@agent-cards/sdk 0.23.5 → 0.23.7

package/dist/cybersource-secure-acceptance.generated.js

@@ -0,0 +1,955 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: bd26046b49ee14791e119bd7d6c8ebf370940ee2371099e13582566579c485d5
+// src/deep-freeze.js
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// src/test-pans.js
+function immutableSet(values, name) {
+    const set = new Set(values);
+    for (const method of ["add", "delete", "clear"]) {
+        set[method] = () => {
+            throw new TypeError(`${name} is immutable`);
+        };
+    }
+    return Object.freeze(set);
+}
+var DOCUMENTED_TEST_PANS = /* @__PURE__ */ immutableSet([
+    "4242424242424242",
+    "4000000000000002",
+    "4000002500003155",
+    "4111111111111111"
+], "DOCUMENTED_TEST_PANS");
+// src/cybersource-secure-acceptance.js
+var SECURE_ACCEPTANCE_PSP = "cybersource_secure_acceptance";
+var SECURE_ACCEPTANCE_CAPABILITY = "cybersource_sa_token_create";
+var SECURE_ACCEPTANCE_HOSTS = /* @__PURE__ */ Object.freeze({
+    production: "secureacceptance.cybersource.com",
+    sandbox: "testsecureacceptance.cybersource.com"
+});
+var SECURE_ACCEPTANCE_TOKEN_CREATE_PATH = "/silent/embedded/token/create";
+var SECURE_ACCEPTANCE_SIGNED_FIELDS = /* @__PURE__ */ Object.freeze([
+    "access_key",
+    "amount",
+    "currency",
+    "locale",
+    "payment_method",
+    "profile_id",
+    "reference_number",
+    "signed_date_time",
+    "signed_field_names",
+    "transaction_type",
+    "transaction_uuid",
+    "unsigned_field_names",
+    "bill_to_forename",
+    "bill_to_surname",
+    "bill_to_email",
+    "bill_to_address_country",
+    "bill_to_address_city",
+    "bill_to_address_line1",
+    "override_custom_receipt_page",
+    "device_fingerprint_id"
+]);
+var SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS = /* @__PURE__ */ Object.freeze(["bill_to_address_state", "bill_to_address_postal_code"]);
+var SECURE_ACCEPTANCE_UNSIGNED_FIELDS = /* @__PURE__ */ Object.freeze([
+    "card_type",
+    "card_number",
+    "card_expiry_date",
+    "merchant_defined_data5",
+    "merchant_defined_data6",
+    "merchant_defined_data7",
+    "bill_to_address_line2",
+    "card_cvn"
+]);
+var SECURE_ACCEPTANCE_CARD_TYPES = /* @__PURE__ */ Object.freeze({ visa: "001", mastercard: "002", amex: "003", discover: "004" });
+var SECURE_ACCEPTANCE_TEST_PANS = /* @__PURE__ */ immutableSet([
+    "4111111111111111",
+    "4622943127013705",
+    "4622943127013713",
+    "4622943127013721",
+    "4622943127013739",
+    "4622943127013747",
+    "2222420000001113",
+    "2222630000001125",
+    "5555555555554444",
+    "378282246310005",
+    "6011111111111117",
+    "6011000990139424",
+    "3566111111111113"
+], "SECURE_ACCEPTANCE_TEST_PANS");
+var SECURE_ACCEPTANCE_REQUEST_REFUSALS = /* @__PURE__ */ Object.freeze([
+    "not_token_create",
+    "content_type",
+    "origin_header",
+    "referer_header",
+    "body_unreadable",
+    "fields_unreviewed",
+    "signed_fields_unreviewed",
+    "unsigned_fields_unreviewed",
+    "transaction_type",
+    "amount_not_zero",
+    "payment_method",
+    "currency",
+    "locale",
+    "profile_id",
+    "access_key",
+    "receipt_page",
+    "keeps_card",
+    "edits_saved_card",
+    "card_type",
+    "card_fields",
+    "bill_to",
+    "signature",
+    "signed_date_time",
+    "request_ids",
+    "device_fingerprint"
+]);
+var SECURE_ACCEPTANCE_REFUSAL_REASON_CODES = /* @__PURE__ */ Object.freeze(["102", "202", "211", "231", "232", "240"]);
+var SECURE_ACCEPTANCE_REPLY_REASONS = /* @__PURE__ */ Object.freeze([
+    "reply_status",
+    "reply_redirect",
+    "reply_type",
+    "reply_size",
+    "reply_markup",
+    "reply_form",
+    "reply_action",
+    "reply_fields",
+    "reply_mismatch",
+    "card_in_reply",
+    "card_mismatch",
+    "token_shape",
+    "reply_unconfirmed"
+]);
+var SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE = "text/html;charset=UTF-8";
+var SECURE_ACCEPTANCE_MERCHANTS = /* @__PURE__ */ deepFreeze([
+    {
+        id: "arrow_token_create",
+        merchant: "Arrow Electronics",
+        environment: "production",
+        status: "enabled",
+        origins: ["https://www.arrow.com"],
+        profileIds: ["C29B5F8F-3688-4634-BAFB-8EC6763F47CD"],
+        accessKeys: ["d8768bb0b9873004a76cd20f6fa0a922"],
+        pending: [],
+        navigation: "frame",
+        frameName: "secureAcceptanceiFrame",
+        followUp: { method: "POST", url: "https://www.arrow.com/experienceservices/cart/current/user/current/checkout/paymentmethod/set" },
+        sources: [
+            { kind: "saved_observation", reference: "arrow-2026-10-08:secure-acceptance-silent-embedded-token-create-hidden-form", reviewed_on: "2026-10-08" },
+            { kind: "public_page_model", reference: "arrow-2026-10-08:en-cart-and-checkout-model-json-config-cybersource", reviewed_on: "2026-10-08" }
+        ]
+    }
+]);
+var SA_FORM_TYPE = "application/x-www-form-urlencoded";
+var SA_URL_LIMIT = 2048;
+var SA_BODY_LIMIT = 32 * 1024;
+var SA_REPLY_LIMIT = 64 * 1024;
+var SA_PROFILE_ID = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+var SA_ACCESS_KEY = /^[0-9A-Fa-f]{32}$/;
+var SA_REQUEST_ID = /^[A-Za-z0-9-]{1,50}$/;
+var SA_SIGNED_DATE_TIME = /^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]Z$/;
+var SA_SIGNATURE = /^[A-Za-z0-9+/]{43}=$/;
