@agent-cards/sdk 0.23.27 → 0.24.0

package/dist/processout.generated.d.ts

@@ -0,0 +1,61 @@
+declare var PROCESSOUT_PSP: string;
+declare var PROCESSOUT_CAPABILITY: string;
+declare var PROCESSOUT_OPERATION: string;
+declare var PROCESSOUT_API_HOST: string;
+declare var PROCESSOUT_API_VERSION: string;
+declare var PROCESSOUT_PREPARATION_URLS: Readonly<{
+    production: "https://api.processout.com/cards?project_id=proj_prepared";
+    sandbox: "https://api.processout.com/cards?project_id=test-proj_prepared";
+}>;
+declare var PROCESSOUT_REFUSAL_CODES: readonly string[];
+declare var PROCESSOUT_CARD_KEYS: readonly string[];
+declare function processoutCardTarget(url: any): Readonly<{
+    projectId: string;
+    environment: "production" | "sandbox";
+}> | null;
+declare function isProcessoutCardUrl(url: any): boolean;
+declare function processoutEnvironment(url: any): "production" | "sandbox" | null;
+declare function processoutBodyVerdict(body: any, url: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function processoutRequestRefusal(request: any): any;
+declare function processoutProjectId(request: any): string | null;
+declare function isPreparedProcessoutRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare function processoutPinOriginUsable(origin: any): boolean;
+declare var PROCESSOUT_MERCHANT_PINS: readonly never[];
+declare function processoutOriginPin(merchantOrigin: any, pins?: readonly never[]): null;
+declare function processoutPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly never[]): "unsupported_environment" | "processout_merchant_unreviewed" | null;
+declare function processoutMerchantPin(merchantOrigin: any, request: any, pins?: readonly never[]): null;
+declare function processoutMerchantRefusal(merchantOrigin: any, request: any, pins?: readonly never[]): "processout_url_refused" | "processout_merchant_unreviewed" | "processout_project_unreviewed" | null;
+declare var PROCESSOUT_TEST_PANS: readonly string[];
+declare function isProcessoutTestCard(number: any): boolean;
+declare function processoutDeviceRefusal(request: any, card: any, options: any): any;
+declare function processoutRefusalMessage(code: any): any;
+declare function injectProcessoutCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function processoutRefusalCode(text: any): string | null;
+declare function isProcessoutRefusalCode(code: any): boolean;
+declare function processoutAnswerOutcome(status: any, text: any, card: any, template: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+declare var processout_default: any;
+declare var device: any;
+export { PROCESSOUT_API_HOST, PROCESSOUT_API_VERSION, PROCESSOUT_CAPABILITY, PROCESSOUT_CARD_KEYS, PROCESSOUT_MERCHANT_PINS, PROCESSOUT_OPERATION, PROCESSOUT_PREPARATION_URLS, PROCESSOUT_PSP, PROCESSOUT_REFUSAL_CODES, PROCESSOUT_TEST_PANS, processout_default as default, device, injectProcessoutCard, isPreparedProcessoutRequest, isProcessoutCardUrl, isProcessoutRefusalCode, isProcessoutTestCard, processoutAnswerOutcome, processoutBodyVerdict, processoutCardTarget, processoutDeviceRefusal, processoutEnvironment, processoutMerchantPin, processoutMerchantRefusal, processoutOriginPin, processoutPinOriginUsable, processoutPreparationRefusal, processoutProjectId, processoutRefusalCode, processoutRefusalMessage, processoutRequestRefusal };

package/dist/processout.generated.js

@@ -0,0 +1,577 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: b04e28b1a574ea60e62b721f13185f487aee8ed4c78fe9f3b35793df51bd9fe7
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/registration.js
+var PARTS = {
+    psp: "id",
+    definitions: "list",
+    refusedOperations: "list",
+    settlementReadback: "any",
+    exactUrl: "rule",
+    bodyGate: "rule",
+    amount: "rule",
+    hostedEntry: "rule",
+    limitations: "sentences"
+};
+var DEVICE_PARTS = { psp: "id", testPans: "numbers", deviceCheck: "rule", fill: "rule", refusalCode: "rule", outcome: "rule", relayOnly: "flag" };
+var PSP_ID = /^[a-z][a-z0-9_]*$/;
+function problemsOf(spec, parts) {
