@bemony/payment-form 0.1.10 → 0.1.12

package/README.md

@@ -43,7 +43,8 @@ const form = await BemonyPaymentForm.mount({
   riskCollectors,
   threeDS: { presentation: 'modal' },
   onStatusChange: (status) => console.log(status),
-  onError: (error) => console.error(error)
+  onError: (error) => console.error(error),
+  onEvent: (event) => analytics.track('bemony_payment_form', event)
 });
 
 const result = await form.pay({
@@ -96,6 +97,20 @@ identifier, retry guidance, BFF status, Runtime correlation and browser-safe pro
 They never contain card data, card tokens, session secrets, service credentials, raw upstream bodies
 or 3DS material.
 
+## Lifecycle telemetry
+
+`onEvent` is optional and carries only browser-safe lifecycle data. It can be used to measure
+iframe recovery without inspecting card fields or collector values. The SDK emits
+`MOUNT_STARTED`, `MOUNT_SLOW`, `MOUNT_RETRY`, `MOUNT_FAILED`, `MOUNTED`, `PAYMENT_STARTED`,
+`PAYMENT_SUCCEEDED`, `PAYMENT_FAILED` and `DESTROYED`. `MOUNT_RETRY` is limited to the initial
+iframe navigation/handshake; a ready form is not visually remounted for a transient inner-frame
+failure. `MOUNT_SLOW` is diagnostic only: it consumes foreground time only and never tears down
+or rejects an otherwise pending secure form.
+
+On `mount()`, the SDK opportunistically installs deduplicated `dns-prefetch` and `preconnect`
+hints for the hosted Form origin. Merchants may add the same hints in their document head earlier
+in the page lifecycle, but they are never required for correctness.
+
 ```ts
 import type {
   PaymentFormError,
@@ -120,7 +135,7 @@ authenticated payment query for fulfillment.
 ## CDN
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/@bemony/payment-form@0.1.8/dist/bemony-payment-form.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@bemony/payment-form@0.1.12/dist/bemony-payment-form.min.js"></script>
 ```
 
 The script exposes `globalThis.BemonyPaymentForm` with the same `mount()` API.

package/dist/bemony-payment-form.min.js

@@ -1,2 +1,2 @@
-"use strict";(()=>{function g(e,t,n){return n===void 0?{code:e,message:t}:{code:e,message:t,requestId:n}}function j(e){let t=e.client,n=K(window.location.href),s=K(document.referrer),l={colorDepth:window.screen?.colorDepth,javascriptEnabled:!0,javaEnabled:ce(),language:navigator.language,screenHeight:window.screen?.height,screenWidth:window.screen?.width,timezoneOffsetMinutes:new Date().getTimezoneOffset()},a=z({...se(),...q(t?.utm)}),r={...ie(),...n===void 0?{}:{page:n},...s===void 0?{}:{referrer:s},...t,...Object.keys(a).length===0?{}:{utm:a},browserInfo:{...l,...t?.browserInfo}};return{...e,client:r}}function ie(){let e=navigator.userAgent;return{deviceType:/Mobi|Android|iPhone|iPad/i.test(e)?"mobile":"desktop",os:/Windows NT/i.test(e)?"Windows":/Android/i.test(e)?"Android":/iPhone|iPad|Mac OS X/i.test(e)?"Apple":/Linux/i.test(e)?"Linux":void 0,browser:/Edg\//i.test(e)?"Edge":/Firefox\//i.test(e)?"Firefox":/Chrome\//i.test(e)?"Chrome":/Safari\//i.test(e)?"Safari":void 0}}function se(){let e=new URLSearchParams(window.location.search);return q({source:e.get("utm_source")??void 0,campaign:e.get("utm_campaign")??void 0,medium:e.get("utm_medium")??void 0,content:e.get("utm_content")??void 0,term:e.get("utm_term")??void 0})}function q(e){return e===void 0?{}:z({source:N(e.source),campaign:N(e.campaign),medium:N(e.medium),content:N(e.content),term:N(e.term)})}function N(e){if(typeof e!="string")return;let t=e.normalize("NFKC").trim();if(!(t===""||t.length>120||de(t)||ae(t)))return t}function ae(e){return/(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(e)||/(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(e)||/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i.test(e)}function de(e){return Array.from(e).some(t=>{let n=t.codePointAt(0);return n<32||n===127})}function K(e){if(e!=="")try{let t=new URL(e);return["http:","https:"].includes(t.protocol)?(t.search="",t.hash="",t.toString()):void 0}catch{return}}function ce(){let e=navigator;try{return e.javaEnabled?.()??!1}catch{return!1}}function z(e){for(let t of Object.keys(e))(e[t]===void 0||e[t]==="")&&delete e[t];return e}var M;function k(){return typeof window.Stripe=="function"?Promise.resolve(window.Stripe):(M!==void 0||(M=new Promise((e,t)=>{let n=document.createElement("script");n.src="https://js.stripe.com/v3/",n.async=!0,n.referrerPolicy="origin",n.onload=()=>{typeof window.Stripe=="function"?e(window.Stripe):t(new Error("Stripe.js loaded without its public API."))},n.onerror=()=>t(new Error("Stripe.js could not be loaded.")),document.head.append(n)})),M)}var ue={sandbox:"https://tst.kaptcha.com",live:"https://ssl.kaptcha.com"},me=12,pe=256,fe=8192;function G(e,t){if(e===void 0||e.length===0)return{snapshot:()=>{},settled:Promise.resolve()};let n={},s=ye(e),l=Promise.all(s.map(async a=>{let r=await Se(a,t).catch(()=>{});r!==void 0&&(n[a.publicKey]=r)})).then(()=>{});return{snapshot:()=>le(n),settled:l}}function ye(e){let t=[],n=new Set;for(let s of e.slice(0,pe))if(he(s)&&!n.has(s.publicKey)&&(n.add(s.publicKey),t.push(s),t.length===me))break;return t}function le(e){if(Object.keys(e).length===0)return;let t=Ae({...e});return t.length<=fe?t:void 0}async function Se(e,t){if(e.provider==="stripe"&&e.collector==="radar"){let n=(await k())(e.publicKey);if(n===null||n.createRadarSession===void 0)return;let s=await n.createRadarSession();return Ee(s)}if((e.provider==="nmi"||e.provider==="seamless")&&e.collector==="kount"){let n=Re(32);return await ge(e.publicKey,n,t),n}}function ge(e,t,n){return new Promise((s,l)=>{let a=document.createElement("script"),r=new URL("/collect/sdk",ue[n]);r.searchParams.set("m",e),r.searchParams.set("s",t),a.src=r.toString(),a.async=!0,a.referrerPolicy="origin",a.onload=()=>s(),a.onerror=()=>l(new Error("Kount collector could not be loaded.")),document.head.append(a)})}function Ee(e){if(typeof e=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(e))return e;if($(e)){let t=e.id;if(typeof t=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(t))return t;if($(e.radarSession)){let n=e.radarSession.id;if(typeof n=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(n))return n}}}function he(e){return typeof e.publicKey!="string"||e.publicKey.length===0||e.publicKey.length>512?!1:e.provider==="stripe"&&e.collector==="radar"?/^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(e.publicKey):(e.provider==="nmi"||e.provider==="seamless")&&e.collector==="kount"&&/^(?:\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(e.publicKey)}function Re(e){let t=new Uint8Array(e/2);return crypto.getRandomValues(t),Array.from(t,n=>n.toString(16).padStart(2,"0")).join("")}function Ae(e){let t=new TextEncoder().encode(JSON.stringify(e)),n="";for(let s of t)n+=String.fromCharCode(s);return btoa(n)}function $(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}async function V(e){let t=(await k())(e.publishableKey);if(t===null)throw new Error("Stripe.js could not initialize.");if((await t.handleNextAction({clientSecret:e.clientSecret})).error!==void 0)throw new Error("Stripe authentication failed.")}function W(e){if(!Ie(e))return!1;switch(e.type){case"READY":case"MOUNTED":case"THREE_DS_CLOSE":return d(e,["channel","version","instanceId","type"]);case"THREE_DS_OPEN":return d(e,["channel","version","instanceId","type"]);case"STRIPE_3DS":return d(e,["channel","version","instanceId","type","action"])&&_e(e.action);case"STATUS":return d(e,["channel","version","instanceId","type","status"])&&be(e.status);case"RESIZED":return d(e,["channel","version","instanceId","type","height"])&&Pe(e.height);case"CARD_STATE":return d(e,["channel","version","instanceId","type","state"])&&Oe(e.state);case"SUCCESS":return d(e,["channel","version","instanceId","type","requestId","payment"])&&F(e.requestId)&&Ne(e.payment);case"ERROR":return d(e,["channel","version","instanceId","type","requestId","error"])&&(e.requestId===void 0||F(e.requestId))&&we(e.error);default:return!1}}function Ie(e){return E(e)&&e.channel==="BEMONY_FORM_PAYMENT"&&e.version===1&&F(e.instanceId)&&typeof e.type=="string"}function d(e,t){return Object.keys(e).every(n=>t.includes(n))}function F(e){return typeof e=="string"&&/^[A-Za-z0-9-]{16,128}$/.test(e)}function _e(e){return E(e)&&d(e,["actionId","clientSecret","publishableKey"])&&Te(e.actionId)&&typeof e.clientSecret=="string"&&/^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(e.clientSecret)&&typeof e.publishableKey=="string"&&/^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(e.publishableKey)}function Te(e){return typeof e=="string"&&/^pi_[A-Za-z0-9_]{4,256}$/.test(e)}function be(e){return typeof e=="string"&&["MOUNTING","READY","TOKENIZING","SUBMITTING","AUTHENTICATING_3DS","PROCESSING","AUTHORIZED","CAPTURED","DECLINED","FAILED","UNKNOWN","EXPIRED","REQUIRES_PAYMENT_METHOD","DESTROYED"].includes(e)}function Pe(e){return typeof e=="number"&&Number.isInteger(e)&&e>=80&&e<=1200}function Oe(e){return E(e)&&d(e,["complete","valid"])&&typeof e.complete=="boolean"&&typeof e.valid=="boolean"}function Ne(e){return E(e)&&d(e,["paymentId","status"])&&typeof e.paymentId=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.paymentId)&&(e.status==="AUTHORIZED"||e.status==="CAPTURED")}function we(e){return E(e)&&d(e,["code","message","requestId","paymentId","retryable","httpStatus","upstreamRequestId","frameStage","payment"])&&typeof e.code=="string"&&/^[A-Z][A-Z0-9_]{1,63}$/.test(e.code)&&typeof e.message=="string"&&e.message.length<=1e3&&(e.requestId===void 0||F(e.requestId))&&(e.paymentId===void 0||typeof e.paymentId=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.paymentId))&&(e.retryable===void 0||typeof e.retryable=="boolean")&&(e.httpStatus===void 0||typeof e.httpStatus=="number"&&Number.isInteger(e.httpStatus)&&e.httpStatus>=400&&e.httpStatus<=599)&&(e.upstreamRequestId===void 0||typeof e.upstreamRequestId=="string"&&e.upstreamRequestId.length>0&&e.upstreamRequestId.length<=1e3)&&(e.frameStage===void 0||e.frameStage==="FRAME_DOCUMENT"||e.frameStage==="CARD_FRAME")&&(e.payment===void 0||Ce(e.payment))}function Ce(e){return E(e)&&d(e,["id","environment","currency","transaction"])&&typeof e.id=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.id)&&(e.environment==="sandbox"||e.environment==="live")&&typeof e.currency=="string"&&/^[A-Z]{3}$/.test(e.currency)&&De(e.transaction)}function De(e){return E(e)&&d(e,["id","status","amount","currency","provider","providerReference","attempts"])&&typeof e.id=="string"&&/^txn_[A-Za-z0-9_-]{4,128}$/.test(e.id)&&ke(e.status)&&Number.isSafeInteger(e.amount)&&typeof e.currency=="string"&&/^[A-Z]{3}$/.test(e.currency)&&y(e.provider)&&y(e.providerReference)&&(e.attempts===void 0||Array.isArray(e.attempts)&&e.attempts.length<=20&&e.attempts.every(Me))}function Me(e){return E(e)&&d(e,["ordinal","provider","status","delivery","failureReason","providerCode","providerStatus","providerReference","message","toProxyMs","midMs"])&&x(e.ordinal)&&y(e.provider)&&y(e.status)&&y(e.delivery)&&y(e.failureReason)&&y(e.providerCode)&&y(e.providerStatus)&&y(e.providerReference)&&y(e.message)&&x(e.toProxyMs)&&x(e.midMs)}function ke(e){return typeof e=="string"&&["PROCESSING","AUTHORIZED","CAPTURED","DECLINED","FAILED","UNKNOWN","EXPIRED","REQUIRES_PAYMENT_METHOD"].includes(e)}function y(e){return e===void 0||typeof e=="string"&&e.length>0&&e.length<=1e3}function x(e){return e===void 0||typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}function E(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Y="https://payment-form.bemony.com",Fe=624,Ue=12,Le=25e3,X={mount(e){let t=xe(e.target);if(!Ye(e.clientSecret))return Promise.reject(g("PAYMENT_SESSION_INVALID","A sess\xE3o de pagamento \xE9 inv\xE1lida."));if(e.signal?.aborted)return Promise.reject(g("INVALID_STATE","A montagem foi cancelada."));let n=G(e.riskCollectors,e.clientSecret.startsWith("cs_test_")?"sandbox":"live"),s=crypto.randomUUID(),l=He(),a=document.createElement("div");a.dataset.bemonyPaymentForm="";let r=document.createElement("iframe");r.title="Pagamento seguro Bemony",r.src=`${l}/frame?instance=${encodeURIComponent(s)}`,r.setAttribute("allow","payment *"),r.setAttribute("referrerpolicy","no-referrer");let b=100;H(r,b),a.style.cssText="display:block;width:100%;margin:0;padding:0;background:transparent;",a.append(r),t.append(a);let I=!1,h=!1,R,p,U,w=null,C=null,S,f={status:"MOUNTING",ready:!1,isSubmitting:!1},P,c,L=()=>{},A=(i,m)=>{try{i?.(m)}catch{}},_=i=>{r.contentWindow?.postMessage(i,l)},D=()=>{p!==void 0&&(p.remove(),p=void 0,w===null?document.body.style.removeProperty("overflow"):document.body.setAttribute("style",w),C===null?document.documentElement.style.removeProperty("overflow"):document.documentElement.setAttribute("style",C),w=null,C=null,U=void 0,H(r,b),r.removeAttribute("role"),r.removeAttribute("aria-modal"),r.removeAttribute("aria-label"))},Q=()=>{if(e.threeDS?.presentation!=="modal"||p!==void 0)return;p=document.createElement("div"),p.dataset.bemonyPaymentThreeDsModal="",p.setAttribute("aria-hidden","true"),r.setAttribute("tabindex","-1"),r.setAttribute("role","dialog"),r.setAttribute("aria-modal","true"),r.setAttribute("aria-label","Autentica\xE7\xE3o segura do banco"),p.style.cssText=["position:fixed","inset:0","z-index:2147483646","display:flex","align-items:center","justify-content:center","padding:0",`background:${e.appearance?.threeDS?.modalBackdrop??"rgba(2, 6, 23, .72)"}`].join(";");let i=()=>{r.style.cssText=["position:fixed","left:50%","top:50%","z-index:2147483647","display:block",`width:min(${Fe}px, calc(100vw - 24px))`,`height:min(${b}px, calc(100dvh - 24px))`,"border:0",`border-radius:${Ue}px`,"overflow:hidden","background:#fff","box-shadow:none","transform:translate(-50%, -50%)"].join(";")};U=i,w=document.body.getAttribute("style"),C=document.documentElement.getAttribute("style"),document.body.style.setProperty("overflow","hidden","important"),document.documentElement.style.setProperty("overflow","hidden","important"),i(),document.body.append(p),window.requestAnimationFrame(()=>r.focus({preventScroll:!0}))},J=i=>{I||(f={...f,status:i,ready:h,isSubmitting:["TOKENIZING","SUBMITTING","AUTHENTICATING_3DS","PROCESSING"].includes(i)},A(e.onStatusChange,i))},v=(i,m)=>{if(!(m!==void 0&&c!==void 0&&c.requestId!==m)){if(D(),(i.code==="PAYMENT_STATUS_UNKNOWN"||i.code==="PAYMENT_ALREADY_IN_PROGRESS"||m!==void 0&&i.retryable!==!0)&&(P=i),f={...f,...P!==void 0?{status:"UNKNOWN"}:{},error:i,isSubmitting:!1},A(e.onError,i),!h&&S!==void 0){R!==void 0&&window.clearTimeout(R);let u=S;S=void 0,O(),u(i);return}c!==void 0&&(c.reject(i),c=void 0)}},O=()=>{if(!I&&(I=!0,R!==void 0&&window.clearTimeout(R),window.removeEventListener("message",L),e.signal?.removeEventListener("abort",O),D(),_({channel:"BEMONY_FORM_PAYMENT",version:1,type:"DESTROY",instanceId:s}),r.remove(),a.remove(),c?.reject(g("FRAME_UNAVAILABLE","O formul\xE1rio de pagamento foi desmontado.")),c=void 0,f={...f,status:"DESTROYED",ready:!1,isSubmitting:!1},!h&&S!==void 0)){let i=S;S=void 0,i(g("INVALID_STATE","A montagem foi cancelada."))}},ee={pay(i){if(I)return Promise.reject(g("INVALID_STATE","O formul\xE1rio de pagamento foi desmontado."));if(!h)return Promise.reject(g("FORM_NOT_READY","O formul\xE1rio de pagamento ainda n\xE3o est\xE1 pronto."));if(P!==void 0)return Promise.reject(P);if(c!==void 0)return c.promise;let m=crypto.randomUUID(),u,o,B=new Promise((re,oe)=>{u=re,o=oe});c={requestId:m,promise:B,resolve:u,reject:o};let ne=j(i),Z=n.snapshot();return _({channel:"BEMONY_FORM_PAYMENT",version:1,type:"PAY",instanceId:s,requestId:m,input:ne,...Z===void 0?{}:{riskCollectorSessions:Z}}),B},getState:()=>f,destroy:O},te=new Promise((i,m)=>{S=m,R=window.setTimeout(()=>{if(h||I)return;let u=g("FRAME_UNAVAILABLE","N\xE3o foi poss\xEDvel carregar o formul\xE1rio de pagamento.");S=void 0,O(),m(u)},Le),L=u=>{if(I||u.origin!==l||u.source!==r.contentWindow||!W(u.data)||u.data.instanceId!==s)return;let o=u.data;if(o.type==="READY"){_({channel:"BEMONY_FORM_PAYMENT",version:1,type:"INIT",instanceId:s,clientSecret:e.clientSecret,presentation:e.threeDS?.presentation??"modal",...e.appearance===void 0?{}:{appearance:e.appearance}});return}if(o.type==="MOUNTED"){if(h)return;h=!0,R!==void 0&&window.clearTimeout(R),S=void 0,f={...f,status:"READY",ready:!0},A(e.onReady,void 0),A(e.onStatusChange,"READY"),i(ee);return}if(o.type==="STATUS")return J(o.status);if(o.type==="CARD_STATE")return A(e.onCardStateChange,o.state);if(o.type==="RESIZED"){b=o.height,p===void 0?H(r,b):U?.();return}if(o.type==="STRIPE_3DS"){V(o.action).then(()=>{_({channel:"BEMONY_FORM_PAYMENT",version:1,type:"STRIPE_3DS_RESULT",instanceId:s,actionId:o.action.actionId,result:"SUCCEEDED"})},()=>{_({channel:"BEMONY_FORM_PAYMENT",version:1,type:"STRIPE_3DS_RESULT",instanceId:s,actionId:o.action.actionId,result:"FAILED"})});return}if(o.type==="THREE_DS_OPEN"){Q(),window.requestAnimationFrame(()=>{window.requestAnimationFrame(()=>{_({channel:"BEMONY_FORM_PAYMENT",version:1,type:"THREE_DS_PRESENTED",instanceId:s})})});return}if(o.type==="THREE_DS_CLOSE")return D();if(o.type==="SUCCESS"&&(c===void 0||c.requestId===o.requestId)){D(),P=void 0,f={status:o.payment.status,ready:!0,isSubmitting:!1,payment:o.payment},A(e.onStatusChange,o.payment.status),A(e.onSuccess,o.payment),c?.resolve(o.payment),c=void 0;return}o.type==="ERROR"&&v(o.error,o.requestId)},window.addEventListener("message",L)});return e.signal?.addEventListener("abort",O,{once:!0}),te}};function xe(e){let t=typeof e=="string"?document.querySelector(e):e;if(t===null||!(t instanceof HTMLElement))throw g("PAY_INPUT_INVALID","O container do Payment Form n\xE3o foi encontrado.");return t}function Ye(e){return/^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(e)}function He(){let e=["localhost","127.0.0.1","[::1]"].includes(window.location.hostname),t=globalThis.__BEMONY_PAYMENT_FORM_FRAME_URL__;if(!e||t===void 0)return Y;try{let n=new URL(t);return!["http:","https:"].includes(n.protocol)||n.pathname!=="/"||n.search||n.hash||n.username||n.password?Y:n.origin}catch{return Y}}function H(e,t){e.style.cssText=`display:block;width:100%;height:${t}px;min-height:${t}px;border:0;background:transparent;`,e.removeAttribute("tabindex")}globalThis.BemonyPaymentForm=X;})();
+"use strict";(()=>{function O(e,t,n,r={}){return{code:e,message:t,...W(e),...r,...n===void 0?{}:{requestId:n}}}function $(e){let{category:t,stage:n,...r}=e;return{...r,...W(e.code),...t===void 0?{}:{category:t},...n===void 0?{}:{stage:n}}}function W(e){switch(e){case"PAY_INPUT_INVALID":case"CARD_FIELDS_INCOMPLETE":return{category:"VALIDATION",stage:"CARD_TOKENIZATION"};case"PAYMENT_SESSION_INVALID":case"CHECKOUT_SESSION_INVALID":case"CHECKOUT_SESSION_EXPIRED":case"ORIGIN_NOT_ALLOWED":return{category:"CONFIGURATION",stage:"CARD_FRAME_DOCUMENT"};case"FORM_NOT_READY":case"FORM_DESTROYED":case"FORM_MOUNT_CANCELLED":case"INVALID_STATE":return{category:"LIFECYCLE",stage:"FORM_SDK"};case"FRAME_UNAVAILABLE":case"MOUNT_FAILED":case"FRAME_NETWORK_TIMEOUT":case"FRAME_DOCUMENT_NOT_FOUND":case"FRAME_RATE_LIMITED":case"FRAME_POLICY_BLOCKED":return{category:"FRAME",stage:e==="MOUNT_FAILED"?"FORM_SDK":"CARD_FRAME_HANDSHAKE"};case"TOKENIZATION_UNAVAILABLE":case"TOKENIZATION_FAILED":return{category:"TOKENIZATION",stage:"CARD_TOKENIZATION"};case"THREE_DS_FAILED":case"STRIPE_3DS_FAILED":return{category:"THREE_DS",stage:"THREE_DS"};case"PAYMENT_DECLINED":case"PAYMENT_FAILED":case"PAYMENT_STATUS_UNKNOWN":case"PAYMENT_ALREADY_IN_PROGRESS":return{category:"PAYMENT",stage:e==="PAYMENT_STATUS_UNKNOWN"||e==="PAYMENT_ALREADY_IN_PROGRESS"?"PAYMENT_RECONCILIATION":"PAYMENT_SUBMISSION"};case"ORCHESTRATOR_UNAVAILABLE":case"ORCHESTRATOR_ERROR":case"INVALID_UPSTREAM_RESPONSE":case"PAYMENT_FORM_SERVER_ERROR":return{category:"RUNTIME",stage:"RUNTIME"};default:return{category:"UNKNOWN",stage:"RUNTIME"}}}function G(e){let t=e.client,n=Y(t?.page)??Y(window.location.href),r=Y(t?.referrer)??Y(document.referrer),c={colorDepth:window.screen?.colorDepth,javascriptEnabled:!0,javaEnabled:Ee(),language:navigator.language,screenHeight:window.screen?.height,screenWidth:window.screen?.width,timezoneOffsetMinutes:new Date().getTimezoneOffset()},s=Q({...pe(),...X(t?.utm)}),o={...me(),...t,...n===void 0?{}:{page:n},...r===void 0?{}:{referrer:r},...Object.keys(s).length===0?{}:{utm:s},browserInfo:{...c,...t?.browserInfo}};return{...e,client:o}}function me(){let e=navigator.userAgent;return{deviceType:/Mobi|Android|iPhone|iPad/i.test(e)?"mobile":"desktop",os:/Windows NT/i.test(e)?"Windows":/Android/i.test(e)?"Android":/iPhone|iPad|Mac OS X/i.test(e)?"Apple":/Linux/i.test(e)?"Linux":void 0,browser:/Edg\//i.test(e)?"Edge":/Firefox\//i.test(e)?"Firefox":/Chrome\//i.test(e)?"Chrome":/Safari\//i.test(e)?"Safari":void 0}}function pe(){let e=new URLSearchParams(window.location.search);return X({source:e.get("utm_source")??void 0,campaign:e.get("utm_campaign")??void 0,medium:e.get("utm_medium")??void 0,content:e.get("utm_content")??void 0,term:e.get("utm_term")??void 0})}function X(e){return e===void 0?{}:Q({source:C(e.source),campaign:C(e.campaign),medium:C(e.medium),content:C(e.content),term:C(e.term)})}function C(e){if(typeof e!="string")return;let t=e.normalize("NFKC").trim();if(!(t===""||t.length>120||ye(t)||fe(t)))return t}function fe(e){return/(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(e)||/(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(e)||/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i.test(e)}function ye(e){return Array.from(e).some(t=>{let n=t.codePointAt(0);return n<32||n===127})}function Y(e){if(!(e===void 0||e===""))try{let t=new URL(e);return["http:","https:"].includes(t.protocol)?(t.search="",t.hash="",t.toString()):void 0}catch{return}}function Ee(){let e=navigator;try{return e.javaEnabled?.()??!1}catch{return!1}}function Q(e){for(let t of Object.keys(e))(e[t]===void 0||e[t]==="")&&delete e[t];return e}var H;function x(){return typeof window.Stripe=="function"?Promise.resolve(window.Stripe):(H!==void 0||(H=new Promise((e,t)=>{let n=document.createElement("script");n.src="https://js.stripe.com/v3/",n.async=!0,n.referrerPolicy="origin",n.onload=()=>{typeof window.Stripe=="function"?e(window.Stripe):t(new Error("Stripe.js loaded without its public API."))},n.onerror=()=>t(new Error("Stripe.js could not be loaded.")),document.head.append(n)})),H)}var le={sandbox:"https://tst.kaptcha.com",live:"https://ssl.kaptcha.com"},Ae=12,Se=256,ge=8192;function v(e,t){if(e===void 0||e.length===0)return{snapshot:()=>{},settled:Promise.resolve()};let n={},r=Ie(e),c=Promise.all(r.map(async s=>{let o=await _e(s,t).catch(()=>{});o!