+var SA_DEVICE_FINGERPRINT = /^[A-Za-z0-9_.:-]{1,88}$/;
+var SA_EXPIRY = /^(?:0[1-9]|1[0-2])-[0-9]{4}$/;
+var saExact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var saControlFree = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var saRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var SA_MALFORMED = "Refusing to pay: malformed payment request.";
+var SA_SANDBOX_CARD = "Refusing to pay: a sandbox or test host accepts only the processor's documented test cards, not a real card.";
+var SA_FILL_FAILED = "Could not fill the card fields for CyberSource Secure Acceptance. Nothing was sent.";
+function secureAcceptanceEnvironment(hostname) {
+    if (hostname === SECURE_ACCEPTANCE_HOSTS.production)
+        return "production";
+    if (hostname === SECURE_ACCEPTANCE_HOSTS.sandbox)
+        return "sandbox";
+    return null;
+}
+function secureAcceptancePreparationUrl(environment) {
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("unsupported_secure_acceptance_environment");
+    return `https://${SECURE_ACCEPTANCE_HOSTS[environment]}${SECURE_ACCEPTANCE_TOKEN_CREATE_PATH}`;
+}
+function isSecureAcceptanceTokenRequest(url, method) {
+    if (method !== "POST" || typeof url !== "string" || url.length > SA_URL_LIMIT || url.includes("?") || url.includes("#"))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.href === url && parsed.protocol === "https:" && !parsed.port && !parsed.username && !parsed.password && secureAcceptanceEnvironment(parsed.hostname) !== null && parsed.pathname === SECURE_ACCEPTANCE_TOKEN_CREATE_PATH;
+}
+function saFormEncode(value) {
+    let encoded;
+    try {
+        encoded = encodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+    return encoded.replace(/[!'()~]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%20/g, "+");
+}
+function saFormDecode(raw) {
+    if (!/^(?:[A-Za-z0-9*._+-]|%[0-9A-F]{2})*$/.test(raw))
+        return null;
+    let value;
+    try {
+        value = decodeURIComponent(raw.replace(/\+/g, "%20"));
+    }
+    catch {
+        return null;
+    }
+    return saFormEncode(value) === raw ? value : null;
+}
+function saParseForm(body) {
+    if (typeof body !== "string" || body === "" || body.length > SA_BODY_LIMIT)
+        return null;
+    const pairs = [];
+    const values = /* @__PURE__ */ new Map();
+    for (const chunk of body.split("&")) {
+        const separator = chunk.indexOf("=");
+        if (separator < 1)
+            return null;
+        const rawName = chunk.slice(0, separator), raw = chunk.slice(separator + 1);
+        const name = saFormDecode(rawName), value = saFormDecode(raw);
+        if (name === null || value === null || values.has(name))
+            return null;
+        pairs.push({ name, rawName, raw, value });
+        values.set(name, value);
+    }
+    return { pairs, values };
+}
+function saSignedListAllowed(value) {
+    const base = SECURE_ACCEPTANCE_SIGNED_FIELDS.join(",");
+    const [state, postal] = SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS;
+    return [base, `${base},${state}`, `${base},${postal}`, `${base},${state},${postal}`].includes(value);
+}
+function saFieldListRefusal(form) {
+    const signed = form.values.get("signed_field_names");
+    if (!saSignedListAllowed(signed))
+        return "signed_fields_unreviewed";
+    if (form.values.get("unsigned_field_names") !== SECURE_ACCEPTANCE_UNSIGNED_FIELDS.join(","))
+        return "unsigned_fields_unreviewed";
+    const expected = /* @__PURE__ */ new Set([...signed.split(","), ...SECURE_ACCEPTANCE_UNSIGNED_FIELDS, "signature"]);
+    if (form.pairs.length !== expected.size || form.pairs.some(({ name }) => !expected.has(name)))
+        return "fields_unreviewed";
+    return null;
+}
+function saExpiryOf(card) {
+    const month = typeof card?.month === "number" || typeof card?.month === "string" ? String(card.month) : "";
+    const year = typeof card?.year === "number" || typeof card?.year === "string" ? String(card.year) : "";
+    if (!/^[0-9]{1,2}$/.test(month) || Number(month) < 1 || Number(month) > 12 || !/^(?:[0-9]{2}|[0-9]{4})$/.test(year))
+        return null;
+    return `${month.padStart(2, "0")}-${year.length === 2 ? `20${year}` : year}`;
+}
+var SA_CARD_VALUES = /* @__PURE__ */ new Map([
+    ["card_type", (value) => Object.values(SECURE_ACCEPTANCE_CARD_TYPES).includes(value)],
+    ["card_number", (value) => saExact(/^[0-9]{13,19}$/, value)],
+    ["card_expiry_date", (value) => saExact(SA_EXPIRY, value)],
+    ["card_cvn", (value) => saExact(/^[0-9]{3,4}$/, value)]
+]);
+var SA_BILL_TO_RULES = /* @__PURE__ */ new Map([
+    ["bill_to_forename", (value) => saControlFree(value, 1, 60)],
+    ["bill_to_surname", (value) => saControlFree(value, 1, 60)],
+    ["bill_to_address_line1", (value) => saControlFree(value, 1, 60)],
+    ["bill_to_email", (value) => saControlFree(value, 1, 255) && value.split("@").length === 2],
+    ["bill_to_address_city", (value) => saControlFree(value, 1, 50)],
+    ["bill_to_address_country", (value) => saExact(/^[A-Z]{2}$/, value)],
+    ["bill_to_address_state", (value) => saControlFree(value, 1, 60)],
+    ["bill_to_address_postal_code", (value) => saExact(/^[A-Za-z0-9 -]{1,10}$/, value)],
+    ["bill_to_address_line2", (value) => saControlFree(value, 0, 60)]
+]);
+function saAdmittedOrigin(merchantOrigin, environment) {