+    if (!spec || typeof spec !== "object")
+        return ["a registration is an object"];
+    const psp = spec.psp;
+    if (typeof psp !== "string" || !PSP_ID.test(psp))
+        return [`${JSON.stringify(psp)} is not a processor id`];
+    const problems = Object.keys(spec).filter((key) => !(key in parts)).map((key) => `${psp}: ${key} is no registration part`);
+    for (const [key, kind] of Object.entries(parts)) {
+        const value = spec[key];
+        if (value === void 0)
+            continue;
+        if (kind === "rule" && typeof value !== "function")
+            problems.push(`${psp}: ${key} is not a function`);
+        if (kind === "flag" && value !== true)
+            problems.push(`${psp}: ${key} is not true`);
+        if (kind === "numbers" && !((Array.isArray(value) || value instanceof Set) && [...value].every((n) => typeof n === "string" && /^\d{12,19}$/.test(n)))) {
+            problems.push(`${psp}: ${key} is not a list of card numbers`);
+        }
+        if (kind === "sentences" && !(Array.isArray(value) && value.length > 0 && value.every((s) => typeof s === "string" && s.trim() !== ""))) {
+            problems.push(`${psp}: ${key} is not a list of sentences`);
+        }
+    }
+    if ("definitions" in parts) {
+        if (!Array.isArray(spec.definitions) || spec.definitions.length === 0)
+            problems.push(`${psp}: names no definition`);
+        else if (spec.definitions.some((definition) => definition?.psp !== psp))
+            problems.push(`${psp}: a definition names another processor`);
+        for (const id of spec.refusedOperations ?? []) {
+            if (typeof id !== "string" || !id.startsWith(`${psp}.`))
+                problems.push(`${psp}: ${JSON.stringify(id)} is not one of its operations`);
+        }
+        const pages = Array.isArray(spec.definitions) ? spec.definitions.filter((d) => d?.hostedForm?.cardIn === "processor_page") : [];
+        if (spec.hostedEntry !== void 0 && (pages.length === 0 || pages.some((d) => d.hostedForm.policy !== void 0))) {
+            problems.push(`${psp}: hostedEntry needs a definition whose hosted form takes the card on the processor's page and names no policy`);
+        }
+    }
+    return problems;
+}
+function registered(spec, parts) {
+    const problems = problemsOf(spec, parts);
+    if (problems.length)
+        throw new Error(`payment-core registration refused: ${problems.join("; ")}`);
+    return deepFreeze({ ...spec });
+}
+function registerProcessor(spec) {
+    return registered(spec, PARTS);
+}
+function registerDeviceRules(psp, rules) {
+    const checked = registered({ psp, ...rules }, DEVICE_PARTS);
+    return checked.testPans ? Object.freeze({ ...checked, testPans: new Set(checked.testPans) }) : checked;
+}
+// src/processors/processout.js
+var PROCESSOUT_PSP = "processout";
+var PROCESSOUT_CAPABILITY = "processout_card_token";
+var PROCESSOUT_OPERATION = "processout.card_request";
+var PROCESSOUT_API_HOST = "api.processout.com";
+var PROCESSOUT_API_VERSION = "1.3.0.0";
+var PROCESSOUT_PREPARATION_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://api.processout.com/cards?project_id=proj_prepared",
+    sandbox: "https://api.processout.com/cards?project_id=test-proj_prepared"
+});
+var PROCESSOUT_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "processout_url_refused",
+    "processout_headers_refused",
+    "processout_body_unsupported",
+    "processout_merchant_unreviewed",
+    "processout_project_unreviewed",
+    "processout_live_row_required",
+    "processout_keep_on_file",
+    "processout_test_card_required"
+]);
+var URL_LIMIT = 512;
+var BODY_LIMIT = 4096;
+var CARD_URL = /^https:\/\/api\.processout\.com\/cards\?legacyrequest=true&project_id=((?:test-)?proj_[A-Za-z0-9]{16,64})&x-Content-Type=application\/json&x-API-Version=1\.3\.0\.0&x-Authorization=Basic%20([A-Za-z0-9+/]{4,256}={0,2})$/;
+var JSON_TYPE = /^application\/json(?:; ?charset=utf-8)?$/i;