==void 0&&(n[s.publicKey]=o)})).then(()=>{});return{snapshot:()=>Re(n),settled:c}}function Ie(e){let t=[],n=new Set;for(let r of e.slice(0,Se))if(Oe(r)&&!n.has(r.publicKey)&&(n.add(r.publicKey),t.push(r),t.length===Ae))break;return t}function Re(e){if(Object.keys(e).length===0)return;let t=Pe({...e});return t.length<=ge?t:void 0}async function _e(e,t){if(e.provider==="stripe"&&e.collector==="radar"){let n=(await x())(e.publicKey);if(n===null||n.createRadarSession===void 0)return;let r=await n.createRadarSession();return Ne(r)}if((e.provider==="nmi"||e.provider==="seamless")&&e.collector==="kount"){let n=he(32);return await Te(e.publicKey,n,t),n}}function Te(e,t,n){return new Promise((r,c)=>{let s=document.createElement("script"),o=new URL("/collect/sdk",le[n]);o.searchParams.set("m",e),o.searchParams.set("s",t),s.src=o.toString(),s.async=!0,s.referrerPolicy="origin",s.onload=()=>r(),s.onerror=()=>c(new Error("Kount collector could not be loaded.")),document.head.append(s)})}function Ne(e){if(typeof e=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(e))return e;if(J(e)){let t=e.id;if(typeof t=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(t))return t;if(J(e.radarSession)){let n=e.radarSession.id;if(typeof n=="string"&&/^rse_[A-Za-z0-9_-]{4,512}$/.test(n))return n}}}function Oe(e){return typeof e.publicKey!="string"||e.publicKey.length===0||e.publicKey.length>512?!1:e.provider==="stripe"&&e.collector==="radar"?/^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(e.publicKey):(e.provider==="nmi"||e.provider==="seamless")&&e.collector==="kount"&&/^(?:\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(e.publicKey)}function he(e){let t=new Uint8Array(e/2);return crypto.getRandomValues(t),Array.from(t,n=>n.toString(16).padStart(2,"0")).join("")}function Pe(e){let t=new TextEncoder().encode(JSON.stringify(e)),n="";for(let r of t)n+=String.fromCharCode(r);return btoa(n)}function J(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}async function ee(e){let t=(await x())(e.publishableKey);if(t===null)throw new Error("Stripe.js could not initialize.");if((await t.handleNextAction({clientSecret:e.clientSecret})).error!==void 0)throw new Error("Stripe authentication failed.")}function te(e){if(!Me(e))return!1;switch(e.type){case"READY":case"MOUNTED":case"THREE_DS_CLOSE":return d(e,["channel","version","instanceId","type"]);case"THREE_DS_OPEN":return d(e,["channel","version","instanceId","type"]);case"MOUNT_SLOW":return d(e,["channel","version","instanceId","type","stage","durationMs"])&&Fe(e.stage)&&typeof e.durationMs=="number"&&Number.isInteger(e.durationMs)&&e.durationMs>=0&&e.durationMs<=1440*60*1e3;case"STRIPE_3DS":return d(e,["channel","version","instanceId","type","action"])&&be(e.action);case"STATUS":return d(e,["channel","version","instanceId","type","status"])&&Ce(e.status);case"RESIZED":return d(e,["channel","version","instanceId","type","height"])&&we(e.height);case"CARD_STATE":return d(e,["channel","version","instanceId","type","state"])&&Le(e.state);case"SUCCESS":return d(e,["channel","version","instanceId","type","requestId","payment"])&&K(e.requestId)&&Ue(e.payment);case"ERROR":return d(e,["channel","version","instanceId","type","requestId","error"])&&(e.requestId===void 0||K(e.requestId))&&ke(e.error);default:return!1}}function Me(e){return h(e)&&e.channel==="BEMONY_FORM_PAYMENT"&&e.version===1&&K(e.instanceId)&&typeof e.type=="string"}function d(e,t){return Object.keys(e).every(n=>t.includes(n))}function K(e){return typeof e=="string"&&/^[A-Za-z0-9-]{16,128}$/.test(e)}function be(e){return h(e)&&d(e,["actionId","clientSecret","publishableKey"])&&De(e.actionId)&&typeof e.clientSecret=="string"&&/^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(e.clientSecret)&&typeof e.publishableKey=="string"&&/^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(e.publishableKey)}function De(e){return typeof e=="string"&&/^pi_[A-Za-z0-9_]{4,256}$/.test(e)}function Ce(e){return typeof e=="string"&&["MOUNTING","READY","TOKENIZING","SUBMITTING","AUTHENTICATING_3DS","PROCESSING","AUTHORIZED","CAPTURED","DECLINED","FAILED","UNKNOWN","EXPIRED","REQUIRES_PAYMENT_METHOD","DESTROYED"].includes(e)}function Fe(e){return typeof e=="string"&&["FORM_IFRAME_NAVIGATION","FORM_HANDSHAKE","CARD_FRAME_DOCUMENT","CARD_FRAME_HANDSHAKE","CARD_FRAME_INITIALIZATION"].includes(e)}function we(e){return typeof e=="number"&&Number.isInteger(e)&&e>=80&&e<=1200}function Le(e){return h(e)&&d(e,["complete","valid"])&&typeof e.complete=="boolean"&&typeof e.valid=="boolean"}function Ue(e){return h(e)&&d(e,["paymentId","status"])&&typeof e.paymentId=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.paymentId)&&(e.status==="AUTHORIZED"||e.status==="CAPTURED")}function ke(e){return h(e)&&d(e,["code","message","category","stage","requestId","paymentId","retryable","httpStatus","upstreamRequestId","frameStage","payment"])&&typeof e.code=="string"&&/^[A-Z][A-Z0-9_]{1,63}$/.test(e.code)&&typeof e.message=="string"&&e.message.length<=1e3&&(e.category===void 0||typeof e.category=="string"&&["VALIDATION","CONFIGURATION","LIFECYCLE","FRAME","TOKENIZATION","THREE_DS","PAYMENT","RUNTIME","UNKNOWN"].includes(e.category))&&(e.stage===void 0||typeof e.stage=="string"&&["FORM_SDK","FORM_IFRAME_NAVIGATION","FORM_HANDSHAKE","CARD_FRAME_DOCUMENT","CARD_FRAME_HANDSHAKE","CARD_FRAME_INITIALIZATION","CARD_TOKENIZATION","THREE_DS","PAYMENT_SUBMISSION","PAYMENT_RECONCILIATION","RUNTIME"].includes(e.stage))&&(e.requestId===void 0||K(e.requestId))&&(e.paymentId===void 0||typeof e.paymentId=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.paymentId))&&(e.retryable===void 0||typeof e.retryable=="boolean")&&(e.httpStatus===void 0||typeof e.httpStatus=="number"&&Number.isInteger(e.httpStatus)&&e.httpStatus>=400&&e.httpStatus<=599)&&(e.upstreamRequestId===void 0||typeof e.upstreamRequestId=="string"&&e.upstreamRequestId.length>0&&e.upstreamRequestId.length<=1e3)&&(e.frameStage===void 0||e.frameStage==="FRAME_DOCUMENT"||e.frameStage==="CARD_FRAME")&&(e.payment===void 0||Ye(e.payment))}function Ye(e){return h(e)&&d(e,["id","environment","currency","transaction"])&&typeof e.id=="string"&&/^pay_[A-Za-z0-9_-]{4,128}$/.test(e.id)&&(e.environment==="sandbox"||e.environment==="live")&&typeof e.currency=="string"&&/^[A-Z]{3}$/.test(e.currency)&&He(e.transaction)}function He(e){return h(e)&&d(e,["id","status","amount","currency","provider","providerReference","attempts"])&&typeof e.id=="string"&&/^txn_[A-Za-z0-9_-]{4,128}$/.test(e.id)&&Ke(e.status)&&Number.isSafeInteger(e.amount)&&typeof e.currency=="string"&&/^[A-Z]{3}$/.test(e.currency)&&S(e.provider)&&S(e.providerReference)&&(e.attempts===void 0||Array.isArray(e.attempts)&&e.attempts.length<=20&&e.attempts.every(xe))}function xe(e){return h(e)&&d(e,["ordinal","provider","status","delivery","failureReason","providerCode","providerStatus","providerReference","message","toProxyMs","midMs"])&&j(e.ordinal)&&S(e.provider)&&S(e.status)&&S(e.delivery)&&S(e.failureReason)&&S(e.providerCode)&&S(e.providerStatus)&&S(e.providerReference)&&S(e.message)&&j(e.toProxyMs)&&j(e.midMs)}function Ke(e){return typeof e=="string"&&["PROCESSING","AUTHORIZED","CAPTURED","DECLINED","FAILED","UNKNOWN","EXPIRED","REQUIRES_PAYMENT_METHOD"].includes(e)}function S(e){return e===void 0||typeof e=="string"&&e.length>0&&e.length<=1e3}function j(e){return e===void 0||typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var V="https://payment-form.bemony.com",Ze=624,Be=12,je=1e4,ne={mount(e){let t=Ve(e.target);if(!qe(e.clientSecret))return Promise.reject(O("PAYMENT_SESSION_INVALID","A sess\xE3o de pagamento \xE9 inv\xE1lida."));if(e.signal?.aborted)return Promise.reject(O("FORM_MOUNT_CANCELLED","A montagem foi cancelada."));let n=v(e.riskCollectors,e.clientSecret.startsWith("cs_test_")?"sandbox":"live"),r=crypto.randomUUID(),c=ze();$e(c);let s=document.createElement("div");s.dataset.bemonyPaymentForm="";let o=document.createElement("iframe");o.title="Pagamento seguro Bemony",o.setAttribute("allow","payment *"),o.setAttribute("referrerpolicy","no-referrer");let I=100;q(o,I),s.style.cssText="display:block;width:100%;margin:0;padding:0;background:transparent;",s.append(o),t.append(s);let g=!1,m=!1,y,R=0,F=0,P="FORM_IFRAME_NAVIGATION",E,Z,w=null,L=null,_,l={status:"MOUNTING",ready:!1,isSubmitting:!1},D,p,B=()=>{},T=(a,A)=>{try{a?.(A)}catch{}},N=a=>T(e.onEvent,a),M=a=>{o.contentWindow?.postMessage(a,c)},U=()=>{E!==void 0&&(E.remove(),E=void 0,w===null?document.body.style.removeProperty("overflow"):document.body.setAttribute("style",w),L===null?document.documentElement.style.removeProperty("overflow"):document.documentElement.setAttribute("style",L),w=null,L=null,Z=void 0,q(o,I),o.removeAttribute("role"),o.removeAttribute("aria-modal"),o.removeAttribute("aria-label"))},re=()=>{if(e.threeDS?.presentation!=="modal"||E!==void 0)return;E=document.createElement("div"),E.dataset.bemonyPaymentThreeDsModal="",E.setAttribute("aria-hidden","true"),o.setAttribute("tabindex","-1"),o.setAttribute("role","dialog"),o.setAttribute("aria-modal","true"),o.setAttribute("aria-label","Autentica\xE7\xE3o segura do banco"),E.style.cssText=["position:fixed","inset:0","z-index:2147483646","display:flex","align-items:center","justify-content:center","padding:0",`background:${e.appearance?.threeDS?.modalBackdrop??"rgba(2, 6, 23, .72)"}`].join(";");let a=()=>{o.style.cssText=["position:fixed","left:50%","top:50%","z-index:2147483647","display:block",`width:min(${Ze}px, calc(100vw - 24px))`,`height:min(${I}px, calc(100dvh - 24px))`,"border:0",`border-radius:${Be}px`,"overflow:hidden","background:#fff","box-shadow:none","transform:translate(-50%, -50%)"].join(";")};Z=a,w=document.body.getAttribute("style"),L=document.documentElement.getAttribute("style"),document.body.style.setProperty("overflow","hidden","important"),document.documentElement.style.setProperty("overflow","hidden","important"),a(),document.body.append(E),window.requestAnimationFrame(()=>o.focus({preventScroll:!0}))},oe=a=>{g||(l={...l,status:a,ready:m,isSubmitting:["TOKENIZING","SUBMITTING","AUTHENTICATING_3DS","PROCESSING"].includes(a)},T(e.onStatusChange,a))},ie=(a,A)=>{if(A!==void 0&&p!==void 0&&p.requestId!==A)return;let u=$(a.stage===void 0&&!m?{...a,category:"FRAME",stage:P}:a);if(U(),(u.code==="PAYMENT_STATUS_UNKNOWN"||u.code==="PAYMENT_ALREADY_IN_PROGRESS"||A!==void 0&&u.retryable!==!0)&&(D=u),l={...l,...D!==void 0?{status:"UNKNOWN"}:{},error:u,isSubmitting:!1},T(e.onError,u),N({type:m?"PAYMENT_FAILED":"MOUNT_FAILED",...m?{}:{attempt:R,durationMs:Date.now()-F,stage:u.stage??P},error:u}),!m&&_!==void 0){y?.cancel();let f=_;_=void 0,k(),f(u);return}p!==void 0&&(p.reject(u),p=void 0)},k=()=>{if(!g&&(g=!0,y?.cancel(),window.removeEventListener("message",B),e.signal?.removeEventListener("abort",k),U(),M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"DESTROY",instanceId:r}),o.remove(),s.remove(),p?.reject(O("FORM_DESTROYED","O formul\xE1rio de pagamento foi desmontado.")),p=void 0,l={...l,status:"DESTROYED",ready:!1,isSubmitting:!1},N({type:"DESTROYED"}),!m&&_!==void 0)){let a=_;_=void 0,a(O("FORM_MOUNT_CANCELLED","A montagem foi cancelada."))}},se={pay(a){if(g)return Promise.reject(O("INVALID_STATE","O formul\xE1rio de pagamento foi desmontado."));if(!m)return Promise.reject(O("FORM_NOT_READY","O formul\xE1rio de pagamento ainda n\xE3o est\xE1 pronto."));if(D!==void 0)return Promise.reject(D);if(p!==void 0)return p.promise;let A=crypto.randomUUID(),u,f,i=new Promise((de,ue)=>{u=de,f=ue});p={requestId:A,promise:i,resolve:u,reject:f},N({type:"PAYMENT_STARTED"});let ce=G(a),z=n.snapshot();return M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"PAY",instanceId:r,requestId:A,input:ce,...z===void 0?{}:{riskCollectorSessions:z}}),i},getState:()=>l,destroy:k},ae=new Promise((a,A)=>{_=A;let u=()=>{y?.cancel(),R+=1,F=Date.now(),N({type:R===1?"MOUNT_STARTED":"MOUNT_RETRY",attempt:R}),P="FORM_IFRAME_NAVIGATION";let f=new URL("/frame",c);f.searchParams.set("instance",r),f.searchParams.set("mountAttempt",String(R)),o.src=f.toString(),y=We(()=>{m||g||N({type:"MOUNT_SLOW",attempt:R,durationMs:Date.now()-F,stage:P})},je)};B=f=>{if(g||f.origin!==c||f.source!==o.contentWindow||!te(f.data)||f.data.instanceId!==r)return;let i=f.data;if(i.type==="READY"){P="CARD_FRAME_INITIALIZATION",y?.cancel(),M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"INIT",instanceId:r,clientSecret:e.clientSecret,presentation:e.threeDS?.presentation??"modal",...e.appearance===void 0?{}:{appearance:e.appearance}});return}if(i.type==="MOUNTED"){if(m)return;m=!0,y?.cancel(),_=void 0,l={...l,status:"READY",ready:!0},T(e.onReady,void 0),T(e.onStatusChange,"READY"),N({type:"MOUNTED",attempt:R,durationMs:Date.now()-F,stage:"CARD_FRAME_INITIALIZATION"}),a(se);return}if(i.type==="MOUNT_SLOW"){N({type:"MOUNT_SLOW",attempt:R,durationMs:i.durationMs,stage:i.stage});return}if(i.type==="STATUS")return oe(i.status);if(i.type==="CARD_STATE")return T(e.onCardStateChange,i.state);if(i.type==="RESIZED"){I=i.height,E===void 0?q(o,I):Z?.();return}if(i.type==="STRIPE_3DS"){ee(i.action).then(()=>{M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"STRIPE_3DS_RESULT",instanceId:r,actionId:i.action.actionId,result:"SUCCEEDED"})},()=>{M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"STRIPE_3DS_RESULT",instanceId:r,actionId:i.action.actionId,result:"FAILED"})});return}if(i.type==="THREE_DS_OPEN"){re(),window.requestAnimationFrame(()=>{window.requestAnimationFrame(()=>{M({channel:"BEMONY_FORM_PAYMENT",version:1,type:"THREE_DS_PRESENTED",instanceId:r})})});return}if(i.type==="THREE_DS_CLOSE")return U();if(i.type==="SUCCESS"&&(p===void 0||p.requestId===i.requestId)){U(),D=void 0,l={status:i.payment.status,ready:!0,isSubmitting:!1,payment:i.payment},T(e.onStatusChange,i.payment.status),T(e.onSuccess,i.payment),N({type:"PAYMENT_SUCCEEDED"}),p?.resolve(i.payment),p=void 0;return}i.type==="ERROR"&&ie(i.error,i.requestId)},window.addEventListener("message",B),o.addEventListener("load",()=>{!m&&!g&&P==="FORM_IFRAME_NAVIGATION"&&(P="FORM_HANDSHAKE")}),u()});return e.signal?.addEventListener("abort",k,{once:!0}),ae}};function Ve(e){let t=typeof e=="string"?document.querySelector(e):e;if(t===null||!(t instanceof HTMLElement))throw O("PAY_INPUT_INVALID","O container do Payment Form n\xE3o foi encontrado.");return t}function qe(e){return/^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(e)}function ze(){let e=["localhost","127.0.0.1","[::1]"].includes(window.location.hostname),t=globalThis.__BEMONY_PAYMENT_FORM_FRAME_URL__;if(!e||t===void 0)return V;try{let n=new URL(t);return!["http:","https:"].includes(n.protocol)||n.pathname!=="/"||n.search||n.hash||n.username||n.password?V:n.origin}catch{return V}}function $e(e){for(let t of["dns-prefetch","preconnect"]){if(Array.from(document.head.querySelectorAll("link")).some(c=>{try{return c.rel===t&&new URL(c.href).origin===e}catch{return!1}}))continue;let r=document.createElement("link");r.rel=t,r.href=e,t==="preconnect"&&(r.crossOrigin="anonymous"),document.head.append(r)}}function q(e,t){e.style.cssText=`display:block;width:100%;height:${t}px;min-height:${t}px;border:0;background:transparent;`,e.removeAttribute("tabindex")}function We(e,t){let n=t,r,c,s=!1,o=()=>{c!==void 0&&window.clearTimeout(c),c=void 0},I=()=>{r!==void 0&&(n=Math.max(0,n-(Date.now()-r)),r=void 0,o())},g=()=>{s||(I(),n===0&&(s=!0,document.removeEventListener("visibilitychange",y),e()))},m=()=>{s||r!==void 0||(r=Date.now(),c=window.setTimeout(g,n))},y=()=>{document.visibilityState==="hidden"?I():m()};return document.addEventListener("visibilitychange",y),document.visibilityState!=="hidden"&&m(),{cancel(){s||(s=!0,o(),document.removeEventListener("visibilitychange",y))}}}globalThis.BemonyPaymentForm=ne;})();
 //# sourceMappingURL=bemony-payment-form.min.js.map

package/dist/bemony-payment-form.min.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/contracts/errors.ts", "../src/browser-context.ts", "../src/stripe.ts", "../src/risk-collectors.ts", "../src/stripe-three-ds.ts", "../src/protocol.ts", "../src/mount.ts", "../src/browser.ts"],
-  "sourcesContent": ["import type { PaymentFormError } from './types';\n\nexport function formError(code: string, message: string, requestId?: string): PaymentFormError {\n  return requestId === undefined ? { code, message } : { code, message, requestId };\n}\n\nexport function safeError(error: unknown, fallback: string): PaymentFormError {\n  if (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    typeof error.code === 'string'\n  ) {\n    const code = /^[A-Z][A-Z0-9_]{1,63}$/.test(error.code) ? error.code : fallback;\n    return formError(code, messageFor(code));\n  }\n  return formError(fallback, messageFor(fallback));\n}\n\nexport function messageFor(code: string): string {\n  switch (code) {\n    case 'PAY_INPUT_INVALID':\n      return 'Confira os dados do pagador.';\n    case 'PAYMENT_STATUS_UNKNOWN':\n      return 'Ainda estamos confirmando o pagamento.';\n    case 'SESSION_RECOVERY_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel consultar a sess\u00E3o de pagamento. Tente novamente mais tarde.';\n    case 'PAYMENT_ALREADY_IN_PROGRESS':\n      return 'O pagamento j\u00E1 est\u00E1 em andamento.';\n    case 'CHECKOUT_SESSION_EXPIRED':\n      return 'A sess\u00E3o de pagamento expirou.';\n    case 'TOKENIZATION_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel tokenizar o cart\u00E3o.';\n    case 'THREE_DS_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel concluir a autentica\u00E7\u00E3o do banco.';\n    default:\n      return 'N\u00E3o foi poss\u00EDvel concluir esta etapa do pagamento.';\n  }\n}\n", "import type { CheckoutClient, PayInput } from './contracts/types';\n\n/**\n * Adds non-sensitive browser context at the merchant document, where the\n * hosted iframe cannot read the parent location or its campaign parameters.\n * Explicit merchant values win; no fingerprint is generated here.\n */\nexport function enrichPayInputFromBrowser(input: PayInput): PayInput {\n  const declared = input.client;\n  const location = sanitizeUrl(window.location.href);\n  const referrer = sanitizeUrl(document.referrer);\n  const browserInfo: NonNullable<CheckoutClient['browserInfo']> = {\n    colorDepth: window.screen?.colorDepth,\n    javascriptEnabled: true,\n    javaEnabled: javaEnabled(),\n    language: navigator.language,\n    screenHeight: window.screen?.height,\n    screenWidth: window.screen?.width,\n    timezoneOffsetMinutes: new Date().getTimezoneOffset()\n  };\n  const utm = compact({\n    ...campaignFromLocation(),\n    ...sanitizeUtm(declared?.utm)\n  });\n  const client: CheckoutClient = {\n    ...browserIdentity(),\n    ...(location === undefined ? {} : { page: location }),\n    ...(referrer === undefined ? {} : { referrer }),\n    ...declared,\n    ...(Object.keys(utm).length === 0 ? {} : { utm }),\n    browserInfo: { ...browserInfo, ...declared?.browserInfo }\n  };\n  return { ...input, client };\n}\n\nfunction browserIdentity(): Pick<CheckoutClient, 'deviceType' | 'os' | 'browser'> {\n  const userAgent = navigator.userAgent;\n  return {\n    deviceType: /Mobi|Android|iPhone|iPad/i.test(userAgent) ? 'mobile' : 'desktop',\n    os: /Windows NT/i.test(userAgent)\n      ? 'Windows'\n      : /Android/i.test(userAgent)\n        ? 'Android'\n        : /iPhone|iPad|Mac OS X/i.test(userAgent)\n          ? 'Apple'\n          : /Linux/i.test(userAgent)\n            ? 'Linux'\n            : undefined,\n    browser: /Edg\\//i.test(userAgent)\n      ? 'Edge'\n      : /Firefox\\//i.test(userAgent)\n        ? 'Firefox'\n        : /Chrome\\//i.test(userAgent)\n          ? 'Chrome'\n          : /Safari\\//i.test(userAgent)\n            ? 'Safari'\n            : undefined\n  };\n}\n\nfunction campaignFromLocation(): NonNullable<CheckoutClient['utm']> {\n  const params = new URLSearchParams(window.location.search);\n  return sanitizeUtm({\n    source: params.get('utm_source') ?? undefined,\n    campaign: params.get('utm_campaign') ?? undefined,\n    medium: params.get('utm_medium') ?? undefined,\n    content: params.get('utm_content') ?? undefined,\n    term: params.get('utm_term') ?? undefined\n  });\n}\n\nfunction sanitizeUtm(value: CheckoutClient['utm'] | undefined): NonNullable<CheckoutClient['utm']> {\n  if (value === undefined) return {};\n  return compact({\n    source: sanitizeUtmValue(value.source),\n    campaign: sanitizeUtmValue(value.campaign),\n    medium: sanitizeUtmValue(value.medium),\n    content: sanitizeUtmValue(value.content),\n    term: sanitizeUtmValue(value.term)\n  });\n}\n\nfunction sanitizeUtmValue(value: string | null | undefined): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.normalize('NFKC').trim();\n  if (\n    normalized === '' ||\n    normalized.length > 120 ||\n    hasControlCharacter(normalized) ||\n    looksLikeSensitiveUtm(normalized)\n  ) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction looksLikeSensitiveUtm(value: string): boolean {\n  return (\n    /(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(value) ||\n    /(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(value) ||\n    /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i.test(value)\n  );\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0)!;\n    return code < 32 || code === 127;\n  });\n}\n\nfunction sanitizeUrl(value: string): string | undefined {\n  if (value === '') return undefined;\n  try {\n    const url = new URL(value);\n    if (!['http:', 'https:'].includes(url.protocol)) return undefined;\n    url.search = '';\n    url.hash = '';\n    return url.toString();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction javaEnabled(): boolean {\n  const candidate = navigator as Navigator & { javaEnabled?: () => boolean };\n  try {\n    return candidate.javaEnabled?.() ?? false;\n  } catch {\n    return false;\n  }\n}\n\nfunction compact<T extends Record<string, string | undefined>>(value: T): T {\n  for (const key of Object.keys(value) as Array<keyof T>) {\n    if (value[key] === undefined || value[key] === '') delete value[key];\n  }\n  return value;\n}\n", "export type StripeRadarSessionResult =\n  string | Readonly<{ id?: string; radarSession?: Readonly<{ id?: string }>; error?: unknown }>;\n\nexport type StripeClient = Readonly<{\n  handleNextAction(\n    input: Readonly<{ clientSecret: string }>\n  ): Promise<Readonly<{ error?: unknown }>>;\n  createRadarSession?: () => Promise<StripeRadarSessionResult>;\n}>;\n\nexport type StripeConstructor = (publishableKey: string) => StripeClient | null;\n\ndeclare global {\n  interface Window {\n    Stripe?: StripeConstructor;\n  }\n}\n\nlet stripeScript: Promise<StripeConstructor> | undefined;\n\n/** Loads Stripe.js once in the merchant top-level document. */\nexport function loadStripe(): Promise<StripeConstructor> {\n  if (typeof window.Stripe === 'function') return Promise.resolve(window.Stripe);\n  if (stripeScript !