replace(/%3([0-9])/g, "$1").replace(/&#x0*3([0-9]);/gi, "$1").replace(/&#0*(4[89]|5[0-7]);/g, (_form, code) => String.fromCharCode(Number(code))).split(/[^0-9]+/).filter(Boolean);
+        for (let first = 0; first < groups.length; first += 1) {
+            let digits = "";
+            for (let last = first; last < groups.length; last += 1) {
+                digits += groups[last];
+                if (digits.length > 19)
+                    break;
+                if (digits.length >= 13 && digits[0] >= "2" && digits[0] <= "6" && luhn(digits))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function percentUndone(text) {
+    let out = text;
+    for (let pass = 0; pass < 16; pass += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            return out;
+        out = next;
+    }
+    return null;
+}
+function passedOver(name, value, sent) {
+    if (name === "signature")
+        return exact(SIGNATURE, value);
+    if (name === "token_name")
+        return exact(TOKEN_NAME, value);
+    return !APS_CARD_FIELDS.includes(name) && sent.has(name) && sent.get(name) === value;
+}
+var unicodeDigit = (code) => code >= 1632 && code <= 1641 ? code - 1632 : code >= 1776 && code <= 1785 ? code - 1776 : code >= 65296 && code <= 65305 ? code - 65296 : -1;
+function asciiDigits(text) {
+    const asDigit = (whole, code) => unicodeDigit(code) < 0 ? whole : String(unicodeDigit(code));
+    return text.replace(/&#(?:[xX]0*([0-9a-fA-F]{1,6})|0*([0-9]{1,7}));/g, (whole, hex, dec) => asDigit(whole, hex ? parseInt(hex, 16) : parseInt(dec, 10))).replace(/\\u([0-9a-fA-F]{4})/g, (whole, hex) => asDigit(whole, parseInt(hex, 16))).replace(/%D9%A([0-9])|%DB%B([0-9])|%EF%BC%9([0-9])/gi, (_whole, a, b, c) => a ?? b ?? c).replace(/[\u0660-\u0669\u06F0-\u06F9\uFF10-\uFF19]/g, (digit) => String(unicodeDigit(digit.charCodeAt(0))));
+}
+function scannedTexts(read, sent) {
+    const spans = [
+        ...[...read.fields].filter(([name, field]) => field.end > field.start && passedOver(name, field.value, sent)).map(([, field]) => field),
+        ...read.own
+    ].sort((a, b) => b.start - a.start);
+    let out = read.text;
+    for (const { start, end } of spans)
+        out = out.slice(0, start) + out.slice(end);
+    out = asciiDigits(out);
+    return read.shape === "page" ? [out, out.replace(/<[^>]*>/g, " ")] : [out];
+}
+function statedValues(fields) {
+    const out = /* @__PURE__ */ new Map();
+    for (const [name, field] of fields) {
+        if (field.value === null || field.value === "")
+            continue;
+        const width = !field.numeric ? 0 : name === "status" ? 2 : name === "response_code" ? 5 : 0;
+        out.set(name, field.value.padStart(width, "0"));
+    }
+    return out;
+}
+var BINDING_ECHOES = /* @__PURE__ */ Object.freeze(["merchant_identifier", "access_code", "merchant_reference"]);
+var sentFields = (template) => record(template) && apsTokenizationUrl(template.url) && apsBodyRefusal(template.body) === null ? parseForm(template.body).values : null;
+function apsScannedTexts(reply, template) {
+    const sent = sentFields(template);
+    if (!record(reply) || !Number.isInteger(reply.status) || typeof reply.bodyText !== "string" || !sent)
+        return null;
+    const read = answerParams(reply, sent.get("return_url"));
+    return read.error ? null : scannedTexts(read, sent);
+}
+function apsAnswerOutcome(reply, template, card, options) {
+    const unknown = (reason) => ({ outcome: "unknown", reason });
+    const sent = sentFields(template);
+    if (!record(reply) || !Number.isInteger(reply.status) || typeof reply.bodyText !== "string" || !sent)
+        return unknown("answer_unreadable");
+    const read = answerParams(reply, sent.get("return_url"));
+    if (read.error)
+        return unknown(read.error);
+    const p = statedValues(read.fields);
+    if (p.has("card_security_code") || !p.has("status") || !p.has("response_code"))
+        return unknown("answer_fields");
+    if (BINDING_ECHOES.some((name) => p.has(name) && p.get(name) !== sent.get(name)) || p.has("service_command") && p.get("service_command") !== "TOKENIZATION")