+    if (typeof merchantOrigin !== "string" || merchantOrigin.length > SA_URL_LIMIT)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(merchantOrigin);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.origin !== merchantOrigin)
+        return null;
+    if (parsed.protocol === "https:")
+        return merchantOrigin;
+    return environment === "sandbox" && parsed.protocol === "http:" && parsed.hostname === "localhost" ? merchantOrigin : null;
+}
+function saUrlOnOrigin(value, origin) {
+    if (typeof value !== "string" || value.length > SA_URL_LIMIT || value.includes("#") || /[\u0000-\u0020\u007f]/.test(value))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return parsed.origin === origin && !parsed.username && !parsed.password;
+}
+function saRequestHeaders(headers) {
+    if (headers === void 0)
+        return /* @__PURE__ */ new Map();
+    if (!saRecord(headers))
+        return null;
+    const out = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (typeof value !== "string" || out.has(lower))
+            return null;
+        out.set(lower, value);
+    }
+    return out;
+}
+function secureAcceptanceRequestRefusal(request, options) {
+    if (!saRecord(request) || !isSecureAcceptanceTokenRequest(request.url, request.method))
+        return "not_token_create";
+    const environment = secureAcceptanceEnvironment(new URL(request.url).hostname);
+    const origin = saAdmittedOrigin(saRecord(options) ? options.merchantOrigin : void 0, environment);
+    const headers = saRequestHeaders(request.headers);
+    const type = headers?.get("content-type");
+    if (!headers || typeof type !== "string" || type.trim().toLowerCase() !== SA_FORM_TYPE)
+        return "content_type";
+    if (!origin || headers.get("origin") !== origin)
+        return "origin_header";
+    if (headers.has("referer")) {
+        const referer = headers.get("referer");
+        let parsed = null;
+        try {
+            parsed = new URL(referer);
+        }
+        catch {
+            parsed = null;
+        }
+        if (!parsed || parsed.href !== referer || !saUrlOnOrigin(referer, origin))
+            return "referer_header";
+    }
+    const form = saParseForm(request.body);
+    if (!form)
+        return "body_unreadable";
+    const lists = saFieldListRefusal(form);
+    if (lists)
+        return lists;
+    const v = (name) => form.values.get(name);
+    if (v("transaction_type") !== "create_payment_token")
+        return "transaction_type";
+    if (v("amount") !== "0")
+        return "amount_not_zero";
+    if (v("payment_method") !== "card")
+        return "payment_method";
+    const currency = saRecord(options) ? options.currency : void 0;
+    if (!saExact(/^[A-Z]{3}$/, v("currency")) || currency !== void 0 && (typeof currency !== "string" || v("currency").toLowerCase() !== currency.toLowerCase()))
+        return "currency";
+    if (!saExact(/^[a-z]{2}(?:-[a-z]{2})?$/, v("locale")))
+        return "locale";
+    if (!saExact(SA_PROFILE_ID, v("profile_id")))
+        return "profile_id";
+    if (!saExact(SA_ACCESS_KEY, v("access_key")))
+        return "access_key";
+    if (!saUrlOnOrigin(v("override_custom_receipt_page"), origin))
+        return "receipt_page";
+    if (v("merchant_defined_data5") !== "false" || v("merchant_defined_data6") !== "false")
+        return "keeps_card";
+    if (v("merchant_defined_data7") !== "")
+        return "edits_saved_card";
+    if (!SA_CARD_VALUES.get("card_type")(v("card_type")))
+        return "card_type";
+    if (!["card_number", "card_expiry_date", "card_cvn"].every((name) => SA_CARD_VALUES.get(name)(v(name))))
+        return "card_fields";
+    for (const [name, rule] of SA_BILL_TO_RULES) {
+        if (form.values.has(name) && !rule(v(name)))
+            return "bill_to";
+    }
+    if (!saExact(SA_SIGNATURE, v("signature")))
+        return "signature";
+    if (!saExact(SA_SIGNED_DATE_TIME, v("signed_date_time")))
+        return "signed_date_time";
+    if (!saExact(SA_REQUEST_ID, v("reference_number")) || !saExact(SA_REQUEST_ID, v("transaction_uuid")))
+        return "request_ids";
+    if (!saExact(SA_DEVICE_FINGERPRINT, v("device_fingerprint_id")))
+        return "device_fingerprint";
+    return null;
+}
+function secureAcceptanceRequestFacts(request) {
+    if (!saRecord(request) || !isSecureAcceptanceTokenRequest(request.url, request.method))
+        return null;
+    const form = saParseForm(request.body);
+    if (!form)
+        return null;
+    const v = (name) => form.values.get(name);
+    if (!saExact(SA_PROFILE_ID, v("profile_id")) || !saExact(SA_ACCESS_KEY, v("access_key")) || !saExact(SA_REQUEST_ID, v("transaction_uuid")) || !saExact(SA_REQUEST_ID, v("reference_number")) || !saExact(/^[A-Z]{3}$/, v("currency")) || !saExact(SA_SIGNED_DATE_TIME, v("signed_date_time")))
+        return null;
+    return {
+        environment: secureAcceptanceEnvironment(new URL(request.url).hostname),
+        profileId: v("profile_id"),
+        accessKey: v("access_key"),
+        transactionUuid: v("transaction_uuid"),
+        referenceNumber: v("reference_number"),
+        currency: v("currency"),
+        signedDateTime: v("signed_date_time")
+    };
+}
+function isPreparedSecureAcceptanceRequest(url, method, body, headers, environment, binding) {