+var FOREIGN_HEADERS = /* @__PURE__ */ Object.freeze(["x-processout-client-secret", "idempotency-key"]);
+var PAGE_KEYS = /* @__PURE__ */ Object.freeze(["name", "contact", "preferred_scheme"]);
+var CONTACT_KEYS = /* @__PURE__ */ Object.freeze(["address1", "address2", "city", "state", "country_code", "zip"]);
+var DEVICE_KEYS = /* @__PURE__ */ Object.freeze([
+    "request_origin",
+    "app_color_depth",
+    "app_language",
+    "app_screen_height",
+    "app_screen_width",
+    "app_timezone_offset",
+    "app_java_enabled"
+]);
+var PROCESSOUT_CARD_KEYS = /* @__PURE__ */ Object.freeze(["number", "exp_month", "exp_year", "cvc2"]);
+var BODY_KEYS = /* @__PURE__ */ new Set([...PAGE_KEYS, "device", ...DEVICE_KEYS, ...PROCESSOUT_CARD_KEYS]);
+var NUMBER = /^[0-9]{12,19}$/;
+var MONTH = /^(?:[1-9]|1[0-2])$/;
+var YEAR = /^20[0-9]{2}$/;
+var CODE = /^[0-9]{3,4}$/;
+var TEXT_LIMIT = 256;
+var SCHEME = /^[A-Za-z][A-Za-z0-9 _-]{0,31}$/;
+var LANGUAGE = /^[A-Za-z]{1,8}(?:-[A-Za-z0-9]{1,8}){0,4}$/;
+var PAN_LIKE = /(?:[0-9][^0-9A-Za-z]*){12,}/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+var BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Of(text) {
+    let out = "";
+    for (let at = 0; at < text.length; at += 3) {
+        const a = text.charCodeAt(at);
+        const b = at + 1 < text.length ? text.charCodeAt(at + 1) : NaN;
+        const c = at + 2 < text.length ? text.charCodeAt(at + 2) : NaN;
+        out += BASE64[a >> 2] + BASE64[(a & 3) << 4 | (Number.isNaN(b) ? 0 : b >> 4)] + (Number.isNaN(b) ? "=" : BASE64[(b & 15) << 2 | (Number.isNaN(c) ? 0 : c >> 6)]) + (Number.isNaN(c) ? "=" : BASE64[c & 63]);
+    }
+    return out;
+}
+var basicOf = (projectId) => base64Of(`${projectId}:`);
+function luhn(digits) {
+    let sum = 0;
+    for (let at = 0; at < digits.length; at += 1) {
+        let digit = Number(digits[digits.length - 1 - at]);
+        if (at % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function processoutCardTarget(url) {
+    if (typeof url !== "string" || url.length > URL_LIMIT)
+        return null;
+    const match = CARD_URL.exec(url);
+    if (!match || match[2] !== basicOf(match[1]))
+        return null;
+    return Object.freeze({ projectId: match[1], environment: match[1].startsWith("test-") ? "sandbox" : "production" });
+}
+function isProcessoutCardUrl(url) {
+    return processoutCardTarget(url) !== null;
+}
+function processoutEnvironment(url) {
+    const target = processoutCardTarget(url);
+    return target === null ? null : target.environment;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(body);
+        return record(value) && JSON.stringify(value) === body ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var pageText = (value) => value === null || typeof value === "string" && value.length <= TEXT_LIMIT && !PAN_LIKE.test(value);
+var DEVICE_RULES = /* @__PURE__ */ Object.freeze({
+    request_origin: (value) => value === "web",
+    app_color_depth: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 64,
+    app_language: (value) => typeof value === "string" && value.length <= 64 && LANGUAGE.test(value),
+    app_screen_height: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_screen_width: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 1e5,
+    app_timezone_offset: (value) => Number.isSafeInteger(value) && value >= -1440 && value <= 1440,
+    app_java_enabled: (value) => typeof value === "boolean"
+});
+function soundDevice(value) {
+    const device2 = value.device;
+    if (!record(device2) || !own(device2, "request_origin") || !own(device2, "app_timezone_offset"))
+        return false;
+    return DEVICE_KEYS.every((key) => own(device2, key) ? DEVICE_RULES[key](device2[key]) && own(value, key) && value[key] === device2[key] : !own(value, key)) && Object.keys(device2).every((key) => DEVICE_KEYS.includes(key));
+}
+function soundPageData(value) {
+    if (own(value, "name") && !pageText(value.name))
+        return false;
+    if (own(value, "preferred_scheme") && !(value.preferred_scheme === null || typeof value.preferred_scheme === "string" && SCHEME.test(value.preferred_scheme)))
