@bemony/payment-form 0.1.8 → 0.1.9

package/dist/index.js

@@ -17,12 +17,16 @@ function enrichPayInputFromBrowser(input) {
     screenWidth: window.screen?.width,
     timezoneOffsetMinutes: (/* @__PURE__ */ new Date()).getTimezoneOffset()
   };
+  const utm = compact({
+    ...campaignFromLocation(),
+    ...sanitizeUtm(declared?.utm)
+  });
   const client = {
     ...browserIdentity(),
     ...location === void 0 ? {} : { page: location },
     ...referrer === void 0 ? {} : { referrer },
     ...declared,
-    utm: { ...campaignFromLocation(), ...declared?.utm },
+    ...Object.keys(utm).length === 0 ? {} : { utm },
     browserInfo: { ...browserInfo, ...declared?.browserInfo }
   };
   return { ...input, client };
@@ -37,7 +41,7 @@ function browserIdentity() {
 }
 function campaignFromLocation() {
   const params = new URLSearchParams(window.location.search);
-  return compact({
+  return sanitizeUtm({
     source: params.get("utm_source") ?? void 0,
     campaign: params.get("utm_campaign") ?? void 0,
     medium: params.get("utm_medium") ?? void 0,
@@ -45,6 +49,33 @@ function campaignFromLocation() {
     term: params.get("utm_term") ?? void 0
   });
 }
+function sanitizeUtm(value) {
+  if (value === void 0) return {};
+  return compact({
+    source: sanitizeUtmValue(value.source),
+    campaign: sanitizeUtmValue(value.campaign),
+    medium: sanitizeUtmValue(value.medium),
+    content: sanitizeUtmValue(value.content),
+    term: sanitizeUtmValue(value.term)
+  });
+}
+function sanitizeUtmValue(value) {
+  if (typeof value !== "string") return void 0;
+  const normalized = value.normalize("NFKC").trim();
+  if (normalized === "" || normalized.length > 120 || hasControlCharacter(normalized) || looksLikeSensitiveUtm(normalized)) {
+    return void 0;
+  }
+  return normalized;
+}
+function looksLikeSensitiveUtm(value) {
+  return /(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(value) || /(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(value) || /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i.test(value);
+}
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.codePointAt(0);
+    return code < 32 || code === 127;
+  });
+}
 function sanitizeUrl(value) {
   if (value === "") return void 0;
   try {
@@ -72,14 +103,8 @@ function compact(value) {
   return value;
 }
 
-// src/stripe-three-ds.ts
+// src/stripe.ts
 var stripeScript;
-async function completeStripeThreeDS(action) {
-  const stripe = (await loadStripe())(action.publishableKey);
-  if (stripe === null) throw new Error("Stripe.js could not initialize.");
-  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });
-  if (result.error !== void 0) throw new Error("Stripe authentication failed.");
-}
 function loadStripe() {
   if (typeof window.Stripe === "function") return Promise.resolve(window.Stripe);
   if (stripeScript !== void 0) return stripeScript;
@@ -98,6 +123,121 @@ function loadStripe() {
   return stripeScript;
 }
 
+// src/risk-collectors.ts
+var KOUNT_HOSTS = {
+  sandbox: "https://tst.kaptcha.com",
+  live: "https://ssl.kaptcha.com"
+};
+var MAX_RISK_COLLECTORS = 12;
+var MAX_RISK_COLLECTOR_INPUTS = 256;
+var MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH = 8192;
+function startRiskCollectorSessionCollection(collectors, environment) {
+  if (collectors === void 0 || collectors.length === 0) {
+    return { snapshot: () => void 0, settled: Promise.resolve() };
+  }
+  const sessions = {};
+  const acceptedCollectors = boundedCollectors(collectors);
+  const settled = Promise.all(
+    acceptedCollectors.map(async (collector) => {
+      const session = await collectOne(collector, environment).catch(() => void 0);
+      if (session !== void 0) sessions[collector.publicKey] = session;
+    })
+  ).then(() => void 0);
+  return {
+    snapshot: () => boundedSnapshot(sessions),
+    settled
+  };
+}
+function boundedCollectors(collectors) {
+  const accepted = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const collector of collectors.slice(0, MAX_RISK_COLLECTOR_INPUTS)) {
+    if (!isRiskCollector(collector)) continue;
+    if (seenKeys.has(collector.publicKey)) continue;
+    seenKeys.add(collector.publicKey);
+    accepted.push(collector);
+    if (accepted.length === MAX_RISK_COLLECTORS) break;
+  }
+  return accepted;
+}
+function boundedSnapshot(sessions) {
+  if (Object.keys(sessions).length === 0) return void 0;
+  const encoded = base64Json({ ...sessions });
+  return encoded.length <= MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH ? encoded : void 0;
+}
+async function collectOne(collector, environment) {
+  if (collector.provider === "stripe" && collector.collector === "radar") {
+    const stripe = (await loadStripe())(collector.publicKey);
+    if (stripe === null || stripe.createRadarSession === void 0) return void 0;
+    const result = await stripe.createRadarSession();
+    return radarSessionId(result);
+  }
+  if ((collector.provider === "nmi" || collector.provider === "seamless") && collector.collector === "kount") {
+    const session = randomHex(32);
+    await loadKount(collector.publicKey, session, environment);
+    return session;
+  }
+  return void 0;
+}
+function loadKount(merchantId, sessionId, environment) {
+  return new Promise((resolve, reject) => {
+    const script = document.createElement("script");
+    const url = new URL("/collect/sdk", KOUNT_HOSTS[environment]);
+    url.searchParams.set("m", merchantId);
+    url.searchParams.set("s", sessionId);
+    script.src = url.toString();
+    script.async = true;
+    script.referrerPolicy = "origin";
+    script.onload = () => resolve();
+    script.onerror = () => reject(new Error("Kount collector could not be loaded."));
+    document.head.append(script);
+  });
+}
+function radarSessionId(value) {
+  if (typeof value === "string" && /^rse_[A-Za-z0-9_-]{4,512}$/.test(value)) return value;
+  if (isRecord(value)) {
+    const direct = value.id;
+    if (typeof direct === "string" && /^rse_[A-Za-z0-9_-]{4,512}$/.test(direct)) return direct;
+    if (isRecord(value.radarSession)) {
+      const nested = value.radarSession.id;
+      if (typeof nested === "string" && /^rse_[A-Za-z0-9_-]{4,512}$/.test(nested)) return nested;
+    }
+  }
+  return void 0;
+}
+function isRiskCollector(value) {
+  if (typeof value.publicKey !== "string" || value.publicKey.length === 0 || value.publicKey.length > 512)
+    return false;
+  if (value.provider === "stripe" && value.collector === "radar")
+    return /^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(value.publicKey);
+  return (value.provider === "nmi" || value.provider === "seamless") && value.collector === "kount" && // Kount accepts both legacy numeric MIDs and Runtime-issued checkout_public_* keys.
+  // The value is serialized by URLSearchParams, so accepting the documented public key format
+  // does not create a URL-injection surface.
+  /^(?:\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(value.publicKey);
+}
+function randomHex(length) {
+  const bytes = new Uint8Array(length / 2);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function base64Json(value) {
+  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/stripe-three-ds.ts
+async function completeStripeThreeDS(action) {
+  const stripe = (await loadStripe())(action.publishableKey);
+  if (stripe === null) throw new Error("Stripe.js could not initialize.");
+  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });
+  if (result.error !== void 0) throw new Error("Stripe authentication failed.");
+}
+
 // src/protocol.ts
 var FORM_PAYMENT_PROTOCOL_VERSION = 1;
 function isFrameToHostMessage(value) {
@@ -126,7 +266,7 @@ function isFrameToHostMessage(value) {
   }
 }
 function hasBase(value) {
-  return isRecord(value) && value.channel === "BEMONY_FORM_PAYMENT" && value.version === FORM_PAYMENT_PROTOCOL_VERSION && isId(value.instanceId) && typeof value.type === "string";
+  return isRecord2(value) && value.channel === "BEMONY_FORM_PAYMENT" && value.version === FORM_PAYMENT_PROTOCOL_VERSION && isId(value.instanceId) && typeof value.type === "string";
 }
 function hasOnly(value, keys) {
   return Object.keys(value).every((key) => keys.includes(key));
@@ -135,7 +275,7 @@ function isId(value) {
   return typeof value === "string" && /^[A-Za-z0-9-]{16,128}$/.test(value);
 }
 function isStripeThreeDSAction(value) {
-  return isRecord(value) && hasOnly(value, ["actionId", "clientSecret", "publishableKey"]) && isStripeActionId(value.actionId) && typeof value.clientSecret === "string" && /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) && typeof value.publishableKey === "string" && /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey);
+  return isRecord2(value) && hasOnly(value, ["actionId", "clientSecret", "publishableKey"]) && isStripeActionId(value.actionId) && typeof value.clientSecret === "string" && /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) && typeof value.publishableKey === "string" && /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey);
 }
 function isStripeActionId(value) {
   return typeof value === "string" && /^pi_[A-Za-z0-9_]{4,256}$/.test(value);
@@ -162,13 +302,13 @@ function isFrameHeight(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 80 && value <= 1200;
 }
 function isCardState(value) {
-  return isRecord(value) && hasOnly(value, ["complete", "valid"]) && typeof value.complete === "boolean" && typeof value.valid === "boolean";
+  return isRecord2(value) && hasOnly(value, ["complete", "valid"]) && typeof value.complete === "boolean" && typeof value.valid === "boolean";
 }
 function isOutcome(value) {
-  return isRecord(value) && hasOnly(value, ["paymentId", "status"]) && typeof value.paymentId === "string" && /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) && (value.status === "AUTHORIZED" || value.status === "CAPTURED");
+  return isRecord2(value) && hasOnly(value, ["paymentId", "status"]) && typeof value.paymentId === "string" && /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) && (value.status === "AUTHORIZED" || value.status === "CAPTURED");
 }
 function isError(value) {
-  return isRecord(value) && hasOnly(value, [
+  return isRecord2(value) && hasOnly(value, [
     "code",
     "message",
     "requestId",
@@ -181,10 +321,10 @@ function isError(value) {
   ]) && typeof value.code === "string" && /^[A-Z][A-Z0-9_]{1,63}$/.test(value.code) && typeof value.message === "string" && value.message.length <= 1e3 && (value.requestId === void 0 || isId(value.requestId)) && (value.paymentId === void 0 || typeof value.paymentId === "string" && /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId)) && (value.retryable === void 0 || typeof value.retryable === "boolean") && (value.httpStatus === void 0 || typeof value.httpStatus === "number" && Number.isInteger(value.httpStatus) && value.httpStatus >= 400 && value.httpStatus <= 599) && (value.upstreamRequestId === void 0 || typeof value.upstreamRequestId === "string" && value.upstreamRequestId.length > 0 && value.upstreamRequestId.length <= 1e3) && (value.frameStage === void 0 || value.frameStage === "FRAME_DOCUMENT" || value.frameStage === "CARD_FRAME") && (value.payment === void 0 || isErrorPayment(value.payment));
 }
 function isErrorPayment(value) {
-  return isRecord(value) && hasOnly(value, ["id", "environment", "currency", "transaction"]) && typeof value.id === "string" && /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) && (value.environment === "sandbox" || value.environment === "live") && typeof value.currency === "string" && /^[A-Z]{3}$/.test(value.currency) && isErrorTransaction(value.transaction);
+  return isRecord2(value) && hasOnly(value, ["id", "environment", "currency", "transaction"]) && typeof value.id === "string" && /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) && (value.environment === "sandbox" || value.environment === "live") && typeof value.currency === "string" && /^[A-Z]{3}$/.test(value.currency) && isErrorTransaction(value.transaction);
 }
 function isErrorTransaction(value) {
-  return isRecord(value) && hasOnly(value, [
+  return isRecord2(value) && hasOnly(value, [
     "id",
     "status",
     "amount",
@@ -195,7 +335,7 @@ function isErrorTransaction(value) {
   ]) && typeof value.id === "string" && /^txn_[A-Za-z0-9_-]{4,128}$/.test(value.id) && isPaymentStatus(value.status) && Number.isSafeInteger(value.amount) && typeof value.currency === "string" && /^[A-Z]{3}$/.test(value.currency) && optionalText(value.provider) && optionalText(value.providerReference) && (value.attempts === void 0 || Array.isArray(value.attempts) && value.attempts.length <= 20 && value.attempts.every(isErrorAttempt));
 }
 function isErrorAttempt(value) {
-  return isRecord(value) && hasOnly(value, [
+  return isRecord2(value) && hasOnly(value, [
     "ordinal",
     "provider",
     "status",
@@ -227,7 +367,7 @@ function optionalText(value) {
 function optionalInteger(value) {
   return value === void 0 || typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -247,6 +387,10 @@ var BemonyPaymentForm = {
     if (options.signal?.aborted) {
       return Promise.reject(formError("INVALID_STATE", "A montagem foi cancelada."));
     }
+    const riskCollectorSessions = startRiskCollectorSessionCollection(
+      options.riskCollectors,
+      options.clientSecret.startsWith("cs_test_") ? "sandbox" : "live"
+    );
     const instanceId = crypto.randomUUID();
     const frameOrigin = resolveFrameOrigin();
     const slot = document.createElement("div");
@@ -426,13 +570,16 @@ var BemonyPaymentForm = {
           reject = nextReject;
         });
         active = { requestId, promise, resolve, reject };
+        const enrichedInput = enrichPayInputFromBrowser(input);
+        const sessions = riskCollectorSessions.snapshot();
         post({
           channel: "BEMONY_FORM_PAYMENT",
           version: FORM_PAYMENT_PROTOCOL_VERSION,
           type: "PAY",
           instanceId,
           requestId,
-          input: enrichPayInputFromBrowser(input)
+          input: enrichedInput,
+          ...sessions === void 0 ? {} : { riskCollectorSessions: sessions }
         });
         return promise;
       },

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/contracts/errors.ts", "../src/browser-context.ts", "../src/stripe-three-ds.ts", "../src/protocol.ts", "../src/mount.ts"],