+    if (environment !== "production" && environment !== "sandbox")
+        return false;
+    const profileId = saRecord(binding) ? binding.profileId : void 0;
+    const merchantOrigin = saRecord(binding) ? binding.merchantOrigin : void 0;
+    if (!saExact(SA_PROFILE_ID, profileId))
+        return false;
+    const request = { url, method, headers, body };
+    if (secureAcceptanceRequestRefusal(request, { merchantOrigin }) !== null)
+        return false;
+    const facts = secureAcceptanceRequestFacts(request);
+    return !!facts && facts.environment === environment && facts.profileId === profileId;
+}
+function secureAcceptanceMerchantEntry(profileId, merchantOrigin, entries = SECURE_ACCEPTANCE_MERCHANTS) {
+    if (!saExact(SA_PROFILE_ID, profileId) || typeof merchantOrigin !== "string" || !Array.isArray(entries))
+        return null;
+    return entries.find((entry) => saRecord(entry) && entry.environment === "production" && Array.isArray(entry.origins) && Array.isArray(entry.profileIds) && entry.origins.includes(merchantOrigin) && entry.profileIds.includes(profileId)) ?? null;
+}
+function secureAcceptanceMerchantRefusal(environment, profileId, merchantOrigin, accessKey, entries = SECURE_ACCEPTANCE_MERCHANTS) {
+    if (!saExact(SA_PROFILE_ID, profileId))
+        return "invalid_profile_id";
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    const forOrigin = (Array.isArray(entries) ? entries : []).filter((entry2) => saRecord(entry2) && entry2.environment === "production" && Array.isArray(entry2.origins) && entry2.origins.includes(merchantOrigin));
+    if (forOrigin.length === 0)
+        return "secure_acceptance_merchant_unreviewed";
+    const pending = (entry2) => !Array.isArray(entry2.pending) || entry2.pending.length > 0;
+    const entry = secureAcceptanceMerchantEntry(profileId, merchantOrigin, forOrigin);
+    if (!entry)
+        return forOrigin.some(pending) ? "secure_acceptance_merchant_pending" : "secure_acceptance_merchant_unreviewed";
+    if (pending(entry))
+        return "secure_acceptance_merchant_pending";
+    if (accessKey !== void 0 && !(Array.isArray(entry.accessKeys) && entry.accessKeys.includes(accessKey)))
+        return "secure_acceptance_access_key_unreviewed";
+    return entry.status === "enabled" ? null : "secure_acceptance_merchant_observe";
+}
+function secureAcceptanceCardType(number) {
+    if (typeof number !== "string" || !/^[0-9]{12,19}$/.test(number))
+        return null;
+    const two = Number(number.slice(0, 2)), three = Number(number.slice(0, 3)), four = Number(number.slice(0, 4));
+    if (number[0] === "4")
+        return SECURE_ACCEPTANCE_CARD_TYPES.visa;
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return SECURE_ACCEPTANCE_CARD_TYPES.mastercard;
+    if (two === 34 || two === 37)
+        return SECURE_ACCEPTANCE_CARD_TYPES.amex;
+    if (four === 6011 || three >= 644 && three <= 649 || two === 65)
+        return SECURE_ACCEPTANCE_CARD_TYPES.discover;
+    return null;
+}
+function saLuhn(number) {
+    let sum = 0;
+    for (let i = 0; i < number.length; i++) {
+        let digit = number.charCodeAt(number.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function secureAcceptanceCardRefusal(environment, card) {
+    if (environment !== "production" && environment !== "sandbox")
+        return "unsupported_environment";
+    const pan = saRecord(card) && typeof card.number === "string" ? card.number : "";
+    if (!/^[0-9]{13,19}$/.test(pan) || /^([0-9])\1+$/.test(pan) || !saLuhn(pan))
+        return "invalid_card_number";
+    if (!secureAcceptanceCardType(pan))
+        return "card_network_unsupported";
+    if (environment === "sandbox" && !SECURE_ACCEPTANCE_TEST_PANS.has(pan))
+        return "sandbox_host_requires_documented_test_card";
+    if (environment === "production" && (SECURE_ACCEPTANCE_TEST_PANS.has(pan) || DOCUMENTED_TEST_PANS.has(pan)))
+        return "live_host_refuses_documented_test_card";
+    if (!saExpiryOf(card))
+        return "invalid_expiry";
+    if (!saExact(/^[0-9]{3,4}$/, card.cvc))
+        return "invalid_cvn";
+    return null;
+}
+function isSecureAcceptanceDeviceRequest(templateBody, deviceBody, environment) {
+    const template = saParseForm(templateBody);
+    const device = saParseForm(deviceBody);
+    if (!template || !device || saFieldListRefusal(template) !== null || device.pairs.length !== template.pairs.length)
+        return false;
+    return device.pairs.every((pair, i) => {
+        const page = template.pairs[i];
+        if (pair.rawName !== page.rawName)
+            return false;
+        const rule = SA_CARD_VALUES.get(pair.name);
+        if (!rule)
+            return pair.raw === page.raw;
+        if (!rule(pair.value))
+            return false;
+        if (pair.name !== "card_number" || pair.raw !== page.raw)
+            return true;
+        return environment === "sandbox" && SECURE_ACCEPTANCE_TEST_PANS.has(pair.value);
+    });
+}
+function secureAcceptanceDeviceRequest(request, card, options) {
+    const merchantOrigin = saRecord(options) ? options.merchantOrigin : void 0;
+    if (typeof merchantOrigin !== "string" || secureAcceptanceRequestRefusal(request, { merchantOrigin }) !== null)
+        throw new Error(SA_MALFORMED);
+    const environment = secureAcceptanceEnvironment(new URL(request.url).hostname);