+        return false;
+    const contact = value.contact;
+    return record(contact) && Object.keys(contact).every((key) => CONTACT_KEYS.includes(key) && pageText(contact[key]));
+}
+function processoutBodyVerdict(body, url) {
+    if (url !== void 0 && processoutCardTarget(url) === null)
+        return refuse("processout_url_refused");
+    const value = readBody(body);
+    if (value === null || !Object.keys(value).every((key) => BODY_KEYS.has(key)))
+        return refuse("processout_body_unsupported");
+    if (!PROCESSOUT_CARD_KEYS.every((key) => typeof value[key] === "string"))
+        return refuse("processout_body_unsupported");
+    if (!NUMBER.test(value.number) || !luhn(value.number) || !MONTH.test(value.exp_month) || !YEAR.test(value.exp_year) || !CODE.test(value.cvc2))
+        return refuse("processout_body_unsupported");
+    if (!soundPageData(value) || !soundDevice(value))
+        return refuse("processout_body_unsupported");
+    return CARD;
+}
+function headerMap(headers) {
+    const out = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(record(headers) ? headers : {})) {
+        const lower = name.toLowerCase();
+        if (out.has(lower) || typeof value !== "string")
+            return null;
+        out.set(lower, value);
+    }
+    return out;
+}
+function processoutRequestRefusal(request) {
+    if (!record(request) || request.method !== "POST")
+        return "processout_url_refused";
+    const target = processoutCardTarget(request.url);
+    if (target === null)
+        return "processout_url_refused";
+    const map = headerMap(request.headers);
+    if (map === null || !JSON_TYPE.test(map.get("content-type") ?? "") || map.get("api-version") !== PROCESSOUT_API_VERSION || map.get("authorization") !== `Basic ${basicOf(target.projectId)}` || FOREIGN_HEADERS.some((name) => map.has(name)))
+        return "processout_headers_refused";
+    const verdict = processoutBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function processoutProjectId(request) {
+    return processoutRequestRefusal(request) === null ? processoutCardTarget(request.url).projectId : null;
+}
+function isPreparedProcessoutRequest(url, method, body, environment, headers) {
+    return (environment === "production" || environment === "sandbox") && processoutEnvironment(url) === environment && processoutRequestRefusal({ url, method, headers, body }) === null;
+}
+var PIN_ORIGIN = /^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/;
+var PROCESSOUT_DOMAIN = /(?:^|\.)processout\.(?:com|ninja|dev)$/;
+var LIVE_PROJECT = /^proj_[A-Za-z0-9]{16,64}$/;
+function processoutPinOriginUsable(origin) {
+    const host = typeof origin === "string" ? PIN_ORIGIN.exec(origin) : null;
+    return !!host && !PROCESSOUT_DOMAIN.test(host[1]);
+}
+var PROCESSOUT_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([]);
+var usablePin = (entry) => record(entry) && typeof entry.merchant === "string" && entry.merchant !== "" && Array.isArray(entry.origins) && entry.origins.length > 0 && entry.origins.every(processoutPinOriginUsable) && Array.isArray(entry.projectIds) && entry.projectIds.length > 0 && entry.projectIds.every((id) => typeof id === "string" && LIVE_PROJECT.test(id));
+function processoutOriginPin(merchantOrigin, pins = PROCESSOUT_MERCHANT_PINS) {
+    if (!processoutPinOriginUsable(merchantOrigin) || !Array.isArray(pins))
+        return null;
+    const found = pins.filter((entry) => usablePin(entry) && entry.origins.includes(merchantOrigin));
+    return found.length === 1 ? found[0] : null;
+}
+function processoutPreparationRefusal(environment, merchantOrigin, pins = PROCESSOUT_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    return processoutOriginPin(merchantOrigin, pins) ? null : "processout_merchant_unreviewed";
+}
+function processoutMerchantPin(merchantOrigin, request, pins = PROCESSOUT_MERCHANT_PINS) {
+    const target = record(request) ? processoutCardTarget(request.url) : null;