== undefined) return stripeScript;\n  stripeScript = new Promise<StripeConstructor>((resolve, reject) => {\n    const script = document.createElement('script');\n    script.src = 'https://js.stripe.com/v3/';\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => {\n      if (typeof window.Stripe === 'function') resolve(window.Stripe);\n      else reject(new Error('Stripe.js loaded without its public API.'));\n    };\n    script.onerror = () => reject(new Error('Stripe.js could not be loaded.'));\n    document.head.append(script);\n  });\n  return stripeScript;\n}\n", "import { loadStripe } from './stripe';\nimport type { RiskCollector } from './contracts/types';\n\nconst KOUNT_HOSTS = {\n  sandbox: 'https://tst.kaptcha.com',\n  live: 'https://ssl.kaptcha.com'\n} as const;\n// Keep client work aligned with the hosted bridge's decoded-object ceiling.\nconst MAX_RISK_COLLECTORS = 12;\n// Inspect a bounded superset so malformed/duplicate instructions cannot crowd\n// out a valid backend-issued collector near the start of a corrupted list.\nconst MAX_RISK_COLLECTOR_INPUTS = 256;\nconst MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH = 8_192;\n\nexport type RiskCollectorSessionCollection = Readonly<{\n  /**\n   * Returns only sessions that have already completed. It never waits on a\n   * third party and is therefore safe to call from the payment critical path.\n   */\n  snapshot: () => string | undefined;\n  /**\n   * Resolves after every third-party collector settles. A provider that never\n   * responds can keep this pending; this is observability-only and must never\n   * be awaited by the payment path.\n   */\n  settled: Promise<void>;\n}>;\n\n/**\n * Starts every collector without making payment availability depend on third\n * parties. Call snapshot() at PAY time to obtain the sessions that completed\n * while the buyer was entering their card details.\n */\nexport function startRiskCollectorSessionCollection(\n  collectors: readonly RiskCollector[] | undefined,\n  environment: 'sandbox' | 'live'\n): RiskCollectorSessionCollection {\n  if (collectors === undefined || collectors.length === 0) {\n    return { snapshot: () => undefined, settled: Promise.resolve() };\n  }\n\n  const sessions: Record<string, string> = {};\n  const acceptedCollectors = boundedCollectors(collectors);\n  const settled = Promise.all(\n    acceptedCollectors.map(async (collector) => {\n      const session = await collectOne(collector, environment).catch(() => undefined);\n      if (session !== undefined) sessions[collector.publicKey] = session;\n    })\n  ).then(() => undefined);\n\n  return {\n    snapshot: () => boundedSnapshot(sessions),\n    settled\n  };\n}\n\n/**\n * CheckoutSession may pass through untrusted browser code, so enforce the\n * bridge contract before creating third-party requests. The Runtime may return\n * any supported provider/collector combination and distinct public keys; only\n * duplicate keys and an unbounded list are rejected locally.\n */\nfunction boundedCollectors(collectors: readonly RiskCollector[]): RiskCollector[] {\n  const accepted: RiskCollector[] = [];\n  const seenKeys = new Set<string>();\n\n  // Do not iterate over an unbounded host-controlled list. Inspect a bounded\n  // superset to tolerate malformed/duplicate values before the accepted cap.\n  for (const collector of collectors.slice(0, MAX_RISK_COLLECTOR_INPUTS)) {\n    if (!isRiskCollector(collector)) continue;\n    if (seenKeys.has(collector.publicKey)) continue;\n    seenKeys.add(collector.publicKey);\n    accepted.push(collector);\n    if (accepted.length === MAX_RISK_COLLECTORS) break;\n  }\n  return accepted;\n}\n\nfunction boundedSnapshot(sessions: Record<string, string>): string | undefined {\n  if (Object.keys(sessions).length === 0) return undefined;\n  const encoded = base64Json({ ...sessions });\n  // Omit optional telemetry instead of emitting a bridge message that the\n  // hosted form would reject and potentially delaying the payment state.\n  return encoded.length <= MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH ? encoded : undefined;\n}\n\nasync function collectOne(\n  collector: RiskCollector,\n  environment: 'sandbox' | 'live'\n): Promise<string | undefined> {\n  if (collector.provider === 'stripe' && collector.collector === 'radar') {\n    const stripe = (await loadStripe())(collector.publicKey);\n    if (stripe === null || stripe.createRadarSession === undefined) return undefined;\n    const result = await stripe.createRadarSession();\n    return radarSessionId(result);\n  }\n  if (\n    (collector.provider === 'nmi' || collector.provider === 'seamless') &&\n    collector.collector === 'kount'\n  ) {\n    const session = randomHex(32);\n    await loadKount(collector.publicKey, session, environment);\n    return session;\n  }\n  return undefined;\n}\n\nfunction loadKount(\n  merchantId: string,\n  sessionId: string,\n  environment: 'sandbox' | 'live'\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement('script');\n    const url = new URL('/collect/sdk', KOUNT_HOSTS[environment]);\n    url.searchParams.set('m', merchantId);\n    url.searchParams.set('s', sessionId);\n    script.src = url.toString();\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => resolve();\n    script.onerror = () => reject(new Error('Kount collector could not be loaded.'));\n    document.head.append(script);\n  });\n}\n\nfunction radarSessionId(value: unknown): string | undefined {\n  if (typeof value === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(value)) return value;\n  if (isRecord(value)) {\n    const direct = value.id;\n    if (typeof direct === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(direct)) return direct;\n    if (isRecord(value.radarSession)) {\n      const nested = value.radarSession.id;\n      if (typeof nested === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(nested)) return nested;\n    }\n  }\n  return undefined;\n}\n\nfunction isRiskCollector(value: RiskCollector): boolean {\n  if (\n    typeof value.publicKey !== 'string' ||\n    value.publicKey.length === 0 ||\n    value.publicKey.length > 512\n  )\n    return false;\n  if (value.provider === 'stripe' && value.collector === 'radar')\n    return /^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(value.publicKey);\n  return (\n    (value.provider === 'nmi' || value.provider === 'seamless') &&\n    value.collector === 'kount' &&\n    // Kount accepts both legacy numeric MIDs and Runtime-issued checkout_public_* keys.\n    // The value is serialized by URLSearchParams, so accepting the documented public key format\n    // does not create a URL-injection surface.\n    /^(?:\\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(value.publicKey)\n  );\n}\n\nfunction randomHex(length: number): string {\n  const bytes = new Uint8Array(length / 2);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction base64Json(value: Record<string, string>): string {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "type StripeThreeDSAction = Readonly<{\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nimport { loadStripe } from './stripe';\n\n/**\n * Runs in the merchant document so Stripe.js can present its native modal at\n * the top-level browsing context. The action is accepted only from the\n * already-bound hosted frame and is never exposed to integration callbacks.\n */\nexport async function completeStripeThreeDS(action: StripeThreeDSAction): Promise<void> {\n  const stripe = (await loadStripe())(action.publishableKey);\n  if (stripe === null) throw new Error('Stripe.js could not initialize.');\n  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });\n  if (result.error !== undefined) throw new Error('Stripe authentication failed.');\n}\n", "import type {\n  CardState,\n  PaymentFormAppearance,\n  PaymentFormError,\n  PaymentFormStatus,\n  PayInput,\n  PayOutcome,\n  ThreeDSPresentation\n} from './contracts/types';\n\nexport const FORM_PAYMENT_PROTOCOL_VERSION = 1 as const;\n\ntype Base = Readonly<{\n  channel: 'BEMONY_FORM_PAYMENT';\n  version: typeof FORM_PAYMENT_PROTOCOL_VERSION;\n  instanceId: string;\n}>;\n\ntype StripeThreeDSAction = Readonly<{\n  actionId: string;\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nexport type HostToFrameMessage =\n  | (Base &\n      Readonly<{\n        type: 'INIT';\n        clientSecret: string;\n        appearance?: PaymentFormAppearance;\n        presentation: ThreeDSPresentation;\n      }>)\n  | (Base &\n      Readonly<{\n        type: 'PAY';\n        requestId: string;\n        input: PayInput;\n        /** Base64 JSON map generated only by the public collector layer. */\n        riskCollectorSessions?: string;\n      }>)\n  | (Base & Readonly<{ type: 'THREE_DS_PRESENTED' }>)\n  | (Base &\n      Readonly<{ type: 'STRIPE_3DS_RESULT'; actionId: string; result: 'SUCCEEDED' | 'FAILED' }>)\n  | (Base & Readonly<{ type: 'DESTROY' }>);\n\nexport type FrameToHostMessage =\n  | (Base & Readonly<{ type: 'READY' | 'MOUNTED' | 'THREE_DS_CLOSE' }>)\n  | (Base & Readonly<{ type: 'THREE_DS_OPEN' }>)\n  | (Base & Readonly<{ type: 'STRIPE_3DS'; action: StripeThreeDSAction }>)\n  | (Base & Readonly<{ type: 'RESIZED'; height: number }>)\n  | (Base & Readonly<{ type: 'STATUS'; status: PaymentFormStatus }>)\n  | (Base & Readonly<{ type: 'CARD_STATE'; state: CardState }>)\n  | (Base & Readonly<{ type: 'SUCCESS'; requestId: string; payment: PayOutcome }>)\n  | (Base & Readonly<{ type: 'ERROR'; requestId?: string; error: PaymentFormError }>);\n\nexport function isFrameToHostMessage(value: unknown): value is FrameToHostMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'READY':\n    case 'MOUNTED':\n    case 'THREE_DS_CLOSE':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'THREE_DS_OPEN':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'action']) &&\n        isStripeThreeDSAction(value.action)\n      );\n    case 'STATUS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'status']) &&\n        isStatus(value.status)\n      );\n    case 'RESIZED':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'height']) &&\n        isFrameHeight(value.height)\n      );\n    case 'CARD_STATE':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'state']) &&\n        isCardState(value.state)\n      );\n    case 'SUCCESS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'payment']) &&\n        isId(value.requestId) &&\n        isOutcome(value.payment)\n      );\n    case 'ERROR':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'error']) &&\n        (value.requestId === undefined || isId(value.requestId)) &&\n        isError(value.error)\n      );\n    default:\n      return false;\n  }\n}\n\nexport function isHostToFrameMessage(value: unknown): value is HostToFrameMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'INIT':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'clientSecret',\n          'appearance',\n          'presentation'\n        ]) &&\n        isClientSecret(value.clientSecret) &&\n        isPresentation(value.presentation) &&\n        (value.appearance === undefined || isAppearance(value.appearance))\n      );\n    case 'PAY':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'requestId',\n          'input',\n          'riskCollectorSessions'\n        ]) &&\n        isId(value.requestId) &&\n        isPayInput(value.input) &&\n        (value.riskCollectorSessions === undefined ||\n          isRiskCollectorSessions(value.riskCollectorSessions))\n      );\n    case 'THREE_DS_PRESENTED':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS_RESULT':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'actionId', 'result']) &&\n        isStripeActionId(value.actionId) &&\n        (value.result === 'SUCCEEDED' || value.result === 'FAILED')\n      );\n    case 'DESTROY':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    default:\n      return false;\n  }\n}\n\nfunction hasBase(value: unknown): value is Record<string, unknown> & Base {\n  return (\n    isRecord(value) &&\n    value.channel === 'BEMONY_FORM_PAYMENT' &&\n    value.version === FORM_PAYMENT_PROTOCOL_VERSION &&\n    isId(value.instanceId) &&\n    typeof value.type === 'string'\n  );\n}\n\nfunction hasOnly(value: Record<string, unknown>, keys: readonly string[]): boolean {\n  return Object.keys(value).every((key) => keys.includes(key));\n}\n\nfunction isId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9-]{16,128}$/.test(value);\n}\n\nfunction isClientSecret(value: unknown): value is string {\n  return typeof value === 'string' && /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction isRiskCollectorSessions(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    value.length <= 8_192 &&\n    /^[A-Za-z0-9+/]*={0,2}$/.test(value)\n  );\n}\n\nfunction isStripeThreeDSAction(value: unknown): value is StripeThreeDSAction {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['actionId', 'clientSecret', 'publishableKey']) &&\n    isStripeActionId(value.actionId) &&\n    typeof value.clientSecret === 'string' &&\n    /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) &&\n    typeof value.publishableKey === 'string' &&\n    /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey)\n  );\n}\n\nfunction isStripeActionId(value: unknown): value is string {\n  return typeof value === 'string' && /^pi_[A-Za-z0-9_]{4,256}$/.test(value);\n}\n\nfunction isPresentation(value: unknown): value is ThreeDSPresentation {\n  return value === 'modal' || value === 'inline';\n}\n\nfunction isStatus(value: unknown): value is PaymentFormStatus {\n  return (\n    typeof value === 'string' &&\n    [\n      'MOUNTING',\n      'READY',\n      'TOKENIZING',\n      'SUBMITTING',\n      'AUTHENTICATING_3DS',\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD',\n      'DESTROYED'\n    ].includes(value)\n  );\n}\n\nfunction isFrameHeight(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value >= 80 && value <= 1_200;\n}\n\nfunction isCardState(value: unknown): value is CardState {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['complete', 'valid']) &&\n    typeof value.complete === 'boolean' &&\n    typeof value.valid === 'boolean'\n  );\n}\n\nfunction isOutcome(value: unknown): value is PayOutcome {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['paymentId', 'status']) &&\n    typeof value.paymentId === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) &&\n    (value.status === 'AUTHORIZED' || value.status === 'CAPTURED')\n  );\n}\n\nfunction isError(value: unknown): value is PaymentFormError {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'code',\n      'message',\n      'requestId',\n      'paymentId',\n      'retryable',\n      'httpStatus',\n      'upstreamRequestId',\n      'frameStage',\n      'payment'\n    ]) &&\n    typeof value.code === 'string' &&\n    /^[A-Z][A-Z0-9_]{1,63}$/.test(value.code) &&\n    typeof value.message === 'string' &&\n    value.message.length <= 1_000 &&\n    (value.requestId === undefined || isId(value.requestId)) &&\n    (value.paymentId === undefined ||\n      (typeof value.paymentId === 'string' &&\n        /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId))) &&\n    (value.retryable === undefined || typeof value.retryable === 'boolean') &&\n    (value.httpStatus === undefined ||\n      (typeof value.httpStatus === 'number' &&\n        Number.isInteger(value.httpStatus) &&\n        value.httpStatus >= 400 &&\n        value.httpStatus <= 599)) &&\n    (value.upstreamRequestId === undefined ||\n      (typeof value.upstreamRequestId === 'string' &&\n        value.upstreamRequestId.length > 0 &&\n        value.upstreamRequestId.length <= 1_000)) &&\n    (value.frameStage === undefined ||\n      value.frameStage === 'FRAME_DOCUMENT' ||\n      value.frameStage === 'CARD_FRAME') &&\n    (value.payment === undefined || isErrorPayment(value.payment))\n  );\n}\n\nfunction isErrorPayment(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['id', 'environment', 'currency', 'transaction']) &&\n    typeof value.id === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    (value.environment === 'sandbox' || value.environment === 'live') &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    isErrorTransaction(value.transaction)\n  );\n}\n\nfunction isErrorTransaction(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'id',\n      'status',\n      'amount',\n      'currency',\n      'provider',\n      'providerReference',\n      'attempts'\n    ]) &&\n    typeof value.id === 'string' &&\n    /^txn_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    isPaymentStatus(value.status) &&\n    Number.isSafeInteger(value.amount) &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    optionalText(value.provider) &&\n    optionalText(value.providerReference) &&\n    (value.attempts === undefined ||\n      (Array.isArray(value.attempts) &&\n        value.attempts.length <= 20 &&\n        value.attempts.every(isErrorAttempt)))\n  );\n}\n\nfunction isErrorAttempt(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'ordinal',\n      'provider',\n      'status',\n      'delivery',\n      'failureReason',\n      'providerCode',\n      'providerStatus',\n      'providerReference',\n      'message',\n      'toProxyMs',\n      'midMs'\n    ]) &&\n    optionalInteger(value.ordinal) &&\n    optionalText(value.provider) &&\n    optionalText(value.status) &&\n    optionalText(value.delivery) &&\n    optionalText(value.failureReason) &&\n    optionalText(value.providerCode) &&\n    optionalText(value.providerStatus) &&\n    optionalText(value.providerReference) &&\n    optionalText(value.message) &&\n    optionalInteger(value.toProxyMs) &&\n    optionalInteger(value.midMs)\n  );\n}\n\nfunction isPaymentStatus(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    [\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD'\n    ].includes(value)\n  );\n}\n\nfunction optionalText(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'string' && value.length > 0 && value.length <= 1_000)\n  );\n}\n\nfunction optionalInteger(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n  );\n}\n\nfunction isAppearance(value: unknown): value is PaymentFormAppearance {\n  if (!isRecord(value) || !hasOnly(value, ['theme', 'variables', 'threeDS'])) return false;\n  if (value.theme !== undefined && !['light', 'dark', 'system'].includes(String(value.theme)))\n    return false;\n  if (\n    value.variables !== undefined &&\n    (!isRecord(value.variables) ||\n      Object.values(value.variables).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  if (\n    value.threeDS !== undefined &&\n    (!isRecord(value.threeDS) ||\n      Object.values(value.threeDS).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  return true;\n}\n\nfunction isPayInput(value: unknown): value is PayInput {\n  if (\n    !isRecord(value) ||\n    !hasOnly(value, [\n      'merchantOrderId',\n      'merchantReference',\n      'description',\n      'currency',\n      'operation',\n      'customer',\n      'billingAddress',\n      'shippingAddress',\n      'cardStorageConsent',\n      'items',\n      'amounts',\n      'initialTransactionReference',\n      'checkoutUrl',\n      'returnUrl',\n      'metadata',\n      'client'\n    ])\n  )\n    return false;\n  if (\n    typeof value.merchantOrderId !== 'string' ||\n    value.merchantOrderId.trim().length === 0 ||\n    value.merchantOrderId.length > 255 ||\n    typeof value.currency !== 'string' ||\n    !/^[A-Z]{3}$/.test(value.currency) ||\n    (value.operation !== undefined && value.operation !== 'AUTHORIZE' && value.operation !== 'SALE')\n  )\n    return false;\n  return (\n    Array.isArray(value.items) &&\n    value.items.length > 0 &&\n    value.items.length <= 20 &&\n    value.items.every(isPaymentItem)\n  );\n}\n\nfunction isPaymentItem(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'description',\n      'id',\n      'sku',\n      'unitAmount',\n      'quantity',\n      'type',\n      'interval',\n      'intervalCount',\n      'trialDays',\n      'cycle',\n      'isMain',\n      'category',\n      'brand',\n      'imageUrl',\n      'manufacturePartNumber'\n    ]) &&\n    typeof value.description === 'string' &&\n    value.description.trim().length > 0 &&\n    Number.isSafeInteger(value.unitAmount) &&\n    Number(value.unitAmount) > 0 &&\n    Number.isSafeInteger(value.quantity) &&\n    Number(value.quantity) > 0 &&\n    Number(value.quantity) <= 999 &&\n    (value.type === 'ONE_TIME' ||\n      value.type === 'RECURRING' ||\n      value.type === 'UNIQUE' ||\n      value.type === 'unique' ||\n      value.type === 'recurring')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "import { formError } from './contracts/errors';\nimport { enrichPayInputFromBrowser } from './browser-context';\nimport { startRiskCollectorSessionCollection } from './risk-collectors';\nimport { completeStripeThreeDS } from './stripe-three-ds';\nimport type {\n  PayInput,\n  PaymentFormError,\n  PaymentFormInstance,\n  PaymentFormMountOptions,\n  PaymentFormState,\n  PaymentFormStatus,\n  PayOutcome\n} from './contracts/types';\nimport {\n  FORM_PAYMENT_PROTOCOL_VERSION,\n  isFrameToHostMessage,\n  type FrameToHostMessage,\n  type HostToFrameMessage\n} from './protocol';\n\nconst productionFrameOrigin = 'https://payment-form.bemony.com';\nconst threeDSModalWidth = 624;\nconst threeDSModalRadius = 12;\n// The hosted form has up to two 10s Card Frame bootstrap attempts. Keep this\n// outer watchdog above that bounded recovery window so it cannot mask the\n// structured frame error with a generic FRAME_UNAVAILABLE.\nconst FORM_MOUNT_TIMEOUT_MS = 25_000;\n\nexport const BemonyPaymentForm = {\n  mount(options: PaymentFormMountOptions): Promise<PaymentFormInstance> {\n    const target = resolveTarget(options.target);\n    if (!isClientSecret(options.clientSecret)) {\n      return Promise.reject(\n        formError('PAYMENT_SESSION_INVALID', 'A sess\u00E3o de pagamento \u00E9 inv\u00E1lida.')\n      );\n    }\n    if (options.signal?.aborted) {\n      return Promise.reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n    }\n\n    // Begin telemetry at mount time so collection can run while the secure\n    // frame boots and the buyer fills in card fields. PAY reads a synchronous\n    // snapshot: an unavailable fraud provider never adds latency to payment.\n    const riskCollectorSessions = startRiskCollectorSessionCollection(\n      options.riskCollectors,\n      options.clientSecret.startsWith('cs_test_') ? 