+    const refusal = secureAcceptanceCardRefusal(environment, card);
+    if (refusal === "sandbox_host_requires_documented_test_card")
+        throw new Error(SA_SANDBOX_CARD);
+    if (refusal)
+        throw new Error(SA_FILL_FAILED);
+    const fresh = /* @__PURE__ */ new Map([
+        ["card_type", secureAcceptanceCardType(card.number)],
+        ["card_number", card.number],
+        ["card_expiry_date", saExpiryOf(card)],
+        ["card_cvn", card.cvc]
+    ]);
+    const form = saParseForm(request.body);
+    const body = form.pairs.map(({ name, rawName, raw }) => `${rawName}=${fresh.has(name) ? saFormEncode(fresh.get(name)) : raw}`).join("&");
+    if (!isSecureAcceptanceDeviceRequest(request.body, body, environment))
+        throw new Error(SA_MALFORMED);
+    const captured = saRequestHeaders(request.headers);
+    const headers = { "content-type": SA_FORM_TYPE, origin: merchantOrigin };
+    if (captured.has("referer"))
+        headers.referer = captured.get("referer");
+    return { url: request.url, method: "POST", headers, body, where: form.pairs.filter(({ name }) => fresh.has(name)).map(({ name }) => name) };
+}
+var SA_ENTITY = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+function saDecodeEntities(text) {
+    return text.replace(/&(#x[0-9a-f]{1,6}|#[0-9]{1,7}|[a-z]{2,6});/gi, (whole, name) => {
+        if (name[0] === "#") {
+            const code = name[1] === "x" || name[1] === "X" ? parseInt(name.slice(2), 16) : parseInt(name.slice(1), 10);
+            return Number.isFinite(code) && code > 0 && code <= 1114111 ? String.fromCodePoint(code) : whole;
+        }
+        return Object.prototype.hasOwnProperty.call(SA_ENTITY, name.toLowerCase()) ? SA_ENTITY[name.toLowerCase()] : whole;
+    });
+}
+function saReadAttributes(html, from, to) {
+    const out = /* @__PURE__ */ new Map();
+    let at = from;
+    while (at < to) {
+        if (/\s/.test(html[at]) || html[at] === "/") {
+            at += 1;
+            continue;
+        }
+        let end = at;
+        while (end < to && !/[\s"'>/=]/.test(html[end]))
+            end += 1;
+        if (end === at)
+            return null;
+        const name = html.slice(at, end).toLowerCase();
+        at = end;
+        while (at < to && /\s/.test(html[at]))
+            at += 1;
+        let start = -1, stop = -1;
+        if (html[at] === "=") {
+            at += 1;
+            while (at < to && /\s/.test(html[at]))
+                at += 1;
+            const quote = html[at];
+            if (quote === '"' || quote === "'") {
+                const close = html.indexOf(quote, at + 1);
+                if (close < 0 || close >= to)
+                    return null;
+                start = at + 1;
+                stop = close;
+                at = close + 1;
+            }
+            else {
+                let last = at;
+                while (last < to && !/[\s"'=<>`]/.test(html[last]))
+                    last += 1;
+                if (last === at)
+                    return null;
+                start = at;
+                stop = last;
+                at = last;
+            }
+        }
+        if (out.has(name))
+            return null;
+        out.set(name, { value: start < 0 ? "" : saDecodeEntities(html.slice(start, stop)), start, end: stop });
+    }
+    return out;
+}
+var SA_REFUSED_TAGS = /* @__PURE__ */ new Set([
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "img",
+    "image",
+    "picture",
+    "source",
+    "audio",
+    "video",
+    "track",
+    "link",
+    "base",
+    "portal",
+    "svg",
+    "style",
+    "textarea",
+    "select",
+    "button",
+    "isindex",
+    "keygen",
+    "xmp",
+    "plaintext",
+    "noembed",
+    "noframes",
+    "template"
+]);
+var SA_URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+    "src",
+    "srcset",
+    "href",
+    "background",
+    "poster",
+    "data",
+    "action",
+    "formaction",
+    "ping",
+    "manifest",
+    "lowsrc",
+    "dynsrc",
+    "codebase",
+    "archive",
+    "longdesc",
+    "cite",
+    "xlink:href",
+    "icon",
+    "imagesrcset"
+]);
+var SA_FIELD_NAME = /^[a-z][a-z0-9_]{0,63}$/;
+function saReadReplyPage(html, scriptOrigin) {
+    const tags = [];
+    const ends = [];
+    let at = 0;
+    while (at < html.length) {
+        const open = html.indexOf("<", at);
+        if (open < 0)
+            break;
+        if (html.startsWith("<!--", open)) {
+            const close = html.indexOf("-->", open + 4);
+            if (close < 0)
+                return { error: "reply_markup" };
+            at = close + 3;
+            continue;
+        }
+        const next = html.charAt(open + 1);
+        if (next === "!") {
+            const doctype = /<!doctype\s+html\s*>/iy;
+            doctype.lastIndex = open;
+            if (!doctype.test(html))
+                return { error: "reply_markup" };
+            at = doctype.lastIndex;
+            continue;
+        }
+        if (next === "/") {
+            const end = /<\/([A-Za-z][A-Za-z0-9-]*)\s*>/y;
+            end.lastIndex = open;
+            const match2 = end.exec(html);
+            if (!match2)
+                return { error: "reply_markup" };
+            ends.push({ name: match2[1].toLowerCase(), start: open });
+            at = end.lastIndex;
+            continue;
+        }
+        if (next === "?")