+    if (target === null || target.environment !== "production")
+        return null;
+    const found = processoutOriginPin(merchantOrigin, pins);
+    return found && found.projectIds.includes(target.projectId) ? found : null;
+}
+function processoutMerchantRefusal(merchantOrigin, request, pins = PROCESSOUT_MERCHANT_PINS) {
+    const target = record(request) ? processoutCardTarget(request.url) : null;
+    if (target === null)
+        return "processout_url_refused";
+    if (target.environment === "sandbox")
+        return null;
+    if (processoutOriginPin(merchantOrigin, pins) === null)
+        return "processout_merchant_unreviewed";
+    return processoutMerchantPin(merchantOrigin, request, pins) ? null : "processout_project_unreviewed";
+}
+var PROCESSOUT_TEST_PANS = /* @__PURE__ */ Object.freeze([
+    "4242424242424242",
+    "5555555555554444",
+    "378282246310005",
+    "30123456789019",
+    "3530111333300000",
+    "6011111111111117",
+    "4977830000000001",
+    "4360000001000005",
+    "5130290000000009",
+    "4658580000000008",
+    "4571730000000003",
+    "4023600000000002",
+    "4338300000000009",
+    "4835910000000003",
+    "4000000000000101",
+    "4000000000000119",
+    "4000000000000259",
+    "4000000000003238",
+    "4000000000003055",
+    "4000000000003063",
+    "4000000000003220",
+    "4000000000003253",
+    "4000000000003246",
+    "4000000000002180",
+    "4000000000002198",
+    "4000000000002206",
+    "4000000000002214",
+    "4000000000002222",
+    "4000000000002230",
+    "4000000000002248",
+    "4000000000002255",
+    "4000000000002263",
+    "4000000000002271",
+    "4000000000002289",
+    "4127969420587632",
+    "4000000000000002",
+    "4000000000000010",
+    "4000000000000127",
+    "4000000000000135",
+    "4000000000000028",
+    "4000000000000036",
+    "4000000000000044",
+    "4000000000000069",
+    "4000000000000077",
+    "4000000000000085",
+    "4000000000000093",
+    "4000000000000200",
+    "4000000000000309",
+    "4000000000001216",
+    "4000000000004004",
+    "4000000000006223",
+    "4000000000000531",
+    "4000000000003303",
+    "4000000000006009",
+    "4000000000004301",
+    "5337480000007168"
+]);
+function isProcessoutTestCard(number) {
+    const digits = typeof number === "string" || Number.isSafeInteger(number) ? String(number).replace(/[ -]/g, "") : "";
+    return PROCESSOUT_TEST_PANS.includes(digits);
+}
+function processoutDeviceRefusal(request, card, options) {
+    const refusal = processoutRequestRefusal(request);
+    if (refusal)
+        return refusal;
+    if (processoutEnvironment(request.url) === "sandbox")
+        return record(card) && isProcessoutTestCard(card.number) ? null : "processout_test_card_required";
+    const settings = record(options) ? options : {};
+    if (typeof settings.merchantOrigin !== "string")
+        return "processout_merchant_unreviewed";
+    if (settings.sandbox !== false)
+        return "processout_live_row_required";
+    const merchant = processoutMerchantRefusal(settings.merchantOrigin, request);
+    if (merchant)
+        return merchant;
+    return settings.keepOnFile === true ? null : "processout_keep_on_file";
+}
+var UNREVIEWED = "Refusing to pay: this ProcessOut payment goes to a merchant account Agentcard has not reviewed. Nothing was sent.";
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    processout_url_refused: "Refusing to pay: this ProcessOut card request does not go to ProcessOut's card address exactly as ProcessOut's card fields send it. Nothing was sent.",
+    processout_headers_refused: "Refusing to pay: this ProcessOut card request does not carry the headers ProcessOut's card fields send. Nothing was sent.",
+    processout_body_unsupported: "Refusing to pay: this is not the card request of ProcessOut's card fields. Nothing was sent.",
+    // The device's refusals of a live or a sandbox request (processoutDeviceRefusal), in the sentences Openpay, Pin
+    // Payments and the shared sandbox rule ship.