-  "sourcesContent": ["import type { PaymentFormError } from './types';\n\nexport function formError(code: string, message: string, requestId?: string): PaymentFormError {\n  return requestId === undefined ? { code, message } : { code, message, requestId };\n}\n\nexport function safeError(error: unknown, fallback: string): PaymentFormError {\n  if (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    typeof error.code === 'string'\n  ) {\n    const code = /^[A-Z][A-Z0-9_]{1,63}$/.test(error.code) ? error.code : fallback;\n    return formError(code, messageFor(code));\n  }\n  return formError(fallback, messageFor(fallback));\n}\n\nexport function messageFor(code: string): string {\n  switch (code) {\n    case 'PAY_INPUT_INVALID':\n      return 'Confira os dados do pagador.';\n    case 'PAYMENT_STATUS_UNKNOWN':\n      return 'Ainda estamos confirmando o pagamento.';\n    case 'SESSION_RECOVERY_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel consultar a sess\u00E3o de pagamento. Tente novamente mais tarde.';\n    case 'PAYMENT_ALREADY_IN_PROGRESS':\n      return 'O pagamento j\u00E1 est\u00E1 em andamento.';\n    case 'CHECKOUT_SESSION_EXPIRED':\n      return 'A sess\u00E3o de pagamento expirou.';\n    case 'TOKENIZATION_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel tokenizar o cart\u00E3o.';\n    case 'THREE_DS_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel concluir a autentica\u00E7\u00E3o do banco.';\n    default:\n      return 'N\u00E3o foi poss\u00EDvel concluir esta etapa do pagamento.';\n  }\n}\n", "import type { CheckoutClient, PayInput } from './contracts/types';\n\n/**\n * Adds non-sensitive browser context at the merchant document, where the\n * hosted iframe cannot read the parent location or its campaign parameters.\n * Explicit merchant values win; no fingerprint is generated here.\n */\nexport function enrichPayInputFromBrowser(input: PayInput): PayInput {\n  const declared = input.client;\n  const location = sanitizeUrl(window.location.href);\n  const referrer = sanitizeUrl(document.referrer);\n  const browserInfo: NonNullable<CheckoutClient['browserInfo']> = {\n    colorDepth: window.screen?.colorDepth,\n    javascriptEnabled: true,\n    javaEnabled: javaEnabled(),\n    language: navigator.language,\n    screenHeight: window.screen?.height,\n    screenWidth: window.screen?.width,\n    timezoneOffsetMinutes: new Date().getTimezoneOffset()\n  };\n  const client: CheckoutClient = {\n    ...browserIdentity(),\n    ...(location === undefined ? {} : { page: location }),\n    ...(referrer === undefined ? {} : { referrer }),\n    ...declared,\n    utm: { ...campaignFromLocation(), ...declared?.utm },\n    browserInfo: { ...browserInfo, ...declared?.browserInfo }\n  };\n  return { ...input, client };\n}\n\nfunction browserIdentity(): Pick<CheckoutClient, 'deviceType' | 'os' | 'browser'> {\n  const userAgent = navigator.userAgent;\n  return {\n    deviceType: /Mobi|Android|iPhone|iPad/i.test(userAgent) ? 'mobile' : 'desktop',\n    os: /Windows NT/i.test(userAgent)\n      ? 'Windows'\n      : /Android/i.test(userAgent)\n        ? 'Android'\n        : /iPhone|iPad|Mac OS X/i.test(userAgent)\n          ? 'Apple'\n          : /Linux/i.test(userAgent)\n            ? 'Linux'\n            : undefined,\n    browser: /Edg\\//i.test(userAgent)\n      ? 'Edge'\n      : /Firefox\\//i.test(userAgent)\n        ? 'Firefox'\n        : /Chrome\\//i.test(userAgent)\n          ? 'Chrome'\n          : /Safari\\//i.test(userAgent)\n            ? 'Safari'\n            : undefined\n  };\n}\n\nfunction campaignFromLocation(): NonNullable<CheckoutClient['utm']> {\n  const params = new URLSearchParams(window.location.search);\n  return compact({\n    source: params.get('utm_source') ?? undefined,\n    campaign: params.get('utm_campaign') ?? undefined,\n    medium: params.get('utm_medium') ?? undefined,\n    content: params.get('utm_content') ?? undefined,\n    term: params.get('utm_term') ?? undefined\n  });\n}\n\nfunction sanitizeUrl(value: string): string | undefined {\n  if (value === '') return undefined;\n  try {\n    const url = new URL(value);\n    if (!['http:', 'https:'].includes(url.protocol)) return undefined;\n    url.search = '';\n    url.hash = '';\n    return url.toString();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction javaEnabled(): boolean {\n  const candidate = navigator as Navigator & { javaEnabled?: () => boolean };\n  try {\n    return candidate.javaEnabled?.() ?? false;\n  } catch {\n    return false;\n  }\n}\n\nfunction compact<T extends Record<string, string | undefined>>(value: T): T {\n  for (const key of Object.keys(value) as Array<keyof T>) {\n    if (value[key] === undefined || value[key] === '') delete value[key];\n  }\n  return value;\n}\n", "type StripeThreeDSAction = Readonly<{\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\ntype StripeResult = Readonly<{\n  error?: Readonly<{ message?: string }>;\n}>;\n\ntype StripeClient = Readonly<{\n  handleNextAction(input: Readonly<{ clientSecret: string }>): Promise<StripeResult>;\n}>;\n\ntype StripeConstructor = (publishableKey: string) => StripeClient | null;\n\ndeclare global {\n  interface Window {\n    Stripe?: StripeConstructor;\n  }\n}\n\nlet stripeScript: Promise<StripeConstructor> | undefined;\n\n/**\n * Runs in the merchant document so Stripe.js can present its native modal at\n * the top-level browsing context. The action is accepted only from the\n * already-bound hosted frame and is never exposed to integration callbacks.\n */\nexport async function completeStripeThreeDS(action: StripeThreeDSAction): Promise<void> {\n  const stripe = (await loadStripe())(action.publishableKey);\n  if (stripe === null) throw new Error('Stripe.js could not initialize.');\n  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });\n  if (result.error !== undefined) throw new Error('Stripe authentication failed.');\n}\n\nfunction loadStripe(): Promise<StripeConstructor> {\n  if (typeof window.Stripe === 'function') return Promise.resolve(window.Stripe);\n  if (stripeScript !== undefined) return stripeScript;\n  stripeScript = new Promise<StripeConstructor>((resolve, reject) => {\n    const script = document.createElement('script');\n    script.src = 'https://js.stripe.com/v3/';\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => {\n      if (typeof window.Stripe === 'function') resolve(window.Stripe);\n      else reject(new Error('Stripe.js loaded without its public API.'));\n    };\n    script.onerror = () => reject(new Error('Stripe.js could not be loaded.'));\n    document.head.append(script);\n  });\n  return stripeScript;\n}\n", "import type {\n  CardState,\n  PaymentFormAppearance,\n  PaymentFormError,\n  PaymentFormStatus,\n  PayInput,\n  PayOutcome,\n  ThreeDSPresentation\n} from './contracts/types';\n\nexport const FORM_PAYMENT_PROTOCOL_VERSION = 1 as const;\n\ntype Base = Readonly<{\n  channel: 'BEMONY_FORM_PAYMENT';\n  version: typeof FORM_PAYMENT_PROTOCOL_VERSION;\n  instanceId: string;\n}>;\n\ntype StripeThreeDSAction = Readonly<{\n  actionId: string;\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nexport type HostToFrameMessage =\n  | (Base &\n      Readonly<{\n        type: 'INIT';\n        clientSecret: string;\n        appearance?: PaymentFormAppearance;\n        presentation: ThreeDSPresentation;\n      }>)\n  | (Base & Readonly<{ type: 'PAY'; requestId: string; input: PayInput }>)\n  | (Base & Readonly<{ type: 'THREE_DS_PRESENTED' }>)\n  | (Base &\n      Readonly<{ type: 'STRIPE_3DS_RESULT'; actionId: string; result: 'SUCCEEDED' | 'FAILED' }>)\n  | (Base & Readonly<{ type: 'DESTROY' }>);\n\nexport type FrameToHostMessage =\n  | (Base & Readonly<{ type: 'READY' | 'MOUNTED' | 'THREE_DS_CLOSE' }>)\n  | (Base & Readonly<{ type: 'THREE_DS_OPEN' }>)\n  | (Base & Readonly<{ type: 'STRIPE_3DS'; action: StripeThreeDSAction }>)\n  | (Base & Readonly<{ type: 'RESIZED'; height: number }>)\n  | (Base & Readonly<{ type: 'STATUS'; status: PaymentFormStatus }>)\n  | (Base & Readonly<{ type: 'CARD_STATE'; state: CardState }>)\n  | (Base & Readonly<{ type: 'SUCCESS'; requestId: string; payment: PayOutcome }>)\n  | (Base & Readonly<{ type: 'ERROR'; requestId?: string; error: PaymentFormError }>);\n\nexport function isFrameToHostMessage(value: unknown): value is FrameToHostMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'READY':\n    case 'MOUNTED':\n    case 'THREE_DS_CLOSE':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'THREE_DS_OPEN':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'action']) &&\n        isStripeThreeDSAction(value.action)\n      );\n    case 'STATUS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'status']) &&\n        isStatus(value.status)\n      );\n    case 'RESIZED':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'height']) &&\n        isFrameHeight(value.height)\n      );\n    case 'CARD_STATE':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'state']) &&\n        isCardState(value.state)\n      );\n    case 'SUCCESS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'payment']) &&\n        isId(value.requestId) &&\n        isOutcome(value.payment)\n      );\n    case 'ERROR':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'error']) &&\n        (value.requestId === undefined || isId(value.requestId)) &&\n        isError(value.error)\n      );\n    default:\n      return false;\n  }\n}\n\nexport function isHostToFrameMessage(value: unknown): value is HostToFrameMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'INIT':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'clientSecret',\n          'appearance',\n          'presentation'\n        ]) &&\n        isClientSecret(value.clientSecret) &&\n        isPresentation(value.presentation) &&\n        (value.appearance === undefined || isAppearance(value.appearance))\n      );\n    case 'PAY':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'input']) &&\n        isId(value.requestId) &&\n        isPayInput(value.input)\n      );\n    case 'THREE_DS_PRESENTED':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS_RESULT':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'actionId', 'result']) &&\n        isStripeActionId(value.actionId) &&\n        (value.result === 'SUCCEEDED' || value.result === 'FAILED')\n      );\n    case 'DESTROY':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    default:\n      return false;\n  }\n}\n\nfunction hasBase(value: unknown): value is Record<string, unknown> & Base {\n  return (\n    isRecord(value) &&\n    value.channel === 'BEMONY_FORM_PAYMENT' &&\n    value.version === FORM_PAYMENT_PROTOCOL_VERSION &&\n    isId(value.instanceId) &&\n    typeof value.type === 'string'\n  );\n}\n\nfunction hasOnly(value: Record<string, unknown>, keys: readonly string[]): boolean {\n  return Object.keys(value).every((key) => keys.includes(key));\n}\n\nfunction isId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9-]{16,128}$/.test(value);\n}\n\nfunction isClientSecret(value: unknown): value is string {\n  return typeof value === 'string' && /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction isStripeThreeDSAction(value: unknown): value is StripeThreeDSAction {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['actionId', 'clientSecret', 'publishableKey']) &&\n    isStripeActionId(value.actionId) &&\n    typeof value.clientSecret === 'string' &&\n    /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) &&\n    typeof value.publishableKey === 'string' &&\n    /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey)\n  );\n}\n\nfunction isStripeActionId(value: unknown): value is string {\n  return typeof value === 'string' && /^pi_[A-Za-z0-9_]{4,256}$/.test(value);\n}\n\nfunction isPresentation(value: unknown): value is ThreeDSPresentation {\n  return value === 'modal' || value === 'inline';\n}\n\nfunction isStatus(value: unknown): value is PaymentFormStatus {\n  return (\n    typeof value === 'string' &&\n    [\n      'MOUNTING',\n      'READY',\n      'TOKENIZING',\n      'SUBMITTING',\n      'AUTHENTICATING_3DS',\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD',\n      'DESTROYED'\n    ].includes(value)\n  );\n}\n\nfunction isFrameHeight(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value >= 80 && value <= 1_200;\n}\n\nfunction isCardState(value: unknown): value is CardState {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['complete', 'valid']) &&\n    typeof value.complete === 'boolean' &&\n    typeof value.valid === 'boolean'\n  );\n}\n\nfunction isOutcome(value: unknown): value is PayOutcome {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['paymentId', 'status']) &&\n    typeof value.paymentId === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) &&\n    (value.status === 'AUTHORIZED' || value.status === 'CAPTURED')\n  );\n}\n\nfunction isError(value: unknown): value is PaymentFormError {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'code',\n      'message',\n      'requestId',\n      'paymentId',\n      'retryable',\n      'httpStatus',\n      'upstreamRequestId',\n      'frameStage',\n      'payment'\n    ]) &&\n    typeof value.code === 'string' &&\n    /^[A-Z][A-Z0-9_]{1,63}$/.test(value.code) &&\n    typeof value.message === 'string' &&\n    value.message.length <= 1_000 &&\n    (value.requestId === undefined || isId(value.requestId)) &&\n    (value.paymentId === undefined ||\n      (typeof value.paymentId === 'string' &&\n        /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId))) &&\n    (value.retryable === undefined || typeof value.retryable === 'boolean') &&\n    (value.httpStatus === undefined ||\n      (typeof value.httpStatus === 'number' &&\n        Number.isInteger(value.httpStatus) &&\n        value.httpStatus >= 400 &&\n        value.httpStatus <= 599)) &&\n    (value.upstreamRequestId === undefined ||\n      (typeof value.upstreamRequestId === 'string' &&\n        value.upstreamRequestId.length > 0 &&\n        value.upstreamRequestId.length <= 1_000)) &&\n    (value.frameStage === undefined ||\n      value.frameStage === 'FRAME_DOCUMENT' ||\n      value.frameStage === 'CARD_FRAME') &&\n    (value.payment === undefined || isErrorPayment(value.payment))\n  );\n}\n\nfunction isErrorPayment(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['id', 'environment', 'currency', 'transaction']) &&\n    typeof value.id === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    (value.environment === 'sandbox' || value.environment === 'live') &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    isErrorTransaction(value.transaction)\n  );\n}\n\nfunction isErrorTransaction(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'id',\n      'status',\n      'amount',\n      'currency',\n      'provider',\n      'providerReference',\n      'attempts'\n    ]) &&\n    typeof value.id === 'string' &&\n    /^txn_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    isPaymentStatus(value.status) &&\n    Number.isSafeInteger(value.amount) &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    optionalText(value.provider) &&\n    optionalText(value.providerReference) &&\n    (value.attempts === undefined ||\n      (Array.isArray(value.attempts) &&\n        value.attempts.length <= 20 &&\n        value.attempts.every(isErrorAttempt)))\n  );\n}\n\nfunction isErrorAttempt(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'ordinal',\n      'provider',\n      'status',\n      'delivery',\n      'failureReason',\n      'providerCode',\n      'providerStatus',\n      'providerReference',\n      'message',\n      'toProxyMs',\n      'midMs'\n    ]) &&\n    optionalInteger(value.ordinal) &&\n    optionalText(value.provider) &&\n    optionalText(value.status) &&\n    optionalText(value.delivery) &&\n    optionalText(value.failureReason) &&\n    optionalText(value.providerCode) &&\n    optionalText(value.providerStatus) &&\n    optionalText(value.providerReference) &&\n    optionalText(value.message) &&\n    optionalInteger(value.toProxyMs) &&\n    optionalInteger(value.midMs)\n  );\n}\n\nfunction isPaymentStatus(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    [\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD'\n    ].includes(value)\n  );\n}\n\nfunction optionalText(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'string' && value.length > 0 && value.length <= 1_000)\n  );\n}\n\nfunction optionalInteger(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n  );\n}\n\nfunction isAppearance(value: unknown): value is PaymentFormAppearance {\n  if (!isRecord(value) || !hasOnly(value, ['theme', 'variables', 'threeDS'])) return false;\n  if (value.theme !== undefined && !['light', 'dark', 'system'].includes(String(value.theme)))\n    return false;\n  if (\n    value.variables !== undefined &&\n    (!isRecord(value.variables) ||\n      Object.values(value.variables).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  if (\n    value.threeDS !== undefined &&\n    (!isRecord(value.threeDS) ||\n      Object.values(value.threeDS).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  return true;\n}\n\nfunction isPayInput(value: unknown): value is PayInput {\n  if (\n    !isRecord(value) ||\n    !hasOnly(value, [\n      'merchantOrderId',\n      'merchantReference',\n      'description',\n      'currency',\n      'operation',\n      'customer',\n      'billingAddress',\n      'shippingAddress',\n      'cardStorageConsent',\n      'items',\n      'amounts',\n      'initialTransactionReference',\n      'checkoutUrl',\n      'returnUrl',\n      'metadata',\n      'client'\n    ])\n  )\n    return false;\n  if (\n    typeof value.merchantOrderId !