+            return { error: "reply_markup" };
+        if (!/[A-Za-z]/.test(next)) {
+            at = open + 1;
+            continue;
+        }
+        const start = /<([A-Za-z][A-Za-z0-9-]*)((?:[^>"']|"[^"]*"|'[^']*')*)>/y;
+        start.lastIndex = open;
+        const match = start.exec(html);
+        if (!match)
+            return { error: "reply_markup" };
+        const name = match[1].toLowerCase();
+        const tag = { name, start: open, end: start.lastIndex, attrs: saReadAttributes(html, open + 1 + match[1].length, start.lastIndex - 1) };
+        tags.push(tag);
+        at = start.lastIndex;
+        if (name === "script" || name === "title") {
+            const close = new RegExp(`</${name}[\\s/>]`, "ig");
+            close.lastIndex = at;
+            const found = close.exec(html);
+            if (!found)
+                return { error: "reply_markup" };
+            const after = html.indexOf(">", found.index);
+            if (after < 0)
+                return { error: "reply_markup" };
+            at = after + 1;
+        }
+    }
+    for (const tag of tags) {
+        if (SA_REFUSED_TAGS.has(tag.name))
+            return { error: "reply_markup" };
+        if (!tag.attrs)
+            return { error: tag.name === "form" || tag.name === "input" ? "reply_form" : "reply_markup" };
+        for (const [attribute, { value }] of tag.attrs) {
+            if (SA_URL_ATTRIBUTES.has(attribute) && !(attribute === "action" && tag.name === "form") && !(attribute === "src" && tag.name === "script")) {
+                return { error: "reply_markup" };
+            }
+            if (attribute === "style" && /url\s*\(|@import|expression\s*\(/i.test(value))
+                return { error: "reply_markup" };
+        }
+        if (tag.name === "meta" && (tag.attrs.get("http-equiv")?.value ?? "").trim().toLowerCase() === "refresh")
+            return { error: "reply_markup" };
+        if (tag.name === "script" && tag.attrs.has("src")) {
+            let src = null;
+            try {
+                src = new URL(tag.attrs.get("src").value, `${scriptOrigin}/`);
+            }
+            catch {
+                src = null;
+            }
+            if (!src || src.origin !== scriptOrigin)
+                return { error: "reply_markup" };
+        }
+    }
+    const forms = tags.filter((tag) => tag.name === "form");
+    if (forms.length !== 1)
+        return { error: "reply_form" };
+    const form = forms[0];
+    const target = form.attrs.get("target")?.value.trim().toLowerCase();
+    const enctype = form.attrs.get("enctype")?.value.trim().toLowerCase();
+    if (target !== void 0 && target !== "_self" || enctype !== void 0 && enctype !== SA_FORM_TYPE || (form.attrs.get("method")?.value.trim().toLowerCase() ?? "") !== "post")
+        return { error: "reply_form" };
+    const closing = ends.find((end) => end.name === "form" && end.start > form.start);
+    const inside = (tag) => tag.start > form.start && tag.start < (closing ? closing.start : html.length);
+    const fields = /* @__PURE__ */ new Map();
+    let submits = 0;
+    for (const input of tags.filter((tag) => tag.name === "input")) {
+        if (!inside(input) || [...input.attrs.keys()].some((attribute) => attribute.startsWith("form")))
+            return { error: "reply_form" };
+        const type = (input.attrs.get("type")?.value ?? "text").trim().toLowerCase();
+        if (type === "submit" && !input.attrs.has("name") && submits === 0) {
+            submits += 1;
+            continue;
+        }
+        const fieldName = input.attrs.get("name")?.value;
+        if (type !== "hidden" || !saExact(SA_FIELD_NAME, fieldName) || fields.has(fieldName))
+            return { error: "reply_form" };
+        const value = input.attrs.get("value") ?? { value: "", start: -1, end: -1 };
+        fields.set(fieldName, value);
+    }
+    return { action: form.attrs.get("action")?.value, fields };
+}
+function saTemplateFields(template) {
+    if (!saRecord(template) || !isSecureAcceptanceTokenRequest(template.url, "POST"))
+        return null;
+    const form = saParseForm(template.body);
+    if (!form || typeof form.values.get("override_custom_receipt_page") !== "string")
+        return null;
+    return { origin: new URL(template.url).origin, values: form.values };
+}
+var SA_SCRUBBED = /* @__PURE__ */ new Map([
+    ["signature", SA_SIGNATURE],
+    ["payment_token", /^[0-9A-Fa-f]{32}$/],
+    ["transaction_id", /^[0-9]{22}$/],
+    ["request_token", /^[A-Za-z0-9+/]{16,512}={0,2}$/],
+    ["payment_token_instrument_identifier_id", /^[0-9]{12,32}$/],
+    ["payment_account_reference", /^(?=[A-Za-z0-9]*[A-Za-z])[A-Za-z0-9]{29}$/],
+    ["auth_trans_ref_no", /^(?=[A-Za-z0-9]*[A-Za-z])[A-Za-z0-9]{1,60}$/]
+]);
+var SA_CARD_ECHOES = /* @__PURE__ */ new Set(["req_card_type", "req_card_number", "req_card_expiry_date", "req_card_cvn"]);
+function saScannedPage(html, page, sent) {
+    const spans = [];
+    for (const [name, field] of page.fields) {