+    processout_merchant_unreviewed: UNREVIEWED,
+    processout_project_unreviewed: UNREVIEWED,
+    processout_live_row_required: "Refusing to pay: Agentcard sends a card to a live ProcessOut checkout only for a live purchase, and this one is not live. Nothing was sent.",
+    processout_keep_on_file: "Refusing to pay: this ProcessOut payment would keep the card on file without your consent. Nothing was sent.",
+    processout_test_card_required: "Refusing to pay: a sandbox or test host accepts only the processor's documented test cards, not a real card."
+});
+function processoutRefusalMessage(code) {
+    return own(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.processout_body_unsupported;
+}
+var FILL_FAILED = "Could not fill the card fields for ProcessOut. Nothing was sent.";
+var AMEX = /^3[47]/;
+var whole = (value) => {
+    if (Number.isSafeInteger(value) && value >= 0)
+        return value;
+    return typeof value === "string" && /^[0-9]{1,4}$/.test(value) ? Number(value) : NaN;
+};
+function cardValues(card) {
+    const usable = (value) => typeof value === "string" || Number.isSafeInteger(value);
+    if (!record(card) || !usable(card.number) || !usable(card.cvc))
+        return null;
+    const number = String(card.number);
+    const cvc = String(card.cvc);
+    const month = whole(card.month);
+    const stated = whole(card.year);
+    const year = stated >= 0 && stated <= 99 ? 2e3 + stated : stated;
+    if (!NUMBER.test(number) || !luhn(number) || !(month >= 1 && month <= 12) || !(year >= 2e3 && year <= 2099))
+        return null;
+    if (!new RegExp(`^[0-9]{${AMEX.test(number) ? 4 : 3}}$`).test(cvc))
+        return null;
+    return { number, exp_month: String(month), exp_year: String(year), cvc2: cvc };
+}
+var withoutCard = (value) => JSON.stringify(Object.fromEntries(Object.entries(value).filter(([key]) => !PROCESSOUT_CARD_KEYS.includes(key))));
+function injectProcessoutCard(body, card) {
+    const verdict = processoutBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(processoutRefusalMessage(verdict.code));
+    const values = cardValues(card);
+    if (!values)
+        throw new Error(FILL_FAILED);
+    const page = JSON.parse(body);
+    const value = JSON.parse(body);
+    for (const key of PROCESSOUT_CARD_KEYS)
+        value[key] = values[key];
+    const filled = JSON.stringify(value);
+    if (processoutBodyVerdict(filled).verdict !== "card" || withoutCard(JSON.parse(filled)) !== withoutCard(page))
+        throw new Error(FILL_FAILED);
+    return { body: filled, where: [...PROCESSOUT_CARD_KEYS] };
+}
+var ANSWER_LIMIT = 65536;
+var CARD_TOKEN = /^card_[A-Za-z0-9]{8,64}$/;
+var CARD_FACTS = /* @__PURE__ */ Object.freeze([
+    "id",
+    "project_id",
+    "scheme",
+    "co_scheme",
+    "preferred_scheme",
+    "type",
+    "bank_name",
+    "brand",
+    "category",
+    "iin",
+    "last_4_digits",
+    "exp_month",
+    "exp_year",
+    "expires_soon",
+    "sandbox"
+]);
+var LAST_FOUR = /^[0-9]{4}$/;
+var IIN = /^[0-9]{6}$/;
+var ERROR_TYPE = /^[a-z][a-z0-9_-]*(?:\.[a-z0-9_-]+)+$/;
+var TYPE_LIMIT = 53;
+var UNSETTLED_TYPE = /(?:pending|timeout|internal-error|network-error|network-failed|unknown-error)$/;
+var MAX_CODE_DIGITS = 11;
+var OUTCOMES = /* @__PURE__ */ Object.freeze(["success", "failed", "pending"]);
+var REFUSAL_CODE = /^(?:processout_refused|processout_[a-z][a-z0-9_-]*(?:\.[a-z0-9_-]+)+|http_4[0-9]{2})$/;
+var digitCount = (text) => (text.match(/[0-9]/g) ?? []).length;
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+var outcomeOf = (answer) => OUTCOMES.includes(answer.outcome) ? answer.outcome : answer.success === true ? "success" : "failed";
+var explicitRefusal = (answer) => !own(answer, "card") && !own(answer, "customer_action") && (answer.outcome === "failed" || !own(answer, "outcome") && answer.success === false);
+var unsettledRefusal = (answer) => explicitRefusal(answer) && typeof answer.error_type === "string" && UNSETTLED_TYPE.test(answer.error_type);
+var unfinished = (answer) => own(answer, "customer_action") || typeof answer.error_type === "string" && UNSETTLED_TYPE.test(answer.error_type);
+function processoutRefusalCode(text) {
+    const answer = readAnswer(text);
+    if (answer === null || !explicitRefusal(answer) || unsettledRefusal(answer))
+        return null;
+    const type = answer.error_type;
+    return typeof type === "string" && type.length <= TYPE_LIMIT && ERROR_TYPE.test(type) && digitCount(type) <= MAX_CODE_DIGITS ? `processout_${type}` : null;
+}
+function isProcessoutRefusalCode(code) {