== 'string' ||\n    value.merchantOrderId.trim().length === 0 ||\n    value.merchantOrderId.length > 255 ||\n    typeof value.currency !== 'string' ||\n    !/^[A-Z]{3}$/.test(value.currency) ||\n    (value.operation !== undefined && value.operation !== 'AUTHORIZE' && value.operation !== 'SALE')\n  )\n    return false;\n  return (\n    Array.isArray(value.items) &&\n    value.items.length > 0 &&\n    value.items.length <= 20 &&\n    value.items.every(isPaymentItem)\n  );\n}\n\nfunction isPaymentItem(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'description',\n      'id',\n      'sku',\n      'unitAmount',\n      'quantity',\n      'type',\n      'interval',\n      'intervalCount',\n      'trialDays',\n      'cycle',\n      'isMain',\n      'category',\n      'brand',\n      'imageUrl',\n      'manufacturePartNumber'\n    ]) &&\n    typeof value.description === 'string' &&\n    value.description.trim().length > 0 &&\n    Number.isSafeInteger(value.unitAmount) &&\n    Number(value.unitAmount) > 0 &&\n    Number.isSafeInteger(value.quantity) &&\n    Number(value.quantity) > 0 &&\n    Number(value.quantity) <= 999 &&\n    (value.type === 'ONE_TIME' ||\n      value.type === 'RECURRING' ||\n      value.type === 'UNIQUE' ||\n      value.type === 'unique' ||\n      value.type === 'recurring')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "import { formError } from './contracts/errors';\nimport { enrichPayInputFromBrowser } from './browser-context';\nimport { completeStripeThreeDS } from './stripe-three-ds';\nimport type {\n  PayInput,\n  PaymentFormError,\n  PaymentFormInstance,\n  PaymentFormMountOptions,\n  PaymentFormState,\n  PaymentFormStatus,\n  PayOutcome\n} from './contracts/types';\nimport {\n  FORM_PAYMENT_PROTOCOL_VERSION,\n  isFrameToHostMessage,\n  type FrameToHostMessage,\n  type HostToFrameMessage\n} from './protocol';\n\nconst productionFrameOrigin = 'https://payment-form.bemony.com';\nconst threeDSModalWidth = 624;\nconst threeDSModalRadius = 12;\n// The hosted form has up to two 10s Card Frame bootstrap attempts. Keep this\n// outer watchdog above that bounded recovery window so it cannot mask the\n// structured frame error with a generic FRAME_UNAVAILABLE.\nconst FORM_MOUNT_TIMEOUT_MS = 25_000;\n\nexport const BemonyPaymentForm = {\n  mount(options: PaymentFormMountOptions): Promise<PaymentFormInstance> {\n    const target = resolveTarget(options.target);\n    if (!isClientSecret(options.clientSecret)) {\n      return Promise.reject(\n        formError('PAYMENT_SESSION_INVALID', 'A sess\u00E3o de pagamento \u00E9 inv\u00E1lida.')\n      );\n    }\n    if (options.signal?.aborted) {\n      return Promise.reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n    }\n\n    const instanceId = crypto.randomUUID();\n    const frameOrigin = resolveFrameOrigin();\n    const slot = document.createElement('div');\n    slot.dataset.bemonyPaymentForm = '';\n    const iframe = document.createElement('iframe');\n    iframe.title = 'Pagamento seguro Bemony';\n    iframe.src = `${frameOrigin}/frame?instance=${encodeURIComponent(instanceId)}`;\n    iframe.setAttribute('allow', 'payment *');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    let contentHeight = 100;\n    setInlineStyle(iframe, contentHeight);\n    slot.style.cssText = 'display:block;width:100%;margin:0;padding:0;background:transparent;';\n    slot.append(iframe);\n    target.append(slot);\n\n    let destroyed = false;\n    let mounted = false;\n    let timer: number | undefined;\n    let overlay: HTMLDivElement | undefined;\n    let applyOverlayLayout: (() => void) | undefined;\n    let bodyOverflow: string | null = null;\n    let documentOverflow: string | null = null;\n    let rejectMount: ((reason: PaymentFormError) => void) | undefined;\n    let state: PaymentFormState = { status: 'MOUNTING', ready: false, isSubmitting: false };\n    let blockedError: PaymentFormError | undefined;\n    let active:\n      | Readonly<{\n          requestId: string;\n          promise: Promise<PayOutcome>;\n          resolve: (value: PayOutcome) => void;\n          reject: (reason: PaymentFormError) => void;\n        }>\n      | undefined;\n    let onMessage: (event: MessageEvent<unknown>) => void = () => undefined;\n\n    const callback = <T>(fn: ((value: T) => void) | undefined, value: T): void => {\n      try {\n        fn?.(value);\n      } catch {\n        /* Merchant callbacks never control payment state. */\n      }\n    };\n    const post = (message: HostToFrameMessage): void => {\n      iframe.contentWindow?.postMessage(message, frameOrigin);\n    };\n    const restoreInline = (): void => {\n      if (overlay === undefined) return;\n      overlay.remove();\n      overlay = undefined;\n      if (bodyOverflow === null) document.body.style.removeProperty('overflow');\n      else document.body.setAttribute('style', bodyOverflow);\n      if (documentOverflow === null) document.documentElement.style.removeProperty('overflow');\n      else document.documentElement.setAttribute('style', documentOverflow);\n      bodyOverflow = null;\n      documentOverflow = null;\n      applyOverlayLayout = undefined;\n      setInlineStyle(iframe, contentHeight);\n      iframe.removeAttribute('role');\n      iframe.removeAttribute('aria-modal');\n      iframe.removeAttribute('aria-label');\n    };\n    const showOverlay = (): void => {\n      if (options.threeDS?.presentation !== 'modal' || overlay !== undefined) return;\n      overlay = document.createElement('div');\n      overlay.dataset.bemonyPaymentThreeDsModal = '';\n      // Keep the Frame in its original DOM position. Reparenting an iframe can\n      // reload its nested Card Frame and discard the in-flight issuer challenge.\n      // The backdrop belongs to document.body; fixed positioning turns the\n      // already-mounted frame into the modal without resetting it.\n      overlay.setAttribute('aria-hidden', 'true');\n      iframe.setAttribute('tabindex', '-1');\n      iframe.setAttribute('role', 'dialog');\n      iframe.setAttribute('aria-modal', 'true');\n      iframe.setAttribute('aria-label', 'Autentica\u00E7\u00E3o segura do banco');\n      overlay.style.cssText = [\n        'position:fixed',\n        'inset:0',\n        // The secure iframe must stay above this backdrop. It is appended\n        // after the iframe so equal stacking values would intercept the\n        // issuer's buttons and make a valid challenge impossible to finish.\n        'z-index:2147483646',\n        'display:flex',\n        'align-items:center',\n        'justify-content:center',\n        'padding:0',\n        `background:${options.appearance?.threeDS?.modalBackdrop ?? 'rgba(2, 6, 23, .72)'}`\n      ].join(';');\n      const applyLayout = (): void => {\n        iframe.style.cssText = [\n          'position:fixed',\n          'left:50%',\n          'top:50%',\n          'z-index:2147483647',\n          'display:block',\n          `width:min(${threeDSModalWidth}px, calc(100vw - 24px))`,\n          `height:min(${contentHeight}px, calc(100dvh - 24px))`,\n          'border:0',\n          `border-radius:${threeDSModalRadius}px`,\n          'overflow:hidden',\n          'background:#fff',\n          'box-shadow:none',\n          'transform:translate(-50%, -50%)'\n        ].join(';');\n      };\n      applyOverlayLayout = applyLayout;\n      bodyOverflow = document.body.getAttribute('style');\n      documentOverflow = document.documentElement.getAttribute('style');\n      document.body.style.setProperty('overflow', 'hidden', 'important');\n      document.documentElement.style.setProperty('overflow', 'hidden', 'important');\n      applyLayout();\n      document.body.append(overlay);\n      window.requestAnimationFrame(() => iframe.focus({ preventScroll: true }));\n    };\n    const reportStatus = (status: PaymentFormStatus): void => {\n      if (destroyed) return;\n      state = {\n        ...state,\n        status,\n        ready: mounted,\n        isSubmitting: ['TOKENIZING', 'SUBMITTING', 'AUTHENTICATING_3DS', 'PROCESSING'].includes(\n          status\n        )\n      };\n      callback(options.onStatusChange, status);\n    };\n    const reportError = (error: PaymentFormError, requestId?: string): void => {\n      if (requestId !== undefined && active !== undefined && active.requestId !== requestId) return;\n      restoreInline();\n      if (error.code === 'PAYMENT_STATUS_UNKNOWN') blockedError = error;\n      state = {\n        ...state,\n        ...(error.code === 'PAYMENT_STATUS_UNKNOWN' ? { status: 'UNKNOWN' as const } : {}),\n        error,\n        isSubmitting: false\n      };\n      callback(options.onError, error);\n      if (!mounted && rejectMount !== undefined) {\n        if (timer !== undefined) window.clearTimeout(timer);\n        const reject = rejectMount;\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n        return;\n      }\n      if (active !== undefined) {\n        active.reject(error);\n        active = undefined;\n      }\n    };\n    const destroy = (): void => {\n      if (destroyed) return;\n      destroyed = true;\n      if (timer !== undefined) window.clearTimeout(timer);\n      window.removeEventListener('message', onMessage);\n      options.signal?.removeEventListener('abort', destroy);\n      restoreInline();\n      post({\n        channel: 'BEMONY_FORM_PAYMENT',\n        version: FORM_PAYMENT_PROTOCOL_VERSION,\n        type: 'DESTROY',\n        instanceId\n      });\n      iframe.remove();\n      slot.remove();\n      active?.reject(formError('FRAME_UNAVAILABLE', 'O formul\u00E1rio de pagamento foi desmontado.'));\n      active = undefined;\n      state = { ...state, status: 'DESTROYED', ready: false, isSubmitting: false };\n      if (!mounted && rejectMount !== undefined) {\n        const reject = rejectMount;\n        rejectMount = undefined;\n        reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n      }\n    };\n    const instance: PaymentFormInstance = {\n      pay(input: PayInput): Promise<PayOutcome> {\n        if (destroyed)\n          return Promise.reject(\n            formError('INVALID_STATE', 'O formul\u00E1rio de pagamento foi desmontado.')\n          );\n        if (!mounted)\n          return Promise.reject(\n            formError('FORM_NOT_READY', 'O formul\u00E1rio de pagamento ainda n\u00E3o est\u00E1 pronto.')\n          );\n        if (blockedError !== undefined) return Promise.reject(blockedError);\n        if (active !== undefined) return active.promise;\n        const requestId = crypto.randomUUID();\n        let resolve!: (payment: PayOutcome) => void;\n        let reject!: (error: PaymentFormError) => void;\n        const promise = new Promise<PayOutcome>((nextResolve, nextReject) => {\n          resolve = nextResolve;\n          reject = nextReject;\n        });\n        active = { requestId, promise, resolve, reject };\n        post({\n          channel: 'BEMONY_FORM_PAYMENT',\n          version: FORM_PAYMENT_PROTOCOL_VERSION,\n          type: 'PAY',\n          instanceId,\n          requestId,\n          input: enrichPayInputFromBrowser(input)\n        });\n        return promise;\n      },\n      getState: () => state,\n      destroy\n    };\n    const mountPromise = new Promise<PaymentFormInstance>((resolve, reject) => {\n      rejectMount = reject;\n      timer = window.setTimeout(() => {\n        if (mounted || destroyed) return;\n        const error = formError(\n          'FRAME_UNAVAILABLE',\n          'N\u00E3o foi poss\u00EDvel carregar o formul\u00E1rio de pagamento.'\n        );\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n      }, FORM_MOUNT_TIMEOUT_MS);\n      onMessage = (event: MessageEvent<unknown>): void => {\n        if (destroyed || event.origin !== frameOrigin || event.source !== iframe.contentWindow)\n          return;\n        if (!isFrameToHostMessage(event.data) || event.data.instanceId !== instanceId) return;\n        const message: FrameToHostMessage = event.data;\n        if (message.type === 'READY') {\n          post({\n            channel: 'BEMONY_FORM_PAYMENT',\n            version: FORM_PAYMENT_PROTOCOL_VERSION,\n            type: 'INIT',\n            instanceId,\n            clientSecret: options.clientSecret,\n            presentation: options.threeDS?.presentation ?? 'modal',\n            ...(options.appearance === undefined ? {} : { appearance: options.appearance })\n          });\n          return;\n        }\n        if (message.type === 'MOUNTED') {\n          if (mounted) return;\n          mounted = true;\n          if (timer !== undefined) window.clearTimeout(timer);\n          rejectMount = undefined;\n          state = { ...state, status: 'READY', ready: true };\n          callback(options.onReady, undefined);\n          callback(options.onStatusChange, 'READY');\n          resolve(instance);\n          return;\n        }\n        if (message.type === 'STATUS') return reportStatus(message.status);\n        if (message.type === 'CARD_STATE')\n          return callback(options.onCardStateChange, message.state);\n        if (message.type === 'RESIZED') {\n          contentHeight = message.height;\n          if (overlay === undefined) setInlineStyle(iframe, contentHeight);\n          else applyOverlayLayout?.();\n          return;\n        }\n        if (message.type === 'STRIPE_3DS') {\n          // Stripe.js owns the top-level challenge surface. The sensitive,\n          // ephemeral action stays on this private bridge and never reaches\n          // consumer callbacks or public SDK state.\n          void completeStripeThreeDS(message.action).then(\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'SUCCEEDED'\n              });\n            },\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'FAILED'\n              });\n            }\n          );\n          return;\n        }\n        if (message.type === 'THREE_DS_OPEN') {\n          // The hosted form must not start the issuer challenge until the\n          // public host has promoted this iframe to its modal and the browser\n          // has had a chance to paint that layout.\n          showOverlay();\n          window.requestAnimationFrame(() => {\n            window.requestAnimationFrame(() => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'THREE_DS_PRESENTED',\n                instanceId\n              });\n            });\n          });\n          return;\n        }\n        if (message.type === 'THREE_DS_CLOSE') return restoreInline();\n        if (\n          message.type === 'SUCCESS' &&\n          (active === undefined || active.requestId === message.requestId)\n        ) {\n          restoreInline();\n          blockedError = undefined;\n          state = {\n            status: message.payment.status,\n            ready: true,\n            isSubmitting: false,\n            payment: message.payment\n          };\n          callback(options.onStatusChange, message.payment.status);\n          callback(options.onSuccess, message.payment);\n          active?.resolve(message.payment);\n          active = undefined;\n          return;\n        }\n        if (message.type === 'ERROR') reportError(message.error, message.requestId);\n      };\n      window.addEventListener('message', onMessage);\n    });\n    options.signal?.addEventListener('abort', destroy, { once: true });\n    return mountPromise;\n  }\n};\n\nfunction resolveTarget(target: string | HTMLElement): HTMLElement {\n  const element = typeof target === 'string' ? document.querySelector<HTMLElement>(target) : target;\n  if (element === null || !(element instanceof HTMLElement))\n    throw formError('PAY_INPUT_INVALID', 'O container do Payment Form n\u00E3o foi encontrado.');\n  return element;\n}\n\nfunction isClientSecret(value: string): boolean {\n  return /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction resolveFrameOrigin(): string {\n  const isLoopbackHost = ['localhost', '127.0.0.1', '[::1]'].includes(window.location.hostname);\n  const configured = (\n    globalThis as typeof globalThis & { __BEMONY_PAYMENT_FORM_FRAME_URL__?: string }\n  ).__BEMONY_PAYMENT_FORM_FRAME_URL__;\n  if (!isLoopbackHost || configured === undefined) return productionFrameOrigin;\n\n  try {\n    const url = new URL(configured);\n    if (\n      !['http:', 'https:'].includes(url.protocol) ||\n      url.pathname !== '/' ||\n      url.search ||\n      url.hash ||\n      url.username ||\n      url.password\n    ) {\n      return productionFrameOrigin;\n    }\n    return url.origin;\n  } catch {\n    return productionFrameOrigin;\n  }\n}\n\nfunction setInlineStyle(iframe: HTMLIFrameElement, height: number): void {\n  iframe.style.cssText = `display:block;width:100%;height:${height}px;min-height:${height}px;border:0;background:transparent;`;\n  iframe.removeAttribute('tabindex');\n}\n"],