'sandbox' : 'live'\n    );\n\n    const instanceId = crypto.randomUUID();\n    const frameOrigin = resolveFrameOrigin();\n    const slot = document.createElement('div');\n    slot.dataset.bemonyPaymentForm = '';\n    const iframe = document.createElement('iframe');\n    iframe.title = 'Pagamento seguro Bemony';\n    iframe.src = `${frameOrigin}/frame?instance=${encodeURIComponent(instanceId)}`;\n    iframe.setAttribute('allow', 'payment *');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    let contentHeight = 100;\n    setInlineStyle(iframe, contentHeight);\n    slot.style.cssText = 'display:block;width:100%;margin:0;padding:0;background:transparent;';\n    slot.append(iframe);\n    target.append(slot);\n\n    let destroyed = false;\n    let mounted = false;\n    let timer: number | undefined;\n    let overlay: HTMLDivElement | undefined;\n    let applyOverlayLayout: (() => void) | undefined;\n    let bodyOverflow: string | null = null;\n    let documentOverflow: string | null = null;\n    let rejectMount: ((reason: PaymentFormError) => void) | undefined;\n    let state: PaymentFormState = { status: 'MOUNTING', ready: false, isSubmitting: false };\n    let blockedError: PaymentFormError | undefined;\n    let active:\n      | Readonly<{\n          requestId: string;\n          promise: Promise<PayOutcome>;\n          resolve: (value: PayOutcome) => void;\n          reject: (reason: PaymentFormError) => void;\n        }>\n      | undefined;\n    let onMessage: (event: MessageEvent<unknown>) => void = () => undefined;\n\n    const callback = <T>(fn: ((value: T) => void) | undefined, value: T): void => {\n      try {\n        fn?.(value);\n      } catch {\n        /* Merchant callbacks never control payment state. */\n      }\n    };\n    const post = (message: HostToFrameMessage): void => {\n      iframe.contentWindow?.postMessage(message, frameOrigin);\n    };\n    const restoreInline = (): void => {\n      if (overlay === undefined) return;\n      overlay.remove();\n      overlay = undefined;\n      if (bodyOverflow === null) document.body.style.removeProperty('overflow');\n      else document.body.setAttribute('style', bodyOverflow);\n      if (documentOverflow === null) document.documentElement.style.removeProperty('overflow');\n      else document.documentElement.setAttribute('style', documentOverflow);\n      bodyOverflow = null;\n      documentOverflow = null;\n      applyOverlayLayout = undefined;\n      setInlineStyle(iframe, contentHeight);\n      iframe.removeAttribute('role');\n      iframe.removeAttribute('aria-modal');\n      iframe.removeAttribute('aria-label');\n    };\n    const showOverlay = (): void => {\n      if (options.threeDS?.presentation !== 'modal' || overlay !== undefined) return;\n      overlay = document.createElement('div');\n      overlay.dataset.bemonyPaymentThreeDsModal = '';\n      // Keep the Frame in its original DOM position. Reparenting an iframe can\n      // reload its nested Card Frame and discard the in-flight issuer challenge.\n      // The backdrop belongs to document.body; fixed positioning turns the\n      // already-mounted frame into the modal without resetting it.\n      overlay.setAttribute('aria-hidden', 'true');\n      iframe.setAttribute('tabindex', '-1');\n      iframe.setAttribute('role', 'dialog');\n      iframe.setAttribute('aria-modal', 'true');\n      iframe.setAttribute('aria-label', 'Autentica\u00E7\u00E3o segura do banco');\n      overlay.style.cssText = [\n        'position:fixed',\n        'inset:0',\n        // The secure iframe must stay above this backdrop. It is appended\n        // after the iframe so equal stacking values would intercept the\n        // issuer's buttons and make a valid challenge impossible to finish.\n        'z-index:2147483646',\n        'display:flex',\n        'align-items:center',\n        'justify-content:center',\n        'padding:0',\n        `background:${options.appearance?.threeDS?.modalBackdrop ?? 'rgba(2, 6, 23, .72)'}`\n      ].join(';');\n      const applyLayout = (): void => {\n        iframe.style.cssText = [\n          'position:fixed',\n          'left:50%',\n          'top:50%',\n          'z-index:2147483647',\n          'display:block',\n          `width:min(${threeDSModalWidth}px, calc(100vw - 24px))`,\n          `height:min(${contentHeight}px, calc(100dvh - 24px))`,\n          'border:0',\n          `border-radius:${threeDSModalRadius}px`,\n          'overflow:hidden',\n          'background:#fff',\n          'box-shadow:none',\n          'transform:translate(-50%, -50%)'\n        ].join(';');\n      };\n      applyOverlayLayout = applyLayout;\n      bodyOverflow = document.body.getAttribute('style');\n      documentOverflow = document.documentElement.getAttribute('style');\n      document.body.style.setProperty('overflow', 'hidden', 'important');\n      document.documentElement.style.setProperty('overflow', 'hidden', 'important');\n      applyLayout();\n      document.body.append(overlay);\n      window.requestAnimationFrame(() => iframe.focus({ preventScroll: true }));\n    };\n    const reportStatus = (status: PaymentFormStatus): void => {\n      if (destroyed) return;\n      state = {\n        ...state,\n        status,\n        ready: mounted,\n        isSubmitting: ['TOKENIZING', 'SUBMITTING', 'AUTHENTICATING_3DS', 'PROCESSING'].includes(\n          status\n        )\n      };\n      callback(options.onStatusChange, status);\n    };\n    const reportError = (error: PaymentFormError, requestId?: string): void => {\n      if (requestId !== undefined && active !== undefined && active.requestId !== requestId) return;\n      restoreInline();\n      // Neither a timeout/unknown result nor a competing in-flight command\n      // proves that no charge exists. Keep this instance fail-closed until\n      // the merchant reconciles the canonical Payment. Terminal declines and\n      // failures are deliberately not included: they can start a new attempt.\n      if (\n        error.code === 'PAYMENT_STATUS_UNKNOWN' ||\n        error.code === 'PAYMENT_ALREADY_IN_PROGRESS' ||\n        (requestId !== undefined && error.retryable !== true)\n      ) {\n        blockedError = error;\n      }\n      state = {\n        ...state,\n        ...(blockedError !== undefined ? { status: 'UNKNOWN' as const } : {}),\n        error,\n        isSubmitting: false\n      };\n      callback(options.onError, error);\n      if (!mounted && rejectMount !== undefined) {\n        if (timer !== undefined) window.clearTimeout(timer);\n        const reject = rejectMount;\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n        return;\n      }\n      if (active !== undefined) {\n        active.reject(error);\n        active = undefined;\n      }\n    };\n    const destroy = (): void => {\n      if (destroyed) return;\n      destroyed = true;\n      if (timer !== undefined) window.clearTimeout(timer);\n      window.removeEventListener('message', onMessage);\n      options.signal?.removeEventListener('abort', destroy);\n      restoreInline();\n      post({\n        channel: 'BEMONY_FORM_PAYMENT',\n        version: FORM_PAYMENT_PROTOCOL_VERSION,\n        type: 'DESTROY',\n        instanceId\n      });\n      iframe.remove();\n      slot.remove();\n      active?.reject(formError('FRAME_UNAVAILABLE', 'O formul\u00E1rio de pagamento foi desmontado.'));\n      active = undefined;\n      state = { ...state, status: 'DESTROYED', ready: false, isSubmitting: false };\n      if (!mounted && rejectMount !== undefined) {\n        const reject = rejectMount;\n        rejectMount = undefined;\n        reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n      }\n    };\n    const instance: PaymentFormInstance = {\n      pay(input: PayInput): Promise<PayOutcome> {\n        if (destroyed)\n          return Promise.reject(\n            formError('INVALID_STATE', 'O formul\u00E1rio de pagamento foi desmontado.')\n          );\n        if (!mounted)\n          return Promise.reject(\n            formError('FORM_NOT_READY', 'O formul\u00E1rio de pagamento ainda n\u00E3o est\u00E1 pronto.')\n          );\n        if (blockedError !== undefined) return Promise.reject(blockedError);\n        if (active !== undefined) return active.promise;\n        const requestId = crypto.randomUUID();\n        let resolve!: (payment: PayOutcome) => void;\n        let reject!: (error: PaymentFormError) => void;\n        const promise = new Promise<PayOutcome>((nextResolve, nextReject) => {\n          resolve = nextResolve;\n          reject = nextReject;\n        });\n        active = { requestId, promise, resolve, reject };\n        const enrichedInput = enrichPayInputFromBrowser(input);\n        const sessions = riskCollectorSessions.snapshot();\n        post({\n          channel: 'BEMONY_FORM_PAYMENT',\n          version: FORM_PAYMENT_PROTOCOL_VERSION,\n          type: 'PAY',\n          instanceId,\n          requestId,\n          input: enrichedInput,\n          ...(sessions === undefined ? {} : { riskCollectorSessions: sessions })\n        });\n        return promise;\n      },\n      getState: () => state,\n      destroy\n    };\n    const mountPromise = new Promise<PaymentFormInstance>((resolve, reject) => {\n      rejectMount = reject;\n      timer = window.setTimeout(() => {\n        if (mounted || destroyed) return;\n        const error = formError(\n          'FRAME_UNAVAILABLE',\n          'N\u00E3o foi poss\u00EDvel carregar o formul\u00E1rio de pagamento.'\n        );\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n      }, FORM_MOUNT_TIMEOUT_MS);\n      onMessage = (event: MessageEvent<unknown>): void => {\n        if (destroyed || event.origin !== frameOrigin || event.source !== iframe.contentWindow)\n          return;\n        if (!isFrameToHostMessage(event.data) || event.data.instanceId !== instanceId) return;\n        const message: FrameToHostMessage = event.data;\n        if (message.type === 'READY') {\n          post({\n            channel: 'BEMONY_FORM_PAYMENT',\n            version: FORM_PAYMENT_PROTOCOL_VERSION,\n            type: 'INIT',\n            instanceId,\n            clientSecret: options.clientSecret,\n            presentation: options.threeDS?.presentation ?? 'modal',\n            ...(options.appearance === undefined ? {} : { appearance: options.appearance })\n          });\n          return;\n        }\n        if (message.type === 'MOUNTED') {\n          if (mounted) return;\n          mounted = true;\n          if (timer !== undefined) window.clearTimeout(timer);\n          rejectMount = undefined;\n          state = { ...state, status: 'READY', ready: true };\n          callback(options.onReady, undefined);\n          callback(options.onStatusChange, 'READY');\n          resolve(instance);\n          return;\n        }\n        if (message.type === 'STATUS') return reportStatus(message.status);\n        if (message.type === 'CARD_STATE')\n          return callback(options.onCardStateChange, message.state);\n        if (message.type === 'RESIZED') {\n          contentHeight = message.height;\n          if (overlay === undefined) setInlineStyle(iframe, contentHeight);\n          else applyOverlayLayout?.();\n          return;\n        }\n        if (message.type === 'STRIPE_3DS') {\n          // Stripe.js owns the top-level challenge surface. The sensitive,\n          // ephemeral action stays on this private bridge and never reaches\n          // consumer callbacks or public SDK state.\n          void completeStripeThreeDS(message.action).then(\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'SUCCEEDED'\n              });\n            },\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'FAILED'\n              });\n            }\n          );\n          return;\n        }\n        if (message.type === 'THREE_DS_OPEN') {\n          // The hosted form must not start the issuer challenge until the\n          // public host has promoted this iframe to its modal and the browser\n          // has had a chance to paint that layout.\n          showOverlay();\n          window.requestAnimationFrame(() => {\n            window.requestAnimationFrame(() => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'THREE_DS_PRESENTED',\n                instanceId\n              });\n            });\n          });\n          return;\n        }\n        if (message.type === 'THREE_DS_CLOSE') return restoreInline();\n        if (\n          message.type === 'SUCCESS' &&\n          (active === undefined || active.requestId === message.requestId)\n        ) {\n          restoreInline();\n          blockedError = undefined;\n          state = {\n            status: message.payment.status,\n            ready: true,\n            isSubmitting: false,\n            payment: message.payment\n          };\n          callback(options.onStatusChange, message.payment.status);\n          callback(options.onSuccess, message.payment);\n          active?.resolve(message.payment);\n          active = undefined;\n          return;\n        }\n        if (message.type === 'ERROR') reportError(message.error, message.requestId);\n      };\n      window.addEventListener('message', onMessage);\n    });\n    options.signal?.addEventListener('abort', destroy, { once: true });\n    return mountPromise;\n  }\n};\n\nfunction resolveTarget(target: string | HTMLElement): HTMLElement {\n  const element = typeof target === 'string' ? document.querySelector<HTMLElement>(target) : target;\n  if (element === null || !(element instanceof HTMLElement))\n    throw formError('PAY_INPUT_INVALID', 'O container do Payment Form n\u00E3o foi encontrado.');\n  return element;\n}\n\nfunction isClientSecret(value: string): boolean {\n  return /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction resolveFrameOrigin(): string {\n  const isLoopbackHost = ['localhost', '127.0.0.1', '[::1]'].includes(window.location.hostname);\n  const configured = (\n    globalThis as typeof globalThis & { __BEMONY_PAYMENT_FORM_FRAME_URL__?: string }\n  ).__BEMONY_PAYMENT_FORM_FRAME_URL__;\n  if (!isLoopbackHost || configured === undefined) return productionFrameOrigin;\n\n  try {\n    const url = new URL(configured);\n    if (\n      !['http:', 'https:'].includes(url.protocol) ||\n      url.pathname !== '/' ||\n      url.search ||\n      url.hash ||\n      url.username ||\n      url.password\n    ) {\n      return productionFrameOrigin;\n    }\n    return url.origin;\n  } catch {\n    return productionFrameOrigin;\n  }\n}\n\nfunction setInlineStyle(iframe: HTMLIFrameElement, height: number): void {\n  iframe.style.cssText = `display:block;width:100%;height:${height}px;min-height:${height}px;border:0;background:transparent;`;\n  iframe.removeAttribute('tabindex');\n}\n", "import { BemonyPaymentForm as WebPaymentForm } from './mount.js';\n\ndeclare global {\n  var BemonyPaymentForm: typeof WebPaymentForm;\n}\n\n/** Script-tag distribution exposes exactly the same Web SDK surface as ESM. */\nglobalThis.BemonyPaymentForm = WebPaymentForm;\n"],
-  "mappings": "mBAEO,SAASA,EAAUC,EAAcC,EAAiBC,EAAsC,CAC7F,OAAOA,IAAc,OAAY,CAAE,KAAAF,EAAM,QAAAC,CAAQ,EAAI,CAAE,KAAAD,EAAM,QAAAC,EAAS,UAAAC,CAAU,CAClF,CCGO,SAASC,EAA0BC,EAA2B,CACnE,IAAMC,EAAWD,EAAM,OACjBE,EAAWC,EAAY,OAAO,SAAS,IAAI,EAC3CC,EAAWD,EAAY,SAAS,QAAQ,EACxCE,EAA0D,CAC9D,WAAY,OAAO,QAAQ,WAC3B,kBAAmB,GACnB,YAAaC,GAAY,EACzB,SAAU,UAAU,SACpB,aAAc,OAAO,QAAQ,OAC7B,YAAa,OAAO,QAAQ,MAC5B,sBAAuB,IAAI,KAAK,EAAE,kBAAkB,CACtD,EACMC,EAAMC,EAAQ,CAClB,GAAGC,GAAqB,EACxB,GAAGC,EAAYT,GAAU,GAAG,CAC9B,CAAC,EACKU,EAAyB,CAC7B,GAAGC,GAAgB,EACnB,GAAIV,IAAa,OAAY,CAAC,EAAI,CAAE,KAAMA,CAAS,EACnD,GAAIE,IAAa,OAAY,CAAC,EAAI,CAAE,SAAAA,CAAS,EAC7C,GAAGH,EACH,GAAI,OAAO,KAAKM,CAAG,EAAE,SAAW,EAAI,CAAC,EAAI,CAAE,IAAAA,CAAI,EAC/C,YAAa,CAAE,GAAGF,EAAa,GAAGJ,GAAU,WAAY,CAC1D,EACA,MAAO,CAAE,GAAGD,EAAO,OAAAW,CAAO,CAC5B,CAEA,SAASC,IAAyE,CAChF,IAAMC,EAAY,UAAU,UAC5B,MAAO,CACL,WAAY,4BAA4B,KAAKA,CAAS,EAAI,SAAW,UACrE,GAAI,cAAc,KAAKA,CAAS,EAC5B,UACA,WAAW,KAAKA,CAAS,EACvB,UACA,wBAAwB,KAAKA,CAAS,EACpC,QACA,SAAS,KAAKA,CAAS,EACrB,QACA,OACV,QAAS,SAAS,KAAKA,CAAS,EAC5B,OACA,aAAa,KAAKA,CAAS,EACzB,UACA,YAAY,KAAKA,CAAS,EACxB,SACA,YAAY,KAAKA,CAAS,EACxB,SACA,MACZ,CACF,CAEA,SAASJ,IAA2D,CAClE,IAAMK,EAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM,EACzD,OAAOJ,EAAY,CACjB,OAAQI,EAAO,IAAI,YAAY,GAAK,OACpC,SAAUA,EAAO,IAAI,cAAc,GAAK,OACxC,OAAQA,EAAO,IAAI,YAAY,GAAK,OACpC,QAASA,EAAO,IAAI,aAAa,GAAK,OACtC,KAAMA,EAAO,IAAI,UAAU,GAAK,MAClC,CAAC,CACH,CAEA,SAASJ,EAAYK,EAA8E,CACjG,OAAIA,IAAU,OAAkB,CAAC,EAC1BP,EAAQ,CACb,OAAQQ,EAAiBD,EAAM,MAAM,EACrC,SAAUC,EAAiBD,EAAM,QAAQ,EACzC,OAAQC,EAAiBD,EAAM,MAAM,EACrC,QAASC,EAAiBD,EAAM,OAAO,EACvC,KAAMC,EAAiBD,EAAM,IAAI,CACnC,CAAC,CACH,CAEA,SAASC,EAAiBD,EAAsD,CAC9E,GAAI,OAAOA,GAAU,SAAU,OAC/B,IAAME,EAAaF,EAAM,UAAU,MAAM,EAAE,KAAK,EAChD,GACE,EAAAE,IAAe,IACfA,EAAW,OAAS,KACpBC,GAAoBD,CAAU,GAC9BE,GAAsBF,CAAU,GAIlC,OAAOA,CACT,CAEA,SAASE,GAAsBJ,EAAwB,CACrD,MACE,wDAAwD,KAAKA,CAAK,GAClE,6CAA6C,KAAKA,CAAK,GACvD,6CAA6C,KAAKA,CAAK,CAE3D,CAEA,SAASG,GAAoBH,EAAwB,CACnD,OAAO,MAAM,KAAKA,CAAK,EAAE,KAAMK,GAAc,CAC3C,IAAMC,EAAOD,EAAU,YAAY,CAAC,EACpC,OAAOC,EAAO,IAAMA,IAAS,GAC/B,CAAC,CACH,CAEA,SAASlB,EAAYY,EAAmC,CACtD,GAAIA,IAAU,GACd,GAAI,CACF,IAAMO,EAAM,IAAI,IAAIP,CAAK,EACzB,MAAK,CAAC,QAAS,QAAQ,EAAE,SAASO,EAAI,QAAQ,GAC9CA,EAAI,OAAS,GACbA,EAAI,KAAO,GACJA,EAAI,SAAS,GAH6B,MAInD,MAAQ,CACN,MACF,CACF,CAEA,SAAShB,IAAuB,CAC9B,IAAMiB,EAAY,UAClB,GAAI,CACF,OAAOA,EAAU,cAAc,GAAK,EACtC,MAAQ,CACN,MAAO,EACT,CACF,CAEA,SAASf,EAAsDO,EAAa,CAC1E,QAAWS,KAAO,OAAO,KAAKT,CAAK,GAC7BA,EAAMS,CAAG,IAAM,QAAaT,EAAMS,CAAG,IAAM,KAAI,OAAOT,EAAMS,CAAG,EAErE,OAAOT,CACT,CCxHA,IAAIU,EAGG,SAASC,GAAyC,CACvD,OAAI,OAAO,OAAO,QAAW,WAAmB,QAAQ,QAAQ,OAAO,MAAM,GACzED,IAAiB,SACrBA,EAAe,IAAI,QAA2B,CAACE,EAASC,IAAW,CACjE,IAAMC,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,IAAM,4BACbA,EAAO,MAAQ,GACfA,EAAO,eAAiB,SACxBA,EAAO,OAAS,IAAM,CAChB,OAAO,OAAO,QAAW,WAAYF,EAAQ,OAAO,MAAM,EACzDC,EAAO,IAAI,MAAM,0CAA0C,CAAC,CACnE,EACAC,EAAO,QAAU,IAAMD,EAAO,IAAI,MAAM,gCAAgC,CAAC,EACzE,SAAS,KAAK,OAAOC,CAAM,CAC7B,CAAC,GACMJ,EACT,CClCA,IAAMK,GAAc,CAClB,QAAS,0BACT,KAAM,yBACR,EAEMC,GAAsB,GAGtBC,GAA4B,IAC5BC,GAA4C,KAqB3C,SAASC,EACdC,EACAC,EACgC,CAChC,GAAID,IAAe,QAAaA,EAAW,SAAW,EACpD,MAAO,CAAE,SAAU,IAAG,GAAc,QAAS,QAAQ,QAAQ,CAAE,EAGjE,IAAME,EAAmC,CAAC,EACpCC,EAAqBC,GAAkBJ,CAAU,EACjDK,EAAU,QAAQ,IACtBF,EAAmB,IAAI,MAAOG,GAAc,CAC1C,IAAMC,EAAU,MAAMC,GAAWF,EAAWL,CAAW,EAAE,MAAM,IAAG,EAAY,EAC1EM,IAAY,SAAWL,EAASI,EAAU,SAAS,EAAIC,EAC7D,CAAC,CACH,EAAE,KAAK,IAAG,EAAY,EAEtB,MAAO,CACL,SAAU,IAAME,GAAgBP,CAAQ,EACxC,QAAAG,CACF,CACF,CAQA,SAASD,GAAkBJ,EAAuD,CAChF,IAAMU,EAA4B,CAAC,EAC7BC,EAAW,IAAI,IAIrB,QAAWL,KAAaN,EAAW,MAAM,EAAGH,EAAyB,EACnE,GAAKe,GAAgBN,CAAS,GAC1B,CAAAK,EAAS,IAAIL,EAAU,SAAS,IACpCK,EAAS,IAAIL,EAAU,SAAS,EAChCI,EAAS,KAAKJ,CAAS,EACnBI,EAAS,SAAWd,IAAqB,MAE/C,OAAOc,CACT,CAEA,SAASD,GAAgBP,EAAsD,CAC7E,GAAI,OAAO,KAAKA,CAAQ,EAAE,SAAW,EAAG,OACxC,IAAMW,EAAUC,GAAW,CAAE,GAAGZ,CAAS,CAAC,EAG1C,OAAOW,EAAQ,QAAUf,GAA4Ce,EAAU,MACjF,CAEA,eAAeL,GACbF,EACAL,EAC6B,CAC7B,GAAIK,EAAU,WAAa,UAAYA,EAAU,YAAc,QAAS,CACtE,IAAMS,GAAU,MAAMC,EAAW,GAAGV,EAAU,SAAS,EACvD,GAAIS,IAAW,MAAQA,EAAO,qBAAuB,OAAW,OAChE,IAAME,EAAS,MAAMF,EAAO,mBAAmB,EAC/C,OAAOG,GAAeD,CAAM,CAC9B,CACA,IACGX,EAAU,WAAa,OAASA,EAAU,WAAa,aACxDA,EAAU,YAAc,QACxB,CACA,IAAMC,EAAUY,GAAU,EAAE,EAC5B,aAAMC,GAAUd,EAAU,UAAWC,EAASN,CAAW,EAClDM,CACT,CAEF,CAEA,SAASa,GACPC,EACAC,EACArB,EACe,CACf,OAAO,IAAI,QAAc,CAACsB,EAASC,IAAW,CAC5C,IAAMC,EAAS,SAAS,cAAc,QAAQ,EACxCC,EAAM,IAAI,IAAI,eAAgB/B,GAAYM,CAAW,CAAC,EAC5DyB,EAAI,aAAa,IAAI,IAAKL,CAAU,EACpCK,EAAI,aAAa,IAAI,IAAKJ,CAAS,EACnCG,EAAO,IAAMC,EAAI,SAAS,EAC1BD,EAAO,MAAQ,GACfA,EAAO,eAAiB,SACxBA,EAAO,OAAS,IAAMF,EAAQ,EAC9BE,EAAO,QAAU,IAAMD,EAAO,IAAI,MAAM,sCAAsC,CAAC,EAC/E,SAAS,KAAK,OAAOC,CAAM,CAC7B,CAAC,CACH,CAEA,SAASP,GAAeS,EAAoC,CAC1D,GAAI,OAAOA,GAAU,UAAY,6BAA6B,KAAKA,CAAK,EAAG,OAAOA,EAClF,GAAIC,EAASD,CAAK,EAAG,CACnB,IAAME,EAASF,EAAM,GACrB,GAAI,OAAOE,GAAW,UAAY,6BAA6B,KAAKA,CAAM,EAAG,OAAOA,EACpF,GAAID,EAASD,EAAM,YAAY,EAAG,CAChC,IAAMG,EAASH,EAAM,aAAa,GAClC,GAAI,OAAOG,GAAW,UAAY,6BAA6B,KAAKA,CAAM,EAAG,OAAOA,CACtF,CACF,CAEF,CAEA,SAASlB,GAAgBe,EAA+B,CACtD,OACE,OAAOA,EAAM,WAAc,UAC3BA,EAAM,UAAU,SAAW,GAC3BA,EAAM,UAAU,OAAS,IAElB,GACLA,EAAM,WAAa,UAAYA,EAAM,YAAc,QAC9C,uCAAuC,KAAKA,EAAM,SAAS,GAEjEA,EAAM,WAAa,OAASA,EAAM,WAAa,aAChDA,EAAM,YAAc,SAIpB,sDAAsD,KAAKA,EAAM,SAAS,CAE9E,CAEA,SAASR,GAAUY,EAAwB,CACzC,IAAMC,EAAQ,IAAI,WAAWD,EAAS,CAAC,EACvC,cAAO,gBAAgBC,CAAK,EACrB,MAAM,KAAKA,EAAQC,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAChF,CAEA,SAASnB,GAAWa,EAAuC,CACzD,IAAMK,EAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUL,CAAK,CAAC,EACxDO,EAAS,GACb,QAAWD,KAAQD,EAAOE,GAAU,OAAO,aAAaD,CAAI,EAC5D,OAAO,KAAKC,CAAM,CACpB,CAEA,SAASN,EAASD,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CCjKA,eAAsBQ,EAAsBC,EAA4C,CACtF,IAAMC,GAAU,MAAMC,EAAW,GAAGF,EAAO,cAAc,EACzD,GAAIC,IAAW,KAAM,MAAM,IAAI,MAAM,iCAAiC,EAEtE,IADe,MAAMA,EAAO,iBAAiB,CAAE,aAAcD,EAAO,YAAa,CAAC,GACvE,QAAU,OAAW,MAAM,IAAI,MAAM,+BAA+B,CACjF,CCsCO,SAASG,EAAqBC,EAA6C,CAChF,GAAI,CAACC,GAAQD,CAAK,EAAG,MAAO,GAC5B,OAAQA,EAAM,KAAM,CAClB,IAAK,QACL,IAAK,UACL,IAAK,iBACH,OAAOE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,MAAM,CAAC,EACpE,IAAK,gBACH,OAAOE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,MAAM,CAAC,EACpE,IAAK,aACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEG,GAAsBH,EAAM,MAAM,EAEtC,IAAK,SACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEI,GAASJ,EAAM,MAAM,EAEzB,IAAK,UACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEK,GAAcL,EAAM,MAAM,EAE9B,IAAK,aACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,OAAO,CAAC,GACpEM,GAAYN,EAAM,KAAK,EAE3B,IAAK,UACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,YAAa,SAAS,CAAC,GACnFO,EAAKP,EAAM,SAAS,GACpBQ,GAAUR,EAAM,OAAO,EAE3B,IAAK,QACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,YAAa,OAAO,CAAC,IAChFA,EAAM,YAAc,QAAaO,EAAKP,EAAM,SAAS,IACtDS,GAAQT,EAAM,KAAK,EAEvB,QACE,MAAO,EACX,CACF,CAmDA,SAASU,GAAQC,EAAyD,CACxE,OACEC,EAASD,CAAK,GACdA,EAAM,UAAY,uBAClBA,EAAM,UAAY,GAClBE,EAAKF,EAAM,UAAU,GACrB,OAAOA,EAAM,MAAS,QAE1B,CAEA,SAASG,EAAQH,EAAgCI,EAAkC,CACjF,OAAO,OAAO,KAAKJ,CAAK,EAAE,MAAOK,GAAQD,EAAK,SAASC,CAAG,CAAC,CAC7D,CAEA,SAASH,EAAKF,EAAiC,CAC7C,OAAO,OAAOA,GAAU,UAAY,yBAAyB,KAAKA,CAAK,CACzE,CAeA,SAASM,GAAsBC,EAA8C,CAC3E,OACEC,EAASD,CAAK,GACdE,EAAQF,EAAO,CAAC,WAAY,eAAgB,gBAAgB,CAAC,GAC7DG,GAAiBH,EAAM,QAAQ,GAC/B,OAAOA,EAAM,cAAiB,UAC9B,uDAAuD,KAAKA,EAAM,YAAY,GAC9E,OAAOA,EAAM,gBAAmB,UAChC,wCAAwC,KAAKA,EAAM,cAAc,CAErE,CAEA,SAASG,GAAiBH,EAAiC,CACzD,OAAO,OAAOA,GAAU,UAAY,2BAA2B,KAAKA,CAAK,CAC3E,CAMA,SAASI,GAASC,EAA4C,CAC5D,OACE,OAAOA,GAAU,UACjB,CACE,WACA,QACA,aACA,aACA,qBACA,aACA,aACA,WACA,WACA,SACA,UACA,UACA,0BACA,WACF,EAAE,SAASA,CAAK,CAEpB,CAEA,SAASC,GAAcD,EAAiC,CACtD,OAAO,OAAOA,GAAU,UAAY,OAAO,UAAUA,CAAK,GAAKA,GAAS,IAAMA,GAAS,IACzF,CAEA,SAASE,GAAYF,EAAoC,CACvD,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CAAC,WAAY,OAAO,CAAC,GACpC,OAAOA,EAAM,UAAa,WAC1B,OAAOA,EAAM,OAAU,SAE3B,CAEA,SAASK,GAAUL,EAAqC,CACtD,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CAAC,YAAa,QAAQ,CAAC,GACtC,OAAOA,EAAM,WAAc,UAC3B,6BAA6B,KAAKA,EAAM,SAAS,IAChDA,EAAM,SAAW,cAAgBA,EAAM,SAAW,WAEvD,CAEA,SAASM,GAAQN,EAA2C,CAC1D,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CACb,OACA,UACA,YACA,YACA,YACA,aACA,oBACA,aACA,SACF,CAAC,GACD,OAAOA,EAAM,MAAS,UACtB,yBAAyB,KAAKA,EAAM,IAAI,GACxC,OAAOA,EAAM,SAAY,UACzBA,EAAM,QAAQ,QAAU,MACvBA,EAAM,YAAc,QAAaO,EAAKP,EAAM,SAAS,KACrDA,EAAM,YAAc,QAClB,OAAOA,EAAM,WAAc,UAC1B,6BAA6B,KAAKA,EAAM,SAAS,KACpDA,EAAM,YAAc,QAAa,OAAOA,EAAM,WAAc,aAC5DA,EAAM,aAAe,QACnB,OAAOA,EAAM,YAAe,UAC3B,OAAO,UAAUA,EAAM,UAAU,GACjCA,EAAM,YAAc,KACpBA,EAAM,YAAc,OACvBA,EAAM,oBAAsB,QAC1B,OAAOA,EAAM,mBAAsB,UAClCA,EAAM,kBAAkB,OAAS,GACjCA,EAAM,kBAAkB,QAAU,OACrCA,EAAM,aAAe,QACpBA,EAAM,aAAe,kBACrBA,EAAM,aAAe,gBACtBA,EAAM,UAAY,QAAaQ,GAAeR,EAAM,OAAO,EAEhE,CAEA,SAASQ,GAAeR,EAAyB,CAC/C,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CAAC,KAAM,cAAe,WAAY,aAAa,CAAC,GAC/D,OAAOA,EAAM,IAAO,UACpB,6BAA6B,KAAKA,EAAM,EAAE,IACzCA,EAAM,cAAgB,WAAaA,EAAM,cAAgB,SAC1D,OAAOA,EAAM,UAAa,UAC1B,aAAa,KAAKA,EAAM,QAAQ,GAChCS,GAAmBT,EAAM,WAAW,CAExC,CAEA,SAASS,GAAmBT,EAAyB,CACnD,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CACb,KACA,SACA,SACA,WACA,WACA,oBACA,UACF,CAAC,GACD,OAAOA,EAAM,IAAO,UACpB,6BAA6B,KAAKA,EAAM,EAAE,GAC1CU,GAAgBV,EAAM,MAAM,GAC5B,OAAO,cAAcA,EAAM,MAAM,GACjC,OAAOA,EAAM,UAAa,UAC1B,aAAa,KAAKA,EAAM,QAAQ,GAChCW,EAAaX,EAAM,QAAQ,GAC3BW,EAAaX,EAAM,iBAAiB,IACnCA,EAAM,WAAa,QACjB,MAAM,QAAQA,EAAM,QAAQ,GAC3BA,EAAM,SAAS,QAAU,IACzBA,EAAM,SAAS,MAAMY,EAAc,EAE3C,CAEA,SAASA,GAAeZ,EAAyB,CAC/C,OACEG,EAASH,CAAK,GACdI,EAAQJ,EAAO,CACb,UACA,WACA,SACA,WACA,gBACA,eACA,iBACA,oBACA,UACA,YACA,OACF,CAAC,GACDa,EAAgBb,EAAM,OAAO,GAC7BW,EAAaX,EAAM,QAAQ,GAC3BW,EAAaX,EAAM,MAAM,GACzBW,EAAaX,EAAM,QAAQ,GAC3BW,EAAaX,EAAM,aAAa,GAChCW,EAAaX,EAAM,YAAY,GAC/BW,EAAaX,EAAM,cAAc,GACjCW,EAAaX,EAAM,iBAAiB,GACpCW,EAAaX,EAAM,OAAO,GAC1Ba,EAAgBb,EAAM,SAAS,GAC/Ba,EAAgBb,EAAM,KAAK,CAE/B,CAEA,SAASU,GAAgBV,EAAyB,CAChD,OACE,OAAOA,GAAU,UACjB,CACE,aACA,aACA,WACA,WACA,SACA,UACA,UACA,yBACF,EAAE,SAASA,CAAK,CAEpB,CAEA,SAASW,EAAaX,EAAyB,CAC7C,OACEA,IAAU,QAAc,OAAOA,GAAU,UAAYA,EAAM,OAAS,GAAKA,EAAM,QAAU,GAE7F,CAEA,SAASa,EAAgBb,EAAyB,CAChD,OACEA,IAAU,QAAc,OAAOA,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAAS,CAEjG,CAgGA,SAASc,EAASC,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CC3cA,IAAMC,EAAwB,kCACxBC,GAAoB,IACpBC,GAAqB,GAIrBC,GAAwB,KAEjBC,EAAoB,CAC/B,MAAMC,EAAgE,CACpE,IAAMC,EAASC,GAAcF,EAAQ,MAAM,EAC3C,GAAI,CAACG,GAAeH,EAAQ,YAAY,EACtC,OAAO,QAAQ,OACbI,EAAU,0BAA2B,4CAAmC,CAC1E,EAEF,GAAIJ,EAAQ,QAAQ,QAClB,OAAO,QAAQ,OAAOI,EAAU,gBAAiB,2BAA2B,CAAC,EAM/E,IAAMC,EAAwBC,EAC5BN,EAAQ,eACRA,EAAQ,aAAa,WAAW,UAAU,EAAI,UAAY,MAC5D,EAEMO,EAAa,OAAO,WAAW,EAC/BC,EAAcC,GAAmB,EACjCC,EAAO,SAAS,cAAc,KAAK,EACzCA,EAAK,QAAQ,kBAAoB,GACjC,IAAMC,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,MAAQ,0BACfA,EAAO,IAAM,GAAGH,CAAW,mBAAmB,mBAAmBD,CAAU,CAAC,GAC5EI,EAAO,aAAa,QAAS,WAAW,EACxCA,EAAO,aAAa,iBAAkB,aAAa,EACnD,IAAIC,EAAgB,IACpBC,EAAeF,EAAQC,CAAa,EACpCF,EAAK,MAAM,QAAU,sEACrBA,EAAK,OAAOC,CAAM,EAClBV,EAAO,OAAOS,CAAI,EAElB,IAAII,EAAY,GACZC,EAAU,GACVC,EACAC,EACAC,EACAC,EAA8B,KAC9BC,EAAkC,KAClCC,EACAC,EAA0B,CAAE,OAAQ,WAAY,MAAO,GAAO,aAAc,EAAM,EAClFC,EACAC,EAQAC,EAAoD,IAAG,GAErDC,EAAW,CAAIC,EAAsCC,IAAmB,CAC5E,GAAI,CACFD,IAAKC,CAAK,CACZ,MAAQ,CAER,CACF,EACMC,EAAQC,GAAsC,CAClDnB,EAAO,eAAe,YAAYmB,EAAStB,CAAW,CACxD,EACMuB,EAAgB,IAAY,CAC5Bd,IAAY,SAChBA,EAAQ,OAAO,EACfA,EAAU,OACNE,IAAiB,KAAM,SAAS,KAAK,MAAM,eAAe,UAAU,EACnE,SAAS,KAAK,aAAa,QAASA,CAAY,EACjDC,IAAqB,KAAM,SAAS,gBAAgB,MAAM,eAAe,UAAU,EAClF,SAAS,gBAAgB,aAAa,QAASA,CAAgB,EACpED,EAAe,KACfC,EAAmB,KACnBF,EAAqB,OACrBL,EAAeF,EAAQC,CAAa,EACpCD,EAAO,gBAAgB,MAAM,EAC7BA,EAAO,gBAAgB,YAAY,EACnCA,EAAO,gBAAgB,YAAY,EACrC,EACMqB,EAAc,IAAY,CAC9B,GAAIhC,EAAQ,SAAS,eAAiB,SAAWiB,IAAY,OAAW,OACxEA,EAAU,SAAS,cAAc,KAAK,EACtCA,EAAQ,QAAQ,0BAA4B,GAK5CA,EAAQ,aAAa,cAAe,MAAM,EAC1CN,EAAO,aAAa,WAAY,IAAI,EACpCA,EAAO,aAAa,OAAQ,QAAQ,EACpCA,EAAO,aAAa,aAAc,MAAM,EACxCA,EAAO,aAAa,aAAc,oCAA8B,EAChEM,EAAQ,MAAM,QAAU,CACtB,iBACA,UAIA,qBACA,eACA,qBACA,yBACA,YACA,cAAcjB,EAAQ,YAAY,SAAS,eAAiB,qBAAqB,EACnF,EAAE,KAAK,GAAG,EACV,IAAMiC,EAAc,IAAY,CAC9BtB,EAAO,MAAM,QAAU,CACrB,iBACA,WACA,UACA,qBACA,gBACA,aAAaf,EAAiB,0BAC9B,cAAcgB,CAAa,2BAC3B,WACA,iBAAiBf,EAAkB,KACnC,kBACA,kBACA,kBACA,iCACF,EAAE,KAAK,GAAG,CACZ,EACAqB,EAAqBe,EACrBd,EAAe,SAAS,KAAK,aAAa,OAAO,EACjDC,EAAmB,SAAS,gBAAgB,aAAa,OAAO,EAChE,SAAS,KAAK,MAAM,YAAY,WAAY,SAAU,WAAW,EACjE,SAAS,gBAAgB,MAAM,YAAY,WAAY,SAAU,WAAW,EAC5Ea,EAAY,EACZ,SAAS,KAAK,OAAOhB,CAAO,EAC5B,OAAO,sBAAsB,IAAMN,EAAO,MAAM,CAAE,cAAe,EAAK,CAAC,CAAC,CAC1E,EACMuB,EAAgBC,GAAoC,CACpDrB,IACJQ,EAAQ,CACN,GAAGA,EACH,OAAAa,EACA,MAAOpB,EACP,aAAc,CAAC,aAAc,aAAc,qBAAsB,YAAY,EAAE,SAC7EoB,CACF,CACF,EACAT,EAAS1B,EAAQ,eAAgBmC,CAAM,EACzC,EACMC,EAAc,CAACC,EAAyBC,IAA6B,CACzE,GAAI,EAAAA,IAAc,QAAad,IAAW,QAAaA,EAAO,YAAcc,GAoB5E,IAnBAP,EAAc,GAMZM,EAAM,OAAS,0BACfA,EAAM,OAAS,+BACdC,IAAc,QAAaD,EAAM,YAAc,MAEhDd,EAAec,GAEjBf,EAAQ,CACN,GAAGA,EACH,GAAIC,IAAiB,OAAY,CAAE,OAAQ,SAAmB,EAAI,CAAC,EACnE,MAAAc,EACA,aAAc,EAChB,EACAX,EAAS1B,EAAQ,QAASqC,CAAK,EAC3B,CAACtB,GAAWM,IAAgB,OAAW,CACrCL,IAAU,QAAW,OAAO,aAAaA,CAAK,EAClD,IAAMuB,EAASlB,EACfA,EAAc,OACdmB,EAAQ,EACRD,EAAOF,CAAK,EACZ,MACF,CACIb,IAAW,SACbA,EAAO,OAAOa,CAAK,EACnBb,EAAS,QAEb,EACMgB,EAAU,IAAY,CAC1B,GAAI,CAAA1B,IACJA,EAAY,GACRE,IAAU,QAAW,OAAO,aAAaA,CAAK,EAClD,OAAO,oBAAoB,UAAWS,CAAS,EAC/CzB,EAAQ,QAAQ,oBAAoB,QAASwC,CAAO,EACpDT,EAAc,EACdF,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,UACN,WAAAtB,CACF,CAAC,EACDI,EAAO,OAAO,EACdD,EAAK,OAAO,EACZc,GAAQ,OAAOpB,EAAU,oBAAqB,8CAA2C,CAAC,EAC1FoB,EAAS,OACTF,EAAQ,CAAE,GAAGA,EAAO,OAAQ,YAAa,MAAO,GAAO,aAAc,EAAM,EACvE,CAACP,GAAWM,IAAgB,QAAW,CACzC,IAAMkB,EAASlB,EACfA,EAAc,OACdkB,EAAOnC,EAAU,gBAAiB,2BAA2B,CAAC,CAChE,CACF,EACMqC,GAAgC,CACpC,IAAIC,EAAsC,CACxC,GAAI5B,EACF,OAAO,QAAQ,OACbV,EAAU,gBAAiB,8CAA2C,CACxE,EACF,GAAI,CAACW,EACH,OAAO,QAAQ,OACbX,EAAU,iBAAkB,2DAAkD,CAChF,EACF,GAAImB,IAAiB,OAAW,OAAO,QAAQ,OAAOA,CAAY,EAClE,GAAIC,IAAW,OAAW,OAAOA,EAAO,QACxC,IAAMc,EAAY,OAAO,WAAW,EAChCK,EACAJ,EACEK,EAAU,IAAI,QAAoB,CAACC,GAAaC,KAAe,CACnEH,EAAUE,GACVN,EAASO,EACX,CAAC,EACDtB,EAAS,CAAE,UAAAc,EAAW,QAAAM,EAAS,QAAAD,EAAS,OAAAJ,CAAO,EAC/C,IAAMQ,GAAgBC,EAA0BN,CAAK,EAC/CO,EAAW5C,EAAsB,SAAS,EAChD,OAAAwB,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,MACN,WAAAtB,EACA,UAAA+B,EACA,MAAOS,GACP,GAAIE,IAAa,OAAY,CAAC,EAAI,CAAE,sBAAuBA,CAAS,CACtE,CAAC,EACML,CACT,EACA,SAAU,IAAMtB,EAChB,QAAAkB,CACF,EACMU,GAAe,IAAI,QAA6B,CAACP,EAASJ,IAAW,CACzElB,EAAckB,EACdvB,EAAQ,OAAO,WAAW,IAAM,CAC9B,GAAID,GAAWD,EAAW,OAC1B,IAAMuB,EAAQjC,EACZ,oBACA,+DACF,EACAiB,EAAc,OACdmB,EAAQ,EACRD,EAAOF,CAAK,CACd,EAAGvC,EAAqB,EACxB2B,EAAa0B,GAAuC,CAGlD,GAFIrC,GAAaqC,EAAM,SAAW3C,GAAe2C,EAAM,SAAWxC,EAAO,eAErE,CAACyC,EAAqBD,EAAM,IAAI,GAAKA,EAAM,KAAK,aAAe5C,EAAY,OAC/E,IAAMuB,EAA8BqB,EAAM,KAC1C,GAAIrB,EAAQ,OAAS,QAAS,CAC5BD,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,OACN,WAAAtB,EACA,aAAcP,EAAQ,aACtB,aAAcA,EAAQ,SAAS,cAAgB,QAC/C,GAAIA,EAAQ,aAAe,OAAY,CAAC,EAAI,CAAE,WAAYA,EAAQ,UAAW,CAC/E,CAAC,EACD,MACF,CACA,GAAI8B,EAAQ,OAAS,UAAW,CAC9B,GAAIf,EAAS,OACbA,EAAU,GACNC,IAAU,QAAW,OAAO,aAAaA,CAAK,EAClDK,EAAc,OACdC,EAAQ,CAAE,GAAGA,EAAO,OAAQ,QAAS,MAAO,EAAK,EACjDI,EAAS1B,EAAQ,QAAS,MAAS,EACnC0B,EAAS1B,EAAQ,eAAgB,OAAO,EACxC2C,EAAQF,EAAQ,EAChB,MACF,CACA,GAAIX,EAAQ,OAAS,SAAU,OAAOI,EAAaJ,EAAQ,MAAM,EACjE,GAAIA,EAAQ,OAAS,aACnB,OAAOJ,EAAS1B,EAAQ,kBAAmB8B,EAAQ,KAAK,EAC1D,GAAIA,EAAQ,OAAS,UAAW,CAC9BlB,EAAgBkB,EAAQ,OACpBb,IAAY,OAAWJ,EAAeF,EAAQC,CAAa,EAC1DM,IAAqB,EAC1B,MACF,CACA,GAAIY,EAAQ,OAAS,aAAc,CAI5BuB,EAAsBvB,EAAQ,MAAM,EAAE,KACzC,IAAM,CACJD,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,oBACN,WAAAtB,EACA,SAAUuB,EAAQ,OAAO,SACzB,OAAQ,WACV,CAAC,CACH,EACA,IAAM,CACJD,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,oBACN,WAAAtB,EACA,SAAUuB,EAAQ,OAAO,SACzB,OAAQ,QACV,CAAC,CACH,CACF,EACA,MACF,CACA,GAAIA,EAAQ,OAAS,gBAAiB,CAIpCE,EAAY,EACZ,OAAO,sBAAsB,IAAM,CACjC,OAAO,sBAAsB,IAAM,CACjCH,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,qBACN,WAAAtB,CACF,CAAC,CACH,CAAC,CACH,CAAC,EACD,MACF,CACA,GAAIuB,EAAQ,OAAS,iBAAkB,OAAOC,EAAc,EAC5D,GACED,EAAQ,OAAS,YAChBN,IAAW,QAAaA,EAAO,YAAcM,EAAQ,WACtD,CACAC,EAAc,EACdR,EAAe,OACfD,EAAQ,CACN,OAAQQ,EAAQ,QAAQ,OACxB,MAAO,GACP,aAAc,GACd,QAASA,EAAQ,OACnB,EACAJ,EAAS1B,EAAQ,eAAgB8B,EAAQ,QAAQ,MAAM,EACvDJ,EAAS1B,EAAQ,UAAW8B,EAAQ,OAAO,EAC3CN,GAAQ,QAAQM,EAAQ,OAAO,EAC/BN,EAAS,OACT,MACF,CACIM,EAAQ,OAAS,SAASM,EAAYN,EAAQ,MAAOA,EAAQ,SAAS,CAC5E,EACA,OAAO,iBAAiB,UAAWL,CAAS,CAC9C,CAAC,EACD,OAAAzB,EAAQ,QAAQ,iBAAiB,QAASwC,EAAS,CAAE,KAAM,EAAK,CAAC,EAC1DU,EACT,CACF,EAEA,SAAShD,GAAcD,EAA2C,CAChE,IAAMqD,EAAU,OAAOrD,GAAW,SAAW,SAAS,cAA2BA,CAAM,EAAIA,EAC3F,GAAIqD,IAAY,MAAQ,EAAEA,aAAmB,aAC3C,MAAMlD,EAAU,oBAAqB,oDAAiD,EACxF,OAAOkD,CACT,CAEA,SAASnD,GAAeyB,EAAwB,CAC9C,MAAO,yCAAyC,KAAKA,CAAK,CAC5D,CAEA,SAASnB,IAA6B,CACpC,IAAM8C,EAAiB,CAAC,YAAa,YAAa,OAAO,EAAE,SAAS,OAAO,SAAS,QAAQ,EACtFC,EACJ,WACA,kCACF,GAAI,CAACD,GAAkBC,IAAe,OAAW,OAAO7D,EAExD,GAAI,CACF,IAAM8D,EAAM,IAAI,IAAID,CAAU,EAC9B,MACE,CAAC,CAAC,QAAS,QAAQ,EAAE,SAASC,EAAI,QAAQ,GAC1CA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,MACJA,EAAI,UACJA,EAAI,SAEG9D,EAEF8D,EAAI,MACb,MAAQ,CACN,OAAO9D,CACT,CACF,CAEA,SAASkB,EAAeF,EAA2B+C,EAAsB,CACvE/C,EAAO,MAAM,QAAU,mCAAmC+C,CAAM,iBAAiBA,CAAM,sCACvF/C,EAAO,gBAAgB,UAAU,CACnC,CCraA,WAAW,kBAAoBgD",
-  "names": ["formError", "code", "message", "requestId", "enrichPayInputFromBrowser", "input", "declared", "location", "sanitizeUrl", "referrer", "browserInfo", "javaEnabled", "utm", "compact", "campaignFromLocation", "sanitizeUtm", "client", "browserIdentity", "userAgent", "params", "value", "sanitizeUtmValue", "normalized", "hasControlCharacter", "looksLikeSensitiveUtm", "character", "code", "url", "candidate", "key", "stripeScript", "loadStripe", "resolve", "reject", "script", "KOUNT_HOSTS", "MAX_RISK_COLLECTORS", "MAX_RISK_COLLECTOR_INPUTS", "MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH", "startRiskCollectorSessionCollection", "collectors", "environment", "sessions", "acceptedCollectors", "boundedCollectors", "settled", "collector", "session", "collectOne", "boundedSnapshot", "accepted", "seenKeys", "isRiskCollector", "encoded", "base64Json", "stripe", "loadStripe", "result", "radarSessionId", "randomHex", "loadKount", "merchantId", "sessionId", "resolve", "reject", "script", "url", "value", "isRecord", "direct", "nested", "length", "bytes", "byte", "binary", "completeStripeThreeDS", "action", "stripe", "loadStripe", "isFrameToHostMessage", "value", "hasBase", "hasOnly", "isStripeThreeDSAction", "isStatus", "isFrameHeight", "isCardState", "isId", "isOutcome", "isError", "hasBase", "value", "isRecord", "isId", "hasOnly", "keys", "key", "isStripeThreeDSAction", "value", "isRecord", "hasOnly", "isStripeActionId", "isStatus", "value", "isFrameHeight", "isCardState", "isRecord", "hasOnly", "isOutcome", "isError", "isId", "isErrorPayment", "isErrorTransaction", "isPaymentStatus", "optionalText", "isErrorAttempt", "optionalInteger", "isRecord", "value", "productionFrameOrigin", "threeDSModalWidth", "threeDSModalRadius", "FORM_MOUNT_TIMEOUT_MS", "BemonyPaymentForm", "options", "target", "resolveTarget", "isClientSecret", "formError", "riskCollectorSessions", "startRiskCollectorSessionCollection", "instanceId", "frameOrigin", "resolveFrameOrigin", "slot", "iframe", "contentHeight", "setInlineStyle", "destroyed", "mounted", "timer", "overlay", "applyOverlayLayout", "bodyOverflow", "documentOverflow", "rejectMount", "state", "blockedError", "active", "onMessage", "callback", "fn", "value", "post", "message", "restoreInline", "showOverlay", "applyLayout", "reportStatus", "status", "reportError", "error", "requestId", "reject", "destroy", "instance", "input", "resolve", "promise", "nextResolve", "nextReject", "enrichedInput", "enrichPayInputFromBrowser", "sessions", "mountPromise", "event", "isFrameToHostMessage", "completeStripeThreeDS", "element", "isLoopbackHost", "configured", "url", "height", "BemonyPaymentForm"]
+  "sourcesContent": ["import type { PaymentFormError, PaymentFormErrorCategory, PaymentFormErrorStage } from './types';\n\ntype ErrorDetails = Omit<PaymentFormError, 'code' | 'message' | 'requestId'>;\n\nexport function formError(\n  code: string,\n  message: string,\n  requestId?: string,\n  details: ErrorDetails = {}\n): PaymentFormError {\n  return {\n    code,\n    message,\n    ...classifyPaymentFormError(code),\n    ...details,\n    ...(requestId === undefined ? {} : { requestId })\n  };\n}\n\n/** Adds stable category/stage metadata without changing an existing public code. */\nexport function normalizePaymentFormError(error: PaymentFormError): PaymentFormError {\n  const { category, stage, ...base } = error;\n  return {\n    ...base,\n    ...classifyPaymentFormError(error.code),\n    ...(category === undefined ? {} : { category }),\n    ...(stage === undefined ? {} : { stage })\n  };\n}\n\nexport function classifyPaymentFormError(\n  code: string\n): Readonly<{ category: PaymentFormErrorCategory; stage: PaymentFormErrorStage }> {\n  switch (code) {\n    case 'PAY_INPUT_INVALID':\n    case 'CARD_FIELDS_INCOMPLETE':\n      return { category: 'VALIDATION', stage: 'CARD_TOKENIZATION' };\n    case 'PAYMENT_SESSION_INVALID':\n    case 'CHECKOUT_SESSION_INVALID':\n    case 'CHECKOUT_SESSION_EXPIRED':\n    case 'ORIGIN_NOT_ALLOWED':\n      return { category: 'CONFIGURATION', stage: 'CARD_FRAME_DOCUMENT' };\n    case 'FORM_NOT_READY':\n    case 'FORM_DESTROYED':\n    case 'FORM_MOUNT_CANCELLED':\n    case 'INVALID_STATE':\n      return { category: 'LIFECYCLE', stage: 'FORM_SDK' };\n    case 'FRAME_UNAVAILABLE':\n    case 'MOUNT_FAILED':\n    case 'FRAME_NETWORK_TIMEOUT':\n    case 'FRAME_DOCUMENT_NOT_FOUND':\n    case 'FRAME_RATE_LIMITED':\n    case 'FRAME_POLICY_BLOCKED':\n      return {\n        category: 'FRAME',\n        stage: code === 'MOUNT_FAILED' ? 'FORM_SDK' : 'CARD_FRAME_HANDSHAKE'\n      };\n    case 'TOKENIZATION_UNAVAILABLE':\n    case 'TOKENIZATION_FAILED':\n      return { category: 'TOKENIZATION', stage: 'CARD_TOKENIZATION' };\n    case 'THREE_DS_FAILED':\n    case 'STRIPE_3DS_FAILED':\n      return { category: 'THREE_DS', stage: 'THREE_DS' };\n    case 'PAYMENT_DECLINED':\n    case 'PAYMENT_FAILED':\n    case 'PAYMENT_STATUS_UNKNOWN':\n    case 'PAYMENT_ALREADY_IN_PROGRESS':\n      return {\n        category: 'PAYMENT',\n        stage:\n          code === 'PAYMENT_STATUS_UNKNOWN' || code === 'PAYMENT_ALREADY_IN_PROGRESS'\n            ? 'PAYMENT_RECONCILIATION'\n            : 'PAYMENT_SUBMISSION'\n      };\n    case 'ORCHESTRATOR_UNAVAILABLE':\n    case 'ORCHESTRATOR_ERROR':\n    case 'INVALID_UPSTREAM_RESPONSE':\n    case 'PAYMENT_FORM_SERVER_ERROR':\n      return { category: 'RUNTIME', stage: 'RUNTIME' };\n    default:\n      return { category: 'UNKNOWN', stage: 'RUNTIME' };\n  }\n}\n\nexport function safeError(error: unknown, fallback: string): PaymentFormError {\n  if (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    typeof error.code === 'string'\n  ) {\n    const code = /^[A-Z][A-Z0-9_]{1,63}$/.test(error.code) ? error.code : fallback;\n    return formError(code, messageFor(code));\n  }\n  return formError(fallback, messageFor(fallback));\n}\n\nexport function messageFor(code: string): string {\n  switch (code) {\n    case 'PAY_INPUT_INVALID':\n      return 'Confira os dados do pagador.';\n    case 'PAYMENT_STATUS_UNKNOWN':\n      return 'Ainda estamos confirmando o pagamento.';\n    case 'SESSION_RECOVERY_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel consultar a sess\u00E3o de pagamento. Tente novamente mais tarde.';\n    case 'PAYMENT_ALREADY_IN_PROGRESS':\n      return 'O pagamento j\u00E1 est\u00E1 em andamento.';\n    case 'CHECKOUT_SESSION_EXPIRED':\n      return 'A sess\u00E3o de pagamento expirou.';\n    case 'TOKENIZATION_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel tokenizar o cart\u00E3o.';\n    case 'THREE_DS_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel concluir a autentica\u00E7\u00E3o do banco.';\n    default:\n      return 'N\u00E3o foi poss\u00EDvel concluir esta etapa do pagamento.';\n  }\n}\n", "import type { CheckoutClient, PayInput } from './contracts/types';\n\n/**\n * Adds non-sensitive browser context at the merchant document, where the\n * hosted iframe cannot read the parent location or its campaign parameters.\n * Explicit merchant values win; no fingerprint is generated here.\n */\nexport function enrichPayInputFromBrowser(input: PayInput): PayInput {\n  const declared = input.client;\n  // Browser-provided values are useful context, not required payment input.\n  // Sanitize both the automatic and merchant-declared variants: spreading a\n  // declared client object must never reintroduce a URL with query parameters\n  // or a non-http(s) scheme.\n  const location = sanitizeUrl(declared?.page) ?? sanitizeUrl(window.location.href);\n  const referrer = sanitizeUrl(declared?.referrer) ?? sanitizeUrl(document.referrer);\n  const browserInfo: NonNullable<CheckoutClient['browserInfo']> = {\n    colorDepth: window.screen?.colorDepth,\n    javascriptEnabled: true,\n    javaEnabled: javaEnabled(),\n    language: navigator.language,\n    screenHeight: window.screen?.height,\n    screenWidth: window.screen?.width,\n    timezoneOffsetMinutes: new Date().getTimezoneOffset()\n  };\n  const utm = compact({\n    ...campaignFromLocation(),\n    ...sanitizeUtm(declared?.utm)\n  });\n  const client: CheckoutClient = {\n    ...browserIdentity(),\n    ...declared,\n    ...(location === undefined ? {} : { page: location }),\n    ...(referrer === undefined ? {} : { referrer }),\n    ...(Object.keys(utm).length === 0 ? {} : { utm }),\n    browserInfo: { ...browserInfo, ...declared?.browserInfo }\n  };\n  return { ...input, client };\n}\n\nfunction browserIdentity(): Pick<CheckoutClient, 'deviceType' | 'os' | 'browser'> {\n  const userAgent = navigator.userAgent;\n  return {\n    deviceType: /Mobi|Android|iPhone|iPad/i.test(userAgent) ? 'mobile' : 'desktop',\n    os: /Windows NT/i.test(userAgent)\n      ? 'Windows'\n      : /Android/i.test(userAgent)\n        ? 'Android'\n        : /iPhone|iPad|Mac OS X/i.test(userAgent)\n          ? 'Apple'\n          : /Linux/i.test(userAgent)\n            ? 'Linux'\n            : undefined,\n    browser: /Edg\\//i.test(userAgent)\n      ? 'Edge'\n      : /Firefox\\//i.test(userAgent)\n        ? 'Firefox'\n        : /Chrome\\//i.test(userAgent)\n          ? 'Chrome'\n          : /Safari\\//i.test(userAgent)\n            ? 'Safari'\n            : undefined\n  };\n}\n\nfunction campaignFromLocation(): NonNullable<CheckoutClient['utm']> {\n  const params = new URLSearchParams(window.location.search);\n  return sanitizeUtm({\n    source: params.get('utm_source') ?? undefined,\n    campaign: params.get('utm_campaign') ?? undefined,\n    medium: params.get('utm_medium') ?? undefined,\n    content: params.get('utm_content') ?? undefined,\n    term: params.get('utm_term') ?? undefined\n  });\n}\n\nfunction sanitizeUtm(value: CheckoutClient['utm'] | undefined): NonNullable<CheckoutClient['utm']> {\n  if (value === undefined) return {};\n  return compact({\n    source: sanitizeUtmValue(value.source),\n    campaign: sanitizeUtmValue(value.campaign),\n    medium: sanitizeUtmValue(value.medium),\n    content: sanitizeUtmValue(value.content),\n    term: sanitizeUtmValue(value.term)\n  });\n}\n\nfunction sanitizeUtmValue(value: string | null | undefined): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.normalize('NFKC').trim();\n  if (\n    normalized === '' ||\n    normalized.length > 120 ||\n    hasControlCharacter(normalized) ||\n    looksLikeSensitiveUtm(normalized)\n  ) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction looksLikeSensitiveUtm(value: string): boolean {\n  return (\n    /(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(value) ||\n    /(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(value) ||\n    /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i.test(value)\n  );\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0)!;\n    return code < 32 || code === 127;\n  });\n}\n\nfunction sanitizeUrl(value: string | undefined): string | undefined {\n  if (value === undefined || value === '') return undefined;\n  try {\n    const url = new URL(value);\n    if (!['http:', 'https:'].includes(url.protocol)) return undefined;\n    url.search = '';\n    url.hash = '';\n    return url.toString();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction javaEnabled(): boolean {\n  const candidate = navigator as Navigator & { javaEnabled?: () => boolean };\n  try {\n    return candidate.javaEnabled?.() ?? false;\n  } catch {\n    return false;\n  }\n}\n\nfunction compact<T extends Record<string, string | undefined>>(value: T): T {\n  for (const key of Object.keys(value) as Array<keyof T>) {\n    if (value[key] === undefined || value[key] === '') delete value[key];\n  }\n  return value;\n}\n", "export type StripeRadarSessionResult =\n  string | Readonly<{ id?: string; radarSession?: Readonly<{ id?: string }>; error?: unknown }>;\n\nexport type StripeClient = Readonly<{\n  handleNextAction(\n    input: Readonly<{ clientSecret: string }>\n  ): Promise<Readonly<{ error?: unknown }>>;\n  createRadarSession?: () => Promise<StripeRadarSessionResult>;\n}>;\n\nexport type StripeConstructor = (publishableKey: string) => StripeClient | null;\n\ndeclare global {\n  interface Window {\n    Stripe?: StripeConstructor;\n  }\n}\n\nlet stripeScript: Promise<StripeConstructor> | undefined;\n\n/** Loads Stripe.js once in the merchant top-level document. */\nexport function loadStripe(): Promise<StripeConstructor> {\n  if (typeof window.Stripe === 'function') return Promise.resolve(window.Stripe);\n  if (stripeScript !== undefined) return stripeScript;\n  stripeScript = new Promise<StripeConstructor>((resolve, reject) => {\n    const script = document.createElement('script');\n    script.src = 'https://js.stripe.com/v3/';\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => {\n      if (typeof window.Stripe === 'function') resolve(window.Stripe);\n      else reject(new Error('Stripe.js loaded without its public API.'));\n    };\n    script.onerror = () => reject(new Error('Stripe.js could not be loaded.'));\n    document.head.append(script);\n  });\n  return stripeScript;\n}\n", "import { loadStripe } from './stripe';\nimport type { RiskCollector } from './contracts/types';\n\nconst KOUNT_HOSTS = {\n  sandbox: 'https://tst.kaptcha.com',\n  live: 'https://ssl.kaptcha.com'\n} as const;\n// Keep client work aligned with the hosted bridge's decoded-object ceiling.\nconst MAX_RISK_COLLECTORS = 12;\n// Inspect a bounded superset so malformed/duplicate instructions cannot crowd\n// out a valid backend-issued collector near the start of a corrupted list.\nconst MAX_RISK_COLLECTOR_INPUTS = 256;\nconst MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH = 8_192;\n\nexport type RiskCollectorSessionCollection = Readonly<{\n  /**\n   * Returns only sessions that have already completed. It never waits on a\n   * third party and is therefore safe to call from the payment critical path.\n   */\n  snapshot: () => string | undefined;\n  /**\n   * Resolves after every third-party collector settles. A provider that never\n   * responds can keep this pending; this is observability-only and must never\n   * be awaited by the payment path.\n   */\n  settled: Promise<void>;\n}>;\n\n/**\n * Starts every collector without making payment availability depend on third\n * parties. Call snapshot() at PAY time to obtain the sessions that completed\n * while the buyer was entering their card details.