+    return typeof code === "string" && code.length <= 64 && REFUSAL_CODE.test(code) && !UNSETTLED_TYPE.test(code) && digitCount(code) <= MAX_CODE_DIGITS;
+}
+var fact = (value) => value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) || typeof value === "string" && value.length <= TEXT_LIMIT;
+var dateFact = (value) => whole(value);
+function tokenAnswer(answer) {
+    if (answer.success !== true || own(answer, "outcome") && answer.outcome !== "success" || own(answer, "customer_action") || own(answer, "error_type") || !record(answer.card))
+        return null;
+    const source = answer.card;
+    if (typeof source.id !== "string" || !CARD_TOKEN.test(source.id) || typeof source.last_4_digits !== "string" || !LAST_FOUR.test(source.last_4_digits) || !(dateFact(source.exp_month) >= 1 && dateFact(source.exp_month) <= 12) || !(dateFact(source.exp_year) >= 2e3))
+        return null;
+    const card = {};
+    for (const key of CARD_FACTS) {
+        if (!own(source, key))
+            continue;
+        if (!fact(source[key]))
+            return null;
+        if (key === "iin" && !(typeof source.iin === "string" && IIN.test(source.iin)))
+            continue;
+        card[key] = source[key];
+    }
+    return { success: true, card };
+}
+function processoutAnswerOutcome(status, text, card, template) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "processout_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    const answer = readAnswer(text);
+    const refused = answer !== null && explicitRefusal(answer);
+    if (answer !== null && unfinished(answer))
+        return { outcome: "unknown", reason: "processout_unconfirmed" };
+    if (status >= 400 && status < 500) {
+        if (answer !== null && !refused && (own(answer, "card") || outcomeOf(answer) !== "failed"))
+            return { outcome: "unknown", reason: "processout_unconfirmed" };
+        return { outcome: "refused", code: processoutRefusalCode(text) ?? `http_${status}` };
+    }
+    if (status !== 200 && status !== 201)
+        return { outcome: "unknown", reason: "processout_unconfirmed" };
+    if (answer === null)
+        return { outcome: "unknown", reason: "processout_unconfirmed" };
+    if (refused)
+        return { outcome: "refused", code: processoutRefusalCode(text) ?? "processout_refused" };
+    if (outcomeOf(answer) === "pending")
+        return { outcome: "unknown", reason: "processout_pending" };
+    const token = tokenAnswer(answer);
+    if (token === null)
+        return { outcome: "unknown", reason: "processout_unconfirmed" };
+    const target = record(template) ? processoutCardTarget(template.url) : null;
+    if (target && (own(token.card, "project_id") && token.card.project_id !== target.projectId || own(token.card, "sandbox") && token.card.sandbox !== (target.environment === "sandbox"))) {
+        return { outcome: "unknown", reason: "processout_token_mismatch" };
+    }
+    const body = JSON.stringify(token);
+    if (card) {
+        const number = String(card.number ?? "").replace(/[^0-9]/g, "");
+        const holdsCard = (raw) => raw.replace(/[^0-9]/g, "").includes(number);
+        if (number && (holdsCard(text) || holdsCard(body)))
+            return { outcome: "unknown", reason: "processout_unsafe_response" };
+        const facts = token.card;
+        if (facts.last_4_digits !== number.slice(-4) || dateFact(facts.exp_month) !== Number(card.month) || dateFact(facts.exp_year) % 100 !== Number(card.year) % 100 || own(facts, "iin") && !number.startsWith(facts.iin)) {
+            return { outcome: "unknown", reason: "processout_token_mismatch" };
+        }
+    }
+    return { outcome: "approved", body };
+}
+var processout_default = /* @__PURE__ */ registerProcessor({
+    psp: PROCESSOUT_PSP,
+    definitions: [
+        {
+            psp: "processout",
+            // ProcessOut.js's card request, as the header above reads it. One host serves every project, live and sandbox
+            // alike, so no sandbox host is marked: the project id names the environment, and the device sends a sandbox
+            // project only ProcessOut's documented test cards (processoutDeviceRefusal). The page gives up 20 seconds after
+            // its tokenize message, so the lane is prepared only (preparationRequired). The match reads the host and the path,
+            // and ends where the path does, as Pin Payments' does: a card's own record under /cards/, where the code refresh
+            // goes, is never paused. The exact-URL rule below holds the query, the project id and its Basic credential among it.