+        if (field.start >= 0 && field.start !== field.end && saScrubbedOrEchoed(name, field, sent))
+            spans.push(field);
+    }
+    spans.sort((a, b) => b.start - a.start);
+    let out = html;
+    for (const { start, end } of spans)
+        out = out.slice(0, start) + out.slice(end);
+    return out;
+}
+function secureAcceptanceScannedPage(bodyText, template) {
+    if (typeof bodyText !== "string")
+        return null;
+    const sent = template === void 0 ? null : saTemplateFields(template);
+    if (template !== void 0 && !sent)
+        return null;
+    const page = saReadReplyPage(bodyText, sent ? sent.origin : `https://${SECURE_ACCEPTANCE_HOSTS.production}`);
+    return page.error ? null : saScannedPage(bodyText, page, sent);
+}
+function saWritesCardNumber(text) {
+    const digit = String.raw `(?:[0-9]|\\u003[0-9]|%3[0-9]|&#0*(?:4[89]|5[0-7]);|&#x0*3[0-9];)`;
+    const escape = String.raw `\\(?:[/\\"bfnrt]|u(?:00(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])|0[1-9a-f][0-9a-f]{2}|[1-9a-f][0-9a-f]{3}))` + String.raw `|%(?:[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f])` + String.raw `|&(?:#0*(?:[0-9]|[1-3][0-9]|4[0-7]|5[89]|6[0-4]|9[1-6]|12[3-9]|1[3-9][0-9]|[2-9][0-9]{2}|[1-9][0-9]{3,6})|#x0*(?:[0-9a-f]|[01][0-9a-f]|2[0-9a-f]|3[a-f]|40|5[b-f]|60|7[b-f]|[89a-f][0-9a-f]|[1-9a-f][0-9a-f]{2,5})|[a-z][a-z0-9]{1,31});`;
+    const separator = `(?:${escape}|[^0-9A-Za-z\\\\%&]|%(?![0-9a-f]{2})|&(?!#?x?[0-9a-z]+;))`;
+    for (const [run] of text.matchAll(new RegExp(`${digit}(?:${separator}*${digit})*`, "gi"))) {
+        const groups = run.replace(new RegExp(escape, "gi"), " ").replace(/\\u003([0-9])/gi, "$1").replace(/%3([0-9])/g, "$1").replace(/&#x0*3([0-9]);/gi, "$1").replace(/&#0*(4[89]|5[0-7]);/g, (_form, code) => String.fromCharCode(Number(code))).split(/[^0-9]+/).filter(Boolean);
+        for (let first = 0; first < groups.length; first += 1) {
+            let digits = "";
+            for (let last = first; last < groups.length; last += 1) {
+                digits += groups[last];
+                if (digits.length > 19)
+                    break;
+                if (digits.length >= 13 && digits[0] >= "2" && digits[0] <= "6" && saLuhn(digits))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function saUnescaped(text) {
+    let out = text;
+    for (let pass = 0; pass < 16; pass += 1) {
+        const next = out.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (next === out)
+            return out;
+        out = next;
+    }
+    return null;
+}
+function saReplyHeaders(headers) {
+    if (headers === void 0)
+        return void 0;
+    const out = /* @__PURE__ */ new Map();
+    const add = (name, value) => {
+        if (typeof name !== "string" || typeof value !== "string")
+            return false;
+        const lower = name.toLowerCase();
+        out.set(lower, [...out.get(lower) ?? [], value]);
+        return true;
+    };
+    if (Array.isArray(headers)) {
+        for (const pair of headers)
+            if (!Array.isArray(pair) || pair.length !== 2 || !add(pair[0], pair[1]))
+                return null;
+        return out;
+    }
+    if (!saRecord(headers))
+        return null;
+    for (const [name, value] of Object.entries(headers)) {
+        for (const item of Array.isArray(value) ? value : [value])
+            if (!add(name, item))
+                return null;
+    }
+    return out;
+}
+function saHtmlUtf8(values, bodyText) {
+    if (!values || values.length !== 1)
+        return false;
+    const [type, ...params] = values[0].split(";").map((part) => part.trim());
+    if (type.toLowerCase() !== "text/html")
+        return false;
+    const charsets = params.filter((param) => /^charset\s*=/i.test(param)).map((param) => param.replace(/^charset\s*=\s*/i, "").replace(/^"(.*)"$/, "$1").toLowerCase());
+    if (charsets.length > 1)
+        return false;
+    return charsets.length === 1 ? charsets[0] === "utf-8" || charsets[0] === "utf8" : /^[\u0000-\u007f]*$/.test(bodyText);
+}
+function saUtf8Length(text) {
+    let bytes = 0;
+    for (const ch of text) {
+        const code = ch.codePointAt(0);
+        bytes += code < 128 ? 1 : code < 2048 ? 2 : code < 65536 ? 3 : 4;
+    }
+    return bytes;
+}
+var SA_MATCHED_ECHOES = /* @__PURE__ */ Object.freeze([
+    "transaction_uuid",
+    "profile_id",
+    "access_key",
+    "reference_number",
+    "transaction_type",
+    "amount",
+    "currency"
+]);
+function secureAcceptanceReplyOutcome(reply, template, card, options) {
+    const unknown = (reason) => ({ outcome: "unknown", reason });
+    const sent = saTemplateFields(template);
+    if (!saRecord(reply) || !Number.isInteger(reply.status) || typeof reply.bodyText !== "string" || !sent)
+        return unknown("reply_unconfirmed");
+    const headers = saReplyHeaders(reply.headers);
+    if (headers === null)
+        return unknown("reply_type");
+    if (reply.status >= 300 && reply.status <= 399 || headers?.has("location"))