\n */\nexport function startRiskCollectorSessionCollection(\n  collectors: readonly RiskCollector[] | undefined,\n  environment: 'sandbox' | 'live'\n): RiskCollectorSessionCollection {\n  if (collectors === undefined || collectors.length === 0) {\n    return { snapshot: () => undefined, settled: Promise.resolve() };\n  }\n\n  const sessions: Record<string, string> = {};\n  const acceptedCollectors = boundedCollectors(collectors);\n  const settled = Promise.all(\n    acceptedCollectors.map(async (collector) => {\n      const session = await collectOne(collector, environment).catch(() => undefined);\n      if (session !== undefined) sessions[collector.publicKey] = session;\n    })\n  ).then(() => undefined);\n\n  return {\n    snapshot: () => boundedSnapshot(sessions),\n    settled\n  };\n}\n\n/**\n * CheckoutSession may pass through untrusted browser code, so enforce the\n * bridge contract before creating third-party requests. The Runtime may return\n * any supported provider/collector combination and distinct public keys; only\n * duplicate keys and an unbounded list are rejected locally.\n */\nfunction boundedCollectors(collectors: readonly RiskCollector[]): RiskCollector[] {\n  const accepted: RiskCollector[] = [];\n  const seenKeys = new Set<string>();\n\n  // Do not iterate over an unbounded host-controlled list. Inspect a bounded\n  // superset to tolerate malformed/duplicate values before the accepted cap.\n  for (const collector of collectors.slice(0, MAX_RISK_COLLECTOR_INPUTS)) {\n    if (!isRiskCollector(collector)) continue;\n    if (seenKeys.has(collector.publicKey)) continue;\n    seenKeys.add(collector.publicKey);\n    accepted.push(collector);\n    if (accepted.length === MAX_RISK_COLLECTORS) break;\n  }\n  return accepted;\n}\n\nfunction boundedSnapshot(sessions: Record<string, string>): string | undefined {\n  if (Object.keys(sessions).length === 0) return undefined;\n  const encoded = base64Json({ ...sessions });\n  // Omit optional telemetry instead of emitting a bridge message that the\n  // hosted form would reject and potentially delaying the payment state.\n  return encoded.length <= MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH ? encoded : undefined;\n}\n\nasync function collectOne(\n  collector: RiskCollector,\n  environment: 'sandbox' | 'live'\n): Promise<string | undefined> {\n  if (collector.provider === 'stripe' && collector.collector === 'radar') {\n    const stripe = (await loadStripe())(collector.publicKey);\n    if (stripe === null || stripe.createRadarSession === undefined) return undefined;\n    const result = await stripe.createRadarSession();\n    return radarSessionId(result);\n  }\n  if (\n    (collector.provider === 'nmi' || collector.provider === 'seamless') &&\n    collector.collector === 'kount'\n  ) {\n    const session = randomHex(32);\n    await loadKount(collector.publicKey, session, environment);\n    return session;\n  }\n  return undefined;\n}\n\nfunction loadKount(\n  merchantId: string,\n  sessionId: string,\n  environment: 'sandbox' | 'live'\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement('script');\n    const url = new URL('/collect/sdk', KOUNT_HOSTS[environment]);\n    url.searchParams.set('m', merchantId);\n    url.searchParams.set('s', sessionId);\n    script.src = url.toString();\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => resolve();\n    script.onerror = () => reject(new Error('Kount collector could not be loaded.'));\n    document.head.append(script);\n  });\n}\n\nfunction radarSessionId(value: unknown): string | undefined {\n  if (typeof value === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(value)) return value;\n  if (isRecord(value)) {\n    const direct = value.id;\n    if (typeof direct === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(direct)) return direct;\n    if (isRecord(value.radarSession)) {\n      const nested = value.radarSession.id;\n      if (typeof nested === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(nested)) return nested;\n    }\n  }\n  return undefined;\n}\n\nfunction isRiskCollector(value: RiskCollector): boolean {\n  if (\n    typeof value.publicKey !== 'string' ||\n    value.publicKey.length === 0 ||\n    value.publicKey.length > 512\n  )\n    return false;\n  if (value.provider === 'stripe' && value.collector === 'radar')\n    return /^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(value.publicKey);\n  return (\n    (value.provider === 'nmi' || value.provider === 'seamless') &&\n    value.collector === 'kount' &&\n    // Kount accepts both legacy numeric MIDs and Runtime-issued checkout_public_* keys.\n    // The value is serialized by URLSearchParams, so accepting the documented public key format\n    // does not create a URL-injection surface.\n    /^(?:\\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(value.publicKey)\n  );\n}\n\nfunction randomHex(length: number): string {\n  const bytes = new Uint8Array(length / 2);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction base64Json(value: Record<string, string>): string {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "type StripeThreeDSAction = Readonly<{\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nimport { loadStripe } from './stripe';\n\n/**\n * Runs in the merchant document so Stripe.js can present its native modal at\n * the top-level browsing context. The action is accepted only from the\n * already-bound hosted frame and is never exposed to integration callbacks.\n */\nexport async function completeStripeThreeDS(action: StripeThreeDSAction): Promise<void> {\n  const stripe = (await loadStripe())(action.publishableKey);\n  if (stripe === null) throw new Error('Stripe.js could not initialize.');\n  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });\n  if (result.error !== undefined) throw new Error('Stripe authentication failed.');\n}\n", "import type {\n  CardState,\n  PaymentFormAppearance,\n  PaymentFormError,\n  PaymentFormStatus,\n  PayInput,\n  PayOutcome,\n  ThreeDSPresentation\n} from './contracts/types';\n\nexport const FORM_PAYMENT_PROTOCOL_VERSION = 1 as const;\n\ntype Base = Readonly<{\n  channel: 'BEMONY_FORM_PAYMENT';\n  version: typeof FORM_PAYMENT_PROTOCOL_VERSION;\n  instanceId: string;\n}>;\n\ntype StripeThreeDSAction = Readonly<{\n  actionId: string;\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nexport type HostToFrameMessage =\n  | (Base &\n      Readonly<{\n        type: 'INIT';\n        clientSecret: string;\n        appearance?: PaymentFormAppearance;\n        presentation: ThreeDSPresentation;\n      }>)\n  | (Base &\n      Readonly<{\n        type: 'PAY';\n        requestId: string;\n        input: PayInput;\n        /** Base64 JSON map generated only by the public collector layer. */\n        riskCollectorSessions?: string;\n      }>)\n  | (Base & Readonly<{ type: 'THREE_DS_PRESENTED' }>)\n  | (Base &\n      Readonly<{ type: 'STRIPE_3DS_RESULT'; actionId: string; result: 'SUCCEEDED' | 'FAILED' }>)\n  | (Base & Readonly<{ type: 'DESTROY' }>);\n\nexport type FrameToHostMessage =\n  | (Base & Readonly<{ type: 'READY' | 'MOUNTED' | 'THREE_DS_CLOSE' }>)\n  | (Base & Readonly<{ type: 'MOUNT_SLOW'; stage: PaymentFormError['stage']; durationMs: number }>)\n  | (Base & Readonly<{ type: 'THREE_DS_OPEN' }>)\n  | (Base & Readonly<{ type: 'STRIPE_3DS'; action: StripeThreeDSAction }>)\n  | (Base & Readonly<{ type: 'RESIZED'; height: number }>)\n  | (Base & Readonly<{ type: 'STATUS'; status: PaymentFormStatus }>)\n  | (Base & Readonly<{ type: 'CARD_STATE'; state: CardState }>)\n  | (Base & Readonly<{ type: 'SUCCESS'; requestId: string; payment: PayOutcome }>)\n  | (Base & Readonly<{ type: 'ERROR'; requestId?: string; error: PaymentFormError }>);\n\nexport function isFrameToHostMessage(value: unknown): value is FrameToHostMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'READY':\n    case 'MOUNTED':\n    case 'THREE_DS_CLOSE':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'THREE_DS_OPEN':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'MOUNT_SLOW':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'stage', 'durationMs']) &&\n        isMountStage(value.stage) &&\n        typeof value.durationMs === 'number' &&\n        Number.isInteger(value.durationMs) &&\n        value.durationMs >= 0 &&\n        value.durationMs <= 24 * 60 * 60 * 1_000\n      );\n    case 'STRIPE_3DS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'action']) &&\n        isStripeThreeDSAction(value.action)\n      );\n    case 'STATUS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'status']) &&\n        isStatus(value.status)\n      );\n    case 'RESIZED':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'height']) &&\n        isFrameHeight(value.height)\n      );\n    case 'CARD_STATE':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'state']) &&\n        isCardState(value.state)\n      );\n    case 'SUCCESS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'payment']) &&\n        isId(value.requestId) &&\n        isOutcome(value.payment)\n      );\n    case 'ERROR':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'error']) &&\n        (value.requestId === undefined || isId(value.requestId)) &&\n        isError(value.error)\n      );\n    default:\n      return false;\n  }\n}\n\nexport function isHostToFrameMessage(value: unknown): value is HostToFrameMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'INIT':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'clientSecret',\n          'appearance',\n          'presentation'\n        ]) &&\n        isClientSecret(value.clientSecret) &&\n        isPresentation(value.presentation) &&\n        (value.appearance === undefined || isAppearance(value.appearance))\n      );\n    case 'PAY':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'requestId',\n          'input',\n          'riskCollectorSessions'\n        ]) &&\n        isId(value.requestId) &&\n        isPayInput(value.input) &&\n        (value.riskCollectorSessions === undefined ||\n          isRiskCollectorSessions(value.riskCollectorSessions))\n      );\n    case 'THREE_DS_PRESENTED':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS_RESULT':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'actionId', 'result']) &&\n        isStripeActionId(value.actionId) &&\n        (value.result === 'SUCCEEDED' || value.result === 'FAILED')\n      );\n    case 'DESTROY':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    default:\n      return false;\n  }\n}\n\nfunction hasBase(value: unknown): value is Record<string, unknown> & Base {\n  return (\n    isRecord(value) &&\n    value.channel === 'BEMONY_FORM_PAYMENT' &&\n    value.version === FORM_PAYMENT_PROTOCOL_VERSION &&\n    isId(value.instanceId) &&\n    typeof value.type === 'string'\n  );\n}\n\nfunction hasOnly(value: Record<string, unknown>, keys: readonly string[]): boolean {\n  return Object.keys(value).every((key) => keys.includes(key));\n}\n\nfunction isId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9-]{16,128}$/.test(value);\n}\n\nfunction isClientSecret(value: unknown): value is string {\n  return typeof value === 'string' && /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction isRiskCollectorSessions(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    value.length <= 8_192 &&\n    /^[A-Za-z0-9+/]*={0,2}$/.test(value)\n  );\n}\n\nfunction isStripeThreeDSAction(value: unknown): value is StripeThreeDSAction {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['actionId', 'clientSecret', 'publishableKey']) &&\n    isStripeActionId(value.actionId) &&\n    typeof value.clientSecret === 'string' &&\n    /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) &&\n    typeof value.publishableKey === 'string' &&\n    /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey)\n  );\n}\n\nfunction isStripeActionId(value: unknown): value is string {\n  return typeof value === 'string' && /^pi_[A-Za-z0-9_]{4,256}$/.test(value);\n}\n\nfunction isPresentation(value: unknown): value is ThreeDSPresentation {\n  return value === 'modal' || value === 'inline';\n}\n\nfunction isStatus(value: unknown): value is PaymentFormStatus {\n  return (\n    typeof value === 'string' &&\n    [\n      'MOUNTING',\n      'READY',\n      'TOKENIZING',\n      'SUBMITTING',\n      'AUTHENTICATING_3DS',\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD',\n      'DESTROYED'\n    ].includes(value)\n  );\n}\n\nfunction isMountStage(value: unknown): value is NonNullable<PaymentFormError['stage']> {\n  return (\n    typeof value === 'string' &&\n    [\n      'FORM_IFRAME_NAVIGATION',\n      'FORM_HANDSHAKE',\n      'CARD_FRAME_DOCUMENT',\n      'CARD_FRAME_HANDSHAKE',\n      'CARD_FRAME_INITIALIZATION'\n    ].includes(value)\n  );\n}\n\nfunction isFrameHeight(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value >= 80 && value <= 1_200;\n}\n\nfunction isCardState(value: unknown): value is CardState {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['complete', 'valid']) &&\n    typeof value.complete === 'boolean' &&\n    typeof value.valid === 'boolean'\n  );\n}\n\nfunction isOutcome(value: unknown): value is PayOutcome {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['paymentId', 'status']) &&\n    typeof value.paymentId === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) &&\n    (value.status === 'AUTHORIZED' || value.status === 'CAPTURED')\n  );\n}\n\nfunction isError(value: unknown): value is PaymentFormError {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'code',\n      'message',\n      'category',\n      'stage',\n      'requestId',\n      'paymentId',\n      'retryable',\n      'httpStatus',\n      'upstreamRequestId',\n      'frameStage',\n      'payment'\n    ]) &&\n    typeof value.code === 'string' &&\n    /^[A-Z][A-Z0-9_]{1,63}$/.test(value.code) &&\n    typeof value.message === 'string' &&\n    value.message.length <= 1_000 &&\n    (value.category === undefined ||\n      (typeof value.category === 'string' &&\n        [\n          'VALIDATION',\n          'CONFIGURATION',\n          'LIFECYCLE',\n          'FRAME',\n          'TOKENIZATION',\n          'THREE_DS',\n          'PAYMENT',\n          'RUNTIME',\n          'UNKNOWN'\n        ].includes(value.category))) &&\n    (value.stage === undefined ||\n      (typeof value.stage === 'string' &&\n        [\n          'FORM_SDK',\n          'FORM_IFRAME_NAVIGATION',\n          'FORM_HANDSHAKE',\n          'CARD_FRAME_DOCUMENT',\n          'CARD_FRAME_HANDSHAKE',\n          'CARD_FRAME_INITIALIZATION',\n          'CARD_TOKENIZATION',\n          'THREE_DS',\n          'PAYMENT_SUBMISSION',\n          'PAYMENT_RECONCILIATION',\n          'RUNTIME'\n        ].includes(value.stage))) &&\n    (value.requestId === undefined || isId(value.requestId)) &&\n    (value.paymentId === undefined ||\n      (typeof value.paymentId === 'string' &&\n        /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId))) &&\n    (value.retryable === undefined || typeof value.retryable === 'boolean') &&\n    (value.httpStatus === undefined ||\n      (typeof value.httpStatus === 'number' &&\n        Number.isInteger(value.httpStatus) &&\n        value.httpStatus >= 400 &&\n        value.httpStatus <= 599)) &&\n    (value.upstreamRequestId === undefined ||\n      (typeof value.upstreamRequestId === 'string' &&\n        value.upstreamRequestId.length > 0 &&\n        value.upstreamRequestId.length <= 1_000)) &&\n    (value.frameStage === undefined ||\n      value.frameStage === 'FRAME_DOCUMENT' ||\n      value.frameStage === 'CARD_FRAME') &&\n    (value.payment === undefined || isErrorPayment(value.payment))\n  );\n}\n\nfunction isErrorPayment(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['id', 'environment', 'currency', 'transaction']) &&\n    typeof value.id === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    (value.environment === 'sandbox' || value.environment === 'live') &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    isErrorTransaction(value.transaction)\n  );\n}\n\nfunction isErrorTransaction(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'id',\n      'status',\n      'amount',\n      'currency',\n      'provider',\n      'providerReference',\n      'attempts'\n    ]) &&\n    typeof value.id === 'string' &&\n    /^txn_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    isPaymentStatus(value.status) &&\n    Number.isSafeInteger(value.amount) &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    optionalText(value.provider) &&\n    optionalText(value.providerReference) &&\n    (value.attempts === undefined ||\n      (Array.isArray(value.attempts) &&\n        value.attempts.length <= 20 &&\n        value.attempts.every(isErrorAttempt)))\n  );\n}\n\nfunction isErrorAttempt(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'ordinal',\n      'provider',\n      'status',\n      'delivery',\n      'failureReason',\n      'providerCode',\n      'providerStatus',\n      'providerReference',\n      'message',\n      'toProxyMs',\n      'midMs'\n    ]) &&\n    optionalInteger(value.ordinal) &&\n    optionalText(value.provider) &&\n    optionalText(value.status) &&\n    optionalText(value.delivery) &&\n    optionalText(value.failureReason) &&\n    optionalText(value.providerCode) &&\n    optionalText(value.providerStatus) &&\n    optionalText(value.providerReference) &&\n    optionalText(value.message) &&\n    optionalInteger(value.toProxyMs) &&\n    optionalInteger(value.midMs)\n  );\n}\n\nfunction isPaymentStatus(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    [\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD'\n    ].includes(value)\n  );\n}\n\nfunction optionalText(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'string' && value.length > 0 && value.length <= 1_000)\n  );\n}\n\nfunction optionalInteger(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n  );\n}\n\nfunction isAppearance(value: unknown): value is PaymentFormAppearance {\n  if (!isRecord(value) || !hasOnly(value, ['theme', 'variables', 'threeDS'])) return false;\n  if (value.theme !== undefined && !['light', 'dark', 'system'].includes(String(value.theme)))\n    return false;\n  if (\n    value.variables !== undefined &&\n    (!isRecord(value.variables) ||\n      Object.values(value.variables).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  if (\n    value.threeDS !== undefined &&\n    (!isRecord(value.threeDS) ||\n      Object.values(value.threeDS).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  return true;\n}\n\nfunction isPayInput(value: unknown): value is PayInput {\n  if (\n    !isRecord(value) ||\n    !hasOnly(value, [\n      'merchantOrderId',\n      'merchantReference',\n      'description',\n      'currency',\n      'operation',\n      'customer',\n      'billingAddress',\n      'shippingAddress',\n      'cardStorageConsent',\n      'items',\n      'amounts',\n      'initialTransactionReference',\n      'checkoutUrl',\n      'returnUrl',\n      'metadata',\n      'client'\n    ])\n  )\n    return false;\n  if (\n    typeof value.merchantOrderId !== 'string' ||\n    value.merchantOrderId.trim().length === 0 ||\n    value.merchantOrderId.length > 255 ||\n    typeof value.currency !== 'string' ||\n    !/^[A-Z]{3}$/.test(value.currency) ||\n    (value.operation !== undefined && value.operation !== 'AUTHORIZE' && value.operation !== 'SALE')\n  )\n    return false;\n  return (\n    Array.isArray(value.items) &&\n    value.items.length > 0 &&\n    value.items.length <= 20 &&\n    value.items.every(isPaymentItem)\n  );\n}\n\nfunction isPaymentItem(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'description',\n      'id',\n      'sku',\n      'unitAmount',\n      'quantity',\n      'type',\n      'interval',\n      'intervalCount',\n      'trialDays',\n      'cycle',\n      'isMain',\n      'category',\n      'brand',\n      'imageUrl',\n      'manufacturePartNumber'\n    ]) &&\n    typeof value.description === 'string' &&\n    value.description.trim().length > 0 &&\n    Number.isSafeInteger(value.unitAmount) &&\n    Number(value.unitAmount) > 0 &&\n    Number.isSafeInteger(value.quantity) &&\n    Number(value.quantity) > 0 &&\n    Number(value.quantity) <= 999 &&\n    (value.type === 'ONE_TIME' ||\n      value.type === 'RECURRING' ||\n      value.type === 'UNIQUE' ||\n      value.type === 'unique' ||\n      value.type === 'recurring')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "import { formError, normalizePaymentFormError } from './contracts/errors';\nimport { enrichPayInputFromBrowser } from './browser-context';\nimport { startRiskCollectorSessionCollection } from './risk-collectors';\nimport { completeStripeThreeDS } from './stripe-three-ds';\nimport type {\n  PayInput,\n  PaymentFormError,\n  PaymentFormEvent,\n  PaymentFormInstance,\n  PaymentFormMountOptions,\n  PaymentFormState,\n  PaymentFormStatus,\n  PayOutcome\n} from './contracts/types';\nimport {\n  FORM_PAYMENT_PROTOCOL_VERSION,\n  isFrameToHostMessage,\n  type FrameToHostMessage,\n  type HostToFrameMessage\n} from './protocol';\n\nconst productionFrameOrigin = 'https://payment-form.bemony.com';\nconst threeDSModalWidth = 624;\nconst threeDSModalRadius = 12;\n// This is a diagnostic milestone, never a mount deadline. A slow or\n// backgrounded buyer must not receive FRAME_UNAVAILABLE merely because the\n// secure iframe took longer than an arbitrary wall-clock budget.\nconst FORM_MOUNT_SLOW_VISIBLE_MS = 10_000;\n\ntype VisibleTimeout = Readonly<{ cancel(): void }>;\n\nexport const BemonyPaymentForm = {\n  mount(options: PaymentFormMountOptions): Promise<PaymentFormInstance> {\n    const target = resolveTarget(options.target);\n    if (!isClientSecret(options.clientSecret)) {\n      return Promise.reject(\n        formError('PAYMENT_SESSION_INVALID', 'A sess\u00E3o de pagamento \u00E9 inv\u00E1lida.')\n      );\n    }\n    if (options.signal?.aborted) {\n      return Promise.reject(formError('FORM_MOUNT_CANCELLED', 'A montagem foi cancelada.'));\n    }\n\n    // Begin telemetry at mount time so collection can run while the secure\n    // frame boots and the buyer fills in card fields. PAY reads a synchronous\n    // snapshot: an unavailable fraud provider never adds latency to payment.\n    const riskCollectorSessions = startRiskCollectorSessionCollection(\n      options.riskCollectors,\n      options.clientSecret.startsWith('cs_test_') ? 