-  "mappings": ";AAEO,SAAS,UAAU,MAAc,SAAiB,WAAsC;AAC7F,SAAO,cAAc,SAAY,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,SAAS,UAAU;AAClF;;;ACGO,SAAS,0BAA0B,OAA2B;AACnE,QAAM,WAAW,MAAM;AACvB,QAAM,WAAW,YAAY,OAAO,SAAS,IAAI;AACjD,QAAM,WAAW,YAAY,SAAS,QAAQ;AAC9C,QAAM,cAA0D;AAAA,IAC9D,YAAY,OAAO,QAAQ;AAAA,IAC3B,mBAAmB;AAAA,IACnB,aAAa,YAAY;AAAA,IACzB,UAAU,UAAU;AAAA,IACpB,cAAc,OAAO,QAAQ;AAAA,IAC7B,aAAa,OAAO,QAAQ;AAAA,IAC5B,wBAAuB,oBAAI,KAAK,GAAE,kBAAkB;AAAA,EACtD;AACA,QAAM,SAAyB;AAAA,IAC7B,GAAG,gBAAgB;AAAA,IACnB,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS;AAAA,IACnD,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAG;AAAA,IACH,KAAK,EAAE,GAAG,qBAAqB,GAAG,GAAG,UAAU,IAAI;AAAA,IACnD,aAAa,EAAE,GAAG,aAAa,GAAG,UAAU,YAAY;AAAA,EAC1D;AACA,SAAO,EAAE,GAAG,OAAO,OAAO;AAC5B;AAEA,SAAS,kBAAyE;AAChF,QAAM,YAAY,UAAU;AAC5B,SAAO;AAAA,IACL,YAAY,4BAA4B,KAAK,SAAS,IAAI,WAAW;AAAA,IACrE,IAAI,cAAc,KAAK,SAAS,IAC5B,YACA,WAAW,KAAK,SAAS,IACvB,YACA,wBAAwB,KAAK,SAAS,IACpC,UACA,SAAS,KAAK,SAAS,IACrB,UACA;AAAA,IACV,SAAS,SAAS,KAAK,SAAS,IAC5B,SACA,aAAa,KAAK,SAAS,IACzB,YACA,YAAY,KAAK,SAAS,IACxB,WACA,YAAY,KAAK,SAAS,IACxB,WACA;AAAA,EACZ;AACF;AAEA,SAAS,uBAA2D;AAClE,QAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,SAAO,QAAQ;AAAA,IACb,QAAQ,OAAO,IAAI,YAAY,KAAK;AAAA,IACpC,UAAU,OAAO,IAAI,cAAc,KAAK;AAAA,IACxC,QAAQ,OAAO,IAAI,YAAY,KAAK;AAAA,IACpC,SAAS,OAAO,IAAI,aAAa,KAAK;AAAA,IACtC,MAAM,OAAO,IAAI,UAAU,KAAK;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,YAAY,OAAmC;AACtD,MAAI,UAAU,GAAI,QAAO;AACzB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,EAAG,QAAO;AACxD,QAAI,SAAS;AACb,QAAI,OAAO;AACX,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAuB;AAC9B,QAAM,YAAY;AAClB,MAAI;AACF,WAAO,UAAU,cAAc,KAAK;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAsD,OAAa;AAC1E,aAAW,OAAO,OAAO,KAAK,KAAK,GAAqB;AACtD,QAAI,MAAM,GAAG,MAAM,UAAa,MAAM,GAAG,MAAM,GAAI,QAAO,MAAM,GAAG;AAAA,EACrE;AACA,SAAO;AACT;;;ACzEA,IAAI;AAOJ,eAAsB,sBAAsB,QAA4C;AACtF,QAAM,UAAU,MAAM,WAAW,GAAG,OAAO,cAAc;AACzD,MAAI,WAAW,KAAM,OAAM,IAAI,MAAM,iCAAiC;AACtE,QAAM,SAAS,MAAM,OAAO,iBAAiB,EAAE,cAAc,OAAO,aAAa,CAAC;AAClF,MAAI,OAAO,UAAU,OAAW,OAAM,IAAI,MAAM,+BAA+B;AACjF;AAEA,SAAS,aAAyC;AAChD,MAAI,OAAO,OAAO,WAAW,WAAY,QAAO,QAAQ,QAAQ,OAAO,MAAM;AAC7E,MAAI,iBAAiB,OAAW,QAAO;AACvC,iBAAe,IAAI,QAA2B,CAAC,SAAS,WAAW;AACjE,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,WAAO,iBAAiB;AACxB,WAAO,SAAS,MAAM;AACpB,UAAI,OAAO,OAAO,WAAW,WAAY,SAAQ,OAAO,MAAM;AAAA,UACzD,QAAO,IAAI,MAAM,0CAA0C,CAAC;AAAA,IACnE;AACA,WAAO,UAAU,MAAM,OAAO,IAAI,MAAM,gCAAgC,CAAC;AACzE,aAAS,KAAK,OAAO,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;;;ACzCO,IAAM,gCAAgC;AAsCtC,SAAS,qBAAqB,OAA6C;AAChF,MAAI,CAAC,QAAQ,KAAK,EAAG,QAAO;AAC5B,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,MAAM,CAAC;AAAA,IACpE,KAAK;AACH,aAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,MAAM,CAAC;AAAA,IACpE,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,sBAAsB,MAAM,MAAM;AAAA,IAEtC,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,SAAS,MAAM,MAAM;AAAA,IAEzB,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,cAAc,MAAM,MAAM;AAAA,IAE9B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,OAAO,CAAC,KACpE,YAAY,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,aAAa,SAAS,CAAC,KACnF,KAAK,MAAM,SAAS,KACpB,UAAU,MAAM,OAAO;AAAA,IAE3B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,aAAa,OAAO,CAAC,MAChF,MAAM,cAAc,UAAa,KAAK,MAAM,SAAS,MACtD,QAAQ,MAAM,KAAK;AAAA,IAEvB;AACE,aAAO;AAAA,EACX;AACF;AAyCA,SAAS,QAAQ,OAAyD;AACxE,SACE,SAAS,KAAK,KACd,MAAM,YAAY,yBAClB,MAAM,YAAY,iCAClB,KAAK,MAAM,UAAU,KACrB,OAAO,MAAM,SAAS;AAE1B;AAEA,SAAS,QAAQ,OAAgC,MAAkC;AACjF,SAAO,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,GAAG,CAAC;AAC7D;AAEA,SAAS,KAAK,OAAiC;AAC7C,SAAO,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACzE;AAMA,SAAS,sBAAsB,OAA8C;AAC3E,SACE,SAAS,KAAK,KACd,QAAQ,OAAO,CAAC,YAAY,gBAAgB,gBAAgB,CAAC,KAC7D,iBAAiB,MAAM,QAAQ,KAC/B,OAAO,MAAM,iBAAiB,YAC9B,uDAAuD,KAAK,MAAM,YAAY,KAC9E,OAAO,MAAM,mBAAmB,YAChC,wCAAwC,KAAK,MAAM,cAAc;AAErE;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAMA,SAAS,SAAS,OAA4C;AAC5D,SACE,OAAO,UAAU,YACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAEpB;AAEA,SAAS,cAAc,OAAiC;AACtD,SAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,MAAM,SAAS;AACzF;AAEA,SAAS,YAAY,OAAoC;AACvD,SACE,SAAS,KAAK,KACd,QAAQ,OAAO,CAAC,YAAY,OAAO,CAAC,KACpC,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,UAAU;AAE3B;AAEA,SAAS,UAAU,OAAqC;AACtD,SACE,SAAS,KAAK,KACd,QAAQ,OAAO,CAAC,aAAa,QAAQ,CAAC,KACtC,OAAO,MAAM,cAAc,YAC3B,6BAA6B,KAAK,MAAM,SAAS,MAChD,MAAM,WAAW,gBAAgB,MAAM,WAAW;AAEvD;AAEA,SAAS,QAAQ,OAA2C;AAC1D,SACE,SAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,OAAO,MAAM,SAAS,YACtB,yBAAyB,KAAK,MAAM,IAAI,KACxC,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,UAAU,QACvB,MAAM,cAAc,UAAa,KAAK,MAAM,SAAS,OACrD,MAAM,cAAc,UAClB,OAAO,MAAM,cAAc,YAC1B,6BAA6B,KAAK,MAAM,SAAS,OACpD,MAAM,cAAc,UAAa,OAAO,MAAM,cAAc,eAC5D,MAAM,eAAe,UACnB,OAAO,MAAM,eAAe,YAC3B,OAAO,UAAU,MAAM,UAAU,KACjC,MAAM,cAAc,OACpB,MAAM,cAAc,SACvB,MAAM,sBAAsB,UAC1B,OAAO,MAAM,sBAAsB,YAClC,MAAM,kBAAkB,SAAS,KACjC,MAAM,kBAAkB,UAAU,SACrC,MAAM,eAAe,UACpB,MAAM,eAAe,oBACrB,MAAM,eAAe,kBACtB,MAAM,YAAY,UAAa,eAAe,MAAM,OAAO;AAEhE;AAEA,SAAS,eAAe,OAAyB;AAC/C,SACE,SAAS,KAAK,KACd,QAAQ,OAAO,CAAC,MAAM,eAAe,YAAY,aAAa,CAAC,KAC/D,OAAO,MAAM,OAAO,YACpB,6BAA6B,KAAK,MAAM,EAAE,MACzC,MAAM,gBAAgB,aAAa,MAAM,gBAAgB,WAC1D,OAAO,MAAM,aAAa,YAC1B,aAAa,KAAK,MAAM,QAAQ,KAChC,mBAAmB,MAAM,WAAW;AAExC;AAEA,SAAS,mBAAmB,OAAyB;AACnD,SACE,SAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,OAAO,MAAM,OAAO,YACpB,6BAA6B,KAAK,MAAM,EAAE,KAC1C,gBAAgB,MAAM,MAAM,KAC5B,OAAO,cAAc,MAAM,MAAM,KACjC,OAAO,MAAM,aAAa,YAC1B,aAAa,KAAK,MAAM,QAAQ,KAChC,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,iBAAiB,MACnC,MAAM,aAAa,UACjB,MAAM,QAAQ,MAAM,QAAQ,KAC3B,MAAM,SAAS,UAAU,MACzB,MAAM,SAAS,MAAM,cAAc;AAE3C;AAEA,SAAS,eAAe,OAAyB;AAC/C,SACE,SAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,gBAAgB,MAAM,OAAO,KAC7B,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,MAAM,KACzB,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,aAAa,KAChC,aAAa,MAAM,YAAY,KAC/B,aAAa,MAAM,cAAc,KACjC,aAAa,MAAM,iBAAiB,KACpC,aAAa,MAAM,OAAO,KAC1B,gBAAgB,MAAM,SAAS,KAC/B,gBAAgB,MAAM,KAAK;AAE/B;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SACE,OAAO,UAAU,YACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAEpB;AAEA,SAAS,aAAa,OAAyB;AAC7C,SACE,UAAU,UAAc,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;AAE7F;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SACE,UAAU,UAAc,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAEjG;AAgGA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AClbA,IAAM,wBAAwB;AAC9B,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAI3B,IAAM,wBAAwB;AAEvB,IAAM,oBAAoB;AAAA,EAC/B,MAAM,SAAgE;AACpE,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,eAAe,QAAQ,YAAY,GAAG;AACzC,aAAO,QAAQ;AAAA,QACb,UAAU,2BAA2B,4CAAmC;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ,SAAS;AAC3B,aAAO,QAAQ,OAAO,UAAU,iBAAiB,2BAA2B,CAAC;AAAA,IAC/E;AAEA,UAAM,aAAa,OAAO,WAAW;AACrC,UAAM,cAAc,mBAAmB;AACvC,UAAM,OAAO,SAAS,cAAc,KAAK;AACzC,SAAK,QAAQ,oBAAoB;AACjC,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,QAAQ;AACf,WAAO,MAAM,GAAG,WAAW,mBAAmB,mBAAmB,UAAU,CAAC;AAC5E,WAAO,aAAa,SAAS,WAAW;AACxC,WAAO,aAAa,kBAAkB,aAAa;AACnD,QAAI,gBAAgB;AACpB,mBAAe,QAAQ,aAAa;AACpC,SAAK,MAAM,UAAU;AACrB,SAAK,OAAO,MAAM;AAClB,WAAO,OAAO,IAAI;AAElB,QAAI,YAAY;AAChB,QAAI,UAAU;AACd,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI,eAA8B;AAClC,QAAI,mBAAkC;AACtC,QAAI;AACJ,QAAI,QAA0B,EAAE,QAAQ,YAAY,OAAO,OAAO,cAAc,MAAM;AACtF,QAAI;AACJ,QAAI;AAQJ,QAAI,YAAoD,MAAM;AAE9D,UAAM,WAAW,CAAI,IAAsC,UAAmB;AAC5E,UAAI;AACF,aAAK,KAAK;AAAA,MACZ,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,OAAO,CAAC,YAAsC;AAClD,aAAO,eAAe,YAAY,SAAS,WAAW;AAAA,IACxD;AACA,UAAM,gBAAgB,MAAY;AAChC,UAAI,YAAY,OAAW;AAC3B,cAAQ,OAAO;AACf,gBAAU;AACV,UAAI,iBAAiB,KAAM,UAAS,KAAK,MAAM,eAAe,UAAU;AAAA,UACnE,UAAS,KAAK,aAAa,SAAS,YAAY;AACrD,UAAI,qBAAqB,KAAM,UAAS,gBAAgB,MAAM,eAAe,UAAU;AAAA,UAClF,UAAS,gBAAgB,aAAa,SAAS,gBAAgB;AACpE,qBAAe;AACf,yBAAmB;AACnB,2BAAqB;AACrB,qBAAe,QAAQ,aAAa;AACpC,aAAO,gBAAgB,MAAM;AAC7B,aAAO,gBAAgB,YAAY;AACnC,aAAO,gBAAgB,YAAY;AAAA,IACrC;AACA,UAAM,cAAc,MAAY;AAC9B,UAAI,QAAQ,SAAS,iBAAiB,WAAW,YAAY,OAAW;AACxE,gBAAU,SAAS,cAAc,KAAK;AACtC,cAAQ,QAAQ,4BAA4B;AAK5C,cAAQ,aAAa,eAAe,MAAM;AAC1C,aAAO,aAAa,YAAY,IAAI;AACpC,aAAO,aAAa,QAAQ,QAAQ;AACpC,aAAO,aAAa,cAAc,MAAM;AACxC,aAAO,aAAa,cAAc,oCAA8B;AAChE,cAAQ,MAAM,UAAU;AAAA,QACtB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,QAAQ,YAAY,SAAS,iBAAiB,qBAAqB;AAAA,MACnF,EAAE,KAAK,GAAG;AACV,YAAM,cAAc,MAAY;AAC9B,eAAO,MAAM,UAAU;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,iBAAiB;AAAA,UAC9B,cAAc,aAAa;AAAA,UAC3B;AAAA,UACA,iBAAiB,kBAAkB;AAAA,UACnC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,GAAG;AAAA,MACZ;AACA,2BAAqB;AACrB,qBAAe,SAAS,KAAK,aAAa,OAAO;AACjD,yBAAmB,SAAS,gBAAgB,aAAa,OAAO;AAChE,eAAS,KAAK,MAAM,YAAY,YAAY,UAAU,WAAW;AACjE,eAAS,gBAAgB,MAAM,YAAY,YAAY,UAAU,WAAW;AAC5E,kBAAY;AACZ,eAAS,KAAK,OAAO,OAAO;AAC5B,aAAO,sBAAsB,MAAM,OAAO,MAAM,EAAE,eAAe,KAAK,CAAC,CAAC;AAAA,IAC1E;AACA,UAAM,eAAe,CAAC,WAAoC;AACxD,UAAI,UAAW;AACf,cAAQ;AAAA,QACN,GAAG;AAAA,QACH;AAAA,QACA,OAAO;AAAA,QACP,cAAc,CAAC,cAAc,cAAc,sBAAsB,YAAY,EAAE;AAAA,UAC7E;AAAA,QACF;AAAA,MACF;AACA,eAAS,QAAQ,gBAAgB,MAAM;AAAA,IACzC;AACA,UAAM,cAAc,CAAC,OAAyB,cAA6B;AACzE,UAAI,cAAc,UAAa,WAAW,UAAa,OAAO,cAAc,UAAW;AACvF,oBAAc;AACd,UAAI,MAAM,SAAS,yBAA0B,gBAAe;AAC5D,cAAQ;AAAA,QACN,GAAG;AAAA,QACH,GAAI,MAAM,SAAS,2BAA2B,EAAE,QAAQ,UAAmB,IAAI,CAAC;AAAA,QAChF;AAAA,QACA,cAAc;AAAA,MAChB;AACA,eAAS,QAAQ,SAAS,KAAK;AAC/B,UAAI,CAAC,WAAW,gBAAgB,QAAW;AACzC,YAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,cAAM,SAAS;AACf,sBAAc;AACd,gBAAQ;AACR,eAAO,KAAK;AACZ;AAAA,MACF;AACA,UAAI,WAAW,QAAW;AACxB,eAAO,OAAO,KAAK;AACnB,iBAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,UAAU,MAAY;AAC1B,UAAI,UAAW;AACf,kBAAY;AACZ,UAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,aAAO,oBAAoB,WAAW,SAAS;AAC/C,cAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,oBAAc;AACd,WAAK;AAAA,QACH,SAAS;AAAA,QACT,SAAS;AAAA,QACT,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AACD,aAAO,OAAO;AACd,WAAK,OAAO;AACZ,cAAQ,OAAO,UAAU,qBAAqB,8CAA2C,CAAC;AAC1F,eAAS;AACT,cAAQ,EAAE,GAAG,OAAO,QAAQ,aAAa,OAAO,OAAO,cAAc,MAAM;AAC3E,UAAI,CAAC,WAAW,gBAAgB,QAAW;AACzC,cAAM,SAAS;AACf,sBAAc;AACd,eAAO,UAAU,iBAAiB,2BAA2B,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM,WAAgC;AAAA,MACpC,IAAI,OAAsC;AACxC,YAAI;AACF,iBAAO,QAAQ;AAAA,YACb,UAAU,iBAAiB,8CAA2C;AAAA,UACxE;AACF,YAAI,CAAC;AACH,iBAAO,QAAQ;AAAA,YACb,UAAU,kBAAkB,2DAAkD;AAAA,UAChF;AACF,YAAI,iBAAiB,OAAW,QAAO,QAAQ,OAAO,YAAY;AAClE,YAAI,WAAW,OAAW,QAAO,OAAO;AACxC,cAAM,YAAY,OAAO,WAAW;AACpC,YAAI;AACJ,YAAI;AACJ,cAAM,UAAU,IAAI,QAAoB,CAAC,aAAa,eAAe;AACnE,oBAAU;AACV,mBAAS;AAAA,QACX,CAAC;AACD,iBAAS,EAAE,WAAW,SAAS,SAAS,OAAO;AAC/C,aAAK;AAAA,UACH,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA,OAAO,0BAA0B,KAAK;AAAA,QACxC,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF;AACA,UAAM,eAAe,IAAI,QAA6B,CAAC,SAAS,WAAW;AACzE,oBAAc;AACd,cAAQ,OAAO,WAAW,MAAM;AAC9B,YAAI,WAAW,UAAW;AAC1B,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,QACF;AACA,sBAAc;AACd,gBAAQ;AACR,eAAO,KAAK;AAAA,MACd,GAAG,qBAAqB;AACxB,kBAAY,CAAC,UAAuC;AAClD,YAAI,aAAa,MAAM,WAAW,eAAe,MAAM,WAAW,OAAO;AACvE;AACF,YAAI,CAAC,qBAAqB,MAAM,IAAI,KAAK,MAAM,KAAK,eAAe,WAAY;AAC/E,cAAM,UAA8B,MAAM;AAC1C,YAAI,QAAQ,SAAS,SAAS;AAC5B,eAAK;AAAA,YACH,SAAS;AAAA,YACT,SAAS;AAAA,YACT,MAAM;AAAA,YACN;AAAA,YACA,cAAc,QAAQ;AAAA,YACtB,cAAc,QAAQ,SAAS,gBAAgB;AAAA,YAC/C,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,UAC/E,CAAC;AACD;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,WAAW;AAC9B,cAAI,QAAS;AACb,oBAAU;AACV,cAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,wBAAc;AACd,kBAAQ,EAAE,GAAG,OAAO,QAAQ,SAAS,OAAO,KAAK;AACjD,mBAAS,QAAQ,SAAS,MAAS;AACnC,mBAAS,QAAQ,gBAAgB,OAAO;AACxC,kBAAQ,QAAQ;AAChB;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,SAAU,QAAO,aAAa,QAAQ,MAAM;AACjE,YAAI,QAAQ,SAAS;AACnB,iBAAO,SAAS,QAAQ,mBAAmB,QAAQ,KAAK;AAC1D,YAAI,QAAQ,SAAS,WAAW;AAC9B,0BAAgB,QAAQ;AACxB,cAAI,YAAY,OAAW,gBAAe,QAAQ,aAAa;AAAA,cAC1D,sBAAqB;AAC1B;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,cAAc;AAIjC,eAAK,sBAAsB,QAAQ,MAAM,EAAE;AAAA,YACzC,MAAM;AACJ,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,gBACA,UAAU,QAAQ,OAAO;AAAA,gBACzB,QAAQ;AAAA,cACV,CAAC;AAAA,YACH;AAAA,YACA,MAAM;AACJ,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,gBACA,UAAU,QAAQ,OAAO;AAAA,gBACzB,QAAQ;AAAA,cACV,CAAC;AAAA,YACH;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,iBAAiB;AAIpC,sBAAY;AACZ,iBAAO,sBAAsB,MAAM;AACjC,mBAAO,sBAAsB,MAAM;AACjC,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,CAAC;AACD;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,iBAAkB,QAAO,cAAc;AAC5D,YACE,QAAQ,SAAS,cAChB,WAAW,UAAa,OAAO,cAAc,QAAQ,YACtD;AACA,wBAAc;AACd,yBAAe;AACf,kBAAQ;AAAA,YACN,QAAQ,QAAQ,QAAQ;AAAA,YACxB,OAAO;AAAA,YACP,cAAc;AAAA,YACd,SAAS,QAAQ;AAAA,UACnB;AACA,mBAAS,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM;AACvD,mBAAS,QAAQ,WAAW,QAAQ,OAAO;AAC3C,kBAAQ,QAAQ,QAAQ,OAAO;AAC/B,mBAAS;AACT;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,QAAS,aAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,MAC5E;AACA,aAAO,iBAAiB,WAAW,SAAS;AAAA,IAC9C,CAAC;AACD,YAAQ,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACjE,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,QAA2C;AAChE,QAAM,UAAU,OAAO,WAAW,WAAW,SAAS,cAA2B,MAAM,IAAI;AAC3F,MAAI,YAAY,QAAQ,EAAE,mBAAmB;AAC3C,UAAM,UAAU,qBAAqB,oDAAiD;AACxF,SAAO;AACT;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,yCAAyC,KAAK,KAAK;AAC5D;AAEA,SAAS,qBAA6B;AACpC,QAAM,iBAAiB,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,OAAO,SAAS,QAAQ;AAC5F,QAAM,aACJ,WACA;AACF,MAAI,CAAC,kBAAkB,eAAe,OAAW,QAAO;AAExD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,IAAI,YACJ,IAAI,UACJ;AACA,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,QAA2B,QAAsB;AACvE,SAAO,MAAM,UAAU,mCAAmC,MAAM,iBAAiB,MAAM;AACvF,SAAO,gBAAgB,UAAU;AACnC;",
-  "names": []
+  "sources": ["../src/contracts/errors.ts", "../src/browser-context.ts", "../src/stripe.ts", "../src/risk-collectors.ts", "../src/stripe-three-ds.ts", "../src/protocol.ts", "../src/mount.ts"],