+        return unknown("reply_redirect");
+    if (reply.status !== 200)
+        return unknown("reply_status");
+    if (headers !== void 0 && !saHtmlUtf8(headers.get("content-type"), reply.bodyText))
+        return unknown("reply_type");
+    if (saUtf8Length(reply.bodyText) > SA_REPLY_LIMIT)
+        return unknown("reply_size");
+    const page = saReadReplyPage(reply.bodyText, sent.origin);
+    if (page.error)
+        return unknown(page.error);
+    if (page.action !== sent.values.get("override_custom_receipt_page"))
+        return unknown("reply_action");
+    const fields = page.fields;
+    const value = (name) => fields.get(name)?.value;
+    if ([...fields.keys()].some((name) => /cvn|cvv|cvc|security_code/i.test(name)) || ["decision", "reason_code", "transaction_id", "req_card_number"].some((name) => !fields.has(name)))
+        return unknown("reply_fields");
+    if (SA_MATCHED_ECHOES.some((name) => fields.has(`req_${name}`) && value(`req_${name}`) !== sent.values.get(name)))
+        return unknown("reply_mismatch");
+    if (!saExact(/^[0-9]{22}$/, value("transaction_id")) || fields.has("payment_token") && !saExact(/^[0-9A-Fa-f]{32}$/, value("payment_token"))) {
+        return unknown("token_shape");
+    }
+    const masked = value("req_card_number");
+    if (!saExact(/^[xX]{9,15}[0-9]{4}$/, masked))
+        return unknown("card_in_reply");
+    const scanned = saScannedPage(reply.bodyText, page, sent);
+    if (saWritesCardNumber(scanned))
+        return unknown("card_in_reply");
+    for (const [name, field] of fields) {
+        if (saScrubbedOrEchoed(name, field, sent))
+            continue;
+        const open = saUnescaped(field.value);
+        if (open === null || saWritesCardNumber(open))
+            return unknown("card_in_reply");
+    }
+    if (card !== void 0 && card !== null) {
+        if (secureAcceptanceCardRefusal(secureAcceptanceEnvironment(new URL(template.url).hostname), card) !== null)
+            return unknown("card_mismatch");
+        const leak = saRecord(options) && Object.prototype.hasOwnProperty.call(options, "cardLeak") ? options.cardLeak : void 0;
+        if (leak !== null || [...fields.values()].some((field) => field.value.includes(card.number)))
+            return unknown("card_in_reply");
+        if (masked.slice(-4) !== card.number.slice(-4) || fields.has("req_card_expiry_date") && value("req_card_expiry_date") !== saExpiryOf(card) || fields.has("req_card_type") && value("req_card_type") !== secureAcceptanceCardType(card.number))
+            return unknown("card_mismatch");
+    }
+    const last4 = saRecord(options) ? options.cardLast4 : void 0;
+    if (last4 !== void 0 && (!saExact(/^[0-9]{4}$/, last4) || masked.slice(-4) !== last4))
+        return unknown("card_mismatch");
+    const decision = value("decision");
+    const code = value("reason_code");
+    if (decision === "ACCEPT" && code === "100" && fields.has("payment_token"))
+        return { outcome: "token", page: reply.bodyText };
+    if ((decision === "DECLINE" || decision === "ERROR") && SECURE_ACCEPTANCE_REFUSAL_REASON_CODES.includes(code) && !fields.has("payment_token")) {
+        return { outcome: "refused", code };
+    }
+    return unknown("reply_unconfirmed");
+}
+function saScrubbedOrEchoed(name, field, sent) {
+    const pattern = SA_SCRUBBED.get(name);
+    if (pattern && saExact(pattern, field.value))
+        return true;
+    return !!sent && name.startsWith("req_") && !SA_CARD_ECHOES.has(name) && sent.values.has(name.slice(4)) && sent.values.get(name.slice(4)) === field.value;
+}
+function secureAcceptanceRefusalCode(bodyText) {
+    if (typeof bodyText !== "string" || saUtf8Length(bodyText) > SA_REPLY_LIMIT)
+        return null;
+    const page = saReadReplyPage(bodyText, `https://${SECURE_ACCEPTANCE_HOSTS.production}`);
+    if (page.error)
+        return null;
+    const decision = page.fields.get("decision")?.value;
+    const code = page.fields.get("reason_code")?.value;
+    return (decision === "DECLINE" || decision === "ERROR") && saExact(/^[0-9]{3}$/, code) ? code : null;
+}
+export { SECURE_ACCEPTANCE_CAPABILITY, SECURE_ACCEPTANCE_CARD_TYPES, SECURE_ACCEPTANCE_HOSTS, SECURE_ACCEPTANCE_MERCHANTS, SECURE_ACCEPTANCE_OPTIONAL_SIGNED_FIELDS, SECURE_ACCEPTANCE_PAGE_CONTENT_TYPE, SECURE_ACCEPTANCE_PSP, SECURE_ACCEPTANCE_REFUSAL_REASON_CODES, SECURE_ACCEPTANCE_REPLY_REASONS, SECURE_ACCEPTANCE_REQUEST_REFUSALS, SECURE_ACCEPTANCE_SIGNED_FIELDS, SECURE_ACCEPTANCE_TEST_PANS, SECURE_ACCEPTANCE_TOKEN_CREATE_PATH, SECURE_ACCEPTANCE_UNSIGNED_FIELDS, isPreparedSecureAcceptanceRequest, isSecureAcceptanceDeviceRequest, isSecureAcceptanceTokenRequest, secureAcceptanceCardRefusal, secureAcceptanceCardType, secureAcceptanceDeviceRequest, secureAcceptanceEnvironment, secureAcceptanceMerchantEntry, secureAcceptanceMerchantRefusal, secureAcceptancePreparationUrl, secureAcceptanceRefusalCode, secureAcceptanceReplyOutcome, secureAcceptanceRequestFacts, secureAcceptanceRequestRefusal, secureAcceptanceScannedPage };