'sandbox' : 'live'\n    );\n\n    const instanceId = crypto.randomUUID();\n    const frameOrigin = resolveFrameOrigin();\n    ensureConnectionHints(frameOrigin);\n    const slot = document.createElement('div');\n    slot.dataset.bemonyPaymentForm = '';\n    const iframe = document.createElement('iframe');\n    iframe.title = 'Pagamento seguro Bemony';\n    iframe.setAttribute('allow', 'payment *');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    let contentHeight = 100;\n    setInlineStyle(iframe, contentHeight);\n    slot.style.cssText = 'display:block;width:100%;margin:0;padding:0;background:transparent;';\n    slot.append(iframe);\n    target.append(slot);\n\n    let destroyed = false;\n    let mounted = false;\n    let mountSlowTimer: VisibleTimeout | undefined;\n    let mountAttempt = 0;\n    let mountAttemptStartedAt = 0;\n    let mountPhase: 'FORM_IFRAME_NAVIGATION' | 'FORM_HANDSHAKE' | 'CARD_FRAME_INITIALIZATION' =\n      'FORM_IFRAME_NAVIGATION';\n    let overlay: HTMLDivElement | undefined;\n    let applyOverlayLayout: (() => void) | undefined;\n    let bodyOverflow: string | null = null;\n    let documentOverflow: string | null = null;\n    let rejectMount: ((reason: PaymentFormError) => void) | undefined;\n    let state: PaymentFormState = { status: 'MOUNTING', ready: false, isSubmitting: false };\n    let blockedError: PaymentFormError | undefined;\n    let active:\n      | Readonly<{\n          requestId: string;\n          promise: Promise<PayOutcome>;\n          resolve: (value: PayOutcome) => void;\n          reject: (reason: PaymentFormError) => void;\n        }>\n      | undefined;\n    let onMessage: (event: MessageEvent<unknown>) => void = () => undefined;\n\n    const callback = <T>(fn: ((value: T) => void) | undefined, value: T): void => {\n      try {\n        fn?.(value);\n      } catch {\n        /* Merchant callbacks never control payment state. */\n      }\n    };\n    const reportEvent = (event: PaymentFormEvent): void => callback(options.onEvent, event);\n    const post = (message: HostToFrameMessage): void => {\n      iframe.contentWindow?.postMessage(message, frameOrigin);\n    };\n    const restoreInline = (): void => {\n      if (overlay === undefined) return;\n      overlay.remove();\n      overlay = undefined;\n      if (bodyOverflow === null) document.body.style.removeProperty('overflow');\n      else document.body.setAttribute('style', bodyOverflow);\n      if (documentOverflow === null) document.documentElement.style.removeProperty('overflow');\n      else document.documentElement.setAttribute('style', documentOverflow);\n      bodyOverflow = null;\n      documentOverflow = null;\n      applyOverlayLayout = undefined;\n      setInlineStyle(iframe, contentHeight);\n      iframe.removeAttribute('role');\n      iframe.removeAttribute('aria-modal');\n      iframe.removeAttribute('aria-label');\n    };\n    const showOverlay = (): void => {\n      if (options.threeDS?.presentation !== 'modal' || overlay !== undefined) return;\n      overlay = document.createElement('div');\n      overlay.dataset.bemonyPaymentThreeDsModal = '';\n      // Keep the Frame in its original DOM position. Reparenting an iframe can\n      // reload its nested Card Frame and discard the in-flight issuer challenge.\n      // The backdrop belongs to document.body; fixed positioning turns the\n      // already-mounted frame into the modal without resetting it.\n      overlay.setAttribute('aria-hidden', 'true');\n      iframe.setAttribute('tabindex', '-1');\n      iframe.setAttribute('role', 'dialog');\n      iframe.setAttribute('aria-modal', 'true');\n      iframe.setAttribute('aria-label', 'Autentica\u00E7\u00E3o segura do banco');\n      overlay.style.cssText = [\n        'position:fixed',\n        'inset:0',\n        // The secure iframe must stay above this backdrop. It is appended\n        // after the iframe so equal stacking values would intercept the\n        // issuer's buttons and make a valid challenge impossible to finish.\n        'z-index:2147483646',\n        'display:flex',\n        'align-items:center',\n        'justify-content:center',\n        'padding:0',\n        `background:${options.appearance?.threeDS?.modalBackdrop ?? 'rgba(2, 6, 23, .72)'}`\n      ].join(';');\n      const applyLayout = (): void => {\n        iframe.style.cssText = [\n          'position:fixed',\n          'left:50%',\n          'top:50%',\n          'z-index:2147483647',\n          'display:block',\n          `width:min(${threeDSModalWidth}px, calc(100vw - 24px))`,\n          `height:min(${contentHeight}px, calc(100dvh - 24px))`,\n          'border:0',\n          `border-radius:${threeDSModalRadius}px`,\n          'overflow:hidden',\n          'background:#fff',\n          'box-shadow:none',\n          'transform:translate(-50%, -50%)'\n        ].join(';');\n      };\n      applyOverlayLayout = applyLayout;\n      bodyOverflow = document.body.getAttribute('style');\n      documentOverflow = document.documentElement.getAttribute('style');\n      document.body.style.setProperty('overflow', 'hidden', 'important');\n      document.documentElement.style.setProperty('overflow', 'hidden', 'important');\n      applyLayout();\n      document.body.append(overlay);\n      window.requestAnimationFrame(() => iframe.focus({ preventScroll: true }));\n    };\n    const reportStatus = (status: PaymentFormStatus): void => {\n      if (destroyed) return;\n      state = {\n        ...state,\n        status,\n        ready: mounted,\n        isSubmitting: ['TOKENIZING', 'SUBMITTING', 'AUTHENTICATING_3DS', 'PROCESSING'].includes(\n          status\n        )\n      };\n      callback(options.onStatusChange, status);\n    };\n    const reportError = (received: PaymentFormError, requestId?: string): void => {\n      if (requestId !== undefined && active !== undefined && active.requestId !== requestId) return;\n      const error = normalizePaymentFormError(\n        received.stage === undefined && !mounted\n          ? { ...received, category: 'FRAME', stage: mountPhase }\n          : received\n      );\n      restoreInline();\n      // Neither a timeout/unknown result nor a competing in-flight command\n      // proves that no charge exists. Keep this instance fail-closed until\n      // the merchant reconciles the canonical Payment. Terminal declines and\n      // failures are deliberately not included: they can start a new attempt.\n      if (\n        error.code === 'PAYMENT_STATUS_UNKNOWN' ||\n        error.code === 'PAYMENT_ALREADY_IN_PROGRESS' ||\n        (requestId !== undefined && error.retryable !== true)\n      ) {\n        blockedError = error;\n      }\n      state = {\n        ...state,\n        ...(blockedError !== undefined ? { status: 'UNKNOWN' as const } : {}),\n        error,\n        isSubmitting: false\n      };\n      callback(options.onError, error);\n      reportEvent({\n        type: !mounted ? 'MOUNT_FAILED' : 'PAYMENT_FAILED',\n        ...(mounted\n          ? {}\n          : {\n              attempt: mountAttempt,\n              durationMs: Date.now() - mountAttemptStartedAt,\n              stage: error.stage ?? mountPhase\n            }),\n        error\n      });\n      if (!mounted && rejectMount !== undefined) {\n        mountSlowTimer?.cancel();\n        const reject = rejectMount;\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n        return;\n      }\n      if (active !== undefined) {\n        active.reject(error);\n        active = undefined;\n      }\n    };\n    const destroy = (): void => {\n      if (destroyed) return;\n      destroyed = true;\n      mountSlowTimer?.cancel();\n      window.removeEventListener('message', onMessage);\n      options.signal?.removeEventListener('abort', destroy);\n      restoreInline();\n      post({\n        channel: 'BEMONY_FORM_PAYMENT',\n        version: FORM_PAYMENT_PROTOCOL_VERSION,\n        type: 'DESTROY',\n        instanceId\n      });\n      iframe.remove();\n      slot.remove();\n      active?.reject(formError('FORM_DESTROYED', 'O formul\u00E1rio de pagamento foi desmontado.'));\n      active = undefined;\n      state = { ...state, status: 'DESTROYED', ready: false, isSubmitting: false };\n      reportEvent({ type: 'DESTROYED' });\n      if (!mounted && rejectMount !== undefined) {\n        const reject = rejectMount;\n        rejectMount = undefined;\n        reject(formError('FORM_MOUNT_CANCELLED', 'A montagem foi cancelada.'));\n      }\n    };\n    const instance: PaymentFormInstance = {\n      pay(input: PayInput): Promise<PayOutcome> {\n        if (destroyed)\n          return Promise.reject(\n            formError('INVALID_STATE', 'O formul\u00E1rio de pagamento foi desmontado.')\n          );\n        if (!mounted)\n          return Promise.reject(\n            formError('FORM_NOT_READY', 'O formul\u00E1rio de pagamento ainda n\u00E3o est\u00E1 pronto.')\n          );\n        if (blockedError !== undefined) return Promise.reject(blockedError);\n        if (active !== undefined) return active.promise;\n        const requestId = crypto.randomUUID();\n        let resolve!: (payment: PayOutcome) => void;\n        let reject!: (error: PaymentFormError) => void;\n        const promise = new Promise<PayOutcome>((nextResolve, nextReject) => {\n          resolve = nextResolve;\n          reject = nextReject;\n        });\n        active = { requestId, promise, resolve, reject };\n        reportEvent({ type: 'PAYMENT_STARTED' });\n        const enrichedInput = enrichPayInputFromBrowser(input);\n        const sessions = riskCollectorSessions.snapshot();\n        post({\n          channel: 'BEMONY_FORM_PAYMENT',\n          version: FORM_PAYMENT_PROTOCOL_VERSION,\n          type: 'PAY',\n          instanceId,\n          requestId,\n          input: enrichedInput,\n          ...(sessions === undefined ? {} : { riskCollectorSessions: sessions })\n        });\n        return promise;\n      },\n      getState: () => state,\n      destroy\n    };\n    const mountPromise = new Promise<PaymentFormInstance>((resolve, reject) => {\n      rejectMount = reject;\n      const startMountAttempt = (): void => {\n        mountSlowTimer?.cancel();\n        mountAttempt += 1;\n        mountAttemptStartedAt = Date.now();\n        reportEvent({\n          type: mountAttempt === 1 ? 'MOUNT_STARTED' : 'MOUNT_RETRY',\n          attempt: mountAttempt\n        });\n        mountPhase = 'FORM_IFRAME_NAVIGATION';\n        const source = new URL('/frame', frameOrigin);\n        source.searchParams.set('instance', instanceId);\n        // Changing only a non-sensitive bootstrap marker forces a fresh\n        // navigation without changing the Form instance or any payment input.\n        source.searchParams.set('mountAttempt', String(mountAttempt));\n        iframe.src = source.toString();\n        mountSlowTimer = setVisibleTimeout(() => {\n          if (mounted || destroyed) return;\n          reportEvent({\n            type: 'MOUNT_SLOW',\n            attempt: mountAttempt,\n            durationMs: Date.now() - mountAttemptStartedAt,\n            stage: mountPhase\n          });\n        }, FORM_MOUNT_SLOW_VISIBLE_MS);\n      };\n      onMessage = (event: MessageEvent<unknown>): void => {\n        if (destroyed || event.origin !== frameOrigin || event.source !== iframe.contentWindow)\n          return;\n        if (!isFrameToHostMessage(event.data) || event.data.instanceId !== instanceId) return;\n        const message: FrameToHostMessage = event.data;\n        if (message.type === 'READY') {\n          mountPhase = 'CARD_FRAME_INITIALIZATION';\n          // The hosted Form has answered. Its private Card Frame reports its\n          // own slow milestone, so avoid emitting an ambiguous outer signal.\n          mountSlowTimer?.cancel();\n          post({\n            channel: 'BEMONY_FORM_PAYMENT',\n            version: FORM_PAYMENT_PROTOCOL_VERSION,\n            type: 'INIT',\n            instanceId,\n            clientSecret: options.clientSecret,\n            presentation: options.threeDS?.presentation ?? 'modal',\n            ...(options.appearance === undefined ? {} : { appearance: options.appearance })\n          });\n          return;\n        }\n        if (message.type === 'MOUNTED') {\n          if (mounted) return;\n          mounted = true;\n          mountSlowTimer?.cancel();\n          rejectMount = undefined;\n          state = { ...state, status: 'READY', ready: true };\n          callback(options.onReady, undefined);\n          callback(options.onStatusChange, 'READY');\n          reportEvent({\n            type: 'MOUNTED',\n            attempt: mountAttempt,\n            durationMs: Date.now() - mountAttemptStartedAt,\n            stage: 'CARD_FRAME_INITIALIZATION'\n          });\n          resolve(instance);\n          return;\n        }\n        if (message.type === 'MOUNT_SLOW') {\n          reportEvent({\n            type: 'MOUNT_SLOW',\n            attempt: mountAttempt,\n            durationMs: message.durationMs,\n            stage: message.stage\n          });\n          return;\n        }\n        if (message.type === 'STATUS') return reportStatus(message.status);\n        if (message.type === 'CARD_STATE')\n          return callback(options.onCardStateChange, message.state);\n        if (message.type === 'RESIZED') {\n          contentHeight = message.height;\n          if (overlay === undefined) setInlineStyle(iframe, contentHeight);\n          else applyOverlayLayout?.();\n          return;\n        }\n        if (message.type === 'STRIPE_3DS') {\n          // Stripe.js owns the top-level challenge surface. The sensitive,\n          // ephemeral action stays on this private bridge and never reaches\n          // consumer callbacks or public SDK state.\n          void completeStripeThreeDS(message.action).then(\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'SUCCEEDED'\n              });\n            },\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'FAILED'\n              });\n            }\n          );\n          return;\n        }\n        if (message.type === 'THREE_DS_OPEN') {\n          // The hosted form must not start the issuer challenge until the\n          // public host has promoted this iframe to its modal and the browser\n          // has had a chance to paint that layout.\n          showOverlay();\n          window.requestAnimationFrame(() => {\n            window.requestAnimationFrame(() => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'THREE_DS_PRESENTED',\n                instanceId\n              });\n            });\n          });\n          return;\n        }\n        if (message.type === 'THREE_DS_CLOSE') return restoreInline();\n        if (\n          message.type === 'SUCCESS' &&\n          (active === undefined || active.requestId === message.requestId)\n        ) {\n          restoreInline();\n          blockedError = undefined;\n          state = {\n            status: message.payment.status,\n            ready: true,\n            isSubmitting: false,\n            payment: message.payment\n          };\n          callback(options.onStatusChange, message.payment.status);\n          callback(options.onSuccess, message.payment);\n          reportEvent({ type: 'PAYMENT_SUCCEEDED' });\n          active?.resolve(message.payment);\n          active = undefined;\n          return;\n        }\n        if (message.type === 'ERROR') reportError(message.error, message.requestId);\n      };\n      window.addEventListener('message', onMessage);\n      iframe.addEventListener('load', () => {\n        if (!mounted && !destroyed && mountPhase === 'FORM_IFRAME_NAVIGATION') {\n          mountPhase = 'FORM_HANDSHAKE';\n        }\n      });\n      startMountAttempt();\n    });\n    options.signal?.addEventListener('abort', destroy, { once: true });\n    return mountPromise;\n  }\n};\n\nfunction resolveTarget(target: string | HTMLElement): HTMLElement {\n  const element = typeof target === 'string' ? document.querySelector<HTMLElement>(target) : target;\n  if (element === null || !(element instanceof HTMLElement))\n    throw formError('PAY_INPUT_INVALID', 'O container do Payment Form n\u00E3o foi encontrado.');\n  return element;\n}\n\nfunction isClientSecret(value: string): boolean {\n  return /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction resolveFrameOrigin(): string {\n  const isLoopbackHost = ['localhost', '127.0.0.1', '[::1]'].includes(window.location.hostname);\n  const configured = (\n    globalThis as typeof globalThis & { __BEMONY_PAYMENT_FORM_FRAME_URL__?: string }\n  ).__BEMONY_PAYMENT_FORM_FRAME_URL__;\n  if (!isLoopbackHost || configured === undefined) return productionFrameOrigin;\n\n  try {\n    const url = new URL(configured);\n    if (\n      !['http:', 'https:'].includes(url.protocol) ||\n      url.pathname !== '/' ||\n      url.search ||\n      url.hash ||\n      url.username ||\n      url.password\n    ) {\n      return productionFrameOrigin;\n    }\n    return url.origin;\n  } catch {\n    return productionFrameOrigin;\n  }\n}\n\n/**\n * Resource hints are opportunistic only: a browser may ignore them and the\n * secure Form must behave exactly the same. They are deduplicated because a\n * React checkout can mount the SDK more than once during its lifetime.\n */\nfunction ensureConnectionHints(origin: string): void {\n  for (const rel of ['dns-prefetch', 'preconnect'] as const) {\n    const exists = Array.from(document.head.querySelectorAll<HTMLLinkElement>('link')).some(\n      (link) => {\n        try {\n          return link.rel === rel && new URL(link.href).origin === origin;\n        } catch {\n          return false;\n        }\n      }\n    );\n    if (exists) continue;\n    const hint = document.createElement('link');\n    hint.rel = rel;\n    hint.href = origin;\n    if (rel === 'preconnect') hint.crossOrigin = 'anonymous';\n    document.head.append(hint);\n  }\n}\n\nfunction setInlineStyle(iframe: HTMLIFrameElement, height: number): void {\n  iframe.style.cssText = `display:block;width:100%;height:${height}px;min-height:${height}px;border:0;background:transparent;`;\n  iframe.removeAttribute('tabindex');\n}\n\n/**\n * A background tab is intentionally throttled by browsers. Counting that\n * time as a network failure destroys an otherwise recoverable secure field\n * when the buyer comes back. This timer consumes only foreground time.\n */\nfunction setVisibleTimeout(callback: () => void, visibleBudgetMs: number): VisibleTimeout {\n  let remaining = visibleBudgetMs;\n  let startedAt: number | undefined;\n  let timer: number | undefined;\n  let cancelled = false;\n\n  const clear = (): void => {\n    if (timer !== undefined) window.clearTimeout(timer);\n    timer = undefined;\n  };\n  const pause = (): void => {\n    if (startedAt === undefined) return;\n    remaining = Math.max(0, remaining - (Date.now() - startedAt));\n    startedAt = undefined;\n    clear();\n  };\n  const expire = (): void => {\n    if (cancelled) return;\n    pause();\n    if (remaining === 0) {\n      cancelled = true;\n      document.removeEventListener('visibilitychange', onVisibilityChange);\n      callback();\n    }\n  };\n  const resume = (): void => {\n    if (cancelled || startedAt !== undefined) return;\n    startedAt = Date.now();\n    timer = window.setTimeout(expire, remaining);\n  };\n  const onVisibilityChange = (): void => {\n    if (document.visibilityState === 'hidden') pause();\n    else resume();\n  };\n\n  document.addEventListener('visibilitychange', onVisibilityChange);\n  if (document.visibilityState !== 'hidden') resume();\n  return {\n    cancel(): void {\n      if (cancelled) return;\n      cancelled = true;\n      clear();\n      document.removeEventListener('visibilitychange', onVisibilityChange);\n    }\n  };\n}\n", "import { BemonyPaymentForm as WebPaymentForm } from './mount.js';\n\ndeclare global {\n  var BemonyPaymentForm: typeof WebPaymentForm;\n}\n\n/** Script-tag distribution exposes exactly the same Web SDK surface as ESM. */\nglobalThis.BemonyPaymentForm = WebPaymentForm;\n"],