+  "sourcesContent": ["import type { PaymentFormError } from './types';\n\nexport function formError(code: string, message: string, requestId?: string): PaymentFormError {\n  return requestId === undefined ? { code, message } : { code, message, requestId };\n}\n\nexport function safeError(error: unknown, fallback: string): PaymentFormError {\n  if (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    typeof error.code === 'string'\n  ) {\n    const code = /^[A-Z][A-Z0-9_]{1,63}$/.test(error.code) ? error.code : fallback;\n    return formError(code, messageFor(code));\n  }\n  return formError(fallback, messageFor(fallback));\n}\n\nexport function messageFor(code: string): string {\n  switch (code) {\n    case 'PAY_INPUT_INVALID':\n      return 'Confira os dados do pagador.';\n    case 'PAYMENT_STATUS_UNKNOWN':\n      return 'Ainda estamos confirmando o pagamento.';\n    case 'SESSION_RECOVERY_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel consultar a sess\u00E3o de pagamento. Tente novamente mais tarde.';\n    case 'PAYMENT_ALREADY_IN_PROGRESS':\n      return 'O pagamento j\u00E1 est\u00E1 em andamento.';\n    case 'CHECKOUT_SESSION_EXPIRED':\n      return 'A sess\u00E3o de pagamento expirou.';\n    case 'TOKENIZATION_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel tokenizar o cart\u00E3o.';\n    case 'THREE_DS_FAILED':\n      return 'N\u00E3o foi poss\u00EDvel concluir a autentica\u00E7\u00E3o do banco.';\n    default:\n      return 'N\u00E3o foi poss\u00EDvel concluir esta etapa do pagamento.';\n  }\n}\n", "import type { CheckoutClient, PayInput } from './contracts/types';\n\n/**\n * Adds non-sensitive browser context at the merchant document, where the\n * hosted iframe cannot read the parent location or its campaign parameters.\n * Explicit merchant values win; no fingerprint is generated here.\n */\nexport function enrichPayInputFromBrowser(input: PayInput): PayInput {\n  const declared = input.client;\n  const location = sanitizeUrl(window.location.href);\n  const referrer = sanitizeUrl(document.referrer);\n  const browserInfo: NonNullable<CheckoutClient['browserInfo']> = {\n    colorDepth: window.screen?.colorDepth,\n    javascriptEnabled: true,\n    javaEnabled: javaEnabled(),\n    language: navigator.language,\n    screenHeight: window.screen?.height,\n    screenWidth: window.screen?.width,\n    timezoneOffsetMinutes: new Date().getTimezoneOffset()\n  };\n  const utm = compact({\n    ...campaignFromLocation(),\n    ...sanitizeUtm(declared?.utm)\n  });\n  const client: CheckoutClient = {\n    ...browserIdentity(),\n    ...(location === undefined ? {} : { page: location }),\n    ...(referrer === undefined ? {} : { referrer }),\n    ...declared,\n    ...(Object.keys(utm).length === 0 ? {} : { utm }),\n    browserInfo: { ...browserInfo, ...declared?.browserInfo }\n  };\n  return { ...input, client };\n}\n\nfunction browserIdentity(): Pick<CheckoutClient, 'deviceType' | 'os' | 'browser'> {\n  const userAgent = navigator.userAgent;\n  return {\n    deviceType: /Mobi|Android|iPhone|iPad/i.test(userAgent) ? 'mobile' : 'desktop',\n    os: /Windows NT/i.test(userAgent)\n      ? 'Windows'\n      : /Android/i.test(userAgent)\n        ? 'Android'\n        : /iPhone|iPad|Mac OS X/i.test(userAgent)\n          ? 'Apple'\n          : /Linux/i.test(userAgent)\n            ? 'Linux'\n            : undefined,\n    browser: /Edg\\//i.test(userAgent)\n      ? 'Edge'\n      : /Firefox\\//i.test(userAgent)\n        ? 'Firefox'\n        : /Chrome\\//i.test(userAgent)\n          ? 'Chrome'\n          : /Safari\\//i.test(userAgent)\n            ? 'Safari'\n            : undefined\n  };\n}\n\nfunction campaignFromLocation(): NonNullable<CheckoutClient['utm']> {\n  const params = new URLSearchParams(window.location.search);\n  return sanitizeUtm({\n    source: params.get('utm_source') ?? undefined,\n    campaign: params.get('utm_campaign') ?? undefined,\n    medium: params.get('utm_medium') ?? undefined,\n    content: params.get('utm_content') ?? undefined,\n    term: params.get('utm_term') ?? undefined\n  });\n}\n\nfunction sanitizeUtm(value: CheckoutClient['utm'] | undefined): NonNullable<CheckoutClient['utm']> {\n  if (value === undefined) return {};\n  return compact({\n    source: sanitizeUtmValue(value.source),\n    campaign: sanitizeUtmValue(value.campaign),\n    medium: sanitizeUtmValue(value.medium),\n    content: sanitizeUtmValue(value.content),\n    term: sanitizeUtmValue(value.term)\n  });\n}\n\nfunction sanitizeUtmValue(value: string | null | undefined): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.normalize('NFKC').trim();\n  if (\n    normalized === '' ||\n    normalized.length > 120 ||\n    hasControlCharacter(normalized) ||\n    looksLikeSensitiveUtm(normalized)\n  ) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction looksLikeSensitiveUtm(value: string): boolean {\n  return (\n    /(?:^|[^A-Za-z0-9])(?:fbclid|fbcid)(?:[^A-Za-z0-9]|$)/i.test(value) ||\n    /(?:^|[^0-9])(?:[0-9][ -]?){12,19}(?![0-9])/.test(value) ||\n    /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i.test(value)\n  );\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0)!;\n    return code < 32 || code === 127;\n  });\n}\n\nfunction sanitizeUrl(value: string): string | undefined {\n  if (value === '') return undefined;\n  try {\n    const url = new URL(value);\n    if (!['http:', 'https:'].includes(url.protocol)) return undefined;\n    url.search = '';\n    url.hash = '';\n    return url.toString();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction javaEnabled(): boolean {\n  const candidate = navigator as Navigator & { javaEnabled?: () => boolean };\n  try {\n    return candidate.javaEnabled?.() ?? false;\n  } catch {\n    return false;\n  }\n}\n\nfunction compact<T extends Record<string, string | undefined>>(value: T): T {\n  for (const key of Object.keys(value) as Array<keyof T>) {\n    if (value[key] === undefined || value[key] === '') delete value[key];\n  }\n  return value;\n}\n", "export type StripeRadarSessionResult =\n  string | Readonly<{ id?: string; radarSession?: Readonly<{ id?: string }>; error?: unknown }>;\n\nexport type StripeClient = Readonly<{\n  handleNextAction(\n    input: Readonly<{ clientSecret: string }>\n  ): Promise<Readonly<{ error?: unknown }>>;\n  createRadarSession?: () => Promise<StripeRadarSessionResult>;\n}>;\n\nexport type StripeConstructor = (publishableKey: string) => StripeClient | null;\n\ndeclare global {\n  interface Window {\n    Stripe?: StripeConstructor;\n  }\n}\n\nlet stripeScript: Promise<StripeConstructor> | undefined;\n\n/** Loads Stripe.js once in the merchant top-level document. */\nexport function loadStripe(): Promise<StripeConstructor> {\n  if (typeof window.Stripe === 'function') return Promise.resolve(window.Stripe);\n  if (stripeScript !== undefined) return stripeScript;\n  stripeScript = new Promise<StripeConstructor>((resolve, reject) => {\n    const script = document.createElement('script');\n    script.src = 'https://js.stripe.com/v3/';\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => {\n      if (typeof window.Stripe === 'function') resolve(window.Stripe);\n      else reject(new Error('Stripe.js loaded without its public API.'));\n    };\n    script.onerror = () => reject(new Error('Stripe.js could not be loaded.'));\n    document.head.append(script);\n  });\n  return stripeScript;\n}\n", "import { loadStripe } from './stripe';\nimport type { RiskCollector } from './contracts/types';\n\nconst KOUNT_HOSTS = {\n  sandbox: 'https://tst.kaptcha.com',\n  live: 'https://ssl.kaptcha.com'\n} as const;\n// Keep client work aligned with the hosted bridge's decoded-object ceiling.\nconst MAX_RISK_COLLECTORS = 12;\n// Inspect a bounded superset so malformed/duplicate instructions cannot crowd\n// out a valid backend-issued collector near the start of a corrupted list.\nconst MAX_RISK_COLLECTOR_INPUTS = 256;\nconst MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH = 8_192;\n\nexport type RiskCollectorSessionCollection = Readonly<{\n  /**\n   * Returns only sessions that have already completed. It never waits on a\n   * third party and is therefore safe to call from the payment critical path.\n   */\n  snapshot: () => string | undefined;\n  /**\n   * Resolves after every third-party collector settles. A provider that never\n   * responds can keep this pending; this is observability-only and must never\n   * be awaited by the payment path.\n   */\n  settled: Promise<void>;\n}>;\n\n/**\n * Starts every collector without making payment availability depend on third\n * parties. Call snapshot() at PAY time to obtain the sessions that completed\n * while the buyer was entering their card details.\n */\nexport function startRiskCollectorSessionCollection(\n  collectors: readonly RiskCollector[] | undefined,\n  environment: 'sandbox' | 'live'\n): RiskCollectorSessionCollection {\n  if (collectors === undefined || collectors.length === 0) {\n    return { snapshot: () => undefined, settled: Promise.resolve() };\n  }\n\n  const sessions: Record<string, string> = {};\n  const acceptedCollectors = boundedCollectors(collectors);\n  const settled = Promise.all(\n    acceptedCollectors.map(async (collector) => {\n      const session = await collectOne(collector, environment).catch(() => undefined);\n      if (session !== undefined) sessions[collector.publicKey] = session;\n    })\n  ).then(() => undefined);\n\n  return {\n    snapshot: () => boundedSnapshot(sessions),\n    settled\n  };\n}\n\n/**\n * CheckoutSession may pass through untrusted browser code, so enforce the\n * bridge contract before creating third-party requests. The Runtime may return\n * any supported provider/collector combination and distinct public keys; only\n * duplicate keys and an unbounded list are rejected locally.\n */\nfunction boundedCollectors(collectors: readonly RiskCollector[]): RiskCollector[] {\n  const accepted: RiskCollector[] = [];\n  const seenKeys = new Set<string>();\n\n  // Do not iterate over an unbounded host-controlled list. Inspect a bounded\n  // superset to tolerate malformed/duplicate values before the accepted cap.\n  for (const collector of collectors.slice(0, MAX_RISK_COLLECTOR_INPUTS)) {\n    if (!isRiskCollector(collector)) continue;\n    if (seenKeys.has(collector.publicKey)) continue;\n    seenKeys.add(collector.publicKey);\n    accepted.push(collector);\n    if (accepted.length === MAX_RISK_COLLECTORS) break;\n  }\n  return accepted;\n}\n\nfunction boundedSnapshot(sessions: Record<string, string>): string | undefined {\n  if (Object.keys(sessions).length === 0) return undefined;\n  const encoded = base64Json({ ...sessions });\n  // Omit optional telemetry instead of emitting a bridge message that the\n  // hosted form would reject and potentially delaying the payment state.\n  return encoded.length <= MAX_RISK_COLLECTOR_SESSIONS_BASE64_LENGTH ? encoded : undefined;\n}\n\nasync function collectOne(\n  collector: RiskCollector,\n  environment: 'sandbox' | 'live'\n): Promise<string | undefined> {\n  if (collector.provider === 'stripe' && collector.collector === 'radar') {\n    const stripe = (await loadStripe())(collector.publicKey);\n    if (stripe === null || stripe.createRadarSession === undefined) return undefined;\n    const result = await stripe.createRadarSession();\n    return radarSessionId(result);\n  }\n  if (\n    (collector.provider === 'nmi' || collector.provider === 'seamless') &&\n    collector.collector === 'kount'\n  ) {\n    const session = randomHex(32);\n    await loadKount(collector.publicKey, session, environment);\n    return session;\n  }\n  return undefined;\n}\n\nfunction loadKount(\n  merchantId: string,\n  sessionId: string,\n  environment: 'sandbox' | 'live'\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement('script');\n    const url = new URL('/collect/sdk', KOUNT_HOSTS[environment]);\n    url.searchParams.set('m', merchantId);\n    url.searchParams.set('s', sessionId);\n    script.src = url.toString();\n    script.async = true;\n    script.referrerPolicy = 'origin';\n    script.onload = () => resolve();\n    script.onerror = () => reject(new Error('Kount collector could not be loaded.'));\n    document.head.append(script);\n  });\n}\n\nfunction radarSessionId(value: unknown): string | undefined {\n  if (typeof value === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(value)) return value;\n  if (isRecord(value)) {\n    const direct = value.id;\n    if (typeof direct === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(direct)) return direct;\n    if (isRecord(value.radarSession)) {\n      const nested = value.radarSession.id;\n      if (typeof nested === 'string' && /^rse_[A-Za-z0-9_-]{4,512}$/.test(nested)) return nested;\n    }\n  }\n  return undefined;\n}\n\nfunction isRiskCollector(value: RiskCollector): boolean {\n  if (\n    typeof value.publicKey !== 'string' ||\n    value.publicKey.length === 0 ||\n    value.publicKey.length > 512\n  )\n    return false;\n  if (value.provider === 'stripe' && value.collector === 'radar')\n    return /^pk_(test|live)_[A-Za-z0-9_]{8,512}$/.test(value.publicKey);\n  return (\n    (value.provider === 'nmi' || value.provider === 'seamless') &&\n    value.collector === 'kount' &&\n    // Kount accepts both legacy numeric MIDs and Runtime-issued checkout_public_* keys.\n    // The value is serialized by URLSearchParams, so accepting the documented public key format\n    // does not create a URL-injection surface.\n    /^(?:\\d{1,12}|checkout_public_[A-Za-z0-9_-]{8,512})$/.test(value.publicKey)\n  );\n}\n\nfunction randomHex(length: number): string {\n  const bytes = new Uint8Array(length / 2);\n  crypto.getRandomValues(bytes);\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction base64Json(value: Record<string, string>): string {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "type StripeThreeDSAction = Readonly<{\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nimport { loadStripe } from './stripe';\n\n/**\n * Runs in the merchant document so Stripe.js can present its native modal at\n * the top-level browsing context. The action is accepted only from the\n * already-bound hosted frame and is never exposed to integration callbacks.\n */\nexport async function completeStripeThreeDS(action: StripeThreeDSAction): Promise<void> {\n  const stripe = (await loadStripe())(action.publishableKey);\n  if (stripe === null) throw new Error('Stripe.js could not initialize.');\n  const result = await stripe.handleNextAction({ clientSecret: action.clientSecret });\n  if (result.error !== undefined) throw new Error('Stripe authentication failed.');\n}\n", "import type {\n  CardState,\n  PaymentFormAppearance,\n  PaymentFormError,\n  PaymentFormStatus,\n  PayInput,\n  PayOutcome,\n  ThreeDSPresentation\n} from './contracts/types';\n\nexport const FORM_PAYMENT_PROTOCOL_VERSION = 1 as const;\n\ntype Base = Readonly<{\n  channel: 'BEMONY_FORM_PAYMENT';\n  version: typeof FORM_PAYMENT_PROTOCOL_VERSION;\n  instanceId: string;\n}>;\n\ntype StripeThreeDSAction = Readonly<{\n  actionId: string;\n  clientSecret: string;\n  publishableKey: string;\n}>;\n\nexport type HostToFrameMessage =\n  | (Base &\n      Readonly<{\n        type: 'INIT';\n        clientSecret: string;\n        appearance?: PaymentFormAppearance;\n        presentation: ThreeDSPresentation;\n      }>)\n  | (Base &\n      Readonly<{\n        type: 'PAY';\n        requestId: string;\n        input: PayInput;\n        /** Base64 JSON map generated only by the public collector layer. */\n        riskCollectorSessions?: string;\n      }>)\n  | (Base & Readonly<{ type: 'THREE_DS_PRESENTED' }>)\n  | (Base &\n      Readonly<{ type: 'STRIPE_3DS_RESULT'; actionId: string; result: 'SUCCEEDED' | 'FAILED' }>)\n  | (Base & Readonly<{ type: 'DESTROY' }>);\n\nexport type FrameToHostMessage =\n  | (Base & Readonly<{ type: 'READY' | 'MOUNTED' | 'THREE_DS_CLOSE' }>)\n  | (Base & Readonly<{ type: 'THREE_DS_OPEN' }>)\n  | (Base & Readonly<{ type: 'STRIPE_3DS'; action: StripeThreeDSAction }>)\n  | (Base & Readonly<{ type: 'RESIZED'; height: number }>)\n  | (Base & Readonly<{ type: 'STATUS'; status: PaymentFormStatus }>)\n  | (Base & Readonly<{ type: 'CARD_STATE'; state: CardState }>)\n  | (Base & Readonly<{ type: 'SUCCESS'; requestId: string; payment: PayOutcome }>)\n  | (Base & Readonly<{ type: 'ERROR'; requestId?: string; error: PaymentFormError }>);\n\nexport function isFrameToHostMessage(value: unknown): value is FrameToHostMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'READY':\n    case 'MOUNTED':\n    case 'THREE_DS_CLOSE':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'THREE_DS_OPEN':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'action']) &&\n        isStripeThreeDSAction(value.action)\n      );\n    case 'STATUS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'status']) &&\n        isStatus(value.status)\n      );\n    case 'RESIZED':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'height']) &&\n        isFrameHeight(value.height)\n      );\n    case 'CARD_STATE':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'state']) &&\n        isCardState(value.state)\n      );\n    case 'SUCCESS':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'payment']) &&\n        isId(value.requestId) &&\n        isOutcome(value.payment)\n      );\n    case 