+            // Ships dark: served only to a client that declares `processout_card_token`, and gated off for every org until
+            // the backend's gate names one.
+            capability: "processout_card_token",
+            match: "api\\.processout\\.com/cards(?![\\w/.%-])",
+            hosts: ["^api\\.processout\\.com$"],
+            preparationRequired: true,
+            encoding: "json",
+            // ProcessOut.js's own headers: the project's Basic credential and the API version. Origin, Referer and cookies
+            // never ride.
+            passthroughHeaders: ["^authorization$", "^api-version$"],
+            jsonCardFields: [["number"]]
+        }
+    ],
+    // Only the cardholder's device sends a card, after a person approves; no reviewed list names processout.
+    refusedOperations: [PROCESSOUT_OPERATION],
+    // Not surveyed: the card request mints a token and moves no money; the store's server charges it under its own
+    // secret key, which Agentcard never holds.
+    settlementReadback: "not_surveyed",
+    exactUrl: isProcessoutCardUrl,
+    bodyGate: (url, body) => processoutBodyVerdict(body, url)
+});
+var device = /* @__PURE__ */ registerDeviceRules(PROCESSOUT_PSP, {
+    // The whole request, then the project: a pinned live one with consent to a kept card, or a sandbox one with a test
+    // card, before any card is written (processoutDeviceRefusal), from the settings and the card device-replay.js hands
+    // every registered processor (deviceCheckArguments).
+    deviceCheck: (request, settings, card) => {
+        const refusal = processoutDeviceRefusal(request, card, settings);
+        return refusal ? processoutRefusalMessage(refusal) : null;
+    },
+    fill: injectProcessoutCard,
+    // Only a bounded code leaves as a fact, never ProcessOut's message, which can echo what was sent.
+    refusalCode: (text) => processoutRefusalCode(text),
+    outcome: (status, text, template, card) => processoutAnswerOutcome(status, text, card, template)
+});
+export { PROCESSOUT_API_HOST, PROCESSOUT_API_VERSION, PROCESSOUT_CAPABILITY, PROCESSOUT_CARD_KEYS, PROCESSOUT_MERCHANT_PINS, PROCESSOUT_OPERATION, PROCESSOUT_PREPARATION_URLS, PROCESSOUT_PSP, PROCESSOUT_REFUSAL_CODES, PROCESSOUT_TEST_PANS, processout_default as default, device, injectProcessoutCard, isPreparedProcessoutRequest, isProcessoutCardUrl, isProcessoutRefusalCode, isProcessoutTestCard, processoutAnswerOutcome, processoutBodyVerdict, processoutCardTarget, processoutDeviceRefusal, processoutEnvironment, processoutMerchantPin, processoutMerchantRefusal, processoutOriginPin, processoutPinOriginUsable, processoutPreparationRefusal, processoutProjectId, processoutRefusalCode, processoutRefusalMessage, processoutRequestRefusal };

package/dist/requests.js

@@ -1,4 +1,4 @@
-import { AgentcardError } from './voice-types.js';
+import { AgentcardError } from './api-types.js';
 /** The placeholder card every builder puts in the request; the Vault replaces it at approval. */
 const PLACEHOLDER = { number: '4242424242424242', exp_month: '12', exp_year: '2030', cvc: '123' };
 /** The paused Stripe request for an order: `POST /v1/payment_intents/{pi}/confirm` with a placeholder card. */