+        return unknown("answer_mismatch");
+    const masked = p.get("card_number");
+    const shown = masked === void 0 ? null : MASKED_NUMBER.exec(masked);
+    if (masked !== void 0 && !shown)
+        return unknown("card_in_answer");
+    if (scannedTexts(read, sent).some(writesCardNumber))
+        return unknown("card_in_answer");
+    for (const [name, value] of p) {
+        if (name === "card_number" || passedOver(name, value, sent))
+            continue;
+        const open = percentUndone(asciiDigits(value));
+        if (open === null || writesCardNumber(asciiDigits(open)))
+            return unknown("card_in_answer");
+    }
+    if (card !== void 0 && card !== null) {
+        const number = record(card) && typeof card.number === "string" ? card.number : "";
+        const leak = record(options) && Object.prototype.hasOwnProperty.call(options, "cardLeak") ? options.cardLeak : void 0;
+        if (!/^[0-9]{12,19}$/.test(number) || leak !== null || [...p.values()].some((value) => asciiDigits(value).replace(/[^0-9]/g, "").includes(number))) {
+            return unknown("card_in_answer");
+        }
+        if (shown && (!number.startsWith(shown[1]) || masked.slice(-4) !== number.slice(-4)) || p.has("card_bin") && !(exact(/^[0-9]{6,8}$/, p.get("card_bin")) && number.startsWith(p.get("card_bin"))) || p.has("expiry_date") && p.get("expiry_date") !== yymmOf(card)) {
+            return unknown("card_mismatch");
+        }
+    }
+    const last4 = record(options) ? options.cardLast4 : void 0;
+    if (last4 !== void 0 && (!exact(/^[0-9]{4}$/, last4) || masked !== void 0 && masked.slice(-4) !== last4))
+        return unknown("card_mismatch");
+    const status = p.get("status"), code = p.get("response_code");
+    if (status === "18" && APS_TOKEN_RESPONSE_CODES.includes(code)) {
+        if (p.get("service_command") !== "TOKENIZATION" || !exact(TOKEN_NAME, p.get("token_name")) || masked === void 0 || BINDING_ECHOES.some((name) => !p.has(name)))
+            return unknown("token_shape");
+        if (sent.get("remember_me") === "NO" && (APS_KEPT_CARD_CODES.includes(code) || p.has("remember_me") && p.get("remember_me") !== "NO")) {
+            return unknown("card_kept");
+        }
+        return { outcome: "token", shape: read.shape, body: read.shape === "page" ? reply.bodyText : "", ...read.shape === "redirect" ? { location: read.text } : {} };
+    }
+    if ((status === "00" || status === "17") && exact(/^[0-9]{5}$/, code) && code.startsWith(status) && APS_REFUSAL_MESSAGES.includes(code.slice(2)) && !p.has("token_name"))
+        return { outcome: "refused", code };
+    return unknown("answer_unconfirmed");
+}
+function apsRefusalCode(bodyText) {
+    if (typeof bodyText !== "string" || bodyText.length > ANSWER_LIMIT)
+        return null;
+    const fields = returnUrlParamsOf(bodyText);
+    const p = fields ? statedValues(fields) : null;
+    const status = p?.get("status"), code = p?.get("response_code");
+    return p && (status === "00" || status === "17") && exact(/^[0-9]{5}$/, code) && code.startsWith(status) && APS_REFUSAL_MESSAGES.includes(code.slice(2)) && !p.has("token_name") ? code : null;
+}
+var isApsRefusalCode = (code) => typeof code === "string" && /^(?:00|17)[0-9]{3}$/.test(code) && APS_REFUSAL_MESSAGES.includes(code.slice(2));
+export { APS_ANSWER_REASONS, APS_CAPABILITY, APS_CARD_FIELDS, APS_HOSTS, APS_KEPT_CARD_CODES, APS_MERCHANTS, APS_MERCHANT_REFUSALS, APS_OPERATION, APS_OPTIONAL_FIELDS, APS_PAGE_CONTENT_TYPE, APS_PSP, APS_REFUSAL_CODES, APS_REFUSAL_MESSAGES, APS_SIGNED_FIELDS, APS_TEST_PANS, APS_TOKENIZATION_PATH, APS_TOKEN_RESPONSE_CODES, apsAnswerOutcome, apsBodyRefusal, apsBodyVerdict, apsCardRefusal, apsDeviceRequest, apsEnvironment, apsKeepsCardOnFile, apsMerchantPin, apsMerchantRefusal, apsRefusalCode, apsRefusalMessage, apsRequestFacts, apsRequestRefusal, apsScannedTexts, apsTokenizationUrl, isApsDeviceRequest, isApsRefusalCode, isApsTokenizationUrl };