'ERROR':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'requestId', 'error']) &&\n        (value.requestId === undefined || isId(value.requestId)) &&\n        isError(value.error)\n      );\n    default:\n      return false;\n  }\n}\n\nexport function isHostToFrameMessage(value: unknown): value is HostToFrameMessage {\n  if (!hasBase(value)) return false;\n  switch (value.type) {\n    case 'INIT':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'clientSecret',\n          'appearance',\n          'presentation'\n        ]) &&\n        isClientSecret(value.clientSecret) &&\n        isPresentation(value.presentation) &&\n        (value.appearance === undefined || isAppearance(value.appearance))\n      );\n    case 'PAY':\n      return (\n        hasOnly(value, [\n          'channel',\n          'version',\n          'instanceId',\n          'type',\n          'requestId',\n          'input',\n          'riskCollectorSessions'\n        ]) &&\n        isId(value.requestId) &&\n        isPayInput(value.input) &&\n        (value.riskCollectorSessions === undefined ||\n          isRiskCollectorSessions(value.riskCollectorSessions))\n      );\n    case 'THREE_DS_PRESENTED':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    case 'STRIPE_3DS_RESULT':\n      return (\n        hasOnly(value, ['channel', 'version', 'instanceId', 'type', 'actionId', 'result']) &&\n        isStripeActionId(value.actionId) &&\n        (value.result === 'SUCCEEDED' || value.result === 'FAILED')\n      );\n    case 'DESTROY':\n      return hasOnly(value, ['channel', 'version', 'instanceId', 'type']);\n    default:\n      return false;\n  }\n}\n\nfunction hasBase(value: unknown): value is Record<string, unknown> & Base {\n  return (\n    isRecord(value) &&\n    value.channel === 'BEMONY_FORM_PAYMENT' &&\n    value.version === FORM_PAYMENT_PROTOCOL_VERSION &&\n    isId(value.instanceId) &&\n    typeof value.type === 'string'\n  );\n}\n\nfunction hasOnly(value: Record<string, unknown>, keys: readonly string[]): boolean {\n  return Object.keys(value).every((key) => keys.includes(key));\n}\n\nfunction isId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9-]{16,128}$/.test(value);\n}\n\nfunction isClientSecret(value: unknown): value is string {\n  return typeof value === 'string' && /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction isRiskCollectorSessions(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    value.length <= 8_192 &&\n    /^[A-Za-z0-9+/]*={0,2}$/.test(value)\n  );\n}\n\nfunction isStripeThreeDSAction(value: unknown): value is StripeThreeDSAction {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['actionId', 'clientSecret', 'publishableKey']) &&\n    isStripeActionId(value.actionId) &&\n    typeof value.clientSecret === 'string' &&\n    /^pi_[A-Za-z0-9_]{4,256}_secret_[A-Za-z0-9_-]{8,512}$/.test(value.clientSecret) &&\n    typeof value.publishableKey === 'string' &&\n    /^pk_(test|live)_[A-Za-z0-9_-]{8,512}$/.test(value.publishableKey)\n  );\n}\n\nfunction isStripeActionId(value: unknown): value is string {\n  return typeof value === 'string' && /^pi_[A-Za-z0-9_]{4,256}$/.test(value);\n}\n\nfunction isPresentation(value: unknown): value is ThreeDSPresentation {\n  return value === 'modal' || value === 'inline';\n}\n\nfunction isStatus(value: unknown): value is PaymentFormStatus {\n  return (\n    typeof value === 'string' &&\n    [\n      'MOUNTING',\n      'READY',\n      'TOKENIZING',\n      'SUBMITTING',\n      'AUTHENTICATING_3DS',\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD',\n      'DESTROYED'\n    ].includes(value)\n  );\n}\n\nfunction isFrameHeight(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value >= 80 && value <= 1_200;\n}\n\nfunction isCardState(value: unknown): value is CardState {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['complete', 'valid']) &&\n    typeof value.complete === 'boolean' &&\n    typeof value.valid === 'boolean'\n  );\n}\n\nfunction isOutcome(value: unknown): value is PayOutcome {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['paymentId', 'status']) &&\n    typeof value.paymentId === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId) &&\n    (value.status === 'AUTHORIZED' || value.status === 'CAPTURED')\n  );\n}\n\nfunction isError(value: unknown): value is PaymentFormError {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'code',\n      'message',\n      'requestId',\n      'paymentId',\n      'retryable',\n      'httpStatus',\n      'upstreamRequestId',\n      'frameStage',\n      'payment'\n    ]) &&\n    typeof value.code === 'string' &&\n    /^[A-Z][A-Z0-9_]{1,63}$/.test(value.code) &&\n    typeof value.message === 'string' &&\n    value.message.length <= 1_000 &&\n    (value.requestId === undefined || isId(value.requestId)) &&\n    (value.paymentId === undefined ||\n      (typeof value.paymentId === 'string' &&\n        /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.paymentId))) &&\n    (value.retryable === undefined || typeof value.retryable === 'boolean') &&\n    (value.httpStatus === undefined ||\n      (typeof value.httpStatus === 'number' &&\n        Number.isInteger(value.httpStatus) &&\n        value.httpStatus >= 400 &&\n        value.httpStatus <= 599)) &&\n    (value.upstreamRequestId === undefined ||\n      (typeof value.upstreamRequestId === 'string' &&\n        value.upstreamRequestId.length > 0 &&\n        value.upstreamRequestId.length <= 1_000)) &&\n    (value.frameStage === undefined ||\n      value.frameStage === 'FRAME_DOCUMENT' ||\n      value.frameStage === 'CARD_FRAME') &&\n    (value.payment === undefined || isErrorPayment(value.payment))\n  );\n}\n\nfunction isErrorPayment(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, ['id', 'environment', 'currency', 'transaction']) &&\n    typeof value.id === 'string' &&\n    /^pay_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    (value.environment === 'sandbox' || value.environment === 'live') &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    isErrorTransaction(value.transaction)\n  );\n}\n\nfunction isErrorTransaction(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'id',\n      'status',\n      'amount',\n      'currency',\n      'provider',\n      'providerReference',\n      'attempts'\n    ]) &&\n    typeof value.id === 'string' &&\n    /^txn_[A-Za-z0-9_-]{4,128}$/.test(value.id) &&\n    isPaymentStatus(value.status) &&\n    Number.isSafeInteger(value.amount) &&\n    typeof value.currency === 'string' &&\n    /^[A-Z]{3}$/.test(value.currency) &&\n    optionalText(value.provider) &&\n    optionalText(value.providerReference) &&\n    (value.attempts === undefined ||\n      (Array.isArray(value.attempts) &&\n        value.attempts.length <= 20 &&\n        value.attempts.every(isErrorAttempt)))\n  );\n}\n\nfunction isErrorAttempt(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'ordinal',\n      'provider',\n      'status',\n      'delivery',\n      'failureReason',\n      'providerCode',\n      'providerStatus',\n      'providerReference',\n      'message',\n      'toProxyMs',\n      'midMs'\n    ]) &&\n    optionalInteger(value.ordinal) &&\n    optionalText(value.provider) &&\n    optionalText(value.status) &&\n    optionalText(value.delivery) &&\n    optionalText(value.failureReason) &&\n    optionalText(value.providerCode) &&\n    optionalText(value.providerStatus) &&\n    optionalText(value.providerReference) &&\n    optionalText(value.message) &&\n    optionalInteger(value.toProxyMs) &&\n    optionalInteger(value.midMs)\n  );\n}\n\nfunction isPaymentStatus(value: unknown): boolean {\n  return (\n    typeof value === 'string' &&\n    [\n      'PROCESSING',\n      'AUTHORIZED',\n      'CAPTURED',\n      'DECLINED',\n      'FAILED',\n      'UNKNOWN',\n      'EXPIRED',\n      'REQUIRES_PAYMENT_METHOD'\n    ].includes(value)\n  );\n}\n\nfunction optionalText(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'string' && value.length > 0 && value.length <= 1_000)\n  );\n}\n\nfunction optionalInteger(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n  );\n}\n\nfunction isAppearance(value: unknown): value is PaymentFormAppearance {\n  if (!isRecord(value) || !hasOnly(value, ['theme', 'variables', 'threeDS'])) return false;\n  if (value.theme !== undefined && !['light', 'dark', 'system'].includes(String(value.theme)))\n    return false;\n  if (\n    value.variables !== undefined &&\n    (!isRecord(value.variables) ||\n      Object.values(value.variables).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  if (\n    value.threeDS !== undefined &&\n    (!isRecord(value.threeDS) ||\n      Object.values(value.threeDS).some((entry) => typeof entry !== 'string'))\n  )\n    return false;\n  return true;\n}\n\nfunction isPayInput(value: unknown): value is PayInput {\n  if (\n    !isRecord(value) ||\n    !hasOnly(value, [\n      'merchantOrderId',\n      'merchantReference',\n      'description',\n      'currency',\n      'operation',\n      'customer',\n      'billingAddress',\n      'shippingAddress',\n      'cardStorageConsent',\n      'items',\n      'amounts',\n      'initialTransactionReference',\n      'checkoutUrl',\n      'returnUrl',\n      'metadata',\n      'client'\n    ])\n  )\n    return false;\n  if (\n    typeof value.merchantOrderId !== 'string' ||\n    value.merchantOrderId.trim().length === 0 ||\n    value.merchantOrderId.length > 255 ||\n    typeof value.currency !== 'string' ||\n    !/^[A-Z]{3}$/.test(value.currency) ||\n    (value.operation !== undefined && value.operation !== 'AUTHORIZE' && value.operation !== 'SALE')\n  )\n    return false;\n  return (\n    Array.isArray(value.items) &&\n    value.items.length > 0 &&\n    value.items.length <= 20 &&\n    value.items.every(isPaymentItem)\n  );\n}\n\nfunction isPaymentItem(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    hasOnly(value, [\n      'description',\n      'id',\n      'sku',\n      'unitAmount',\n      'quantity',\n      'type',\n      'interval',\n      'intervalCount',\n      'trialDays',\n      'cycle',\n      'isMain',\n      'category',\n      'brand',\n      'imageUrl',\n      'manufacturePartNumber'\n    ]) &&\n    typeof value.description === 'string' &&\n    value.description.trim().length > 0 &&\n    Number.isSafeInteger(value.unitAmount) &&\n    Number(value.unitAmount) > 0 &&\n    Number.isSafeInteger(value.quantity) &&\n    Number(value.quantity) > 0 &&\n    Number(value.quantity) <= 999 &&\n    (value.type === 'ONE_TIME' ||\n      value.type === 'RECURRING' ||\n      value.type === 'UNIQUE' ||\n      value.type === 'unique' ||\n      value.type === 'recurring')\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n", "import { formError } from './contracts/errors';\nimport { enrichPayInputFromBrowser } from './browser-context';\nimport { startRiskCollectorSessionCollection } from './risk-collectors';\nimport { completeStripeThreeDS } from './stripe-three-ds';\nimport type {\n  PayInput,\n  PaymentFormError,\n  PaymentFormInstance,\n  PaymentFormMountOptions,\n  PaymentFormState,\n  PaymentFormStatus,\n  PayOutcome\n} from './contracts/types';\nimport {\n  FORM_PAYMENT_PROTOCOL_VERSION,\n  isFrameToHostMessage,\n  type FrameToHostMessage,\n  type HostToFrameMessage\n} from './protocol';\n\nconst productionFrameOrigin = 'https://payment-form.bemony.com';\nconst threeDSModalWidth = 624;\nconst threeDSModalRadius = 12;\n// The hosted form has up to two 10s Card Frame bootstrap attempts. Keep this\n// outer watchdog above that bounded recovery window so it cannot mask the\n// structured frame error with a generic FRAME_UNAVAILABLE.\nconst FORM_MOUNT_TIMEOUT_MS = 25_000;\n\nexport const BemonyPaymentForm = {\n  mount(options: PaymentFormMountOptions): Promise<PaymentFormInstance> {\n    const target = resolveTarget(options.target);\n    if (!isClientSecret(options.clientSecret)) {\n      return Promise.reject(\n        formError('PAYMENT_SESSION_INVALID', 'A sess\u00E3o de pagamento \u00E9 inv\u00E1lida.')\n      );\n    }\n    if (options.signal?.aborted) {\n      return Promise.reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n    }\n\n    // Begin telemetry at mount time so collection can run while the secure\n    // frame boots and the buyer fills in card fields. PAY reads a synchronous\n    // snapshot: an unavailable fraud provider never adds latency to payment.\n    const riskCollectorSessions = startRiskCollectorSessionCollection(\n      options.riskCollectors,\n      options.clientSecret.startsWith('cs_test_') ? 'sandbox' : 'live'\n    );\n\n    const instanceId = crypto.randomUUID();\n    const frameOrigin = resolveFrameOrigin();\n    const slot = document.createElement('div');\n    slot.dataset.bemonyPaymentForm = '';\n    const iframe = document.createElement('iframe');\n    iframe.title = 'Pagamento seguro Bemony';\n    iframe.src = `${frameOrigin}/frame?instance=${encodeURIComponent(instanceId)}`;\n    iframe.setAttribute('allow', 'payment *');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    let contentHeight = 100;\n    setInlineStyle(iframe, contentHeight);\n    slot.style.cssText = 'display:block;width:100%;margin:0;padding:0;background:transparent;';\n    slot.append(iframe);\n    target.append(slot);\n\n    let destroyed = false;\n    let mounted = false;\n    let timer: number | undefined;\n    let overlay: HTMLDivElement | undefined;\n    let applyOverlayLayout: (() => void) | undefined;\n    let bodyOverflow: string | null = null;\n    let documentOverflow: string | null = null;\n    let rejectMount: ((reason: PaymentFormError) => void) | undefined;\n    let state: PaymentFormState = { status: 'MOUNTING', ready: false, isSubmitting: false };\n    let blockedError: PaymentFormError | undefined;\n    let active:\n      | Readonly<{\n          requestId: string;\n          promise: Promise<PayOutcome>;\n          resolve: (value: PayOutcome) => void;\n          reject: (reason: PaymentFormError) => void;\n        }>\n      | undefined;\n    let onMessage: (event: MessageEvent<unknown>) => void = () => undefined;\n\n    const callback = <T>(fn: ((value: T) => void) | undefined, value: T): void => {\n      try {\n        fn?.(value);\n      } catch {\n        /* Merchant callbacks never control payment state. */\n      }\n    };\n    const post = (message: HostToFrameMessage): void => {\n      iframe.contentWindow?.postMessage(message, frameOrigin);\n    };\n    const restoreInline = (): void => {\n      if (overlay === undefined) return;\n      overlay.remove();\n      overlay = undefined;\n      if (bodyOverflow === null) document.body.style.removeProperty('overflow');\n      else document.body.setAttribute('style', bodyOverflow);\n      if (documentOverflow === null) document.documentElement.style.removeProperty('overflow');\n      else document.documentElement.setAttribute('style', documentOverflow);\n      bodyOverflow = null;\n      documentOverflow = null;\n      applyOverlayLayout = undefined;\n      setInlineStyle(iframe, contentHeight);\n      iframe.removeAttribute('role');\n      iframe.removeAttribute('aria-modal');\n      iframe.removeAttribute('aria-label');\n    };\n    const showOverlay = (): void => {\n      if (options.threeDS?.presentation !== 'modal' || overlay !== undefined) return;\n      overlay = document.createElement('div');\n      overlay.dataset.bemonyPaymentThreeDsModal = '';\n      // Keep the Frame in its original DOM position. Reparenting an iframe can\n      // reload its nested Card Frame and discard the in-flight issuer challenge.\n      // The backdrop belongs to document.body; fixed positioning turns the\n      // already-mounted frame into the modal without resetting it.\n      overlay.setAttribute('aria-hidden', 'true');\n      iframe.setAttribute('tabindex', '-1');\n      iframe.setAttribute('role', 'dialog');\n      iframe.setAttribute('aria-modal', 'true');\n      iframe.setAttribute('aria-label', 'Autentica\u00E7\u00E3o segura do banco');\n      overlay.style.cssText = [\n        'position:fixed',\n        'inset:0',\n        // The secure iframe must stay above this backdrop. It is appended\n        // after the iframe so equal stacking values would intercept the\n        // issuer's buttons and make a valid challenge impossible to finish.