+  "mappings": "mBAIO,SAASA,EACdC,EACAC,EACAC,EACAC,EAAwB,CAAC,EACP,CAClB,MAAO,CACL,KAAAH,EACA,QAAAC,EACA,GAAGG,EAAyBJ,CAAI,EAChC,GAAGG,EACH,GAAID,IAAc,OAAY,CAAC,EAAI,CAAE,UAAAA,CAAU,CACjD,CACF,CAGO,SAASG,EAA0BC,EAA2C,CACnF,GAAM,CAAE,SAAAC,EAAU,MAAAC,EAAO,GAAGC,CAAK,EAAIH,EACrC,MAAO,CACL,GAAGG,EACH,GAAGL,EAAyBE,EAAM,IAAI,EACtC,GAAIC,IAAa,OAAY,CAAC,EAAI,CAAE,SAAAA,CAAS,EAC7C,GAAIC,IAAU,OAAY,CAAC,EAAI,CAAE,MAAAA,CAAM,CACzC,CACF,CAEO,SAASJ,EACdJ,EACgF,CAChF,OAAQA,EAAM,CACZ,IAAK,oBACL,IAAK,yBACH,MAAO,CAAE,SAAU,aAAc,MAAO,mBAAoB,EAC9D,IAAK,0BACL,IAAK,2BACL,IAAK,2BACL,IAAK,qBACH,MAAO,CAAE,SAAU,gBAAiB,MAAO,qBAAsB,EACnE,IAAK,iBACL,IAAK,iBACL,IAAK,uBACL,IAAK,gBACH,MAAO,CAAE,SAAU,YAAa,MAAO,UAAW,EACpD,IAAK,oBACL,IAAK,eACL,IAAK,wBACL,IAAK,2BACL,IAAK,qBACL,IAAK,uBACH,MAAO,CACL,SAAU,QACV,MAAOA,IAAS,eAAiB,WAAa,sBAChD,EACF,IAAK,2BACL,IAAK,sBACH,MAAO,CAAE,SAAU,eAAgB,MAAO,mBAAoB,EAChE,IAAK,kBACL,IAAK,oBACH,MAAO,CAAE,SAAU,WAAY,MAAO,UAAW,EACnD,IAAK,mBACL,IAAK,iBACL,IAAK,yBACL,IAAK,8BACH,MAAO,CACL,SAAU,UACV,MACEA,IAAS,0BAA4BA,IAAS,8BAC1C,yBACA,oBACR,EACF,IAAK,2BACL,IAAK,qBACL,IAAK,4BACL,IAAK,4BACH,MAAO,CAAE,SAAU,UAAW,MAAO,SAAU,EACjD,QACE,MAAO,CAAE,SAAU,UAAW,MAAO,SAAU,CACnD,CACF,CC3EO,SAASU,EAA0BC,EAA2B,CACnE,IAAMC,EAAWD,EAAM,OAKjBE,EAAWC,EAAYF,GAAU,IAAI,GAAKE,EAAY,OAAO,SAAS,IAAI,EAC1EC,EAAWD,EAAYF,GAAU,QAAQ,GAAKE,EAAY,SAAS,QAAQ,EAC3EE,EAA0D,CAC9D,WAAY,OAAO,QAAQ,WAC3B,kBAAmB,GACnB,YAAaC,GAAY,EACzB,SAAU,UAAU,SACpB,aAAc,OAAO,QAAQ,OAC7B,YAAa,OAAO,QAAQ,MAC5B,sBAAuB,IAAI,KAAK,EAAE,kBAAkB,CACtD,EACMC,EAAMC,EAAQ,CAClB,GAAGC,GAAqB,EACxB,GAAGC,EAAYT,GAAU,GAAG,CAC9B,CAAC,EACKU,EAAyB,CAC7B,GAAGC,GAAgB,EACnB,GAAGX,EACH,GAAIC,IAAa,OAAY,CAAC,EAAI,CAAE,KAAMA,CAAS,EACnD,GAAIE,IAAa,OAAY,CAAC,EAAI,CAAE,SAAAA,CAAS,EAC7C,GAAI,OAAO,KAAKG,CAAG,EAAE,SAAW,EAAI,CAAC,EAAI,CAAE,IAAAA,CAAI,EAC/C,YAAa,CAAE,GAAGF,EAAa,GAAGJ,GAAU,WAAY,CAC1D,EACA,MAAO,CAAE,GAAGD,EAAO,OAAAW,CAAO,CAC5B,CAEA,SAASC,IAAyE,CAChF,IAAMC,EAAY,UAAU,UAC5B,MAAO,CACL,WAAY,4BAA4B,KAAKA,CAAS,EAAI,SAAW,UACrE,GAAI,cAAc,KAAKA,CAAS,EAC5B,UACA,WAAW,KAAKA,CAAS,EACvB,UACA,wBAAwB,KAAKA,CAAS,EACpC,QACA,SAAS,KAAKA,CAAS,EACrB,QACA,OACV,QAAS,SAAS,KAAKA,CAAS,EAC5B,OACA,aAAa,KAAKA,CAAS,EACzB,UACA,YAAY,KAAKA,CAAS,EACxB,SACA,YAAY,KAAKA,CAAS,EACxB,SACA,MACZ,CACF,CAEA,SAASJ,IAA2D,CAClE,IAAMK,EAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM,EACzD,OAAOJ,EAAY,CACjB,OAAQI,EAAO,IAAI,YAAY,GAAK,OACpC,SAAUA,EAAO,IAAI,cAAc,GAAK,OACxC,OAAQA,EAAO,IAAI,YAAY,GAAK,OACpC,QAASA,EAAO,IAAI,aAAa,GAAK,OACtC,KAAMA,EAAO,IAAI,UAAU,GAAK,MAClC,CAAC,CACH,CAEA,SAASJ,EAAYK,EAA8E,CACjG,OAAIA,IAAU,OAAkB,CAAC,EAC1BP,EAAQ,CACb,OAAQQ,EAAiBD,EAAM,MAAM,EACrC,SAAUC,EAAiBD,EAAM,QAAQ,EACzC,OAAQC,EAAiBD,EAAM,MAAM,EACrC,QAASC,EAAiBD,EAAM,OAAO,EACvC,KAAMC,EAAiBD,EAAM,IAAI,CACnC,CAAC,CACH,CAEA,SAASC,EAAiBD,EAAsD,CAC9E,GAAI,OAAOA,GAAU,SAAU,OAC/B,IAAME,EAAaF,EAAM,UAAU,MAAM,EAAE,KAAK,EAChD,GACE,EAAAE,IAAe,IACfA,EAAW,OAAS,KACpBC,GAAoBD,CAAU,GAC9BE,GAAsBF,CAAU,GAIlC,OAAOA,CACT,CAEA,SAASE,GAAsBJ,EAAwB,CACrD,MACE,wDAAwD,KAAKA,CAAK,GAClE,6CAA6C,KAAKA,CAAK,GACvD,6CAA6C,KAAKA,CAAK,CAE3D,CAEA,SAASG,GAAoBH,EAAwB,CACnD,OAAO,MAAM,KAAKA,CAAK,EAAE,KAAMK,GAAc,CAC3C,IAAMC,EAAOD,EAAU,YAAY,CAAC,EACpC,OAAOC,EAAO,IAAMA,IAAS,GAC/B,CAAC,CACH,CAEA,SAASlB,EAAYY,EAA+C,CAClE,GAAI,EAAAA,IAAU,QAAaA,IAAU,IACrC,GAAI,CACF,IAAMO,EAAM,IAAI,IAAIP,CAAK,EACzB,MAAK,CAAC,QAAS,QAAQ,EAAE,SAASO,EAAI,QAAQ,GAC9CA,EAAI,OAAS,GACbA,EAAI,KAAO,GACJA,EAAI,SAAS,GAH6B,MAInD,MAAQ,CACN,MACF,CACF,CAEA,SAAShB,IAAuB,CAC9B,IAAMiB,EAAY,UAClB,GAAI,CACF,OAAOA,EAAU,cAAc,GAAK,EACtC,MAAQ,CACN,MAAO,EACT,CACF,CAEA,SAASf,EAAsDO,EAAa,CAC1E,QAAWS,KAAO,OAAO,KAAKT,CAAK,GAC7BA,EAAMS,CAAG,IAAM,QAAaT,EAAMS,CAAG,IAAM,KAAI,OAAOT,EAAMS,CAAG,EAErE,OAAOT,CACT,CC5HA,IAAIU,EAGG,SAASC,GAAyC,CACvD,OAAI,OAAO,OAAO,QAAW,WAAmB,QAAQ,QAAQ,OAAO,MAAM,GACzED,IAAiB,SACrBA,EAAe,IAAI,QAA2B,CAACE,EAASC,IAAW,CACjE,IAAMC,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,IAAM,4BACbA,EAAO,MAAQ,GACfA,EAAO,eAAiB,SACxBA,EAAO,OAAS,IAAM,CAChB,OAAO,OAAO,QAAW,WAAYF,EAAQ,OAAO,MAAM,EACzDC,EAAO,IAAI,MAAM,0CAA0C,CAAC,CACnE,EACAC,EAAO,QAAU,IAAMD,EAAO,IAAI,MAAM,gCAAgC,CAAC,EACzE,SAAS,KAAK,OAAOC,CAAM,CAC7B,CAAC,GACMJ,EACT,CClCA,IAAMK,GAAc,CAClB,QAAS,0BACT,KAAM,yBACR,EAEMC,GAAsB,GAGtBC,GAA4B,IAC5BC,GAA4C,KAqB3C,SAASC,EACdC,EACAC,EACgC,CAChC,GAAID,IAAe,QAAaA,EAAW,SAAW,EACpD,MAAO,CAAE,SAAU,IAAG,GAAc,QAAS,QAAQ,QAAQ,CAAE,EAGjE,IAAME,EAAmC,CAAC,EACpCC,EAAqBC,GAAkBJ,CAAU,EACjDK,EAAU,QAAQ,IACtBF,EAAmB,IAAI,MAAOG,GAAc,CAC1C,IAAMC,EAAU,MAAMC,GAAWF,EAAWL,CAAW,EAAE,MAAM,IAAG,EAAY,EAC1EM,IAAY,SAAWL,EAASI,EAAU,SAAS,EAAIC,EAC7D,CAAC,CACH,EAAE,KAAK,IAAG,EAAY,EAEtB,MAAO,CACL,SAAU,IAAME,GAAgBP,CAAQ,EACxC,QAAAG,CACF,CACF,CAQA,SAASD,GAAkBJ,EAAuD,CAChF,IAAMU,EAA4B,CAAC,EAC7BC,EAAW,IAAI,IAIrB,QAAWL,KAAaN,EAAW,MAAM,EAAGH,EAAyB,EACnE,GAAKe,GAAgBN,CAAS,GAC1B,CAAAK,EAAS,IAAIL,EAAU,SAAS,IACpCK,EAAS,IAAIL,EAAU,SAAS,EAChCI,EAAS,KAAKJ,CAAS,EACnBI,EAAS,SAAWd,IAAqB,MAE/C,OAAOc,CACT,CAEA,SAASD,GAAgBP,EAAsD,CAC7E,GAAI,OAAO,KAAKA,CAAQ,EAAE,SAAW,EAAG,OACxC,IAAMW,EAAUC,GAAW,CAAE,GAAGZ,CAAS,CAAC,EAG1C,OAAOW,EAAQ,QAAUf,GAA4Ce,EAAU,MACjF,CAEA,eAAeL,GACbF,EACAL,EAC6B,CAC7B,GAAIK,EAAU,WAAa,UAAYA,EAAU,YAAc,QAAS,CACtE,IAAMS,GAAU,MAAMC,EAAW,GAAGV,EAAU,SAAS,EACvD,GAAIS,IAAW,MAAQA,EAAO,qBAAuB,OAAW,OAChE,IAAME,EAAS,MAAMF,EAAO,mBAAmB,EAC/C,OAAOG,GAAeD,CAAM,CAC9B,CACA,IACGX,EAAU,WAAa,OAASA,EAAU,WAAa,aACxDA,EAAU,YAAc,QACxB,CACA,IAAMC,EAAUY,GAAU,EAAE,EAC5B,aAAMC,GAAUd,EAAU,UAAWC,EAASN,CAAW,EAClDM,CACT,CAEF,CAEA,SAASa,GACPC,EACAC,EACArB,EACe,CACf,OAAO,IAAI,QAAc,CAACsB,EAASC,IAAW,CAC5C,IAAMC,EAAS,SAAS,cAAc,QAAQ,EACxCC,EAAM,IAAI,IAAI,eAAgB/B,GAAYM,CAAW,CAAC,EAC5DyB,EAAI,aAAa,IAAI,IAAKL,CAAU,EACpCK,EAAI,aAAa,IAAI,IAAKJ,CAAS,EACnCG,EAAO,IAAMC,EAAI,SAAS,EAC1BD,EAAO,MAAQ,GACfA,EAAO,eAAiB,SACxBA,EAAO,OAAS,IAAMF,EAAQ,EAC9BE,EAAO,QAAU,IAAMD,EAAO,IAAI,MAAM,sCAAsC,CAAC,EAC/E,SAAS,KAAK,OAAOC,CAAM,CAC7B,CAAC,CACH,CAEA,SAASP,GAAeS,EAAoC,CAC1D,GAAI,OAAOA,GAAU,UAAY,6BAA6B,KAAKA,CAAK,EAAG,OAAOA,EAClF,GAAIC,EAASD,CAAK,EAAG,CACnB,IAAME,EAASF,EAAM,GACrB,GAAI,OAAOE,GAAW,UAAY,6BAA6B,KAAKA,CAAM,EAAG,OAAOA,EACpF,GAAID,EAASD,EAAM,YAAY,EAAG,CAChC,IAAMG,EAASH,EAAM,aAAa,GAClC,GAAI,OAAOG,GAAW,UAAY,6BAA6B,KAAKA,CAAM,EAAG,OAAOA,CACtF,CACF,CAEF,CAEA,SAASlB,GAAgBe,EAA+B,CACtD,OACE,OAAOA,EAAM,WAAc,UAC3BA,EAAM,UAAU,SAAW,GAC3BA,EAAM,UAAU,OAAS,IAElB,GACLA,EAAM,WAAa,UAAYA,EAAM,YAAc,QAC9C,uCAAuC,KAAKA,EAAM,SAAS,GAEjEA,EAAM,WAAa,OAASA,EAAM,WAAa,aAChDA,EAAM,YAAc,SAIpB,sDAAsD,KAAKA,EAAM,SAAS,CAE9E,CAEA,SAASR,GAAUY,EAAwB,CACzC,IAAMC,EAAQ,IAAI,WAAWD,EAAS,CAAC,EACvC,cAAO,gBAAgBC,CAAK,EACrB,MAAM,KAAKA,EAAQC,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAChF,CAEA,SAASnB,GAAWa,EAAuC,CACzD,IAAMK,EAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUL,CAAK,CAAC,EACxDO,EAAS,GACb,QAAWD,KAAQD,EAAOE,GAAU,OAAO,aAAaD,CAAI,EAC5D,OAAO,KAAKC,CAAM,CACpB,CAEA,SAASN,EAASD,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CCjKA,eAAsBQ,GAAsBC,EAA4C,CACtF,IAAMC,GAAU,MAAMC,EAAW,GAAGF,EAAO,cAAc,EACzD,GAAIC,IAAW,KAAM,MAAM,IAAI,MAAM,iCAAiC,EAEtE,IADe,MAAMA,EAAO,iBAAiB,CAAE,aAAcD,EAAO,YAAa,CAAC,GACvE,QAAU,OAAW,MAAM,IAAI,MAAM,+BAA+B,CACjF,CCuCO,SAASG,GAAqBC,EAA6C,CAChF,GAAI,CAACC,GAAQD,CAAK,EAAG,MAAO,GAC5B,OAAQA,EAAM,KAAM,CAClB,IAAK,QACL,IAAK,UACL,IAAK,iBACH,OAAOE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,MAAM,CAAC,EACpE,IAAK,gBACH,OAAOE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,MAAM,CAAC,EACpE,IAAK,aACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAS,YAAY,CAAC,GAClFG,GAAaH,EAAM,KAAK,GACxB,OAAOA,EAAM,YAAe,UAC5B,OAAO,UAAUA,EAAM,UAAU,GACjCA,EAAM,YAAc,GACpBA,EAAM,YAAc,KAAU,GAAK,IAEvC,IAAK,aACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEI,GAAsBJ,EAAM,MAAM,EAEtC,IAAK,SACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEK,GAASL,EAAM,MAAM,EAEzB,IAAK,UACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,QAAQ,CAAC,GACrEM,GAAcN,EAAM,MAAM,EAE9B,IAAK,aACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,OAAO,CAAC,GACpEO,GAAYP,EAAM,KAAK,EAE3B,IAAK,UACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,YAAa,SAAS,CAAC,GACnFQ,EAAKR,EAAM,SAAS,GACpBS,GAAUT,EAAM,OAAO,EAE3B,IAAK,QACH,OACEE,EAAQF,EAAO,CAAC,UAAW,UAAW,aAAc,OAAQ,YAAa,OAAO,CAAC,IAChFA,EAAM,YAAc,QAAaQ,EAAKR,EAAM,SAAS,IACtDU,GAAQV,EAAM,KAAK,EAEvB,QACE,MAAO,EACX,CACF,CAmDA,SAASW,GAAQC,EAAyD,CACxE,OACEC,EAASD,CAAK,GACdA,EAAM,UAAY,uBAClBA,EAAM,UAAY,GAClBE,EAAKF,EAAM,UAAU,GACrB,OAAOA,EAAM,MAAS,QAE1B,CAEA,SAASG,EAAQH,EAAgCI,EAAkC,CACjF,OAAO,OAAO,KAAKJ,CAAK,EAAE,MAAOK,GAAQD,EAAK,SAASC,CAAG,CAAC,CAC7D,CAEA,SAASH,EAAKF,EAAiC,CAC7C,OAAO,OAAOA,GAAU,UAAY,yBAAyB,KAAKA,CAAK,CACzE,CAeA,SAASM,GAAsBC,EAA8C,CAC3E,OACEC,EAASD,CAAK,GACdE,EAAQF,EAAO,CAAC,WAAY,eAAgB,gBAAgB,CAAC,GAC7DG,GAAiBH,EAAM,QAAQ,GAC/B,OAAOA,EAAM,cAAiB,UAC9B,uDAAuD,KAAKA,EAAM,YAAY,GAC9E,OAAOA,EAAM,gBAAmB,UAChC,wCAAwC,KAAKA,EAAM,cAAc,CAErE,CAEA,SAASG,GAAiBH,EAAiC,CACzD,OAAO,OAAOA,GAAU,UAAY,2BAA2B,KAAKA,CAAK,CAC3E,CAMA,SAASI,GAASC,EAA4C,CAC5D,OACE,OAAOA,GAAU,UACjB,CACE,WACA,QACA,aACA,aACA,qBACA,aACA,aACA,WACA,WACA,SACA,UACA,UACA,0BACA,WACF,EAAE,SAASA,CAAK,CAEpB,CAEA,SAASC,GAAaD,EAAiE,CACrF,OACE,OAAOA,GAAU,UACjB,CACE,yBACA,iBACA,sBACA,uBACA,2BACF,EAAE,SAASA,CAAK,CAEpB,CAEA,SAASE,GAAcF,EAAiC,CACtD,OAAO,OAAOA,GAAU,UAAY,OAAO,UAAUA,CAAK,GAAKA,GAAS,IAAMA,GAAS,IACzF,CAEA,SAASG,GAAYH,EAAoC,CACvD,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CAAC,WAAY,OAAO,CAAC,GACpC,OAAOA,EAAM,UAAa,WAC1B,OAAOA,EAAM,OAAU,SAE3B,CAEA,SAASM,GAAUN,EAAqC,CACtD,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CAAC,YAAa,QAAQ,CAAC,GACtC,OAAOA,EAAM,WAAc,UAC3B,6BAA6B,KAAKA,EAAM,SAAS,IAChDA,EAAM,SAAW,cAAgBA,EAAM,SAAW,WAEvD,CAEA,SAASO,GAAQP,EAA2C,CAC1D,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CACb,OACA,UACA,WACA,QACA,YACA,YACA,YACA,aACA,oBACA,aACA,SACF,CAAC,GACD,OAAOA,EAAM,MAAS,UACtB,yBAAyB,KAAKA,EAAM,IAAI,GACxC,OAAOA,EAAM,SAAY,UACzBA,EAAM,QAAQ,QAAU,MACvBA,EAAM,WAAa,QACjB,OAAOA,EAAM,UAAa,UACzB,CACE,aACA,gBACA,YACA,QACA,eACA,WACA,UACA,UACA,SACF,EAAE,SAASA,EAAM,QAAQ,KAC5BA,EAAM,QAAU,QACd,OAAOA,EAAM,OAAU,UACtB,CACE,WACA,yBACA,iBACA,sBACA,uBACA,4BACA,oBACA,WACA,qBACA,yBACA,SACF,EAAE,SAASA,EAAM,KAAK,KACzBA,EAAM,YAAc,QAAaQ,EAAKR,EAAM,SAAS,KACrDA,EAAM,YAAc,QAClB,OAAOA,EAAM,WAAc,UAC1B,6BAA6B,KAAKA,EAAM,SAAS,KACpDA,EAAM,YAAc,QAAa,OAAOA,EAAM,WAAc,aAC5DA,EAAM,aAAe,QACnB,OAAOA,EAAM,YAAe,UAC3B,OAAO,UAAUA,EAAM,UAAU,GACjCA,EAAM,YAAc,KACpBA,EAAM,YAAc,OACvBA,EAAM,oBAAsB,QAC1B,OAAOA,EAAM,mBAAsB,UAClCA,EAAM,kBAAkB,OAAS,GACjCA,EAAM,kBAAkB,QAAU,OACrCA,EAAM,aAAe,QACpBA,EAAM,aAAe,kBACrBA,EAAM,aAAe,gBACtBA,EAAM,UAAY,QAAaS,GAAeT,EAAM,OAAO,EAEhE,CAEA,SAASS,GAAeT,EAAyB,CAC/C,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CAAC,KAAM,cAAe,WAAY,aAAa,CAAC,GAC/D,OAAOA,EAAM,IAAO,UACpB,6BAA6B,KAAKA,EAAM,EAAE,IACzCA,EAAM,cAAgB,WAAaA,EAAM,cAAgB,SAC1D,OAAOA,EAAM,UAAa,UAC1B,aAAa,KAAKA,EAAM,QAAQ,GAChCU,GAAmBV,EAAM,WAAW,CAExC,CAEA,SAASU,GAAmBV,EAAyB,CACnD,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CACb,KACA,SACA,SACA,WACA,WACA,oBACA,UACF,CAAC,GACD,OAAOA,EAAM,IAAO,UACpB,6BAA6B,KAAKA,EAAM,EAAE,GAC1CW,GAAgBX,EAAM,MAAM,GAC5B,OAAO,cAAcA,EAAM,MAAM,GACjC,OAAOA,EAAM,UAAa,UAC1B,aAAa,KAAKA,EAAM,QAAQ,GAChCY,EAAaZ,EAAM,QAAQ,GAC3BY,EAAaZ,EAAM,iBAAiB,IACnCA,EAAM,WAAa,QACjB,MAAM,QAAQA,EAAM,QAAQ,GAC3BA,EAAM,SAAS,QAAU,IACzBA,EAAM,SAAS,MAAMa,EAAc,EAE3C,CAEA,SAASA,GAAeb,EAAyB,CAC/C,OACEI,EAASJ,CAAK,GACdK,EAAQL,EAAO,CACb,UACA,WACA,SACA,WACA,gBACA,eACA,iBACA,oBACA,UACA,YACA,OACF,CAAC,GACDc,EAAgBd,EAAM,OAAO,GAC7BY,EAAaZ,EAAM,QAAQ,GAC3BY,EAAaZ,EAAM,MAAM,GACzBY,EAAaZ,EAAM,QAAQ,GAC3BY,EAAaZ,EAAM,aAAa,GAChCY,EAAaZ,EAAM,YAAY,GAC/BY,EAAaZ,EAAM,cAAc,GACjCY,EAAaZ,EAAM,iBAAiB,GACpCY,EAAaZ,EAAM,OAAO,GAC1Bc,EAAgBd,EAAM,SAAS,GAC/Bc,EAAgBd,EAAM,KAAK,CAE/B,CAEA,SAASW,GAAgBX,EAAyB,CAChD,OACE,OAAOA,GAAU,UACjB,CACE,aACA,aACA,WACA,WACA,SACA,UACA,UACA,yBACF,EAAE,SAASA,CAAK,CAEpB,CAEA,SAASY,EAAaZ,EAAyB,CAC7C,OACEA,IAAU,QAAc,OAAOA,GAAU,UAAYA,EAAM,OAAS,GAAKA,EAAM,QAAU,GAE7F,CAEA,SAASc,EAAgBd,EAAyB,CAChD,OACEA,IAAU,QAAc,OAAOA,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAAS,CAEjG,CAgGA,SAASe,EAASC,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CC/fA,IAAMC,EAAwB,kCACxBC,GAAoB,IACpBC,GAAqB,GAIrBC,GAA6B,IAItBC,GAAoB,CAC/B,MAAMC,EAAgE,CACpE,IAAMC,EAASC,GAAcF,EAAQ,MAAM,EAC3C,GAAI,CAACG,GAAeH,EAAQ,YAAY,EACtC,OAAO,QAAQ,OACbI,EAAU,0BAA2B,4CAAmC,CAC1E,EAEF,GAAIJ,EAAQ,QAAQ,QAClB,OAAO,QAAQ,OAAOI,EAAU,uBAAwB,2BAA2B,CAAC,EAMtF,IAAMC,EAAwBC,EAC5BN,EAAQ,eACRA,EAAQ,aAAa,WAAW,UAAU,EAAI,UAAY,MAC5D,EAEMO,EAAa,OAAO,WAAW,EAC/BC,EAAcC,GAAmB,EACvCC,GAAsBF,CAAW,EACjC,IAAMG,EAAO,SAAS,cAAc,KAAK,EACzCA,EAAK,QAAQ,kBAAoB,GACjC,IAAMC,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,MAAQ,0BACfA,EAAO,aAAa,QAAS,WAAW,EACxCA,EAAO,aAAa,iBAAkB,aAAa,EACnD,IAAIC,EAAgB,IACpBC,EAAeF,EAAQC,CAAa,EACpCF,EAAK,MAAM,QAAU,sEACrBA,EAAK,OAAOC,CAAM,EAClBX,EAAO,OAAOU,CAAI,EAElB,IAAII,EAAY,GACZC,EAAU,GACVC,EACAC,EAAe,EACfC,EAAwB,EACxBC,EACF,yBACEC,EACAC,EACAC,EAA8B,KAC9BC,EAAkC,KAClCC,EACAC,EAA0B,CAAE,OAAQ,WAAY,MAAO,GAAO,aAAc,EAAM,EAClFC,EACAC,EAQAC,EAAoD,IAAG,GAErDC,EAAW,CAAIC,EAAsCC,IAAmB,CAC5E,GAAI,CACFD,IAAKC,CAAK,CACZ,MAAQ,CAER,CACF,EACMC,EAAeC,GAAkCJ,EAAS9B,EAAQ,QAASkC,CAAK,EAChFC,EAAQC,GAAsC,CAClDxB,EAAO,eAAe,YAAYwB,EAAS5B,CAAW,CACxD,EACM6B,EAAgB,IAAY,CAC5BhB,IAAY,SAChBA,EAAQ,OAAO,EACfA,EAAU,OACNE,IAAiB,KAAM,SAAS,KAAK,MAAM,eAAe,UAAU,EACnE,SAAS,KAAK,aAAa,QAASA,CAAY,EACjDC,IAAqB,KAAM,SAAS,gBAAgB,MAAM,eAAe,UAAU,EAClF,SAAS,gBAAgB,aAAa,QAASA,CAAgB,EACpED,EAAe,KACfC,EAAmB,KACnBF,EAAqB,OACrBR,EAAeF,EAAQC,CAAa,EACpCD,EAAO,gBAAgB,MAAM,EAC7BA,EAAO,gBAAgB,YAAY,EACnCA,EAAO,gBAAgB,YAAY,EACrC,EACM0B,GAAc,IAAY,CAC9B,GAAItC,EAAQ,SAAS,eAAiB,SAAWqB,IAAY,OAAW,OACxEA,EAAU,SAAS,cAAc,KAAK,EACtCA,EAAQ,QAAQ,0BAA4B,GAK5CA,EAAQ,aAAa,cAAe,MAAM,EAC1CT,EAAO,aAAa,WAAY,IAAI,EACpCA,EAAO,aAAa,OAAQ,QAAQ,EACpCA,EAAO,aAAa,aAAc,MAAM,EACxCA,EAAO,aAAa,aAAc,oCAA8B,EAChES,EAAQ,MAAM,QAAU,CACtB,iBACA,UAIA,qBACA,eACA,qBACA,yBACA,YACA,cAAcrB,EAAQ,YAAY,SAAS,eAAiB,qBAAqB,EACnF,EAAE,KAAK,GAAG,EACV,IAAMuC,EAAc,IAAY,CAC9B3B,EAAO,MAAM,QAAU,CACrB,iBACA,WACA,UACA,qBACA,gBACA,aAAahB,EAAiB,0BAC9B,cAAciB,CAAa,2BAC3B,WACA,iBAAiBhB,EAAkB,KACnC,kBACA,kBACA,kBACA,iCACF,EAAE,KAAK,GAAG,CACZ,EACAyB,EAAqBiB,EACrBhB,EAAe,SAAS,KAAK,aAAa,OAAO,EACjDC,EAAmB,SAAS,gBAAgB,aAAa,OAAO,EAChE,SAAS,KAAK,MAAM,YAAY,WAAY,SAAU,WAAW,EACjE,SAAS,gBAAgB,MAAM,YAAY,WAAY,SAAU,WAAW,EAC5Ee,EAAY,EACZ,SAAS,KAAK,OAAOlB,CAAO,EAC5B,OAAO,sBAAsB,IAAMT,EAAO,MAAM,CAAE,cAAe,EAAK,CAAC,CAAC,CAC1E,EACM4B,GAAgBC,GAAoC,CACpD1B,IACJW,EAAQ,CACN,GAAGA,EACH,OAAAe,EACA,MAAOzB,EACP,aAAc,CAAC,aAAc,aAAc,qBAAsB,YAAY,EAAE,SAC7EyB,CACF,CACF,EACAX,EAAS9B,EAAQ,eAAgByC,CAAM,EACzC,EACMC,GAAc,CAACC,EAA4BC,IAA6B,CAC5E,GAAIA,IAAc,QAAahB,IAAW,QAAaA,EAAO,YAAcgB,EAAW,OACvF,IAAMC,EAAQC,EACZH,EAAS,QAAU,QAAa,CAAC3B,EAC7B,CAAE,GAAG2B,EAAU,SAAU,QAAS,MAAOvB,CAAW,EACpDuB,CACN,EA+BA,GA9BAN,EAAc,GAMZQ,EAAM,OAAS,0BACfA,EAAM,OAAS,+BACdD,IAAc,QAAaC,EAAM,YAAc,MAEhDlB,EAAekB,GAEjBnB,EAAQ,CACN,GAAGA,EACH,GAAIC,IAAiB,OAAY,CAAE,OAAQ,SAAmB,EAAI,CAAC,EACnE,MAAAkB,EACA,aAAc,EAChB,EACAf,EAAS9B,EAAQ,QAAS6C,CAAK,EAC/BZ,EAAY,CACV,KAAOjB,EAA2B,iBAAjB,eACjB,GAAIA,EACA,CAAC,EACD,CACE,QAASE,EACT,WAAY,KAAK,IAAI,EAAIC,EACzB,MAAO0B,EAAM,OAASzB,CACxB,EACJ,MAAAyB,CACF,CAAC,EACG,CAAC7B,GAAWS,IAAgB,OAAW,CACzCR,GAAgB,OAAO,EACvB,IAAM8B,EAAStB,EACfA,EAAc,OACduB,EAAQ,EACRD,EAAOF,CAAK,EACZ,MACF,CACIjB,IAAW,SACbA,EAAO,OAAOiB,CAAK,EACnBjB,EAAS,OAEb,EACMoB,EAAU,IAAY,CAC1B,GAAI,CAAAjC,IACJA,EAAY,GACZE,GAAgB,OAAO,EACvB,OAAO,oBAAoB,UAAWY,CAAS,EAC/C7B,EAAQ,QAAQ,oBAAoB,QAASgD,CAAO,EACpDX,EAAc,EACdF,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,UACN,WAAA5B,CACF,CAAC,EACDK,EAAO,OAAO,EACdD,EAAK,OAAO,EACZiB,GAAQ,OAAOxB,EAAU,iBAAkB,8CAA2C,CAAC,EACvFwB,EAAS,OACTF,EAAQ,CAAE,GAAGA,EAAO,OAAQ,YAAa,MAAO,GAAO,aAAc,EAAM,EAC3EO,EAAY,CAAE,KAAM,WAAY,CAAC,EAC7B,CAACjB,GAAWS,IAAgB,QAAW,CACzC,IAAMsB,EAAStB,EACfA,EAAc,OACdsB,EAAO3C,EAAU,uBAAwB,2BAA2B,CAAC,CACvE,CACF,EACM6C,GAAgC,CACpC,IAAIC,EAAsC,CACxC,GAAInC,EACF,OAAO,QAAQ,OACbX,EAAU,gBAAiB,8CAA2C,CACxE,EACF,GAAI,CAACY,EACH,OAAO,QAAQ,OACbZ,EAAU,iBAAkB,2DAAkD,CAChF,EACF,GAAIuB,IAAiB,OAAW,OAAO,QAAQ,OAAOA,CAAY,EAClE,GAAIC,IAAW,OAAW,OAAOA,EAAO,QACxC,IAAMgB,EAAY,OAAO,WAAW,EAChCO,EACAJ,EACEK,EAAU,IAAI,QAAoB,CAACC,GAAaC,KAAe,CACnEH,EAAUE,GACVN,EAASO,EACX,CAAC,EACD1B,EAAS,CAAE,UAAAgB,EAAW,QAAAQ,EAAS,QAAAD,EAAS,OAAAJ,CAAO,EAC/Cd,EAAY,CAAE,KAAM,iBAAkB,CAAC,EACvC,IAAMsB,GAAgBC,EAA0BN,CAAK,EAC/CO,EAAWpD,EAAsB,SAAS,EAChD,OAAA8B,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,MACN,WAAA5B,EACA,UAAAqC,EACA,MAAOW,GACP,GAAIE,IAAa,OAAY,CAAC,EAAI,CAAE,sBAAuBA,CAAS,CACtE,CAAC,EACML,CACT,EACA,SAAU,IAAM1B,EAChB,QAAAsB,CACF,EACMU,GAAe,IAAI,QAA6B,CAACP,EAASJ,IAAW,CACzEtB,EAAcsB,EACd,IAAMY,EAAoB,IAAY,CACpC1C,GAAgB,OAAO,EACvBC,GAAgB,EAChBC,EAAwB,KAAK,IAAI,EACjCc,EAAY,CACV,KAAMf,IAAiB,EAAI,gBAAkB,cAC7C,QAASA,CACX,CAAC,EACDE,EAAa,yBACb,IAAMwC,EAAS,IAAI,IAAI,SAAUpD,CAAW,EAC5CoD,EAAO,aAAa,IAAI,WAAYrD,CAAU,EAG9CqD,EAAO,aAAa,IAAI,eAAgB,OAAO1C,CAAY,CAAC,EAC5DN,EAAO,IAAMgD,EAAO,SAAS,EAC7B3C,EAAiB4C,GAAkB,IAAM,CACnC7C,GAAWD,GACfkB,EAAY,CACV,KAAM,aACN,QAASf,EACT,WAAY,KAAK,IAAI,EAAIC,EACzB,MAAOC,CACT,CAAC,CACH,EAAGtB,EAA0B,CAC/B,EACA+B,EAAaK,GAAuC,CAGlD,GAFInB,GAAamB,EAAM,SAAW1B,GAAe0B,EAAM,SAAWtB,EAAO,eAErE,CAACkD,GAAqB5B,EAAM,IAAI,GAAKA,EAAM,KAAK,aAAe3B,EAAY,OAC/E,IAAM6B,EAA8BF,EAAM,KAC1C,GAAIE,EAAQ,OAAS,QAAS,CAC5BhB,EAAa,4BAGbH,GAAgB,OAAO,EACvBkB,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,OACN,WAAA5B,EACA,aAAcP,EAAQ,aACtB,aAAcA,EAAQ,SAAS,cAAgB,QAC/C,GAAIA,EAAQ,aAAe,OAAY,CAAC,EAAI,CAAE,WAAYA,EAAQ,UAAW,CAC/E,CAAC,EACD,MACF,CACA,GAAIoC,EAAQ,OAAS,UAAW,CAC9B,GAAIpB,EAAS,OACbA,EAAU,GACVC,GAAgB,OAAO,EACvBQ,EAAc,OACdC,EAAQ,CAAE,GAAGA,EAAO,OAAQ,QAAS,MAAO,EAAK,EACjDI,EAAS9B,EAAQ,QAAS,MAAS,EACnC8B,EAAS9B,EAAQ,eAAgB,OAAO,EACxCiC,EAAY,CACV,KAAM,UACN,QAASf,EACT,WAAY,KAAK,IAAI,EAAIC,EACzB,MAAO,2BACT,CAAC,EACDgC,EAAQF,EAAQ,EAChB,MACF,CACA,GAAIb,EAAQ,OAAS,aAAc,CACjCH,EAAY,CACV,KAAM,aACN,QAASf,EACT,WAAYkB,EAAQ,WACpB,MAAOA,EAAQ,KACjB,CAAC,EACD,MACF,CACA,GAAIA,EAAQ,OAAS,SAAU,OAAOI,GAAaJ,EAAQ,MAAM,EACjE,GAAIA,EAAQ,OAAS,aACnB,OAAON,EAAS9B,EAAQ,kBAAmBoC,EAAQ,KAAK,EAC1D,GAAIA,EAAQ,OAAS,UAAW,CAC9BvB,EAAgBuB,EAAQ,OACpBf,IAAY,OAAWP,EAAeF,EAAQC,CAAa,EAC1DS,IAAqB,EAC1B,MACF,CACA,GAAIc,EAAQ,OAAS,aAAc,CAI5B2B,GAAsB3B,EAAQ,MAAM,EAAE,KACzC,IAAM,CACJD,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,oBACN,WAAA5B,EACA,SAAU6B,EAAQ,OAAO,SACzB,OAAQ,WACV,CAAC,CACH,EACA,IAAM,CACJD,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,oBACN,WAAA5B,EACA,SAAU6B,EAAQ,OAAO,SACzB,OAAQ,QACV,CAAC,CACH,CACF,EACA,MACF,CACA,GAAIA,EAAQ,OAAS,gBAAiB,CAIpCE,GAAY,EACZ,OAAO,sBAAsB,IAAM,CACjC,OAAO,sBAAsB,IAAM,CACjCH,EAAK,CACH,QAAS,sBACT,QAAS,EACT,KAAM,qBACN,WAAA5B,CACF,CAAC,CACH,CAAC,CACH,CAAC,EACD,MACF,CACA,GAAI6B,EAAQ,OAAS,iBAAkB,OAAOC,EAAc,EAC5D,GACED,EAAQ,OAAS,YAChBR,IAAW,QAAaA,EAAO,YAAcQ,EAAQ,WACtD,CACAC,EAAc,EACdV,EAAe,OACfD,EAAQ,CACN,OAAQU,EAAQ,QAAQ,OACxB,MAAO,GACP,aAAc,GACd,QAASA,EAAQ,OACnB,EACAN,EAAS9B,EAAQ,eAAgBoC,EAAQ,QAAQ,MAAM,EACvDN,EAAS9B,EAAQ,UAAWoC,EAAQ,OAAO,EAC3CH,EAAY,CAAE,KAAM,mBAAoB,CAAC,EACzCL,GAAQ,QAAQQ,EAAQ,OAAO,EAC/BR,EAAS,OACT,MACF,CACIQ,EAAQ,OAAS,SAASM,GAAYN,EAAQ,MAAOA,EAAQ,SAAS,CAC5E,EACA,OAAO,iBAAiB,UAAWP,CAAS,EAC5CjB,EAAO,iBAAiB,OAAQ,IAAM,CAChC,CAACI,GAAW,CAACD,GAAaK,IAAe,2BAC3CA,EAAa,iBAEjB,CAAC,EACDuC,EAAkB,CACpB,CAAC,EACD,OAAA3D,EAAQ,QAAQ,iBAAiB,QAASgD,EAAS,CAAE,KAAM,EAAK,CAAC,EAC1DU,EACT,CACF,EAEA,SAASxD,GAAcD,EAA2C,CAChE,IAAM+D,EAAU,OAAO/D,GAAW,SAAW,SAAS,cAA2BA,CAAM,EAAIA,EAC3F,GAAI+D,IAAY,MAAQ,EAAEA,aAAmB,aAC3C,MAAM5D,EAAU,oBAAqB,oDAAiD,EACxF,OAAO4D,CACT,CAEA,SAAS7D,GAAe6B,EAAwB,CAC9C,MAAO,yCAAyC,KAAKA,CAAK,CAC5D,CAEA,SAASvB,IAA6B,CACpC,IAAMwD,EAAiB,CAAC,YAAa,YAAa,OAAO,EAAE,SAAS,OAAO,SAAS,QAAQ,EACtFC,EACJ,WACA,kCACF,GAAI,CAACD,GAAkBC,IAAe,OAAW,OAAOvE,EAExD,GAAI,CACF,IAAMwE,EAAM,IAAI,IAAID,CAAU,EAC9B,MACE,CAAC,CAAC,QAAS,QAAQ,EAAE,SAASC,EAAI,QAAQ,GAC1CA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,MACJA,EAAI,UACJA,EAAI,SAEGxE,EAEFwE,EAAI,MACb,MAAQ,CACN,OAAOxE,CACT,CACF,CAOA,SAASe,GAAsB0D,EAAsB,CACnD,QAAWC,IAAO,CAAC,eAAgB,YAAY,EAAY,CAUzD,GATe,MAAM,KAAK,SAAS,KAAK,iBAAkC,MAAM,CAAC,EAAE,KAChFC,GAAS,CACR,GAAI,CACF,OAAOA,EAAK,MAAQD,GAAO,IAAI,IAAIC,EAAK,IAAI,EAAE,SAAWF,CAC3D,MAAQ,CACN,MAAO,EACT,CACF,CACF,EACY,SACZ,IAAMG,EAAO,SAAS,cAAc,MAAM,EAC1CA,EAAK,IAAMF,EACXE,EAAK,KAAOH,EACRC,IAAQ,eAAcE,EAAK,YAAc,aAC7C,SAAS,KAAK,OAAOA,CAAI,CAC3B,CACF,CAEA,SAASzD,EAAeF,EAA2B4D,EAAsB,CACvE5D,EAAO,MAAM,QAAU,mCAAmC4D,CAAM,iBAAiBA,CAAM,sCACvF5D,EAAO,gBAAgB,UAAU,CACnC,CAOA,SAASiD,GAAkB/B,EAAsB2C,EAAyC,CACxF,IAAIC,EAAYD,EACZE,EACAC,EACAC,EAAY,GAEVC,EAAQ,IAAY,CACpBF,IAAU,QAAW,OAAO,aAAaA,CAAK,EAClDA,EAAQ,MACV,EACMG,EAAQ,IAAY,CACpBJ,IAAc,SAClBD,EAAY,KAAK,IAAI,EAAGA,GAAa,KAAK,IAAI,EAAIC,EAAU,EAC5DA,EAAY,OACZG,EAAM,EACR,EACME,EAAS,IAAY,CACrBH,IACJE,EAAM,EACFL,IAAc,IAChBG,EAAY,GACZ,SAAS,oBAAoB,mBAAoBI,CAAkB,EACnEnD,EAAS,GAEb,EACMoD,EAAS,IAAY,CACrBL,GAAaF,IAAc,SAC/BA,EAAY,KAAK,IAAI,EACrBC,EAAQ,OAAO,WAAWI,EAAQN,CAAS,EAC7C,EACMO,EAAqB,IAAY,CACjC,SAAS,kBAAoB,SAAUF,EAAM,EAC5CG,EAAO,CACd,EAEA,gBAAS,iBAAiB,mBAAoBD,CAAkB,EAC5D,SAAS,kBAAoB,UAAUC,EAAO,EAC3C,CACL,QAAe,CACTL,IACJA,EAAY,GACZC,EAAM,EACN,SAAS,oBAAoB,mBAAoBG,CAAkB,EACrE,CACF,CACF,CCrjBA,WAAW,kBAAoBE",
+  "names": ["formError", "code", "message", "requestId", "details", "classifyPaymentFormError", "normalizePaymentFormError", "error", "category", "stage", "base", "enrichPayInputFromBrowser", "input", "declared", "location", "sanitizeUrl", "referrer", "browserInfo", "javaEnabled", "utm", "compact", "campaignFromLocation", "sanitizeUtm", "client", "browserIdentity", "userAgent", "params", "value", "sanitizeUtmValue", "normalized", "hasControlCharacter", "looksLikeSensitiveUtm", "character", "code", "url", "candidate", "key", "stripeScript", "loadStripe", "resolve", "reject", "script", "KOUNT_HOSTS", "MAX_RISK_COLLECTORS", "MAX_RISK_COLLECTOR_INPUTS", "MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH", "startRiskCollectorSessionCollection", "collectors", "environment", "sessions", "acceptedCollectors", "boundedCollectors", "settled", "collector", "session", "collectOne", "boundedSnapshot", "accepted", "seenKeys", "isRiskCollector", "encoded", "base64Json", "stripe", "loadStripe", "result", "radarSessionId", "randomHex", "loadKount", "merchantId", "sessionId", "resolve", "reject", "script", "url", "value", "isRecord", "direct", "nested", "length", "bytes", "byte", "binary", "completeStripeThreeDS", "action", "stripe", "loadStripe", "isFrameToHostMessage", "value", "hasBase", "hasOnly", "isMountStage", "isStripeThreeDSAction", "isStatus", "isFrameHeight", "isCardState", "isId", "isOutcome", "isError", "hasBase", "value", "isRecord", "isId", "hasOnly", "keys", "key", "isStripeThreeDSAction", "value", "isRecord", "hasOnly", "isStripeActionId", "isStatus", "value", "isMountStage", "isFrameHeight", "isCardState", "isRecord", "hasOnly", "isOutcome", "isError", "isId", "isErrorPayment", "isErrorTransaction", "isPaymentStatus", "optionalText", "isErrorAttempt", "optionalInteger", "isRecord", "value", "productionFrameOrigin", "threeDSModalWidth", "threeDSModalRadius", "FORM_MOUNT_SLOW_VISIBLE_MS", "BemonyPaymentForm", "options", "target", "resolveTarget", "isClientSecret", "formError", "riskCollectorSessions", "startRiskCollectorSessionCollection", "instanceId", "frameOrigin", "resolveFrameOrigin", "ensureConnectionHints", "slot", "iframe", "contentHeight", "setInlineStyle", "destroyed", "mounted", "mountSlowTimer", "mountAttempt", "mountAttemptStartedAt", "mountPhase", "overlay", "applyOverlayLayout", "bodyOverflow", "documentOverflow", "rejectMount", "state", "blockedError", "active", "onMessage", "callback", "fn", "value", "reportEvent", "event", "post", "message", "restoreInline", "showOverlay", "applyLayout", "reportStatus", "status", "reportError", "received", "requestId", "error", "normalizePaymentFormError", "reject", "destroy", "instance", "input", "resolve", "promise", "nextResolve", "nextReject", "enrichedInput", "enrichPayInputFromBrowser", "sessions", "mountPromise", "startMountAttempt", "source", "setVisibleTimeout", "isFrameToHostMessage", "completeStripeThreeDS", "element", "isLoopbackHost", "configured", "url", "origin", "rel", "link", "hint", "height", "visibleBudgetMs", "remaining", "startedAt", "timer", "cancelled", "clear", "pause", "expire", "onVisibilityChange", "resume", "BemonyPaymentForm"]
 }

package/dist/browser-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-context.d.ts","sourceRoot":"","sources":["../src/browser-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CA0BnE"}
+{"version":3,"file":"browser-context.d.ts","sourceRoot":"","sources":["../src/browser-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CA8BnE"}

package/dist/contracts/errors.d.ts

@@ -1,5 +1,13 @@
-import type { PaymentFormError } from './types';
-export declare function formError(code: string, message: string, requestId?: string): PaymentFormError;
+import type { PaymentFormError, PaymentFormErrorCategory, PaymentFormErrorStage } from './types';
+type ErrorDetails = Omit<PaymentFormError, 'code' | 'message' | 'requestId'>;
+export declare function formError(code: string, message: string, requestId?: string, details?: ErrorDetails): PaymentFormError;
+/** Adds stable category/stage metadata without changing an existing public code. */
+export declare function normalizePaymentFormError(error: PaymentFormError): PaymentFormError;
+export declare function classifyPaymentFormError(code: string): Readonly<{
+    category: PaymentFormErrorCategory;
+    stage: PaymentFormErrorStage;
+}>;
 export declare function safeError(error: unknown, fallback: string): PaymentFormError;
 export declare function messageFor(code: string): string;
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/contracts/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contracts/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAE7F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAW5E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmB/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contracts/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEjG,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC;AAE7E,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,YAAiB,GACzB,gBAAgB,CAQlB;AAED,oFAAoF;AACpF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAQnF;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,QAAQ,CAAC;IAAE,QAAQ,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAkDhF;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAW5E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmB/C"}