\n        'z-index:2147483646',\n        'display:flex',\n        'align-items:center',\n        'justify-content:center',\n        'padding:0',\n        `background:${options.appearance?.threeDS?.modalBackdrop ?? 'rgba(2, 6, 23, .72)'}`\n      ].join(';');\n      const applyLayout = (): void => {\n        iframe.style.cssText = [\n          'position:fixed',\n          'left:50%',\n          'top:50%',\n          'z-index:2147483647',\n          'display:block',\n          `width:min(${threeDSModalWidth}px, calc(100vw - 24px))`,\n          `height:min(${contentHeight}px, calc(100dvh - 24px))`,\n          'border:0',\n          `border-radius:${threeDSModalRadius}px`,\n          'overflow:hidden',\n          'background:#fff',\n          'box-shadow:none',\n          'transform:translate(-50%, -50%)'\n        ].join(';');\n      };\n      applyOverlayLayout = applyLayout;\n      bodyOverflow = document.body.getAttribute('style');\n      documentOverflow = document.documentElement.getAttribute('style');\n      document.body.style.setProperty('overflow', 'hidden', 'important');\n      document.documentElement.style.setProperty('overflow', 'hidden', 'important');\n      applyLayout();\n      document.body.append(overlay);\n      window.requestAnimationFrame(() => iframe.focus({ preventScroll: true }));\n    };\n    const reportStatus = (status: PaymentFormStatus): void => {\n      if (destroyed) return;\n      state = {\n        ...state,\n        status,\n        ready: mounted,\n        isSubmitting: ['TOKENIZING', 'SUBMITTING', 'AUTHENTICATING_3DS', 'PROCESSING'].includes(\n          status\n        )\n      };\n      callback(options.onStatusChange, status);\n    };\n    const reportError = (error: PaymentFormError, requestId?: string): void => {\n      if (requestId !== undefined && active !== undefined && active.requestId !== requestId) return;\n      restoreInline();\n      if (error.code === 'PAYMENT_STATUS_UNKNOWN') blockedError = error;\n      state = {\n        ...state,\n        ...(error.code === 'PAYMENT_STATUS_UNKNOWN' ? { status: 'UNKNOWN' as const } : {}),\n        error,\n        isSubmitting: false\n      };\n      callback(options.onError, error);\n      if (!mounted && rejectMount !== undefined) {\n        if (timer !== undefined) window.clearTimeout(timer);\n        const reject = rejectMount;\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n        return;\n      }\n      if (active !== undefined) {\n        active.reject(error);\n        active = undefined;\n      }\n    };\n    const destroy = (): void => {\n      if (destroyed) return;\n      destroyed = true;\n      if (timer !== undefined) window.clearTimeout(timer);\n      window.removeEventListener('message', onMessage);\n      options.signal?.removeEventListener('abort', destroy);\n      restoreInline();\n      post({\n        channel: 'BEMONY_FORM_PAYMENT',\n        version: FORM_PAYMENT_PROTOCOL_VERSION,\n        type: 'DESTROY',\n        instanceId\n      });\n      iframe.remove();\n      slot.remove();\n      active?.reject(formError('FRAME_UNAVAILABLE', 'O formul\u00E1rio de pagamento foi desmontado.'));\n      active = undefined;\n      state = { ...state, status: 'DESTROYED', ready: false, isSubmitting: false };\n      if (!mounted && rejectMount !== undefined) {\n        const reject = rejectMount;\n        rejectMount = undefined;\n        reject(formError('INVALID_STATE', 'A montagem foi cancelada.'));\n      }\n    };\n    const instance: PaymentFormInstance = {\n      pay(input: PayInput): Promise<PayOutcome> {\n        if (destroyed)\n          return Promise.reject(\n            formError('INVALID_STATE', 'O formul\u00E1rio de pagamento foi desmontado.')\n          );\n        if (!mounted)\n          return Promise.reject(\n            formError('FORM_NOT_READY', 'O formul\u00E1rio de pagamento ainda n\u00E3o est\u00E1 pronto.')\n          );\n        if (blockedError !== undefined) return Promise.reject(blockedError);\n        if (active !== undefined) return active.promise;\n        const requestId = crypto.randomUUID();\n        let resolve!: (payment: PayOutcome) => void;\n        let reject!: (error: PaymentFormError) => void;\n        const promise = new Promise<PayOutcome>((nextResolve, nextReject) => {\n          resolve = nextResolve;\n          reject = nextReject;\n        });\n        active = { requestId, promise, resolve, reject };\n        const enrichedInput = enrichPayInputFromBrowser(input);\n        const sessions = riskCollectorSessions.snapshot();\n        post({\n          channel: 'BEMONY_FORM_PAYMENT',\n          version: FORM_PAYMENT_PROTOCOL_VERSION,\n          type: 'PAY',\n          instanceId,\n          requestId,\n          input: enrichedInput,\n          ...(sessions === undefined ? {} : { riskCollectorSessions: sessions })\n        });\n        return promise;\n      },\n      getState: () => state,\n      destroy\n    };\n    const mountPromise = new Promise<PaymentFormInstance>((resolve, reject) => {\n      rejectMount = reject;\n      timer = window.setTimeout(() => {\n        if (mounted || destroyed) return;\n        const error = formError(\n          'FRAME_UNAVAILABLE',\n          'N\u00E3o foi poss\u00EDvel carregar o formul\u00E1rio de pagamento.'\n        );\n        rejectMount = undefined;\n        destroy();\n        reject(error);\n      }, FORM_MOUNT_TIMEOUT_MS);\n      onMessage = (event: MessageEvent<unknown>): void => {\n        if (destroyed || event.origin !== frameOrigin || event.source !== iframe.contentWindow)\n          return;\n        if (!isFrameToHostMessage(event.data) || event.data.instanceId !== instanceId) return;\n        const message: FrameToHostMessage = event.data;\n        if (message.type === 'READY') {\n          post({\n            channel: 'BEMONY_FORM_PAYMENT',\n            version: FORM_PAYMENT_PROTOCOL_VERSION,\n            type: 'INIT',\n            instanceId,\n            clientSecret: options.clientSecret,\n            presentation: options.threeDS?.presentation ?? 'modal',\n            ...(options.appearance === undefined ? {} : { appearance: options.appearance })\n          });\n          return;\n        }\n        if (message.type === 'MOUNTED') {\n          if (mounted) return;\n          mounted = true;\n          if (timer !== undefined) window.clearTimeout(timer);\n          rejectMount = undefined;\n          state = { ...state, status: 'READY', ready: true };\n          callback(options.onReady, undefined);\n          callback(options.onStatusChange, 'READY');\n          resolve(instance);\n          return;\n        }\n        if (message.type === 'STATUS') return reportStatus(message.status);\n        if (message.type === 'CARD_STATE')\n          return callback(options.onCardStateChange, message.state);\n        if (message.type === 'RESIZED') {\n          contentHeight = message.height;\n          if (overlay === undefined) setInlineStyle(iframe, contentHeight);\n          else applyOverlayLayout?.();\n          return;\n        }\n        if (message.type === 'STRIPE_3DS') {\n          // Stripe.js owns the top-level challenge surface. The sensitive,\n          // ephemeral action stays on this private bridge and never reaches\n          // consumer callbacks or public SDK state.\n          void completeStripeThreeDS(message.action).then(\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'SUCCEEDED'\n              });\n            },\n            () => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'STRIPE_3DS_RESULT',\n                instanceId,\n                actionId: message.action.actionId,\n                result: 'FAILED'\n              });\n            }\n          );\n          return;\n        }\n        if (message.type === 'THREE_DS_OPEN') {\n          // The hosted form must not start the issuer challenge until the\n          // public host has promoted this iframe to its modal and the browser\n          // has had a chance to paint that layout.\n          showOverlay();\n          window.requestAnimationFrame(() => {\n            window.requestAnimationFrame(() => {\n              post({\n                channel: 'BEMONY_FORM_PAYMENT',\n                version: FORM_PAYMENT_PROTOCOL_VERSION,\n                type: 'THREE_DS_PRESENTED',\n                instanceId\n              });\n            });\n          });\n          return;\n        }\n        if (message.type === 'THREE_DS_CLOSE') return restoreInline();\n        if (\n          message.type === 'SUCCESS' &&\n          (active === undefined || active.requestId === message.requestId)\n        ) {\n          restoreInline();\n          blockedError = undefined;\n          state = {\n            status: message.payment.status,\n            ready: true,\n            isSubmitting: false,\n            payment: message.payment\n          };\n          callback(options.onStatusChange, message.payment.status);\n          callback(options.onSuccess, message.payment);\n          active?.resolve(message.payment);\n          active = undefined;\n          return;\n        }\n        if (message.type === 'ERROR') reportError(message.error, message.requestId);\n      };\n      window.addEventListener('message', onMessage);\n    });\n    options.signal?.addEventListener('abort', destroy, { once: true });\n    return mountPromise;\n  }\n};\n\nfunction resolveTarget(target: string | HTMLElement): HTMLElement {\n  const element = typeof target === 'string' ? document.querySelector<HTMLElement>(target) : target;\n  if (element === null || !(element instanceof HTMLElement))\n    throw formError('PAY_INPUT_INVALID', 'O container do Payment Form n\u00E3o foi encontrado.');\n  return element;\n}\n\nfunction isClientSecret(value: string): boolean {\n  return /^cs_(test|live)_[A-Za-z0-9_-]{16,512}$/.test(value);\n}\n\nfunction resolveFrameOrigin(): string {\n  const isLoopbackHost = ['localhost', '127.0.0.1', '[::1]'].includes(window.location.hostname);\n  const configured = (\n    globalThis as typeof globalThis & { __BEMONY_PAYMENT_FORM_FRAME_URL__?: string }\n  ).__BEMONY_PAYMENT_FORM_FRAME_URL__;\n  if (!isLoopbackHost || configured === undefined) return productionFrameOrigin;\n\n  try {\n    const url = new URL(configured);\n    if (\n      !['http:', 'https:'].includes(url.protocol) ||\n      url.pathname !== '/' ||\n      url.search ||\n      url.hash ||\n      url.username ||\n      url.password\n    ) {\n      return productionFrameOrigin;\n    }\n    return url.origin;\n  } catch {\n    return productionFrameOrigin;\n  }\n}\n\nfunction setInlineStyle(iframe: HTMLIFrameElement, height: number): void {\n  iframe.style.cssText = `display:block;width:100%;height:${height}px;min-height:${height}px;border:0;background:transparent;`;\n  iframe.removeAttribute('tabindex');\n}\n"],
+  "mappings": ";AAEO,SAAS,UAAU,MAAc,SAAiB,WAAsC;AAC7F,SAAO,cAAc,SAAY,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,SAAS,UAAU;AAClF;;;ACGO,SAAS,0BAA0B,OAA2B;AACnE,QAAM,WAAW,MAAM;AACvB,QAAM,WAAW,YAAY,OAAO,SAAS,IAAI;AACjD,QAAM,WAAW,YAAY,SAAS,QAAQ;AAC9C,QAAM,cAA0D;AAAA,IAC9D,YAAY,OAAO,QAAQ;AAAA,IAC3B,mBAAmB;AAAA,IACnB,aAAa,YAAY;AAAA,IACzB,UAAU,UAAU;AAAA,IACpB,cAAc,OAAO,QAAQ;AAAA,IAC7B,aAAa,OAAO,QAAQ;AAAA,IAC5B,wBAAuB,oBAAI,KAAK,GAAE,kBAAkB;AAAA,EACtD;AACA,QAAM,MAAM,QAAQ;AAAA,IAClB,GAAG,qBAAqB;AAAA,IACxB,GAAG,YAAY,UAAU,GAAG;AAAA,EAC9B,CAAC;AACD,QAAM,SAAyB;AAAA,IAC7B,GAAG,gBAAgB;AAAA,IACnB,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS;AAAA,IACnD,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAG;AAAA,IACH,GAAI,OAAO,KAAK,GAAG,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI;AAAA,IAC/C,aAAa,EAAE,GAAG,aAAa,GAAG,UAAU,YAAY;AAAA,EAC1D;AACA,SAAO,EAAE,GAAG,OAAO,OAAO;AAC5B;AAEA,SAAS,kBAAyE;AAChF,QAAM,YAAY,UAAU;AAC5B,SAAO;AAAA,IACL,YAAY,4BAA4B,KAAK,SAAS,IAAI,WAAW;AAAA,IACrE,IAAI,cAAc,KAAK,SAAS,IAC5B,YACA,WAAW,KAAK,SAAS,IACvB,YACA,wBAAwB,KAAK,SAAS,IACpC,UACA,SAAS,KAAK,SAAS,IACrB,UACA;AAAA,IACV,SAAS,SAAS,KAAK,SAAS,IAC5B,SACA,aAAa,KAAK,SAAS,IACzB,YACA,YAAY,KAAK,SAAS,IACxB,WACA,YAAY,KAAK,SAAS,IACxB,WACA;AAAA,EACZ;AACF;AAEA,SAAS,uBAA2D;AAClE,QAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,SAAO,YAAY;AAAA,IACjB,QAAQ,OAAO,IAAI,YAAY,KAAK;AAAA,IACpC,UAAU,OAAO,IAAI,cAAc,KAAK;AAAA,IACxC,QAAQ,OAAO,IAAI,YAAY,KAAK;AAAA,IACpC,SAAS,OAAO,IAAI,aAAa,KAAK;AAAA,IACtC,MAAM,OAAO,IAAI,UAAU,KAAK;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,YAAY,OAA8E;AACjG,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,SAAO,QAAQ;AAAA,IACb,QAAQ,iBAAiB,MAAM,MAAM;AAAA,IACrC,UAAU,iBAAiB,MAAM,QAAQ;AAAA,IACzC,QAAQ,iBAAiB,MAAM,MAAM;AAAA,IACrC,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACvC,MAAM,iBAAiB,MAAM,IAAI;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAsD;AAC9E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,UAAU,MAAM,EAAE,KAAK;AAChD,MACE,eAAe,MACf,WAAW,SAAS,OACpB,oBAAoB,UAAU,KAC9B,sBAAsB,UAAU,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAwB;AACrD,SACE,wDAAwD,KAAK,KAAK,KAClE,6CAA6C,KAAK,KAAK,KACvD,6CAA6C,KAAK,KAAK;AAE3D;AAEA,SAAS,oBAAoB,OAAwB;AACnD,SAAO,MAAM,KAAK,KAAK,EAAE,KAAK,CAAC,cAAc;AAC3C,UAAM,OAAO,UAAU,YAAY,CAAC;AACpC,WAAO,OAAO,MAAM,SAAS;AAAA,EAC/B,CAAC;AACH;AAEA,SAAS,YAAY,OAAmC;AACtD,MAAI,UAAU,GAAI,QAAO;AACzB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,EAAG,QAAO;AACxD,QAAI,SAAS;AACb,QAAI,OAAO;AACX,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAuB;AAC9B,QAAM,YAAY;AAClB,MAAI;AACF,WAAO,UAAU,cAAc,KAAK;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAsD,OAAa;AAC1E,aAAW,OAAO,OAAO,KAAK,KAAK,GAAqB;AACtD,QAAI,MAAM,GAAG,MAAM,UAAa,MAAM,GAAG,MAAM,GAAI,QAAO,MAAM,GAAG;AAAA,EACrE;AACA,SAAO;AACT;;;ACxHA,IAAI;AAGG,SAAS,aAAyC;AACvD,MAAI,OAAO,OAAO,WAAW,WAAY,QAAO,QAAQ,QAAQ,OAAO,MAAM;AAC7E,MAAI,iBAAiB,OAAW,QAAO;AACvC,iBAAe,IAAI,QAA2B,CAAC,SAAS,WAAW;AACjE,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,WAAO,iBAAiB;AACxB,WAAO,SAAS,MAAM;AACpB,UAAI,OAAO,OAAO,WAAW,WAAY,SAAQ,OAAO,MAAM;AAAA,UACzD,QAAO,IAAI,MAAM,0CAA0C,CAAC;AAAA,IACnE;AACA,WAAO,UAAU,MAAM,OAAO,IAAI,MAAM,gCAAgC,CAAC;AACzE,aAAS,KAAK,OAAO,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;;;AClCA,IAAM,cAAc;AAAA,EAClB,SAAS;AAAA,EACT,MAAM;AACR;AAEA,IAAM,sBAAsB;AAG5B,IAAM,4BAA4B;AAClC,IAAM,4CAA4C;AAqB3C,SAAS,oCACd,YACA,aACgC;AAChC,MAAI,eAAe,UAAa,WAAW,WAAW,GAAG;AACvD,WAAO,EAAE,UAAU,MAAM,QAAW,SAAS,QAAQ,QAAQ,EAAE;AAAA,EACjE;AAEA,QAAM,WAAmC,CAAC;AAC1C,QAAM,qBAAqB,kBAAkB,UAAU;AACvD,QAAM,UAAU,QAAQ;AAAA,IACtB,mBAAmB,IAAI,OAAO,cAAc;AAC1C,YAAM,UAAU,MAAM,WAAW,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AAC9E,UAAI,YAAY,OAAW,UAAS,UAAU,SAAS,IAAI;AAAA,IAC7D,CAAC;AAAA,EACH,EAAE,KAAK,MAAM,MAAS;AAEtB,SAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;AAQA,SAAS,kBAAkB,YAAuD;AAChF,QAAM,WAA4B,CAAC;AACnC,QAAM,WAAW,oBAAI,IAAY;AAIjC,aAAW,aAAa,WAAW,MAAM,GAAG,yBAAyB,GAAG;AACtE,QAAI,CAAC,gBAAgB,SAAS,EAAG;AACjC,QAAI,SAAS,IAAI,UAAU,SAAS,EAAG;AACvC,aAAS,IAAI,UAAU,SAAS;AAChC,aAAS,KAAK,SAAS;AACvB,QAAI,SAAS,WAAW,oBAAqB;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,UAAsD;AAC7E,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG,QAAO;AAC/C,QAAM,UAAU,WAAW,EAAE,GAAG,SAAS,CAAC;AAG1C,SAAO,QAAQ,UAAU,4CAA4C,UAAU;AACjF;AAEA,eAAe,WACb,WACA,aAC6B;AAC7B,MAAI,UAAU,aAAa,YAAY,UAAU,cAAc,SAAS;AACtE,UAAM,UAAU,MAAM,WAAW,GAAG,UAAU,SAAS;AACvD,QAAI,WAAW,QAAQ,OAAO,uBAAuB,OAAW,QAAO;AACvE,UAAM,SAAS,MAAM,OAAO,mBAAmB;AAC/C,WAAO,eAAe,MAAM;AAAA,EAC9B;AACA,OACG,UAAU,aAAa,SAAS,UAAU,aAAa,eACxD,UAAU,cAAc,SACxB;AACA,UAAM,UAAU,UAAU,EAAE;AAC5B,UAAM,UAAU,UAAU,WAAW,SAAS,WAAW;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UACP,YACA,WACA,aACe;AACf,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,UAAM,MAAM,IAAI,IAAI,gBAAgB,YAAY,WAAW,CAAC;AAC5D,QAAI,aAAa,IAAI,KAAK,UAAU;AACpC,QAAI,aAAa,IAAI,KAAK,SAAS;AACnC,WAAO,MAAM,IAAI,SAAS;AAC1B,WAAO,QAAQ;AACf,WAAO,iBAAiB;AACxB,WAAO,SAAS,MAAM,QAAQ;AAC9B,WAAO,UAAU,MAAM,OAAO,IAAI,MAAM,sCAAsC,CAAC;AAC/E,aAAS,KAAK,OAAO,MAAM;AAAA,EAC7B,CAAC;AACH;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,OAAO,UAAU,YAAY,6BAA6B,KAAK,KAAK,EAAG,QAAO;AAClF,MAAI,SAAS,KAAK,GAAG;AACnB,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,WAAW,YAAY,6BAA6B,KAAK,MAAM,EAAG,QAAO;AACpF,QAAI,SAAS,MAAM,YAAY,GAAG;AAChC,YAAM,SAAS,MAAM,aAAa;AAClC,UAAI,OAAO,WAAW,YAAY,6BAA6B,KAAK,MAAM,EAAG,QAAO;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA+B;AACtD,MACE,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,WAAW,KAC3B,MAAM,UAAU,SAAS;AAEzB,WAAO;AACT,MAAI,MAAM,aAAa,YAAY,MAAM,cAAc;AACrD,WAAO,uCAAuC,KAAK,MAAM,SAAS;AACpE,UACG,MAAM,aAAa,SAAS,MAAM,aAAa,eAChD,MAAM,cAAc;AAAA;AAAA;AAAA,EAIpB,sDAAsD,KAAK,MAAM,SAAS;AAE9E;AAEA,SAAS,UAAU,QAAwB;AACzC,QAAM,QAAQ,IAAI,WAAW,SAAS,CAAC;AACvC,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChF;AAEA,SAAS,WAAW,OAAuC;AACzD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ACjKA,eAAsB,sBAAsB,QAA4C;AACtF,QAAM,UAAU,MAAM,WAAW,GAAG,OAAO,cAAc;AACzD,MAAI,WAAW,KAAM,OAAM,IAAI,MAAM,iCAAiC;AACtE,QAAM,SAAS,MAAM,OAAO,iBAAiB,EAAE,cAAc,OAAO,aAAa,CAAC;AAClF,MAAI,OAAO,UAAU,OAAW,OAAM,IAAI,MAAM,+BAA+B;AACjF;;;ACPO,IAAM,gCAAgC;AA6CtC,SAAS,qBAAqB,OAA6C;AAChF,MAAI,CAAC,QAAQ,KAAK,EAAG,QAAO;AAC5B,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,MAAM,CAAC;AAAA,IACpE,KAAK;AACH,aAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,MAAM,CAAC;AAAA,IACpE,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,sBAAsB,MAAM,MAAM;AAAA,IAEtC,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,SAAS,MAAM,MAAM;AAAA,IAEzB,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,QAAQ,CAAC,KACrE,cAAc,MAAM,MAAM;AAAA,IAE9B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,OAAO,CAAC,KACpE,YAAY,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,aAAa,SAAS,CAAC,KACnF,KAAK,MAAM,SAAS,KACpB,UAAU,MAAM,OAAO;AAAA,IAE3B,KAAK;AACH,aACE,QAAQ,OAAO,CAAC,WAAW,WAAW,cAAc,QAAQ,aAAa,OAAO,CAAC,MAChF,MAAM,cAAc,UAAa,KAAK,MAAM,SAAS,MACtD,QAAQ,MAAM,KAAK;AAAA,IAEvB;AACE,aAAO;AAAA,EACX;AACF;AAmDA,SAAS,QAAQ,OAAyD;AACxE,SACEA,UAAS,KAAK,KACd,MAAM,YAAY,yBAClB,MAAM,YAAY,iCAClB,KAAK,MAAM,UAAU,KACrB,OAAO,MAAM,SAAS;AAE1B;AAEA,SAAS,QAAQ,OAAgC,MAAkC;AACjF,SAAO,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,GAAG,CAAC;AAC7D;AAEA,SAAS,KAAK,OAAiC;AAC7C,SAAO,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACzE;AAeA,SAAS,sBAAsB,OAA8C;AAC3E,SACEC,UAAS,KAAK,KACd,QAAQ,OAAO,CAAC,YAAY,gBAAgB,gBAAgB,CAAC,KAC7D,iBAAiB,MAAM,QAAQ,KAC/B,OAAO,MAAM,iBAAiB,YAC9B,uDAAuD,KAAK,MAAM,YAAY,KAC9E,OAAO,MAAM,mBAAmB,YAChC,wCAAwC,KAAK,MAAM,cAAc;AAErE;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAMA,SAAS,SAAS,OAA4C;AAC5D,SACE,OAAO,UAAU,YACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAEpB;AAEA,SAAS,cAAc,OAAiC;AACtD,SAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,MAAM,SAAS;AACzF;AAEA,SAAS,YAAY,OAAoC;AACvD,SACEC,UAAS,KAAK,KACd,QAAQ,OAAO,CAAC,YAAY,OAAO,CAAC,KACpC,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,UAAU;AAE3B;AAEA,SAAS,UAAU,OAAqC;AACtD,SACEA,UAAS,KAAK,KACd,QAAQ,OAAO,CAAC,aAAa,QAAQ,CAAC,KACtC,OAAO,MAAM,cAAc,YAC3B,6BAA6B,KAAK,MAAM,SAAS,MAChD,MAAM,WAAW,gBAAgB,MAAM,WAAW;AAEvD;AAEA,SAAS,QAAQ,OAA2C;AAC1D,SACEA,UAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,OAAO,MAAM,SAAS,YACtB,yBAAyB,KAAK,MAAM,IAAI,KACxC,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,UAAU,QACvB,MAAM,cAAc,UAAa,KAAK,MAAM,SAAS,OACrD,MAAM,cAAc,UAClB,OAAO,MAAM,cAAc,YAC1B,6BAA6B,KAAK,MAAM,SAAS,OACpD,MAAM,cAAc,UAAa,OAAO,MAAM,cAAc,eAC5D,MAAM,eAAe,UACnB,OAAO,MAAM,eAAe,YAC3B,OAAO,UAAU,MAAM,UAAU,KACjC,MAAM,cAAc,OACpB,MAAM,cAAc,SACvB,MAAM,sBAAsB,UAC1B,OAAO,MAAM,sBAAsB,YAClC,MAAM,kBAAkB,SAAS,KACjC,MAAM,kBAAkB,UAAU,SACrC,MAAM,eAAe,UACpB,MAAM,eAAe,oBACrB,MAAM,eAAe,kBACtB,MAAM,YAAY,UAAa,eAAe,MAAM,OAAO;AAEhE;AAEA,SAAS,eAAe,OAAyB;AAC/C,SACEA,UAAS,KAAK,KACd,QAAQ,OAAO,CAAC,MAAM,eAAe,YAAY,aAAa,CAAC,KAC/D,OAAO,MAAM,OAAO,YACpB,6BAA6B,KAAK,MAAM,EAAE,MACzC,MAAM,gBAAgB,aAAa,MAAM,gBAAgB,WAC1D,OAAO,MAAM,aAAa,YAC1B,aAAa,KAAK,MAAM,QAAQ,KAChC,mBAAmB,MAAM,WAAW;AAExC;AAEA,SAAS,mBAAmB,OAAyB;AACnD,SACEA,UAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,OAAO,MAAM,OAAO,YACpB,6BAA6B,KAAK,MAAM,EAAE,KAC1C,gBAAgB,MAAM,MAAM,KAC5B,OAAO,cAAc,MAAM,MAAM,KACjC,OAAO,MAAM,aAAa,YAC1B,aAAa,KAAK,MAAM,QAAQ,KAChC,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,iBAAiB,MACnC,MAAM,aAAa,UACjB,MAAM,QAAQ,MAAM,QAAQ,KAC3B,MAAM,SAAS,UAAU,MACzB,MAAM,SAAS,MAAM,cAAc;AAE3C;AAEA,SAAS,eAAe,OAAyB;AAC/C,SACEA,UAAS,KAAK,KACd,QAAQ,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,KACD,gBAAgB,MAAM,OAAO,KAC7B,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,MAAM,KACzB,aAAa,MAAM,QAAQ,KAC3B,aAAa,MAAM,aAAa,KAChC,aAAa,MAAM,YAAY,KAC/B,aAAa,MAAM,cAAc,KACjC,aAAa,MAAM,iBAAiB,KACpC,aAAa,MAAM,OAAO,KAC1B,gBAAgB,MAAM,SAAS,KAC/B,gBAAgB,MAAM,KAAK;AAE/B;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SACE,OAAO,UAAU,YACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAEpB;AAEA,SAAS,aAAa,OAAyB;AAC7C,SACE,UAAU,UAAc,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;AAE7F;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SACE,UAAU,UAAc,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAEjG;AAgGA,SAASC,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AC3cA,IAAM,wBAAwB;AAC9B,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAI3B,IAAM,wBAAwB;AAEvB,IAAM,oBAAoB;AAAA,EAC/B,MAAM,SAAgE;AACpE,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,eAAe,QAAQ,YAAY,GAAG;AACzC,aAAO,QAAQ;AAAA,QACb,UAAU,2BAA2B,4CAAmC;AAAA,MAC1E;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ,SAAS;AAC3B,aAAO,QAAQ,OAAO,UAAU,iBAAiB,2BAA2B,CAAC;AAAA,IAC/E;AAKA,UAAM,wBAAwB;AAAA,MAC5B,QAAQ;AAAA,MACR,QAAQ,aAAa,WAAW,UAAU,IAAI,YAAY;AAAA,IAC5D;AAEA,UAAM,aAAa,OAAO,WAAW;AACrC,UAAM,cAAc,mBAAmB;AACvC,UAAM,OAAO,SAAS,cAAc,KAAK;AACzC,SAAK,QAAQ,oBAAoB;AACjC,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,QAAQ;AACf,WAAO,MAAM,GAAG,WAAW,mBAAmB,mBAAmB,UAAU,CAAC;AAC5E,WAAO,aAAa,SAAS,WAAW;AACxC,WAAO,aAAa,kBAAkB,aAAa;AACnD,QAAI,gBAAgB;AACpB,mBAAe,QAAQ,aAAa;AACpC,SAAK,MAAM,UAAU;AACrB,SAAK,OAAO,MAAM;AAClB,WAAO,OAAO,IAAI;AAElB,QAAI,YAAY;AAChB,QAAI,UAAU;AACd,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI,eAA8B;AAClC,QAAI,mBAAkC;AACtC,QAAI;AACJ,QAAI,QAA0B,EAAE,QAAQ,YAAY,OAAO,OAAO,cAAc,MAAM;AACtF,QAAI;AACJ,QAAI;AAQJ,QAAI,YAAoD,MAAM;AAE9D,UAAM,WAAW,CAAI,IAAsC,UAAmB;AAC5E,UAAI;AACF,aAAK,KAAK;AAAA,MACZ,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,OAAO,CAAC,YAAsC;AAClD,aAAO,eAAe,YAAY,SAAS,WAAW;AAAA,IACxD;AACA,UAAM,gBAAgB,MAAY;AAChC,UAAI,YAAY,OAAW;AAC3B,cAAQ,OAAO;AACf,gBAAU;AACV,UAAI,iBAAiB,KAAM,UAAS,KAAK,MAAM,eAAe,UAAU;AAAA,UACnE,UAAS,KAAK,aAAa,SAAS,YAAY;AACrD,UAAI,qBAAqB,KAAM,UAAS,gBAAgB,MAAM,eAAe,UAAU;AAAA,UAClF,UAAS,gBAAgB,aAAa,SAAS,gBAAgB;AACpE,qBAAe;AACf,yBAAmB;AACnB,2BAAqB;AACrB,qBAAe,QAAQ,aAAa;AACpC,aAAO,gBAAgB,MAAM;AAC7B,aAAO,gBAAgB,YAAY;AACnC,aAAO,gBAAgB,YAAY;AAAA,IACrC;AACA,UAAM,cAAc,MAAY;AAC9B,UAAI,QAAQ,SAAS,iBAAiB,WAAW,YAAY,OAAW;AACxE,gBAAU,SAAS,cAAc,KAAK;AACtC,cAAQ,QAAQ,4BAA4B;AAK5C,cAAQ,aAAa,eAAe,MAAM;AAC1C,aAAO,aAAa,YAAY,IAAI;AACpC,aAAO,aAAa,QAAQ,QAAQ;AACpC,aAAO,aAAa,cAAc,MAAM;AACxC,aAAO,aAAa,cAAc,oCAA8B;AAChE,cAAQ,MAAM,UAAU;AAAA,QACtB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA,QAIA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,QAAQ,YAAY,SAAS,iBAAiB,qBAAqB;AAAA,MACnF,EAAE,KAAK,GAAG;AACV,YAAM,cAAc,MAAY;AAC9B,eAAO,MAAM,UAAU;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,iBAAiB;AAAA,UAC9B,cAAc,aAAa;AAAA,UAC3B;AAAA,UACA,iBAAiB,kBAAkB;AAAA,UACnC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,GAAG;AAAA,MACZ;AACA,2BAAqB;AACrB,qBAAe,SAAS,KAAK,aAAa,OAAO;AACjD,yBAAmB,SAAS,gBAAgB,aAAa,OAAO;AAChE,eAAS,KAAK,MAAM,YAAY,YAAY,UAAU,WAAW;AACjE,eAAS,gBAAgB,MAAM,YAAY,YAAY,UAAU,WAAW;AAC5E,kBAAY;AACZ,eAAS,KAAK,OAAO,OAAO;AAC5B,aAAO,sBAAsB,MAAM,OAAO,MAAM,EAAE,eAAe,KAAK,CAAC,CAAC;AAAA,IAC1E;AACA,UAAM,eAAe,CAAC,WAAoC;AACxD,UAAI,UAAW;AACf,cAAQ;AAAA,QACN,GAAG;AAAA,QACH;AAAA,QACA,OAAO;AAAA,QACP,cAAc,CAAC,cAAc,cAAc,sBAAsB,YAAY,EAAE;AAAA,UAC7E;AAAA,QACF;AAAA,MACF;AACA,eAAS,QAAQ,gBAAgB,MAAM;AAAA,IACzC;AACA,UAAM,cAAc,CAAC,OAAyB,cAA6B;AACzE,UAAI,cAAc,UAAa,WAAW,UAAa,OAAO,cAAc,UAAW;AACvF,oBAAc;AACd,UAAI,MAAM,SAAS,yBAA0B,gBAAe;AAC5D,cAAQ;AAAA,QACN,GAAG;AAAA,QACH,GAAI,MAAM,SAAS,2BAA2B,EAAE,QAAQ,UAAmB,IAAI,CAAC;AAAA,QAChF;AAAA,QACA,cAAc;AAAA,MAChB;AACA,eAAS,QAAQ,SAAS,KAAK;AAC/B,UAAI,CAAC,WAAW,gBAAgB,QAAW;AACzC,YAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,cAAM,SAAS;AACf,sBAAc;AACd,gBAAQ;AACR,eAAO,KAAK;AACZ;AAAA,MACF;AACA,UAAI,WAAW,QAAW;AACxB,eAAO,OAAO,KAAK;AACnB,iBAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,UAAU,MAAY;AAC1B,UAAI,UAAW;AACf,kBAAY;AACZ,UAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,aAAO,oBAAoB,WAAW,SAAS;AAC/C,cAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,oBAAc;AACd,WAAK;AAAA,QACH,SAAS;AAAA,QACT,SAAS;AAAA,QACT,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AACD,aAAO,OAAO;AACd,WAAK,OAAO;AACZ,cAAQ,OAAO,UAAU,qBAAqB,8CAA2C,CAAC;AAC1F,eAAS;AACT,cAAQ,EAAE,GAAG,OAAO,QAAQ,aAAa,OAAO,OAAO,cAAc,MAAM;AAC3E,UAAI,CAAC,WAAW,gBAAgB,QAAW;AACzC,cAAM,SAAS;AACf,sBAAc;AACd,eAAO,UAAU,iBAAiB,2BAA2B,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM,WAAgC;AAAA,MACpC,IAAI,OAAsC;AACxC,YAAI;AACF,iBAAO,QAAQ;AAAA,YACb,UAAU,iBAAiB,8CAA2C;AAAA,UACxE;AACF,YAAI,CAAC;AACH,iBAAO,QAAQ;AAAA,YACb,UAAU,kBAAkB,2DAAkD;AAAA,UAChF;AACF,YAAI,iBAAiB,OAAW,QAAO,QAAQ,OAAO,YAAY;AAClE,YAAI,WAAW,OAAW,QAAO,OAAO;AACxC,cAAM,YAAY,OAAO,WAAW;AACpC,YAAI;AACJ,YAAI;AACJ,cAAM,UAAU,IAAI,QAAoB,CAAC,aAAa,eAAe;AACnE,oBAAU;AACV,mBAAS;AAAA,QACX,CAAC;AACD,iBAAS,EAAE,WAAW,SAAS,SAAS,OAAO;AAC/C,cAAM,gBAAgB,0BAA0B,KAAK;AACrD,cAAM,WAAW,sBAAsB,SAAS;AAChD,aAAK;AAAA,UACH,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA,OAAO;AAAA,UACP,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;AAAA,QACtE,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF;AACA,UAAM,eAAe,IAAI,QAA6B,CAAC,SAAS,WAAW;AACzE,oBAAc;AACd,cAAQ,OAAO,WAAW,MAAM;AAC9B,YAAI,WAAW,UAAW;AAC1B,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,QACF;AACA,sBAAc;AACd,gBAAQ;AACR,eAAO,KAAK;AAAA,MACd,GAAG,qBAAqB;AACxB,kBAAY,CAAC,UAAuC;AAClD,YAAI,aAAa,MAAM,WAAW,eAAe,MAAM,WAAW,OAAO;AACvE;AACF,YAAI,CAAC,qBAAqB,MAAM,IAAI,KAAK,MAAM,KAAK,eAAe,WAAY;AAC/E,cAAM,UAA8B,MAAM;AAC1C,YAAI,QAAQ,SAAS,SAAS;AAC5B,eAAK;AAAA,YACH,SAAS;AAAA,YACT,SAAS;AAAA,YACT,MAAM;AAAA,YACN;AAAA,YACA,cAAc,QAAQ;AAAA,YACtB,cAAc,QAAQ,SAAS,gBAAgB;AAAA,YAC/C,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,UAC/E,CAAC;AACD;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,WAAW;AAC9B,cAAI,QAAS;AACb,oBAAU;AACV,cAAI,UAAU,OAAW,QAAO,aAAa,KAAK;AAClD,wBAAc;AACd,kBAAQ,EAAE,GAAG,OAAO,QAAQ,SAAS,OAAO,KAAK;AACjD,mBAAS,QAAQ,SAAS,MAAS;AACnC,mBAAS,QAAQ,gBAAgB,OAAO;AACxC,kBAAQ,QAAQ;AAChB;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,SAAU,QAAO,aAAa,QAAQ,MAAM;AACjE,YAAI,QAAQ,SAAS;AACnB,iBAAO,SAAS,QAAQ,mBAAmB,QAAQ,KAAK;AAC1D,YAAI,QAAQ,SAAS,WAAW;AAC9B,0BAAgB,QAAQ;AACxB,cAAI,YAAY,OAAW,gBAAe,QAAQ,aAAa;AAAA,cAC1D,sBAAqB;AAC1B;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,cAAc;AAIjC,eAAK,sBAAsB,QAAQ,MAAM,EAAE;AAAA,YACzC,MAAM;AACJ,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,gBACA,UAAU,QAAQ,OAAO;AAAA,gBACzB,QAAQ;AAAA,cACV,CAAC;AAAA,YACH;AAAA,YACA,MAAM;AACJ,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,gBACA,UAAU,QAAQ,OAAO;AAAA,gBACzB,QAAQ;AAAA,cACV,CAAC;AAAA,YACH;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,iBAAiB;AAIpC,sBAAY;AACZ,iBAAO,sBAAsB,MAAM;AACjC,mBAAO,sBAAsB,MAAM;AACjC,mBAAK;AAAA,gBACH,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,CAAC;AACD;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,iBAAkB,QAAO,cAAc;AAC5D,YACE,QAAQ,SAAS,cAChB,WAAW,UAAa,OAAO,cAAc,QAAQ,YACtD;AACA,wBAAc;AACd,yBAAe;AACf,kBAAQ;AAAA,YACN,QAAQ,QAAQ,QAAQ;AAAA,YACxB,OAAO;AAAA,YACP,cAAc;AAAA,YACd,SAAS,QAAQ;AAAA,UACnB;AACA,mBAAS,QAAQ,gBAAgB,QAAQ,QAAQ,MAAM;AACvD,mBAAS,QAAQ,WAAW,QAAQ,OAAO;AAC3C,kBAAQ,QAAQ,QAAQ,OAAO;AAC/B,mBAAS;AACT;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,QAAS,aAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,MAC5E;AACA,aAAO,iBAAiB,WAAW,SAAS;AAAA,IAC9C,CAAC;AACD,YAAQ,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACjE,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,QAA2C;AAChE,QAAM,UAAU,OAAO,WAAW,WAAW,SAAS,cAA2B,MAAM,IAAI;AAC3F,MAAI,YAAY,QAAQ,EAAE,mBAAmB;AAC3C,UAAM,UAAU,qBAAqB,oDAAiD;AACxF,SAAO;AACT;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,yCAAyC,KAAK,KAAK;AAC5D;AAEA,SAAS,qBAA6B;AACpC,QAAM,iBAAiB,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,OAAO,SAAS,QAAQ;AAC5F,QAAM,aACJ,WACA;AACF,MAAI,CAAC,kBAAkB,eAAe,OAAW,QAAO;AAExD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,IAAI,YACJ,IAAI,UACJ;AACA,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,QAA2B,QAAsB;AACvE,SAAO,MAAM,UAAU,mCAAmC,MAAM,iBAAiB,MAAM;AACvF,SAAO,gBAAgB,UAAU;AACnC;",
+  "names": ["isRecord", "isRecord", "isRecord", "isRecord"]
 }

package/dist/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,mBAAmB,EACnB,uBAAuB,EAIxB,MAAM,mBAAmB,CAAC;AAgB3B,eAAO,MAAM,iBAAiB;mBACb,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAiVtE,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,mBAAmB,EACnB,uBAAuB,EAIxB,MAAM,mBAAmB,CAAC;AAgB3B,eAAO,MAAM,iBAAiB;mBACb,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA4VtE,CAAC"}

package/dist/protocol.d.ts

@@ -19,6 +19,8 @@ export type HostToFrameMessage = (Base & Readonly<{
     type: 'PAY';
     requestId: string;
     input: PayInput;
+    /** Base64 JSON map generated only by the public collector layer. */
+    riskCollectorSessions?: string;
 }>) | (Base & Readonly<{
     type: 'THREE_DS_PRESENTED';
 }>) | (Base & Readonly<{

package/dist/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,KAAK,IAAI,GAAG,QAAQ,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,OAAO,6BAA6B,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,KAAK,mBAAmB,GAAG,QAAQ,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAC1B,CAAC,IAAI,GACH,QAAQ,CAAC;IACP,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,YAAY,EAAE,mBAAmB,CAAC;CACnC,CAAC,CAAC,GACL,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC,GACtE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAAC,GACjD,CAAC,IAAI,GACH,QAAQ,CAAC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAA;CAAE,CAAC,CAAC,GAC5F,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAC1B,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAA;CAAE,CAAC,CAAC,GACnE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,GAC5C,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAC,GACtE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GACtD,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC,GAChE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,GAC3D,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC,GAC9E,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC,CAAC;AAEtF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CA4ChF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAqChF"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,KAAK,IAAI,GAAG,QAAQ,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,OAAO,6BAA6B,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,KAAK,mBAAmB,GAAG,QAAQ,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAC1B,CAAC,IAAI,GACH,QAAQ,CAAC;IACP,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,YAAY,EAAE,mBAAmB,CAAC;CACnC,CAAC,CAAC,GACL,CAAC,IAAI,GACH,QAAQ,CAAC;IACP,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC,CAAC,GACL,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAAC,GACjD,CAAC,IAAI,GACH,QAAQ,CAAC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAA;CAAE,CAAC,CAAC,GAC5F,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAC1B,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAA;CAAE,CAAC,CAAC,GACnE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,GAC5C,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAC,GACtE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GACtD,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC,GAChE,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,GAC3D,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC,GAC9E,CAAC,IAAI,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC,CAAC;AAEtF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CA4ChF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CA+ChF"}